| *** martinlopes has joined #openstack-keystone | 00:04 | |
| *** lucas_ has quit IRC | 00:05 | |
| *** thorst_ has joined #openstack-keystone | 00:10 | |
| *** thorst_ has quit IRC | 00:12 | |
| *** jamielennox is now known as jamielennox|away | 00:24 | |
| *** guoshan has joined #openstack-keystone | 00:26 | |
| *** jlwhite has quit IRC | 00:28 | |
| *** jlwhite has joined #openstack-keystone | 00:28 | |
| *** rvba has quit IRC | 00:28 | |
| *** rvba has joined #openstack-keystone | 00:28 | |
| *** rvba has quit IRC | 00:29 | |
| *** rvba has joined #openstack-keystone | 00:29 | |
| *** catintheroof has joined #openstack-keystone | 00:36 | |
| *** catintheroof has quit IRC | 00:37 | |
| *** lucas_ has joined #openstack-keystone | 00:38 | |
| *** hoangcx has joined #openstack-keystone | 00:42 | |
| *** jamielennox|away is now known as jamielennox | 00:50 | |
| *** guoshan has quit IRC | 01:16 | |
| *** sileht has quit IRC | 01:19 | |
| *** iurygregory has quit IRC | 01:19 | |
| *** v1k0d3n has quit IRC | 01:19 | |
| *** thorst_ has joined #openstack-keystone | 01:19 | |
| *** liujiong has joined #openstack-keystone | 01:19 | |
| *** thorst_ has quit IRC | 01:19 | |
| *** iurygregory has joined #openstack-keystone | 01:19 | |
| *** v1k0d3n has joined #openstack-keystone | 01:22 | |
| *** sileht has joined #openstack-keystone | 01:23 | |
| *** YModeMonk has quit IRC | 01:24 | |
| *** martinlopes has quit IRC | 01:28 | |
| *** guoshan has joined #openstack-keystone | 01:43 | |
| *** thorst_ has joined #openstack-keystone | 01:45 | |
| *** thorst_ has quit IRC | 01:45 | |
| *** martinlopes has joined #openstack-keystone | 02:05 | |
| *** martinlopes has quit IRC | 02:08 | |
| *** martinlopes has joined #openstack-keystone | 02:13 | |
| *** v1k0d3n has quit IRC | 02:14 | |
| *** thorst_ has joined #openstack-keystone | 02:19 | |
| *** v1k0d3n has joined #openstack-keystone | 02:19 | |
| *** edtubill has joined #openstack-keystone | 02:25 | |
| *** akrzos-pto is now known as akrzos | 02:49 | |
| *** akrzos is now known as akrzos-pto | 02:49 | |
| *** ngupta has joined #openstack-keystone | 02:52 | |
| *** tovin07_ has joined #openstack-keystone | 02:57 | |
| *** edmondsw has joined #openstack-keystone | 03:13 | |
| *** sonuk has joined #openstack-keystone | 03:16 | |
| *** edmondsw has quit IRC | 03:17 | |
| *** thorst_ has joined #openstack-keystone | 03:20 | |
| *** ngupta has quit IRC | 03:21 | |
| *** ngupta has joined #openstack-keystone | 03:22 | |
| *** thorst_ has quit IRC | 03:25 | |
| *** ngupta has quit IRC | 03:26 | |
| *** ngupta has joined #openstack-keystone | 03:40 | |
| *** guoshan has quit IRC | 03:50 | |
| *** Dinesh_Bhor has joined #openstack-keystone | 04:08 | |
| *** lucas_ has quit IRC | 04:20 | |
| *** thorst_ has joined #openstack-keystone | 04:21 | |
| *** adriant has quit IRC | 04:25 | |
| *** thorst_ has quit IRC | 04:26 | |
| *** hoonetorg has quit IRC | 04:34 | |
| *** ngupta has quit IRC | 04:36 | |
| *** ngupta has joined #openstack-keystone | 04:37 | |
| *** ngupta has quit IRC | 04:41 | |
| *** hoonetorg has joined #openstack-keystone | 04:47 | |
| *** lucas_ has joined #openstack-keystone | 04:51 | |
| *** lucas_ has quit IRC | 05:01 | |
| *** mtreinish has quit IRC | 05:20 | |
| *** jaosorior has joined #openstack-keystone | 05:28 | |
| *** mtreinish has joined #openstack-keystone | 05:31 | |
| *** agrebennikov_ has joined #openstack-keystone | 05:33 | |
| *** agrebennikov_ has quit IRC | 05:38 | |
| *** jrist has joined #openstack-keystone | 06:04 | |
| *** lucas_ has joined #openstack-keystone | 06:12 | |
| *** edtubill has quit IRC | 06:18 | |
| *** edtubill has joined #openstack-keystone | 06:19 | |
| *** thorst_ has joined #openstack-keystone | 06:22 | |
| *** edtubill has quit IRC | 06:24 | |
| *** thorst_ has quit IRC | 06:26 | |
| *** martinlopes has quit IRC | 06:26 | |
| *** itisha has quit IRC | 06:42 | |
| *** lucas_ has quit IRC | 06:46 | |
| *** guoshan has joined #openstack-keystone | 06:48 | |
| *** Jack_I has joined #openstack-keystone | 07:02 | |
| *** rcernin has joined #openstack-keystone | 07:15 | |
| *** phalmos has quit IRC | 07:16 | |
| *** tesseract has joined #openstack-keystone | 07:28 | |
| *** tesseract is now known as tesseract-RH | 07:29 | |
| *** pcaruana has joined #openstack-keystone | 07:49 | |
| *** phalmos has joined #openstack-keystone | 07:56 | |
| *** pnavarro has joined #openstack-keystone | 08:10 | |
| *** thorst_ has joined #openstack-keystone | 08:22 | |
| *** phalmos has quit IRC | 08:25 | |
| *** thorst_ has quit IRC | 08:27 | |
| *** zzzeek has quit IRC | 09:00 | |
| *** zzzeek has joined #openstack-keystone | 09:00 | |
| *** tqtran has joined #openstack-keystone | 09:05 | |
| breton | yes, breton@cynicmansion.ru | 09:08 |
|---|---|---|
| *** tqtran has quit IRC | 09:09 | |
| breton | oh | 09:12 |
| breton | nevermind ^ | 09:13 |
| breton | (still my email though if someone wants to tell something) | 09:13 |
| *** phalmos has joined #openstack-keystone | 09:42 | |
| *** jamielennox is now known as jamielennox|away | 09:48 | |
| *** jdennis1 has joined #openstack-keystone | 10:02 | |
| *** jdennis has quit IRC | 10:02 | |
| *** tqtran has joined #openstack-keystone | 10:15 | |
| *** dims_ has quit IRC | 10:16 | |
| *** tqtran has quit IRC | 10:20 | |
| *** dims has joined #openstack-keystone | 10:23 | |
| *** thorst_ has joined #openstack-keystone | 10:23 | |
| *** liujiong has quit IRC | 10:24 | |
| *** jamielennox|away is now known as jamielennox | 10:24 | |
| *** thorst_ has quit IRC | 10:28 | |
| *** guoshan has quit IRC | 10:38 | |
| *** mvk has quit IRC | 10:40 | |
| johnthetubaguy | I am looking into policy in Nova | 10:52 |
| johnthetubaguy | I am thinking about "admin" tokens, and the scope of tokens | 10:52 |
| johnthetubaguy | does anyone know of a good doc to read up about token scope? | 10:52 |
| johnthetubaguy | (thinking about project membership tests, and if there is a token where project="*" or similar) | 10:53 |
| johnthetubaguy | it might mean we have to become domain aware and respect domain global tokens for "admins" | 10:53 |
| *** portdirect is now known as portdirect_ | 10:58 | |
| *** portdirect_ is now known as portdirec | 10:59 | |
| *** portdirec is now known as portdirect_ | 10:59 | |
| *** portdirect_ is now known as portdirect | 10:59 | |
| *** portdirect has joined #openstack-keystone | 11:00 | |
| *** hoangcx has quit IRC | 11:00 | |
| *** jamiec has quit IRC | 11:04 | |
| *** mvk has joined #openstack-keystone | 11:09 | |
| *** jamiec has joined #openstack-keystone | 11:12 | |
| *** nicolasbock has joined #openstack-keystone | 11:31 | |
| *** Mr_Smurf has joined #openstack-keystone | 11:43 | |
| Mr_Smurf | Hello... I'm trying to figure out why login saml2 federation is behaving strangely.. So I could really need some help.. | 11:45 |
| Mr_Smurf | I've looked over the documentation and it looks like I have setup everyting correct in my newton installation. | 11:46 |
| Mr_Smurf | What happends is when I login I'm redirected to my IDP (simpsamlphp) and I authenticate and I'm returned to my keystone port:5000 en then I just get the normal text as you get if you just surf to your keystone on port 5000.. If I then go to my horizon startpage and try to login again I'm redirected to /auth/webbsso and then to the dashboard and the login is successful | 11:48 |
| Mr_Smurf | I do not see any mapping or anything in keystone on the first request (debug=true) just a request for GET http://hpc2n.cloud.snic.se:5000/ | 11:51 |
| Mr_Smurf | the second time I get the mapping correct | 11:52 |
| samueldmq | morning keystone | 11:54 |
| Mr_Smurf | good morning | 11:54 |
| *** dave-mccowan has joined #openstack-keystone | 12:04 | |
| *** pbourke has quit IRC | 12:08 | |
| *** pbourke has joined #openstack-keystone | 12:09 | |
| *** tqtran has joined #openstack-keystone | 12:17 | |
| *** tqtran has quit IRC | 12:22 | |
| *** dims has quit IRC | 12:23 | |
| *** dave-mcc_ has joined #openstack-keystone | 12:28 | |
| *** dave-mccowan has quit IRC | 12:30 | |
| *** phalmos has quit IRC | 12:40 | |
| *** catintheroof has joined #openstack-keystone | 12:41 | |
| *** thorst_ has joined #openstack-keystone | 12:48 | |
| *** dims has joined #openstack-keystone | 13:20 | |
| *** edmondsw has joined #openstack-keystone | 13:23 | |
| *** dolphm has quit IRC | 13:32 | |
| *** martinus__ has quit IRC | 13:32 | |
| *** hyakuhei has quit IRC | 13:32 | |
| *** kevinbenton has quit IRC | 13:32 | |
| *** dolphm_ has joined #openstack-keystone | 13:32 | |
| *** ChanServ sets mode: +o dolphm_ | 13:32 | |
| *** martinus__ has joined #openstack-keystone | 13:32 | |
| *** hyakuhei has joined #openstack-keystone | 13:32 | |
| *** hyakuhei has quit IRC | 13:32 | |
| *** hyakuhei has joined #openstack-keystone | 13:32 | |
| *** hyakuhei has quit IRC | 13:32 | |
| *** hyakuhei has joined #openstack-keystone | 13:32 | |
| *** dolphm_ is now known as dolphm | 13:33 | |
| *** dikonoor has joined #openstack-keystone | 13:34 | |
| *** kevinbenton has joined #openstack-keystone | 13:35 | |
| dikonoor | morgan: Hi morgan. This is about https://bugs.launchpad.net/keystone/+bug/1662762 | 13:39 |
| openstack | Launchpad bug 1662762 in OpenStack Identity (keystone) ocata "Authentication for LDAP user fails at MFA rule check" [High,Triaged] | 13:39 |
| *** dims_ has joined #openstack-keystone | 13:43 | |
| *** lamt has joined #openstack-keystone | 13:44 | |
| *** dims has quit IRC | 13:45 | |
| *** akrzos-pto is now known as akrzos | 13:48 | |
| samueldmq | johnthetubaguy: hi | 13:51 |
| johnthetubaguy | samueldmq: hi | 13:51 |
| samueldmq | johnthetubaguy: perhaps https://developer.openstack.org/api-ref/identity/v3/ is a good place to start | 13:52 |
| samueldmq | johnthetubaguy: there is a "authentication and token management" section | 13:52 |
| samueldmq | johnthetubaguy: the best alternative will of course depending on the operation you're looking at | 13:53 |
| johnthetubaguy | samueldmq: cool, I think I found some of that, somehow I got fixated on the version history, and moved on, oops | 13:53 |
| samueldmq | some operations do not make sense to be associated to a project, e.g manage supervisor | 13:54 |
| johnthetubaguy | samueldmq: unscoped tokens are usually for getting hold of several scoped tokens, I assume? | 13:54 |
| johnthetubaguy | ah, so maybe that is what we want | 13:54 |
| johnthetubaguy | samueldmq: do we have docs on how policy and oslo.context work with unscoped tokens? | 13:54 |
| samueldmq | johnthetubaguy: unscoped tokens are normally used when you don't know what you can scope to yet | 13:55 |
| johnthetubaguy | yeah, I guess there are no roles attached | 13:55 |
| samueldmq | e.g in the federation workflow, you get an unscoped token first, then list the projects you can scope, then get a scoped token to one of those | 13:55 |
| johnthetubaguy | yeah, thats what I thought happened | 13:55 |
| johnthetubaguy | my memory is a bit rusty on these bits | 13:55 |
| samueldmq | johnthetubaguy: correct, no roles since roles are assigned in a scope (to a project or domain) | 13:55 |
| johnthetubaguy | I think its probably the domain scoped token thats interesting | 13:56 |
| johnthetubaguy | samueldmq: for context, its this Nova spec I am thinking about: https://review.openstack.org/#/c/433037/3 | 13:56 |
| johnthetubaguy | basically how to evolve all our stupid is_admin checks to something better | 13:57 |
| * samueldmq looks | 13:57 | |
| *** spilla has joined #openstack-keystone | 13:59 | |
| Mr_Smurf | found the problem.. I am using memcache and relayState was stored in local memory.. chaning relayState to ss:mc in shibboleth2.xml solved that issue | 14:00 |
| samueldmq | johnthetubaguy: cool, I had a glance at the spec and I'll have a better look today | 14:01 |
| johnthetubaguy | samueldmq: that would be awesome, thanks | 14:01 |
| samueldmq | johnthetubaguy: I'll also make sure to add dstanek and lbragstad as reviewers, they've been leading the weekly policy meeting | 14:01 |
| johnthetubaguy | samueldmq: I should tell lbragstad about the new specs | 14:01 |
| johnthetubaguy | ah, jinx, cool | 14:01 |
| samueldmq | johnthetubaguy: nice, thanks for reaching out | 14:02 |
| johnthetubaguy | no worries, thanks for replying :) | 14:02 |
| samueldmq | anytime | 14:02 |
| samueldmq | Mr_Smurf: hi | 14:03 |
| *** dave-mcc_ has quit IRC | 14:03 | |
| *** mvk has quit IRC | 14:03 | |
| samueldmq | Mr_Smurf: that's great you got it sorted out. I do not have a strong knowledge on saml2 federation | 14:03 |
| samueldmq | Mr_Smurf: since most of us are based on the US, more devs will be available soon | 14:04 |
| samueldmq | Mr_Smurf: and someone should be able to assist you on debugging the issue if you have further ones | 14:04 |
| *** dave-mcc_ has joined #openstack-keystone | 14:07 | |
| Mr_Smurf | samueldmq: ok, thanks now I have another issue... every few loggin attempts i get "An error occurred authenticating. Please try again later." But when I look in the keystone logs it looks like the login was successful | 14:07 |
| rodrigods | Mr_Smurf, for this final error, you might be stumbling upon https://bugs.launchpad.net/keystoneauth/+bug/1660436 | 14:11 |
| openstack | Launchpad bug 1660436 in OpenStack Dashboard (Horizon) "Federated users cannot log into horizon" [Critical,Fix released] - Assigned to Colleen Murphy (krinkle) | 14:11 |
| samueldmq | there we go, thanks rodrigods | 14:12 |
| Mr_Smurf | could be but it is a different error message in that bug report | 14:14 |
| *** jperry has joined #openstack-keystone | 14:14 | |
| *** mvk has joined #openstack-keystone | 14:18 | |
| dstanek | good morning keystone | 14:19 |
| rodrigods | Mr_Smurf, hmm, are you using devstack? everything latest master? | 14:21 |
| Mr_Smurf | rodrigods: openstack-ansible stable/newton | 14:22 |
| robcresswell | Mr_Smurf: What's your session engine? | 14:22 |
| Mr_Smurf | robcresswell: django.contrib.sessions.backends.cached_db | 14:23 |
| robcresswell | Well there goes my idea. | 14:25 |
| Mr_Smurf | login does not fail every time.. | 14:26 |
| dikonoor | morgan : hi.. on this, https://bugs.launchpad.net/keystone/+bug/1662762 , as mentioned in the bug, LDAP user does not work.. As you did most of the hcanges for MFA, would you know what's the simplest way to fix this ? | 14:26 |
| openstack | Launchpad bug 1662762 in OpenStack Identity (keystone) ocata "Authentication for LDAP user fails at MFA rule check" [High,Triaged] | 14:26 |
| Mr_Smurf | I do not get any errors in the logs and all looks fine but it just stops after DEBUG oslo_messaging._drivers.amqpdriver [req-c86b6184-5bdf-4cb2-a412-3b1f6391ca28 - - - - -] CAST unique_id: 14bbcb7d65184a42a802189816218c4c NOTIFY exchange 'keystone' topic 'notifications.info' _send /openstack/venvs/keystone-14.0.7/lib/python2.7/site-packages/oslo_messaging/_drivers/amqpdriver.py:432 | 14:28 |
| dikonoor | morgan : In an earlier discussion , dstanek mentioned that he thinks adding an options attribute for LDAP user will be the right direction..The simplest fix would be to not assume that options attribute is always going to be around | 14:28 |
| dstanek | dikonoor: that wouldn't be the simplest fix. the simplest fix is adding the options attribute. | 14:29 |
| Mr_Smurf | so it never gets to auth_token/__init__.py:346 which is the next line when login is successful | 14:30 |
| Mr_Smurf | its like the process just dies | 14:30 |
| dstanek | it's also, by far, more OO of the two | 14:30 |
| dikonoor | dstanek: What's OO ? | 14:30 |
| dikonoor | dstanek : Do you know what is this options attribute supposed to be for ? | 14:31 |
| dstanek | dikonoor: OO == object oriented | 14:34 |
| dstanek | the options attribute is going to be a place to put new attributes for a user that change behavior. | 14:34 |
| dstanek | so not something that describes a user like name, email, etc. something like uses_mfa, must_be_encrypted, etc. - in the past we put this information in the config file as a setting and then another setting for an exclusion list | 14:35 |
| dikonoor | dstanek : ok :) (for OO) | 14:35 |
| dstanek | dikonoor: the reason i said it was simplier and more OO is that I don't want 'if instance(user, SQLUser)' or 'if getattr(user, "options", None)' littered all over the code | 14:38 |
| *** jamielennox is now known as jamielennox|away | 14:39 | |
| *** Jack_V has joined #openstack-keystone | 14:44 | |
| *** jaugustine has joined #openstack-keystone | 14:45 | |
| *** Jack_I has quit IRC | 14:45 | |
| *** dikonoor has quit IRC | 14:46 | |
| *** pcaruana has quit IRC | 14:50 | |
| *** ngupta has joined #openstack-keystone | 14:54 | |
| *** pcaruana has joined #openstack-keystone | 14:55 | |
| *** dave-mcc_ has quit IRC | 14:57 | |
| *** jose-phillips has joined #openstack-keystone | 15:00 | |
| *** openstackgerrit has joined #openstack-keystone | 15:05 | |
| *** dave-mccowan has joined #openstack-keystone | 15:11 | |
| *** jose-phillips has quit IRC | 15:16 | |
| *** jose-phi_ has joined #openstack-keystone | 15:17 | |
| *** lucas_ has joined #openstack-keystone | 15:18 | |
| *** tqtran has joined #openstack-keystone | 15:19 | |
| *** tqtran has quit IRC | 15:24 | |
| *** nkinder has joined #openstack-keystone | 15:25 | |
| *** dave-mccowan has quit IRC | 15:29 | |
| *** chris_hultin|AWA is now known as chris_hultin | 15:31 | |
| *** dave-mccowan has joined #openstack-keystone | 15:34 | |
| *** lucas_ is now known as lucasxu | 15:34 | |
| *** lucasxu has quit IRC | 15:42 | |
| *** lucas_ has joined #openstack-keystone | 15:43 | |
| *** lucas_ has quit IRC | 15:44 | |
| *** lucasxu has joined #openstack-keystone | 15:44 | |
| openstackgerrit | Merged openstack/pycadf master: Updated from global requirements https://review.openstack.org/432080 | 15:47 |
| *** lucasxu has quit IRC | 15:48 | |
| *** lucasxu has joined #openstack-keystone | 15:49 | |
| -openstackstatus- NOTICE: We are currently investigating an issue with our AFS mirrors which is causing some projects jobs to fail. We are working to correct the issue. | 15:49 | |
| *** mvk has quit IRC | 15:53 | |
| *** jose-phi_ has quit IRC | 15:56 | |
| *** ngupta has quit IRC | 16:02 | |
| *** ngupta has joined #openstack-keystone | 16:03 | |
| lbragstad | johnthetubaguy sounds like you're making progress on the nova policy bits? | 16:12 |
| lbragstad | johnthetubaguy I had my head in the sand trying to organize topics of the PTG | 16:12 |
| johnthetubaguy | lbragstad: not sure about progress, splitting up the specs a bit | 16:12 |
| lbragstad | johnthetubaguy cool - how are you planning on splitting it up? Do you have a general direction yet? | 16:13 |
| *** spzala has joined #openstack-keystone | 16:13 | |
| *** ngupta has quit IRC | 16:16 | |
| *** ngupta has joined #openstack-keystone | 16:16 | |
| *** rcernin has quit IRC | 16:19 | |
| *** dims_ has quit IRC | 16:19 | |
| *** pcaruana has quit IRC | 16:20 | |
| *** dims has joined #openstack-keystone | 16:24 | |
| *** tqtran has joined #openstack-keystone | 16:25 | |
| *** v1k0d3n has quit IRC | 16:25 | |
| *** spzala has quit IRC | 16:26 | |
| *** v1k0d3n has joined #openstack-keystone | 16:28 | |
| *** pcaruana has joined #openstack-keystone | 16:34 | |
| *** ravelar has joined #openstack-keystone | 16:46 | |
| *** richm has joined #openstack-keystone | 16:50 | |
| *** dims has quit IRC | 16:51 | |
| *** spzala has joined #openstack-keystone | 16:54 | |
| *** dims has joined #openstack-keystone | 16:55 | |
| *** tesseract-RH has quit IRC | 16:55 | |
| lbragstad | dstanek dolphm looks like there is going to be some API-WG sessions on both monday and tuesday http://lists.openstack.org/pipermail/openstack-dev/2017-February/112054.html | 16:56 |
| lbragstad | dstanek dolphm - it sounds like if any capability API discussion is had, it is going to be in those sessions | 16:57 |
| *** pcaruana has quit IRC | 16:58 | |
| *** pcaruana has joined #openstack-keystone | 16:58 | |
| *** dims_ has joined #openstack-keystone | 17:06 | |
| *** dims has quit IRC | 17:07 | |
| dstanek | lbragstad: yeah, i saw mention of that on the mailing list | 17:18 |
| lbragstad | dstanek cool | 17:18 |
| -openstackstatus- NOTICE: AFS replication issue has been addressed. Mirrors are currently re-syncing and coming back online. | 17:19 | |
| lbragstad | dstanek not sure if you'll be there that early - but I figured I'd drop it in here so that we could talk about it | 17:19 |
| *** jperry has quit IRC | 17:23 | |
| *** jperry has joined #openstack-keystone | 17:24 | |
| johnthetubaguy | lbragstad: this is where I am currently thinking for staging things: https://review.openstack.org/427872 | 17:26 |
| lbragstad | johnthetubaguy ok - is that spec something your working in parallel to the pike goals specs? | 17:28 |
| lbragstad | johnthetubaguy oh! nevermind, that's actually the same spec, you just renamed it | 17:29 |
| johnthetubaguy | lbragstad: I was really meaning, take a look at the two dependent specs too | 17:29 |
| johnthetubaguy | yeah, its been split up | 17:29 |
| johnthetubaguy | the first one, once we have the details agreed, should be a no brainer | 17:29 |
| johnthetubaguy | (famous last words!) | 17:29 |
| johnthetubaguy | the second one I think is important, but I am not 100% happy with that myself | 17:30 |
| lbragstad | johnthetubaguy exactly | 17:30 |
| lbragstad | johnthetubaguy first == https://review.openstack.org/#/c/433010/3 ? | 17:30 |
| lbragstad | second == https://review.openstack.org/#/c/433037/3 ? | 17:30 |
| johnthetubaguy | lbragstad: yeah | 17:30 |
| lbragstad | johnthetubaguy ok - cool, just want to make sure I'm following | 17:30 |
| johnthetubaguy | cool | 17:30 |
| lbragstad | johnthetubaguy sweet - i have all those starred so I'll be reviewing those at some point today | 17:31 |
| johnthetubaguy | the second one gets rid of is_admin_or_owner rules | 17:31 |
| johnthetubaguy | cools | 17:31 |
| lbragstad | johnthetubaguy I also wanted to recap the notes from last weeks policy meeting (but I just haven't had the time yet) | 17:31 |
| lbragstad | johnthetubaguy i'm still working with https://review.openstack.org/#/c/428453 (policy in code) | 17:32 |
| Adobeman | I supposed its good news that I have freeipa up and running, its returning ldapsearch query. I am following keith's blog on getting keystone to communicate with ipa, except the keystone part of the blog still appears to be version 2 (newton only really talk to v3).. | 17:32 |
| johnthetubaguy | lbragstad: cool | 17:32 |
| lbragstad | johnthetubaguy that one seems straight forward since nova has blazed the path there | 17:32 |
| *** ayoung has quit IRC | 17:33 | |
| lbragstad | johnthetubaguy I want to follow up on https://review.openstack.org/#/c/428454 though and possible propose a second spec that takes sdague's idea into consideration | 17:33 |
| lbragstad | johnthetubaguy it'd be interesting to compare the two side-by-side to see what they both have in common and what-not | 17:33 |
| johnthetubaguy | lbragstad: so that "second" spec is interesting, as it blew apart my original ideas for the policy rules | 17:34 |
| johnthetubaguy | lbragstad: I am down to: is_global, observer, member, admin | 17:34 |
| johnthetubaguy | were the is_global thing is a bit separate | 17:35 |
| lbragstad | johnthetubaguy ah - so you're already ahead of the curve and working that perspective into your other specs? | 17:35 |
| johnthetubaguy | lbragstad: adding the is_global idea really simplifies things | 17:35 |
| *** mvk has joined #openstack-keystone | 17:38 | |
| dstanek | lbragstad: i'm going to try to get there for tuesday discussions, but i doubt i'll be there monday as i don't have a room for that night | 17:38 |
| lbragstad | dstanek that makes sense | 17:39 |
| johnthetubaguy | dstanek: I think I managed to capture your ideas in that chain of specs, somewhat anyways | 17:41 |
| johnthetubaguy | I may have mangled some of your ideas along the way too | 17:41 |
| *** ayoung has joined #openstack-keystone | 17:43 | |
| *** ChanServ sets mode: +v ayoung | 17:43 | |
| *** pcaruana has quit IRC | 17:44 | |
| *** spilla has quit IRC | 17:45 | |
| dstanek | johnthetubaguy: nice, i'll take a look | 17:46 |
| johnthetubaguy | dstanek: that second spec is a bit unclear right now, just noticed, pushing a new version in about 15mins | 17:46 |
| *** spilla has joined #openstack-keystone | 17:46 | |
| *** lucasxu has quit IRC | 17:47 | |
| *** adrian_otto has joined #openstack-keystone | 17:48 | |
| *** david-lyle has joined #openstack-keystone | 17:58 | |
| *** spzala has quit IRC | 18:01 | |
| *** hrybacki has quit IRC | 18:06 | |
| *** david-lyle_ has joined #openstack-keystone | 18:08 | |
| *** jaosorior has quit IRC | 18:08 | |
| *** david-lyle has quit IRC | 18:09 | |
| *** david-lyle_ is now known as david-lyle | 18:12 | |
| *** lucasxu has joined #openstack-keystone | 18:19 | |
| *** ravelar has quit IRC | 18:30 | |
| *** hrybacki has joined #openstack-keystone | 18:45 | |
| *** cheran has joined #openstack-keystone | 19:05 | |
| *** Jack_V has quit IRC | 19:07 | |
| *** ravelar has joined #openstack-keystone | 19:08 | |
| *** ravelar has quit IRC | 19:12 | |
| *** MasterOfBugs has joined #openstack-keystone | 19:21 | |
| lbragstad | rderose ping | 19:23 |
| *** lamt has quit IRC | 19:32 | |
| *** lamt has joined #openstack-keystone | 19:37 | |
| rderose | lbragstad: hi | 19:38 |
| lbragstad | rderose do you know if there was any additional things we needed to do in keystone in order for horizon to be able to consume https://review.openstack.org/#/c/425507/18 ? | 19:40 |
| lbragstad | rderose did we agree to advertising that a user needed to be able to change their password somehow? | 19:41 |
| rderose | lbragstad: hmm... not that I recall. in fact, I remember us discuss this requirement with horizon | 19:42 |
| lbragstad | rderose yeah - that's what I thought, too | 19:42 |
| lbragstad | rderose but I can't seem to find any sort of decision as to "how" horizon would know to take a user through that flow? | 19:42 |
| rderose | lbragstad: the earlier version would set the password_expires_at to be expired, which is how we would indicate that the user was required to change their password | 19:45 |
| rderose | kind of lost sight of horizon integration with what got merged | 19:46 |
| lbragstad | same here | 19:46 |
| lbragstad | keystone has the bits to make it so that a user can change their password after an administrative reset | 19:47 |
| rderose | lbragstad: actually... | 19:47 |
| rderose | lbragstad: the password is still getting set to be expired | 19:47 |
| rderose | so if the password is expired, show the change password screen | 19:47 |
| lbragstad | rderose how do we advertise that the password is expired? | 19:47 |
| rderose | password_expires_at attribute | 19:47 |
| lbragstad | rderose so then the only other thing they need to complete that flow is the new password that the administrator set? | 19:48 |
| rderose | lbragstad: the new password? | 19:49 |
| lbragstad | rderose i'm looking at line 1000 here - https://review.openstack.org/#/c/425507/18/keystone/tests/unit/test_v3_identity.py ? | 19:49 |
| lbragstad | rderose which I'm assuming would be communicated via something like an email or secure message of some sort? | 19:51 |
| rderose | lbragstad: to the user, yeah | 19:51 |
| *** gk-1wm-su has joined #openstack-keystone | 19:51 | |
| rderose | lbragstad: so admin reset, system emails user the password | 19:52 |
| rderose | user attempts logs in, unauthorized | 19:52 |
| rderose | :) | 19:52 |
| rderose | lbragstad: horizon would need to make an API call to get user to get the passwords_expires_at attribute | 19:53 |
| rderose | and if expired, allow the user to change it with the rest password | 19:53 |
| rderose | *reset password | 19:54 |
| *** gk-1wm-su has quit IRC | 19:54 | |
| lbragstad | rderose ah - so that technically all do-able today from a keystone perspective | 19:55 |
| rderose | lbragstad: yeah, but it would be nice to indicate during authentication that the password is expired | 19:55 |
| rderose | but currently, horizon would need to make an extra api call to check if the password is expired | 19:56 |
| lbragstad | hmm | 19:58 |
| lbragstad | right | 19:58 |
| lbragstad | ok - i think i'm following | 19:58 |
| openstackgerrit | Sean Dague proposed openstack/keystoneauth master: Make docs about interface less authoritative https://review.openstack.org/433246 | 19:58 |
| lbragstad | rderose if the user is unauthorized - how is horizon suppose to be able to do a get user call? | 20:00 |
| david-lyle | lbragstad, rderose this is the WIP patch for horizon, has the underlying keystone implementation ? and the expiry is not in the token? | 20:01 |
| david-lyle | https://review.openstack.org/#/c/369652/17 | 20:01 |
| rderose | lbragstad: in the earlier version, we allowed the user to login (first use) and then set the password to be expired. so the password_expires_at attribute was in the token. | 20:01 |
| david-lyle | I guess we're just doing a before the fact check | 20:01 |
| david-lyle | not after | 20:01 |
| rderose | lbragstad: with the current version, we set the password to be expired during admin reset or user create | 20:01 |
| *** ravelar has joined #openstack-keystone | 20:02 | |
| *** nkinder has quit IRC | 20:02 | |
| rderose | david-lyle: yeah, the password is already expired, so it would not be in the token because it would fail auth | 20:02 |
| lbragstad | rderose so - after the admin resets a user's password, how is horizon suppose to get a token to get the user? | 20:02 |
| rderose | lbragstad: can horizon get it with the service token? | 20:03 |
| lbragstad | rderose horizon doesn't have a service token, there is no horizon user | 20:04 |
| rderose | lbragstad: hmm... that's a problem then | 20:04 |
| *** cheran has quit IRC | 20:05 | |
| lbragstad | rderose yeah | 20:05 |
| rderose | lbragstad: I should have stuck with my first approach :) | 20:05 |
| lbragstad | rderose I was working through the horizon+keystone stuff and i'm trying to summarize the current state of things | 20:06 |
| rderose | lbragstad: gotcha | 20:06 |
| rderose | lbragstad: we should log a bug for this | 20:06 |
| lbragstad | rderose weren't we just talking about something that could fix this? | 20:06 |
| *** ravelar has quit IRC | 20:06 | |
| lbragstad | rderose like more detailed error messages? | 20:07 |
| lbragstad | rderose or error codes? | 20:07 |
| rderose | lbragstad: yeah, a specific error code would fix it | 20:07 |
| lbragstad | like KSXXXXX | 20:07 |
| rderose | lbragstad: right, just something to tell horizon that the password is expired | 20:07 |
| lbragstad | or whatever the implementation is - it would technically mean 401 due to expired password | 20:07 |
| rderose | yep | 20:08 |
| lbragstad | rderose ok - i'm updating https://etherpad.openstack.org/p/ocata-keystone-horizon | 20:08 |
| rderose | lbragstad: cool | 20:08 |
| lbragstad | (starting at line 90) | 20:08 |
| lbragstad | I'll have to remember to bring this up in the weekly meeting with horizon if we have one this week | 20:09 |
| *** spzala has joined #openstack-keystone | 20:09 | |
| rderose | lbragstad: sounds good | 20:10 |
| *** nkinder has joined #openstack-keystone | 20:16 | |
| lbragstad | david-lyle quick question for you if you're still here | 20:18 |
| lbragstad | david-lyle do you know if horizon has propose patches to pull password requirements from keystone? | 20:18 |
| lbragstad | proposed* | 20:18 |
| *** Jack_V has joined #openstack-keystone | 20:18 | |
| lbragstad | if those aren't up for review yet thats fine, i just want to make sure we have them tracked somewhere if they are | 20:19 |
| lbragstad | johnthetubaguy fwiw - i threw us up on the policy meeting agenda to go over your specs (https://etherpad.openstack.org/p/keystone-policy-meeting) | 20:20 |
| david-lyle | lbragstad: not that I'm aware of | 20:23 |
| lbragstad | david-lyle ok - awesome. thanks for the confirmation | 20:23 |
| *** adrian_otto has quit IRC | 20:26 | |
| *** Jack_V has quit IRC | 20:28 | |
| lbragstad | breton around? curious if there is a follow up here at line 175 - https://etherpad.openstack.org/p/ocata-keystone-horizon | 20:54 |
| *** ravelar has joined #openstack-keystone | 20:56 | |
| breton | lbragstad: nothing to follow up on. All was done there. | 20:57 |
| lbragstad | breton cool - thanks for confirming | 20:58 |
| breton | lbragstad: the only thing not done is from 173. Client part is still not in. | 20:58 |
| lbragstad | Listing won't work? | 20:59 |
| lbragstad | breton as in the client isn't able to browse LDAP users? | 21:00 |
| *** ravelar has quit IRC | 21:01 | |
| *** jamielennox|away is now known as jamielennox | 21:02 | |
| *** ravelar has joined #openstack-keystone | 21:03 | |
| *** nkinder has quit IRC | 21:10 | |
| *** phalmos has joined #openstack-keystone | 21:20 | |
| *** pnavarro has quit IRC | 21:21 | |
| morgan | lbragstad: want to see how dumb keystoneclient is? | 21:24 |
| morgan | lbragstad: look at how much mocking is needed to create/list/delete users https://review.openstack.org/#/c/433244/4/shade/tests/unit/test_caching.py | 21:24 |
| morgan | the fact that it does a list to get the id and then a get of the id, but all the info was already in the list.... | 21:24 |
| morgan | ugh | 21:24 |
| *** pramodrj07 has joined #openstack-keystone | 21:28 | |
| *** phalmos_ has joined #openstack-keystone | 21:29 | |
| *** pramodrj07 has quit IRC | 21:30 | |
| *** pramodrj07 has joined #openstack-keystone | 21:30 | |
| *** MasterOfBugs has quit IRC | 21:32 | |
| *** pramodrj07 has quit IRC | 21:32 | |
| *** MasterOfBugs has joined #openstack-keystone | 21:32 | |
| *** phalmos has quit IRC | 21:33 | |
| *** dave-mccowan has quit IRC | 21:36 | |
| lbragstad | morgan hmm - i'm trying to figure out if some of the things marked as "done" on the keystone+horizon list are actually done or not | 21:39 |
| * morgan goes back to making requests_mock use in shade a thing | 21:40 | |
| *** phalmos_ has quit IRC | 21:41 | |
| *** mriedem has joined #openstack-keystone | 21:48 | |
| mriedem | lbragstad: someone threw "Centralized quota limits storage in keystone" in the nova ptg etherpad as a topic, are you guys going to be talking about that at the ptg? | 21:49 |
| lbragstad | mriedem that is a topic we have on ours too - https://etherpad.openstack.org/p/keystone-pike-ptg | 21:49 |
| lbragstad | item #16 | 21:49 |
| lbragstad | it was a carry over topic from the last summit that we didn't get consensus on | 21:50 |
| mriedem | so something you'll likely talk about on wed or thursday? | 21:50 |
| lbragstad | mriedem probably - I don't think it needs to be on the top of our list, but we can carve time out for it | 21:50 |
| lbragstad | it's also a proposed spec that we've had in review for quite a while - so I'd like make some ground on at least figuring out what to do with it | 21:51 |
| mriedem | ok, garbage time on thursday afternoon it is | 21:51 |
| lbragstad | sweet - | 21:51 |
| lbragstad | mriedem do you know if there are rooms available or if we need to fit things into a schedule? | 21:52 |
| lbragstad | or does each project just get a room to work in for 3 days? | 21:52 |
| mriedem | https://ethercalc.openstack.org/Pike-PTG-Discussion-Rooms ? | 21:52 |
| mriedem | i think that's what that is for | 21:52 |
| mriedem | but it looks like it's down | 21:52 |
| lbragstad | huh - yep same here | 21:53 |
| lbragstad | mriedem are you planning on time-boxing the sessions? specifically the ones for cross-project discussion? | 21:54 |
| lbragstad | like the typical 40 minute time slot per topic? | 21:54 |
| mriedem | our nova/cinder one is boxed | 21:54 |
| mriedem | honestly the scheduling here is a giant clusterf*ck | 21:55 |
| * lbragstad nods | 21:55 | |
| mriedem | i want to gouge my eyes out when i look at our etherpad | 21:55 |
| mriedem | but i'm trying to organize it | 21:55 |
| lbragstad | same here | 21:55 |
| mriedem | like laura's house when i moved in... | 21:55 |
| lbragstad | lol | 21:56 |
| mriedem | my plan is to slot chunks of time for bigger things, and then we'll just fill in with the randoms when we have time | 21:56 |
| lbragstad | i'd like to know if we have to hold to a schedule of some sort | 21:56 |
| mriedem | this schedule is what you make of it, from what i can tell | 21:56 |
| *** phalmos has joined #openstack-keystone | 21:56 | |
| mriedem | there are some common rooms you can try to sign up for if you want, but if we have our own room then i'm not sure why we couldn't just do a thing in one or the other | 21:56 |
| mriedem | like at the design summit | 21:56 |
| mriedem | unless by room they mean closet | 21:56 |
| lbragstad | well - if a have just one big room for a specific project then the schedule becomes pretty each | 21:57 |
| lbragstad | easy* | 21:57 |
| lbragstad | i'm just not sure if we have to switch rooms to go to different places, like previous design summits | 21:57 |
| lbragstad | like, having a dedicated session for client stuff in room XYZ and a dedicated session for operator feedback in ABC, etc... | 21:58 |
| *** lucasxu has quit IRC | 21:58 | |
| lbragstad | because I think that technically determines the "topics" we have (?) | 21:58 |
| *** phalmos has quit IRC | 21:58 | |
| mriedem | that's monday and tuesday from what i gather | 21:59 |
| mriedem | for horizontal teams and workgroups | 22:00 |
| mriedem | the rest of the week, or anytime maybe, you can sign up for a time slot in a common room | 22:00 |
| mriedem | for xp things | 22:00 |
| lbragstad | hmm - ok | 22:00 |
| lbragstad | good to know | 22:00 |
| mriedem | remember, this is the blind leading the blind here | 22:00 |
| mriedem | so don't trust me | 22:00 |
| mriedem | just don't mess it up as your first time being PTL, everyone is watching | 22:01 |
| mriedem | and judging | 22:01 |
| * lbragstad starts sweating even more | 22:01 | |
| *** edmondsw has quit IRC | 22:02 | |
| lbragstad | mriedem ok - well we know we'll have some time to go through quota stuff on Thursday (afternoon?) | 22:02 |
| mriedem | sure | 22:02 |
| lbragstad | 40 minutes? | 22:02 |
| mriedem | um sure | 22:02 |
| *** spilla has quit IRC | 22:03 | |
| lbragstad | mriedem where is your etherpad? | 22:03 |
| *** thorst_ has quit IRC | 22:03 | |
| *** edmondsw has joined #openstack-keystone | 22:04 | |
| mriedem | https://etherpad.openstack.org/p/nova-ptg-pike | 22:05 |
| mriedem | lbragstad: it's fluid | 22:05 |
| mriedem | i'm just trying to group things together right now | 22:05 |
| lbragstad | mriedem same - thanks for the link | 22:06 |
| *** phalmos has joined #openstack-keystone | 22:06 | |
| *** edmondsw has quit IRC | 22:08 | |
| *** catintheroof has quit IRC | 22:20 | |
| *** ngupta has quit IRC | 22:26 | |
| *** ngupta has joined #openstack-keystone | 22:27 | |
| *** ngupta has quit IRC | 22:32 | |
| *** ngupta has joined #openstack-keystone | 22:32 | |
| *** thorst_ has joined #openstack-keystone | 22:33 | |
| *** martinlopes has joined #openstack-keystone | 22:35 | |
| *** lucasxu has joined #openstack-keystone | 22:35 | |
| *** ravelar has quit IRC | 22:35 | |
| *** martinlopes has quit IRC | 22:36 | |
| *** thorst_ has quit IRC | 22:38 | |
| *** ngupta has quit IRC | 22:40 | |
| *** jaugustine has quit IRC | 22:42 | |
| *** dhellmann has left #openstack-keystone | 22:43 | |
| *** lamt has quit IRC | 22:43 | |
| *** lamt has joined #openstack-keystone | 22:45 | |
| *** lamt has quit IRC | 22:46 | |
| *** martinlopes has joined #openstack-keystone | 22:46 | |
| *** martinlopes has quit IRC | 22:51 | |
| *** lamt has joined #openstack-keystone | 22:53 | |
| *** jperry has quit IRC | 22:55 | |
| *** thorst_ has joined #openstack-keystone | 23:01 | |
| *** mriedem is now known as mriedem_afk | 23:02 | |
| *** mriedem_afk has left #openstack-keystone | 23:02 | |
| *** lucasxu has quit IRC | 23:02 | |
| *** lucasxu has joined #openstack-keystone | 23:02 | |
| *** dhellmann has joined #openstack-keystone | 23:04 | |
| *** lamt has quit IRC | 23:04 | |
| *** lamt has joined #openstack-keystone | 23:04 | |
| *** dhellmann has quit IRC | 23:05 | |
| *** gk--1wm- has joined #openstack-keystone | 23:05 | |
| *** gk--1wm- has left #openstack-keystone | 23:05 | |
| *** lamt has quit IRC | 23:07 | |
| *** lamt has joined #openstack-keystone | 23:08 | |
| *** jamielennox is now known as jamielennox|away | 23:15 | |
| *** phalmos has quit IRC | 23:15 | |
| *** jamielennox|away is now known as jamielennox | 23:20 | |
| *** phalmos has joined #openstack-keystone | 23:22 | |
| *** spzala has quit IRC | 23:22 | |
| *** lucasxu has quit IRC | 23:28 | |
| *** ngupta has joined #openstack-keystone | 23:30 | |
| *** esp has joined #openstack-keystone | 23:33 | |
| *** nkinder has joined #openstack-keystone | 23:35 | |
| *** phalmos has quit IRC | 23:39 | |
| *** rerobot is now known as redrobot | 23:43 | |
| *** MasterOfBugs has quit IRC | 23:46 | |
| *** lamt has quit IRC | 23:48 | |
| *** lamt has joined #openstack-keystone | 23:49 | |
| *** edmondsw has joined #openstack-keystone | 23:50 | |
| *** edmondsw has quit IRC | 23:51 | |
| *** edmondsw has joined #openstack-keystone | 23:51 | |
| *** spzala has joined #openstack-keystone | 23:52 | |
| *** catintheroof has joined #openstack-keystone | 23:55 | |
| *** spzala has quit IRC | 23:56 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!