| *** agrebennikov has quit IRC | 00:13 | |
| *** ngupta has quit IRC | 00:24 | |
| *** markvoelker has joined #openstack-keystone | 00:56 | |
| *** ngupta has joined #openstack-keystone | 01:00 | |
| *** dave-mccowan has joined #openstack-keystone | 01:01 | |
| *** tovin07 has joined #openstack-keystone | 01:08 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystone master: Updated from global requirements https://review.openstack.org/439219 | 01:10 |
|---|---|---|
| *** zhurong has joined #openstack-keystone | 01:13 | |
| *** liujiong has joined #openstack-keystone | 01:13 | |
| *** erlon has quit IRC | 01:15 | |
| *** bigjools_ has joined #openstack-keystone | 01:27 | |
| *** ngupta has quit IRC | 01:29 | |
| *** bigjools has quit IRC | 01:29 | |
| *** ngupta has joined #openstack-keystone | 01:30 | |
| *** ngupta has quit IRC | 01:34 | |
| *** zsli has joined #openstack-keystone | 01:35 | |
| *** dave-mccowan has quit IRC | 01:40 | |
| *** chlong__ has joined #openstack-keystone | 01:55 | |
| *** prashkre has joined #openstack-keystone | 02:11 | |
| *** zhurong has quit IRC | 02:15 | |
| *** zhurong has joined #openstack-keystone | 02:19 | |
| *** catintheroof has quit IRC | 02:21 | |
| *** catintheroof has joined #openstack-keystone | 02:23 | |
| *** catintheroof has quit IRC | 02:27 | |
| *** dave-mccowan has joined #openstack-keystone | 02:29 | |
| *** namnh has joined #openstack-keystone | 02:51 | |
| *** guoshan has joined #openstack-keystone | 02:52 | |
| *** thorst has quit IRC | 03:08 | |
| *** prashkre has quit IRC | 03:27 | |
| *** ngupta has joined #openstack-keystone | 03:31 | |
| *** ngupta has quit IRC | 03:35 | |
| *** ngupta has joined #openstack-keystone | 04:00 | |
| *** dave-mccowan has quit IRC | 04:03 | |
| *** spotz_zzz is now known as spotz | 04:13 | |
| *** lamt has joined #openstack-keystone | 04:20 | |
| *** adriant has quit IRC | 04:20 | |
| *** markvoelker has quit IRC | 04:23 | |
| *** ngupta has quit IRC | 04:24 | |
| *** ngupta has joined #openstack-keystone | 04:25 | |
| *** thorst has joined #openstack-keystone | 04:28 | |
| *** ngupta has quit IRC | 04:30 | |
| *** prashkre has joined #openstack-keystone | 04:36 | |
| *** lamt has quit IRC | 04:37 | |
| *** prashkre has quit IRC | 04:48 | |
| *** zsli has quit IRC | 04:48 | |
| *** zsli has joined #openstack-keystone | 04:48 | |
| *** guoshan has quit IRC | 04:53 | |
| *** zsli has quit IRC | 04:54 | |
| *** sreenath has joined #openstack-keystone | 05:09 | |
| *** markvoelker has joined #openstack-keystone | 05:24 | |
| *** arturb has joined #openstack-keystone | 05:25 | |
| *** markvoelker has quit IRC | 05:29 | |
| *** thorst has joined #openstack-keystone | 05:29 | |
| *** thorst has quit IRC | 05:34 | |
| *** guoshan has joined #openstack-keystone | 05:54 | |
| *** Dinesh_Bhor has joined #openstack-keystone | 05:55 | |
| *** guoshan has quit IRC | 05:58 | |
| *** guoshan_ has joined #openstack-keystone | 05:58 | |
| *** rcernin has joined #openstack-keystone | 06:08 | |
| *** prashkre has joined #openstack-keystone | 06:11 | |
| openstackgerrit | zhengliuyang proposed openstack/python-keystoneclient master: Delete pyc and pyo file before test https://review.openstack.org/441754 | 06:15 |
| *** agrebennikov_ has joined #openstack-keystone | 06:18 | |
| *** agrebennikov_ has quit IRC | 06:23 | |
| openstackgerrit | Merged openstack/keystone master: Remove unused variable https://review.openstack.org/439525 | 06:23 |
| *** prashkre has quit IRC | 06:25 | |
| *** thorst has joined #openstack-keystone | 06:30 | |
| *** thorst has quit IRC | 06:34 | |
| *** richm has quit IRC | 06:43 | |
| *** markvoelker has joined #openstack-keystone | 06:44 | |
| openstackgerrit | Merged openstack/keystone master: Imported Translations from Zanata https://review.openstack.org/439420 | 06:47 |
| openstackgerrit | Merged openstack/keystone master: Fix api-ref building with sphinx 1.5 https://review.openstack.org/441653 | 06:47 |
| *** h5t4_ has joined #openstack-keystone | 06:55 | |
| *** pcaruana has joined #openstack-keystone | 06:58 | |
| *** pcaruana has quit IRC | 07:05 | |
| *** pcaruana has joined #openstack-keystone | 07:06 | |
| *** tesseract has joined #openstack-keystone | 07:13 | |
| *** h5t4_ has quit IRC | 07:14 | |
| *** h5t4_ has joined #openstack-keystone | 07:14 | |
| *** ngupta has joined #openstack-keystone | 07:27 | |
| *** jaosorior has joined #openstack-keystone | 07:30 | |
| *** ngupta has quit IRC | 07:32 | |
| *** chlong__ has quit IRC | 07:36 | |
| openstackgerrit | zhengliuyang proposed openstack/keystone master: Delete .pyc and .pyo file before test https://review.openstack.org/441779 | 07:50 |
| *** tovin07 has quit IRC | 08:12 | |
| *** tovin07 has joined #openstack-keystone | 08:12 | |
| *** ngupta has joined #openstack-keystone | 08:28 | |
| *** thorst has joined #openstack-keystone | 08:32 | |
| *** ngupta has quit IRC | 08:33 | |
| *** thorst has quit IRC | 08:36 | |
| *** markvoelker_ has joined #openstack-keystone | 08:51 | |
| *** markvoelker has quit IRC | 08:54 | |
| *** zzzeek has quit IRC | 09:00 | |
| *** zzzeek has joined #openstack-keystone | 09:00 | |
| *** zsli has joined #openstack-keystone | 09:10 | |
| *** d0ugal has quit IRC | 09:14 | |
| Dinesh_Bhor | dolphm: Hi, do you have some time? | 09:18 |
| *** zsli has quit IRC | 09:26 | |
| *** zsli has joined #openstack-keystone | 09:26 | |
| *** d0ugal has joined #openstack-keystone | 09:26 | |
| *** d0ugal has quit IRC | 09:26 | |
| *** d0ugal has joined #openstack-keystone | 09:26 | |
| *** zsli has quit IRC | 09:28 | |
| *** ngupta has joined #openstack-keystone | 09:29 | |
| *** thorst has joined #openstack-keystone | 09:33 | |
| *** ngupta has quit IRC | 09:33 | |
| *** thorst has quit IRC | 09:37 | |
| *** liujiong has quit IRC | 10:17 | |
| robcresswell | Dinesh_Bhor: Probably best to leave a question in the channel, at least then dolphm can respond async. | 10:22 |
| Anticimex | auto-provisioning and R&E federation is great, considering implementing of Ocata-keystone now | 10:24 |
| Anticimex | but there's one slight issue: "Projects will be created within the domain associated with the Identity Provider." | 10:24 |
| Anticimex | we receive ~400 domains from 1 idp config | 10:24 |
| Dinesh_Bhor | robcresswell: thanks, | 10:26 |
| *** Haaibo has joined #openstack-keystone | 10:26 | |
| *** guoshan_ has quit IRC | 10:29 | |
| *** guoshan has joined #openstack-keystone | 10:29 | |
| *** ngupta has joined #openstack-keystone | 10:29 | |
| Dinesh_Bhor | Hi all, about this: https://review.openstack.org/#/c/258742/4 From this patch we have started using keystoneauth1 adapter but the related adapter code is still there in keystoneclient. is there any reason for that? | 10:30 |
| *** openstackgerrit has quit IRC | 10:33 | |
| *** thorst has joined #openstack-keystone | 10:34 | |
| *** ngupta has quit IRC | 10:34 | |
| *** mvk has quit IRC | 10:35 | |
| *** guoshan has quit IRC | 10:38 | |
| *** thorst has quit IRC | 10:38 | |
| jamielennox | Dinesh_Bhor: for various reasons it's really hard to deprecate code out of the client libraries, the keystoneclient adapter should just be considered deprecated | 10:44 |
| jamielennox | it's just being left there for now and use the keystoneauth one instead | 10:44 |
| robcresswell | More noob questions: since an unscoped token requires a domain/user/password, isn't it considered domain-scoped? | 10:46 |
| robcresswell | Still slowly trying to wrap my head around varying levels of scope | 10:47 |
| Dinesh_Bhor | jamielennox: Does that mean they might get used in future? | 10:47 |
| jamielennox | Dinesh_Bhor: no, it means if we remove them before we are really sure every other client doesn't use them we risk breaking things | 10:48 |
| jamielennox | Dinesh_Bhor: they were initially developed in keystoneclient and split out into their own repository so that other clients didn't have to inherit all of keystoneclient's dependencies | 10:48 |
| jamielennox | like lxml and other things | 10:48 |
| jamielennox | they're almost exactly the same, the one in keystoneclient is deprecated | 10:48 |
| jamielennox | robcresswell: a user belongs in a domain, so you're just identifying the user | 10:49 |
| jamielennox | robcresswell: think of it like email "user@domain", user isn't guaranteed to be unique unless you identify the domain as well | 10:49 |
| *** gK-1wm-su has joined #openstack-keystone | 10:51 | |
| robcresswell | jamielennox: Okay, think I've got that. I was looking into the value behind two step auth; i.e. retrieving an unscoped token, to see what you could then scope to, and then retrieving that token vs. Horizons current method of logging in and then switching (which I assume relies on a users role having a default project) | 10:51 |
| Dinesh_Bhor | jamielennox: thanks, clear. | 10:52 |
| jamielennox | robcresswell: that would be the preferred way to do it, at one point we were trying to push towards making it so you couldn't change scope from one scoped token to another, you could only exchange an unscoped token for a scoped token | 10:53 |
| jamielennox | there is a flag you can set on authentication (i'd have to look it up but it's probably ?unscoped=1) that means always get an unscoped token even if there is a default project set | 10:53 |
| robcresswell | Ah, so thats why there is the whole explicit unscoped token vs unscoped token thing | 10:53 |
| jamielennox | yea, really we're trapped into the default project thing because it was an obvious thing in the v2 API, less so in v3 but it would require such a change to actually implement it | 10:54 |
| robcresswell | I'm just building this out fro my own learning/research really, I've been relying on Dave to help with keystone for far too long now. | 10:54 |
| robcresswell | Gotcha | 10:54 |
| jamielennox | well, kinda on versions, but asking for explicit unscoped on first auth would be the ideal way to do it | 10:55 |
| robcresswell | Sure | 10:55 |
| *** gK-1wm-su has quit IRC | 10:55 | |
| jamielennox | robcresswell: so i made a bunch of DOA changes to make kerberos and federation work, there had always been the intent to make it properly ksa but we could never figure out how to serialize the auth info | 10:56 |
| jamielennox | if you're interested in getting it sorted out this cycle we can probably figure it out | 10:57 |
| robcresswell | jamielennox: Er, I don't wanna get ahead of myself; we've already got a fair few keystone changes up for review that need to get done first | 10:58 |
| jamielennox | no worries | 10:58 |
| robcresswell | We'll see where I get to over the next couple weeks | 10:58 |
| jamielennox | i've looked before and don't understand the DOA/django/horizon split well enough | 10:58 |
| robcresswell | jamielennox: I dont really understand the doa split either, tbh. Originally it was designed so that it was pluggable I guess, but in reality it doesnt seem to have been used that way | 10:59 |
| robcresswell | Plus having doa in-tree would make it less complex at release time. | 10:59 |
| robcresswell | jamielennox: I guess since the domain has to be known for unscoped, there isn't much of a use case for getting an unscoped token and then a domain-scoped token? Unless the client (UI in this case) provides a default or something, that the user happens to be part of. | 11:01 |
| jamielennox | yea, i really don't think there's another django project out there making use of DOA | 11:01 |
| robcresswell | Yeah, exactly | 11:01 |
| jamielennox | robcresswell: so domain's owning users is not the best paradigm, but we needed them to be owned by something so that someone had the capabilities to create/modify users | 11:02 |
| jamielennox | that's part of the domain admin's responsibility | 11:02 |
| jamielennox | but that's not to say that the user only has projects in that same domain | 11:02 |
| jamielennox | you could for example just set up an IDP to point user's into a domain so that someone can manage them and then give them roles into projects on other domains | 11:03 |
| jamielennox | similarly they could have roles on other domains | 11:03 |
| jamielennox | however in practice you can probably assume that most of a user's projects will be in the same domain as the user is | 11:04 |
| robcresswell | But in terms of requesting a token, you'd still need to always know the domain name ahead of time, so the unscoped -> scoped workflow main use case if for projects? Unless you had a setup where all your users are in a management domain that is widely known, and after requesting an unscoped token they can then see which domains they are also a part of. | 11:05 |
| *** nicolasbock has joined #openstack-keystone | 11:05 | |
| robcresswell | main use case is for* | 11:05 |
| robcresswell | Trying to wrap my head around doing this in a pleasant UI-way | 11:06 |
| *** mvk has joined #openstack-keystone | 11:07 | |
| jamielennox | yea, for horizon you probably want to know the user domain name ahead of time, listing domains for the user to pick from can be really unsafe because you expose to a user other companies/domains that might be using the same cloud | 11:10 |
| jamielennox | i think last time we approached this in horizon you could define a static list of domains available to that login page | 11:11 |
| jamielennox | but then allow there to be multiple login pages so you could log in from different urls | 11:11 |
| jamielennox | so if you have pepsi and coke in your cloud you could configure DOA at different URLs and give each to the different company so they don't know each other exists | 11:12 |
| jamielennox | i guess that's all apache magic anyway | 11:13 |
| cmurphy | that would be cool | 11:13 |
| *** richm has joined #openstack-keystone | 11:14 | |
| robcresswell | jamielennox: re: exposing domains from other companies, wouldn't the unscoped token control what you could see anyway? My thought was, get unscoped token, get available domain and project scopes for that token, let user select domain or project scope. | 11:14 |
| robcresswell | Ideally avoiding any hardcoding. I'd probably keep the default domain setting though, because thats always going to be useful for a single domain world. | 11:15 |
| robcresswell | No rush to respond btw, I just happen to be dedicating my morning to keystone work :) | 11:16 |
| jamielennox | robcresswell: yea, when you ask what you can do with an unscoped token it is safe to assume the user knows what they can do so that's fine | 11:17 |
| jamielennox | what i mean is from a login page you typically don't want the user to have to know they're in the PEPSI.COM domain, they just want to type their username and password | 11:17 |
| jamielennox | in some situations you might decide that that login page could access PEPSI.COM, PEPSI-DEV.COM and some other things | 11:17 |
| jamielennox | but you can't just ask keystone for all the domains because that would reveal other cloud customers | 11:18 |
| robcresswell | Yep, understood | 11:18 |
| robcresswell | yeah iirc someone proposed a URL -> Domain mapping patch to Horizon | 11:18 |
| jamielennox | ayoung and i argued about this a few cycles ago, there was some specs proposed about domain visibility but i don't know what happened to them | 11:18 |
| ayoung | jamielennox, ! | 11:19 |
| jamielennox | ayoung: oh, hey, didn't expect you to be up yet | 11:19 |
| ayoung | jamielennox, new project has me working European-friendly times | 11:19 |
| ayoung | roughly 6-3 My time | 11:20 |
| ayoung | So, yeah, what do them mean by URL -> DOMAIN...me reads up | 11:20 |
| jamielennox | ayoung: i work with west-coasters now so i'm almost on a regular working day | 11:20 |
| ayoung | heh. | 11:21 |
| robcresswell | https://blueprints.launchpad.net/horizon/+spec/doa-multidomain-mapping | 11:21 |
| robcresswell | Doesn't seem like it went anywhere :( | 11:21 |
| jamielennox | robcresswell: yea, that's part of this - but IMO if you want to go down that path just handle a list from environ and make people do the work in apache | 11:22 |
| ayoung | robcresswell, Ok, so you need to separate how Keystone should work from how it does work....we've added at least one more abstraction than necessary | 11:23 |
| ayoung | Domains and IdPs really should be the same thing. | 11:23 |
| ayoung | In both cases they are "where do I find my users" | 11:23 |
| robcresswell | Right, but you'd like to avoid average joe being domain aware at all | 11:24 |
| ayoung | Keystone really should not own the real users ,but it turns out is absolutely must be a place where we can create lighteweight things like service users etc | 11:24 |
| robcresswell | Right | 11:25 |
| ayoung | robcresswell, so, Federation is kindof the start of that | 11:25 |
| ayoung | its clunky, but the idea is that we need to reuse the corporate user ID system for most companies | 11:25 |
| ayoung | and, even in the case of Rackspace etc where the users are primarily there due to OpenStack, there is always a huge provisioning system | 11:26 |
| * jamielennox poked the bear then goes to bed | 11:26 | |
| ayoung | cuz, you know, payment | 11:26 |
| ayoung | gnight Jamie | 11:26 |
| jamielennox | robcresswell: ping me if there's anything else i can help with later | 11:26 |
| jamielennox | ayoung: night | 11:26 |
| ayoung | robcresswell, so, where I am headed is this: set up Keystone, and then set up one horizon instance per IdP in separate containers | 11:27 |
| ayoung | then point your user at the appropriate Horizon instance | 11:27 |
| ayoung | and have that configured to only know about one IdP | 11:27 |
| robcresswell | night jamielennox, thanks for the help! | 11:28 |
| ayoung | that way, when you add a new IdP, or a new protocol for an existing IdP, you don't mess with the Apache config for all the other ones, and there is no service interruption. Also allows them to be configured for optimal user experience during login | 11:28 |
| ayoung | robcresswell, I'm actually think in terms of a separate Keystone container per IdP as well. | 11:28 |
| ayoung | the containers would not have routes set up for every IdP, just the one specific to it | 11:29 |
| robcresswell | ayoung: Interesting setup, this is good to know | 11:29 |
| ayoung | robcresswell, now the bad news | 11:29 |
| robcresswell | :'( | 11:29 |
| ayoung | robcresswell, I'm no longer working on Keystone, or even OpenStack, full time. I'm a heretic that has moved on. | 11:29 |
| ayoung | But there is nothing preventing anyone from implementing what I just stated. Its really a provisioning system problem to solve | 11:30 |
| ayoung | so Red Hat would have to make it work in Tripleo, and you in....whatever you do. | 11:30 |
| ayoung | robcresswell, In Tripleo, they are just now moving over to containers, so it is necessary to get that up and working before we could push for that approach. What are you using? | 11:31 |
| *** namnh has quit IRC | 11:33 | |
| robcresswell | ayoung: I'm pretty detached from the deployers internally. Maintaining Horizon and learning about Ironic and Keystone is all I'm currently doing, while we figure out container work. | 11:34 |
| ayoung | robcresswell, HA! | 11:35 |
| robcresswell | Yeah, I'm "one of those" | 11:35 |
| ayoung | robcresswell, so...I did this: http://adam.younglogic.com/2017/01/functional-keystone-docker/ | 11:35 |
| ayoung | but I have not yet done the Kubernetes equivalent, as I go stuck behind the Networking setup, and then had to get actual work donw | 11:36 |
| ayoung | done | 11:36 |
| robcresswell | ayoung: Most of our dev work right now is using kolla-k8s, and then I'm testing things with CORS for UI work. Drops all the boilerplate and working straight on to the API. | 11:40 |
| ayoung | robcresswell, so, I think it could then work for you to go with the approach I just described | 11:40 |
| robcresswell | Just involves me hitting the server side guys with stick for a while until they add the CORS conf. Though oslo has made that trivial. | 11:40 |
| robcresswell | Yeah, I think so, its an interesting design | 11:41 |
| ayoung | robcresswell, cool, now I'm back to figuring out how to use Kubernetes to migrate a running VM... | 11:43 |
| robcresswell | ayoung: Ha, thanks for the input :) | 11:44 |
| ayoung | robcresswell, you are welcome | 11:44 |
| *** zhurong has quit IRC | 11:58 | |
| Anticimex | ayoung: neat, nice | 12:00 |
| *** Jack_I has joined #openstack-keystone | 12:06 | |
| *** dave-mccowan has joined #openstack-keystone | 12:09 | |
| *** thorst has joined #openstack-keystone | 12:44 | |
| *** jamielennox is now known as jamielennox|away | 12:50 | |
| *** ngupta has joined #openstack-keystone | 12:50 | |
| *** edmondsw has joined #openstack-keystone | 13:04 | |
| *** lamt has joined #openstack-keystone | 13:10 | |
| *** ngupta has quit IRC | 13:10 | |
| *** ngupta has joined #openstack-keystone | 13:10 | |
| *** lamt has quit IRC | 13:14 | |
| *** ngupta has quit IRC | 13:15 | |
| *** venki has joined #openstack-keystone | 13:23 | |
| venki | Hi, | 13:25 |
| venki | http://paste.openstack.org/show/601543/ | 13:25 |
| venki | I'm getting this error while building for devstack with ironic installation... | 13:25 |
| venki | Issue is in keystone | 13:25 |
| breton | venki: we probably cannot tell anything from the part you showed | 13:27 |
| venki | is there anything you need specifically ? | 13:29 |
| Dinesh_Bhor | venki: not sure but this might help: https://bugs.launchpad.net/devstack/+bug/1569167 | 13:32 |
| openstack | Launchpad bug 1515352 in devstack "duplicate for #1569167 Stacking fails on fedora 22 "Could not determine a suitable URL for the plugin"" [Undecided,Fix committed] | 13:32 |
| *** venki has quit IRC | 13:34 | |
| *** Guest36874 is now known as zeus | 13:38 | |
| *** zeus has quit IRC | 13:39 | |
| *** zeus has joined #openstack-keystone | 13:39 | |
| *** rderose has joined #openstack-keystone | 13:39 | |
| *** rderose has quit IRC | 13:39 | |
| *** rderose has joined #openstack-keystone | 13:39 | |
| *** openstackgerrit has joined #openstack-keystone | 13:43 | |
| openstackgerrit | Merged openstack/keystone-specs master: Remove microversions spec from backlog https://review.openstack.org/439190 | 13:43 |
| openstackgerrit | Merged openstack/keystone-specs master: Remove centralized policy delivery spec from backlog https://review.openstack.org/439195 | 13:44 |
| *** dikonoor has joined #openstack-keystone | 13:47 | |
| samueldmq | morning keystone | 13:52 |
| *** spilla has joined #openstack-keystone | 13:54 | |
| *** catintheroof has joined #openstack-keystone | 14:04 | |
| cmurphy | hey keystone, I noticed that [ldap]/group_members_are_ids isn't one of the "whitelisted_options" http://git.openstack.org/cgit/openstack/keystone/tree/keystone/resource/core.py#n894 which makes keystone-manage domain_config_upload fail if it is set | 14:07 |
| cmurphy | I'm wondering if that's on purpose or if it just got missed? | 14:07 |
| lbragstad | cmurphy that's a good question, i would think henrynash would know the answer to that | 14:32 |
| lbragstad | cmurphy https://github.com/openstack/keystone/blob/master/keystone/conf/ldap.py#L302-L309 seems like something that would change on a per domain basis though | 14:33 |
| lbragstad | my initial gut feeling tells me that it just got missed | 14:34 |
| cmurphy | that's what I was guessing | 14:35 |
| *** dikonoor has quit IRC | 14:39 | |
| lbragstad | cmurphy there isn't a bug open for this yet is there? | 14:42 |
| *** pnavarro has joined #openstack-keystone | 14:42 | |
| cmurphy | lbragstad: I haven't filed one and I don't see one | 14:44 |
| cmurphy | I can open one | 14:44 |
| lbragstad | cmurphy cool - i'm in launchpad opening another bug now... I can open one for the domain config issue if you have a trace? | 14:47 |
| *** ngupta has joined #openstack-keystone | 14:48 | |
| cmurphy | I just nuked the machine I was running it on, i'll have it back in a few minutes | 14:50 |
| lbragstad | cmurphy oh - no worries, i'll create a basic bug report and we can update it with stacktraces later | 14:53 |
| cmurphy | lbragstad: mmk | 14:53 |
| lbragstad | cmurphy https://bugs.launchpad.net/keystone/+bug/1670382 | 14:57 |
| openstack | Launchpad bug 1670382 in OpenStack Identity (keystone) "[ldap]/group_members_are_ids isn't a whitelisted option" [Undecided,New] | 14:57 |
| *** chlong__ has joined #openstack-keystone | 14:57 | |
| knikolla | o/ morning | 15:06 |
| *** ngupta has quit IRC | 15:07 | |
| *** ngupta has joined #openstack-keystone | 15:07 | |
| *** lamt has joined #openstack-keystone | 15:11 | |
| *** venki has joined #openstack-keystone | 15:15 | |
| *** lucasxu has joined #openstack-keystone | 15:16 | |
| openstackgerrit | Anthony Washington proposed openstack/oslo.policy master: Add additional param to policy.RuleDefault https://review.openstack.org/439070 | 15:17 |
| *** ngupta has quit IRC | 15:17 | |
| *** ngupta has joined #openstack-keystone | 15:18 | |
| *** david-lyle has quit IRC | 15:20 | |
| Aurelgad1o | hello guys, i've been trying to configure the oidc driver to be use by both horizon and the cli, I got horizon working but I'm stuck with the cli... I updated on a ticket someone else opened weeks ago here : https://bugs.launchpad.net/python-openstackclient/+bug/1648580 | 15:20 |
| openstack | Launchpad bug 1648580 in python-openstackclient "v3oidcpassword federated login error (argument count)" [Undecided,New] | 15:20 |
| Aurelgad1o | any help would be apreciated | 15:20 |
| Aurelgad1o | i'm pretty weak in python but if there's some work to do to get that working I'm willing to help | 15:21 |
| *** aloga has quit IRC | 15:25 | |
| *** aloga has joined #openstack-keystone | 15:25 | |
| *** erlon has joined #openstack-keystone | 15:26 | |
| cmurphy | Aurelgad1o: I think it's known to not quite work yet https://review.openstack.org/#/c/373983/ | 15:27 |
| Aurelgad1o | Ooh thank you ... may I ask you how I should have used launchpad/gerrit/documentation/google to get to find this ? I dwelled into the code and google lots and lots without seeing once this page :-( | 15:30 |
| Aurelgad1o | So what's the status of this bp ? is it going to be discussed in boston ? | 15:31 |
| *** ravelar has joined #openstack-keystone | 15:33 | |
| cmurphy | Aurelgad1o: when/if that spec gets approved it will end up on http://specs.openstack.org/openstack/keystone-specs/ and then google will be able to find it, i only knew about it because it was mentioned in a meeting | 15:38 |
| Aurelgad1o | alright thx | 15:39 |
| *** venki has quit IRC | 15:40 | |
| *** rderose has quit IRC | 15:44 | |
| Aurelgad1o | but I'm puzzled : if the feature doesn't work / is not implemented, why is it mentionned in the --help ? | 15:45 |
| *** venki has joined #openstack-keystone | 15:50 | |
| knikolla | lbragstad: it's been a while since we merged the updated global requirements from the bot. | 15:59 |
| knikolla | any reason to hold off? | 16:00 |
| robcresswell | lbragstad: Quite a few places in the auth/token mgmt docs are missing that domain is required. Not sure if its a bug, or me being a noob. | 16:01 |
| knikolla | robcresswell: can you link to them? | 16:04 |
| *** chris_hultin|AWA is now known as chris_hultin | 16:04 | |
| robcresswell | knikolla: https://developer.openstack.org/api-ref/identity/v3/index.html?expanded=token-authentication-with-scoped-authorization-detail,password-authentication-with-scoped-authorization-detail#password-authentication-with-scoped-authorization | 16:04 |
| robcresswell | yikes that link | 16:04 |
| robcresswell | So at least, my env threw an error until I included the domain under scope.project.domain | 16:05 |
| *** h5t4_ has quit IRC | 16:05 | |
| robcresswell | Similarly in explicit unscoped auth, domain is still required there, but isnt listed in the API docs I believe. | 16:06 |
| knikolla | robcresswell: the request part of that doc is really confusing. but generally, if you use name (for either user or project), you need domain. if you use id, you don't. | 16:06 |
| robcresswell | ahh, interesting | 16:06 |
| knikolla | robcresswell: yes, i see they fail to mention domain entirely., | 16:06 |
| knikolla | robcresswell: names are not unique across domains, that's why. | 16:07 |
| knikolla | robcresswell: but ids are. | 16:07 |
| robcresswell | probably want that listed as optional. As it happens the error is perfect; it literally told me I was missing domain in field X. | 16:07 |
| robcresswell | knikolla: Yep, makes sense | 16:07 |
| knikolla | robcresswell: i | 16:07 |
| knikolla | i'll have a patch soon to add domain as optional. | 16:07 |
| knikolla | thanks for pointing it out :) | 16:07 |
| robcresswell | knikolla: No problem. Thought I'd just flag it while I'm working through it all | 16:08 |
| *** rcernin has quit IRC | 16:08 | |
| openstackgerrit | Sean Dague proposed openstack/keystone-specs master: WIP: block diag quota scenarios https://review.openstack.org/441203 | 16:09 |
| lbragstad | knikolla done | 16:14 |
| venki | I'm installing devstack with ironic, while I encounters an issue | 16:15 |
| venki | http://paste.openstack.org/show/601600/ | 16:15 |
| venki | issue is in create_keystone_accounts | 16:16 |
| venki | anyone pls help | 16:16 |
| knikolla | venki: can you curl the OS_AUTH_URL there? | 16:17 |
| *** david-lyle has joined #openstack-keystone | 16:17 | |
| knikolla | lbragstad: cool. :) | 16:17 |
| *** pnavarro has quit IRC | 16:18 | |
| venki | Knikolla : getting "500 Internal Server Error" | 16:19 |
| lbragstad | venki can you check your keystone logs? | 16:20 |
| knikolla | venki: if you do "screen -r" you'll have access to the screens with the logs | 16:20 |
| lbragstad | venki you should also be able to see them from /var/log/apache/keystone.log | 16:21 |
| knikolla | lbragstad: right. i figure it's easier that than to explain the usage of screen. haha | 16:21 |
| *** david-lyle has quit IRC | 16:22 | |
| venki | http://paste.openstack.org/show/601604/ | 16:27 |
| venki | @knikolla @lbragstad /var/log/apache/keystone.log | 16:28 |
| dstanek | venki: that seems like devstack isn't installing the correct dependencies | 16:29 |
| *** ngupta_ has joined #openstack-keystone | 16:30 | |
| lbragstad | venki are you using the latest devstack and is this a brand new installation? | 16:30 |
| venki | i cleaned and reinstalled the devstack many times... | 16:30 |
| venki | I'm getting the same error.... | 16:30 |
| venki | I dono what to do.. | 16:30 |
| venki | :( | 16:31 |
| lbragstad | venki when that happens to me I usually just destroy the VM and start over | 16:31 |
| knikolla | ++ | 16:32 |
| lbragstad | with a fresh installation | 16:32 |
| *** lucasxu has quit IRC | 16:32 | |
| lbragstad | venki in my experience, devstack isn't very re-useable | 16:32 |
| *** ngupta has quit IRC | 16:34 | |
| *** ngupta_ has quit IRC | 16:35 | |
| dstanek | ++ | 16:35 |
| venki | oh okey okey.... I will do the same... | 16:37 |
| venki | thanks guys.... | 16:37 |
| venki | :) | 16:37 |
| *** h5t4_ has joined #openstack-keystone | 16:38 | |
| lbragstad | venki keep us posted if you run into anymore issues | 16:44 |
| *** rderose has joined #openstack-keystone | 16:46 | |
| openstackgerrit | Anthony Washington proposed openstack/keystone master: API-ref return code fix https://review.openstack.org/442034 | 16:52 |
| venki | yeah sure @lbragstad | 16:54 |
| lbragstad | rderose i have one comment on https://review.openstack.org/#/c/438761/12 but other than that - i think that spec looks good | 16:55 |
| lbragstad | antwash aha - nice ^ | 16:55 |
| *** chris_hultin is now known as chris_hultin|AWA | 16:58 | |
| *** ngupta has joined #openstack-keystone | 16:58 | |
| *** browne has joined #openstack-keystone | 16:59 | |
| *** _cjones_ has joined #openstack-keystone | 16:59 | |
| *** aasthad has joined #openstack-keystone | 17:01 | |
| *** mgagne_ has quit IRC | 17:05 | |
| *** mgagne_ has joined #openstack-keystone | 17:05 | |
| *** ngupta has quit IRC | 17:06 | |
| *** lamt has quit IRC | 17:06 | |
| openstackgerrit | Richard Avelar proposed openstack/keystone master: Add group_members_are_ids to whitelisted options https://review.openstack.org/442048 | 17:09 |
| *** tesseract has quit IRC | 17:10 | |
| *** lamt has joined #openstack-keystone | 17:17 | |
| *** david-lyle has joined #openstack-keystone | 17:18 | |
| *** david-lyle has quit IRC | 17:24 | |
| *** venki has quit IRC | 17:24 | |
| *** ngupta has joined #openstack-keystone | 17:27 | |
| *** rcernin has joined #openstack-keystone | 17:27 | |
| *** ravelar1 has joined #openstack-keystone | 17:29 | |
| *** ravelar has quit IRC | 17:29 | |
| *** lamt has quit IRC | 17:29 | |
| *** david-lyle has joined #openstack-keystone | 17:30 | |
| *** ravelar1 is now known as ravelar | 17:30 | |
| *** lamt has joined #openstack-keystone | 17:31 | |
| *** lucasxu has joined #openstack-keystone | 17:33 | |
| *** agrebennikov has joined #openstack-keystone | 17:38 | |
| rderose | lbragstad: thanks, replied to your comment | 17:44 |
| rderose | lbragstad: as that is pretty minor change, wondering if we can push this through :) | 17:44 |
| lbragstad | rderose sure - if we get a follow on patch up, we can fast follow it | 17:46 |
| rderose | lbragstad: sweet! | 17:47 |
| *** mvk has quit IRC | 17:49 | |
| *** dikonoor has joined #openstack-keystone | 17:50 | |
| *** jaosorior has quit IRC | 17:58 | |
| *** chris_hultin|AWA is now known as chris_hultin | 17:59 | |
| *** dikonoor has quit IRC | 18:00 | |
| *** chlong__ has quit IRC | 18:08 | |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone master: Support new hashing algorithms for securely storing password hashes https://review.openstack.org/438701 | 18:09 |
| *** sreenath has quit IRC | 18:18 | |
| *** jaugustine has joined #openstack-keystone | 18:27 | |
| *** mvk has joined #openstack-keystone | 18:31 | |
| openstackgerrit | Colleen Murphy proposed openstack/keystone master: Whitelist ldap group configs https://review.openstack.org/442103 | 18:38 |
| *** spotz is now known as spotz_zzz | 18:42 | |
| *** spotz_zzz is now known as spotz | 18:43 | |
| *** lamt has quit IRC | 18:49 | |
| *** lucasxu has quit IRC | 18:55 | |
| *** Kris__ has joined #openstack-keystone | 18:55 | |
| openstackgerrit | Richard Avelar proposed openstack/keystone master: Add group_members_are_ids to whitelisted options https://review.openstack.org/442048 | 18:59 |
| *** pcaruana has quit IRC | 19:04 | |
| *** MasterOfBugs has joined #openstack-keystone | 19:09 | |
| *** pcaruana has joined #openstack-keystone | 19:15 | |
| *** Kris__ has quit IRC | 19:18 | |
| *** basilAB_ has joined #openstack-keystone | 19:26 | |
| * notmorgan looks around. | 19:29 | |
| *** chlong has joined #openstack-keystone | 19:31 | |
| * ravelar waves from across empty room at notmorgan | 19:45 | |
| *** markvoelker_ has quit IRC | 19:47 | |
| *** lamt has joined #openstack-keystone | 19:48 | |
| * stevemar tosses tomatoes at ravelar and notmorgan | 20:01 | |
| * stevemar runs away | 20:01 | |
| * notmorgan watches stevemar get caught in the trap at the edge of the room, "HAH! now you must review code for openstack again" | 20:02 | |
| *** h5t4_ has quit IRC | 20:15 | |
| rcernin | ayoung: notmorgan: may i ask you about recommendation with keystone caching for production? | 20:20 |
| notmorgan | oh sure | 20:20 |
| notmorgan | rcernin: happy to help | 20:21 |
| rcernin | awesome what is preferred for keystone caching in production environment? looked thru the docs and its not memcached but not sure whats best option. we talk about 1000 tokens/min in db and need to increase performance. | 20:21 |
| *** Jack_I has quit IRC | 20:22 | |
| notmorgan | well, honestly, memcache is the easiest to setup | 20:22 |
| notmorgan | the other option that works (and has some differing performance profiles) is Redis | 20:22 |
| notmorgan | it really depends on what you're production engineering expertise is. | 20:22 |
| notmorgan | i fall back to what the people maintaining the cloud are most comfortable with | 20:22 |
| notmorgan | the short answer is "caching is recommended" | 20:23 |
| rcernin | notmorgan: sure it is, do you have any examples for the above two? | 20:23 |
| notmorgan | both in keystone and setup in the keystone-middleware config for the other services | 20:23 |
| rcernin | notmorgan: we could try both, check performance and see which makes better results. | 20:23 |
| notmorgan | i really only have spent time with memcache, and the improvement in devstack was significant, 20-40% (sometimes hirer) | 20:24 |
| *** markvoelker has joined #openstack-keystone | 20:24 | |
| notmorgan | higher* | 20:24 |
| notmorgan | i know some folks use redis, and it is supported since dogpile supports it | 20:24 |
| rcernin | are they are complex to configure? or is there any upstream docs to help configuring it? | 20:24 |
| notmorgan | memcache is super super easy to configure. Mostly it is "install and turn on" and if you have large amounts of data, increase the memory allocation for the memcache sever. Keystone and keystone-middleware configurations are pretty straightforward for caching | 20:25 |
| notmorgan | redis has a lot more tunables on the backend. | 20:25 |
| notmorgan | and keystonemiddleware (afaik) doesn't do redis yet | 20:25 |
| notmorgan | but keystone caching alone is significant | 20:26 |
| notmorgan | https://docs.openstack.org/developer/keystonemiddleware/middlewarearchitecture.html#improving-response-time is where I'd start for keystonemiddleware | 20:27 |
| notmorgan | https://docs.openstack.org/admin-guide/identity-caching-layer.html is for keystone or https://docs.openstack.org/developer/keystone/configuration.html#caching-layer | 20:27 |
| notmorgan | the biggest key recommendation is ensure that the memcache servers used for the non-keystone endpoints are shared if at all possible | 20:28 |
| * rcernin reading | 20:28 | |
| notmorgan | this will accelerate the validation as the first service that validates a token will cache the value | 20:28 |
| notmorgan | and in the case of (say booting a server) some actions, the service will utilize the user's token to talk to another service (e.g. Nova -> Glance to get the image) | 20:29 |
| notmorgan | nova will have validated the token and glance then benefits from the cached validation | 20:29 |
| notmorgan | basically, caching is a very large win in OpenStack for token validation(s). | 20:30 |
| *** bknudson_ has left #openstack-keystone | 20:34 | |
| rcernin | notmorgan: thanks man! | 20:41 |
| notmorgan | rcernin: happy to help | 20:42 |
| *** chlong has quit IRC | 20:48 | |
| openstackgerrit | Sean Dague proposed openstack/keystone-specs master: WIP: block diag quota scenarios https://review.openstack.org/441203 | 20:56 |
| *** jamielennox|away is now known as jamielennox | 21:00 | |
| *** raildo has quit IRC | 21:01 | |
| *** lucasxu has joined #openstack-keystone | 21:06 | |
| *** pcaruana has quit IRC | 21:13 | |
| -openstackstatus- NOTICE: restarting gerrit to address performance problems | 21:16 | |
| eandersson | btw talking about memcached - how does sharding work? e.g. if you have two memcached instances, and one dies, will the other one naturally take over? | 21:17 |
| *** adriant has joined #openstack-keystone | 21:21 | |
| notmorgan | eandersson: that really depends on the dogpile backend and the library it is based upon | 21:35 |
| *** adriant has quit IRC | 21:41 | |
| *** catintheroof has quit IRC | 21:44 | |
| *** catintheroof has joined #openstack-keystone | 21:45 | |
| *** catintheroof has quit IRC | 21:49 | |
| notmorgan | lbragstad: our functional tests are horked: 2017-03-06 20:20:21.028667 | sudo: .tox/all-plugin/bin/testr: command not found | 21:58 |
| lbragstad | ugh | 21:59 |
| lbragstad | i wonder what happened there | 21:59 |
| openstackgerrit | Sujitha proposed openstack/oslo.policy master: Allow multiline descriptions for RuleDefaults https://review.openstack.org/441342 | 21:59 |
| notmorgan | http://logs.openstack.org/01/438701/10/check/gate-keystone-dsvm-functional-ubuntu-xenial/880aea8/console.html is where i saw it first. | 21:59 |
| notmorgan | this is the hash fix thing, looks like something isn't installing testr in the right place? | 21:59 |
| notmorgan | or now it's looking in the wrong place for it? | 22:00 |
| *** lamt has quit IRC | 22:00 | |
| *** jaugustine has quit IRC | 22:01 | |
| *** thorst has quit IRC | 22:04 | |
| *** thorst has joined #openstack-keystone | 22:05 | |
| *** spilla has quit IRC | 22:07 | |
| openstackgerrit | Gage Hugo proposed openstack/python-keystoneclient master: Remove pbr warnerrors in favor of sphinx check https://review.openstack.org/441468 | 22:08 |
| *** thorst has quit IRC | 22:09 | |
| *** edmondsw has quit IRC | 22:12 | |
| *** edmondsw has joined #openstack-keystone | 22:13 | |
| *** ravelar has quit IRC | 22:14 | |
| *** dave-mccowan has quit IRC | 22:17 | |
| *** edmondsw has quit IRC | 22:17 | |
| *** lamt has joined #openstack-keystone | 22:20 | |
| *** adriant has joined #openstack-keystone | 22:22 | |
| *** chris_hultin is now known as chris_hultin|AWA | 22:28 | |
| *** lucasxu has quit IRC | 22:28 | |
| *** lamt has quit IRC | 22:40 | |
| *** ravelar has joined #openstack-keystone | 22:45 | |
| *** lamt has joined #openstack-keystone | 22:49 | |
| *** ravelar has quit IRC | 22:50 | |
| oomichi | rodrigods: hi, can I ask a question about used keystone APIs on the other core-projects? | 22:54 |
| openstackgerrit | Sujitha proposed openstack/oslo.policy master: Allow multiline descriptions for RuleDefaults https://review.openstack.org/441342 | 23:03 |
| *** ngupta has quit IRC | 23:06 | |
| *** ngupta has joined #openstack-keystone | 23:06 | |
| *** pramodrj07 has joined #openstack-keystone | 23:07 | |
| openstackgerrit | Gage Hugo proposed openstack/keystone-specs master: Remove pbr warnerrors in favor of sphinx check https://review.openstack.org/439914 | 23:10 |
| *** ngupta has quit IRC | 23:10 | |
| *** lamt has quit IRC | 23:11 | |
| rodrigods | oomichi, sure! go ahead :) | 23:11 |
| oomichi | rodrigods: thanks :) I'd like to know the used keystone API versions by the other core-projects for https://etherpad.openstack.org/p/tempest-api-versions-in-pike line 37-41 | 23:12 |
| oomichi | rodrigods: I don't know which API version is used on authentication of token on the other projects | 23:13 |
| rodrigods | oomichi, that's a good question | 23:13 |
| oomichi | rodrigods: is that v2 or v3 or configurable? | 23:13 |
| rodrigods | has been a while that we are pushing the usage of v3 and the support status should be documented somewhere | 23:13 |
| rodrigods | let me try to find | 23:13 |
| notmorgan | everythihing at this point should be able to use v3 (at least the "core" projects) | 23:14 |
| rodrigods | oomichi, should be any of them, although there was known some projects that had issues with v3 | 23:14 |
| notmorgan | as long as you configure v3 | 23:14 |
| rodrigods | and the usage of v2.0 and v3 should be configurable | 23:14 |
| notmorgan | in other words, don't configure them to use v2 if at all avoidable, and if it breaks it is a bug and needs to be filed asap | 23:14 |
| rodrigods | oomichi, what notmorgan said ^ :) | 23:14 |
| notmorgan | v2.0 is deprecated (a while now) and v2.0 auth is also deprecated with a pike+4 removal plan | 23:15 |
| notmorgan | v2.0 crud earlier removal | 23:15 |
| oomichi | rodrigods: notmorgan: Thanks, that is good plan :) We will change auth_version to v3 on tempest side: https://review.openstack.org/#/c/441531/ | 23:16 |
| rodrigods | thanks oomichi | 23:17 |
| notmorgan | :) | 23:17 |
| oomichi | rodrigods: notmorgan: which config file we can config it on the other projects ? | 23:17 |
| notmorgan | depends on the project | 23:17 |
| oomichi | I guess it would be on some middleware | 23:17 |
| notmorgan | most of them need it to be set in the keystone_authtoken section and some projects need it elsewhere too | 23:18 |
| notmorgan | (i think nova and neutron specificlaly need it elsewhere in nova/neutron.conf) | 23:18 |
| notmorgan | most of the time it goes in the keystone_authtoken section, and afaik that has all been v3-ified in devstack | 23:18 |
| *** rcernin has quit IRC | 23:19 | |
| oomichi | notmorgan: Thanks for the info, I will dig it on the keystone_authtoken section :) | 23:22 |
| *** gyee has joined #openstack-keystone | 23:46 | |
| openstackgerrit | Merged openstack/keystone master: Updated from global requirements https://review.openstack.org/439219 | 23:57 |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!