| *** ayoung has quit IRC | 00:02 | |
| *** ngupta has quit IRC | 00:09 | |
| *** ngupta has joined #openstack-keystone | 00:10 | |
| *** ngupta has quit IRC | 00:14 | |
| *** markvoelker has quit IRC | 00:15 | |
| *** jose-phillips has quit IRC | 00:17 | |
| *** lamt has quit IRC | 00:19 | |
| *** guoshan has quit IRC | 00:20 | |
| *** jose-phillips has joined #openstack-keystone | 00:29 | |
| *** catintheroof has quit IRC | 00:29 | |
| *** catintheroof has joined #openstack-keystone | 00:30 | |
| *** catintheroof has quit IRC | 00:30 | |
| *** jamielennox is now known as jamielennox|away | 00:36 | |
| *** ravelar1 has joined #openstack-keystone | 00:36 | |
| *** jamielennox|away is now known as jamielennox | 00:37 | |
| *** ravelar1 has quit IRC | 00:41 | |
| *** catintheroof has joined #openstack-keystone | 00:42 | |
| *** jose-phillips has quit IRC | 00:44 | |
| *** adrian_otto has joined #openstack-keystone | 00:46 | |
| *** jose-phillips has joined #openstack-keystone | 00:53 | |
| *** thorst has joined #openstack-keystone | 00:53 | |
| *** jose-phillips has quit IRC | 00:53 | |
| *** jose-phillips has joined #openstack-keystone | 00:54 | |
| *** zhurong has joined #openstack-keystone | 00:56 | |
| *** ayoung has joined #openstack-keystone | 00:57 | |
| *** tovin07 has joined #openstack-keystone | 00:58 | |
| *** browne has quit IRC | 01:10 | |
| *** markvoelker has joined #openstack-keystone | 01:15 | |
| *** liujiong has joined #openstack-keystone | 01:16 | |
| *** ravelar1 has joined #openstack-keystone | 01:18 | |
| *** markvoelker has quit IRC | 01:20 | |
| *** ravelar1 has quit IRC | 01:22 | |
| *** MasterOfBugs has quit IRC | 01:31 | |
| *** chris_hultin is now known as chris_hultin|AWA | 01:34 | |
| *** frontrunner has joined #openstack-keystone | 01:43 | |
| *** adrian_otto has quit IRC | 01:44 | |
| *** thorst has quit IRC | 01:45 | |
| *** ravelar1 has joined #openstack-keystone | 01:59 | |
| *** ravelar1 has quit IRC | 02:03 | |
| *** browne has joined #openstack-keystone | 02:08 | |
| *** markvoelker has joined #openstack-keystone | 02:17 | |
| *** adrian_otto has joined #openstack-keystone | 02:21 | |
| *** agrebennikov has quit IRC | 02:21 | |
| *** markvoelker has quit IRC | 02:23 | |
| *** rderose has quit IRC | 02:28 | |
| *** adrian_otto has quit IRC | 02:29 | |
| *** browne has quit IRC | 02:50 | |
| *** ravelar1 has joined #openstack-keystone | 03:00 | |
| *** ravelar1 has quit IRC | 03:04 | |
| *** asettle has quit IRC | 03:07 | |
| *** frontrunner has quit IRC | 03:09 | |
| *** adrian_otto has joined #openstack-keystone | 03:10 | |
| *** lucasxu has joined #openstack-keystone | 03:10 | |
| *** thorst has joined #openstack-keystone | 03:13 | |
| *** wangqun has joined #openstack-keystone | 03:16 | |
| *** wangqun has quit IRC | 03:17 | |
| *** thorst has quit IRC | 03:18 | |
| *** wangqun has joined #openstack-keystone | 03:18 | |
| *** lucasxu has quit IRC | 03:31 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/ldappool master: Updated from global requirements https://review.openstack.org/431968 | 03:31 |
|---|---|---|
| *** links has joined #openstack-keystone | 03:38 | |
| *** lucasxu has joined #openstack-keystone | 03:40 | |
| *** adrian_otto has quit IRC | 03:40 | |
| *** adrian_otto has joined #openstack-keystone | 03:41 | |
| *** adrian_otto has quit IRC | 03:43 | |
| *** prashkre has joined #openstack-keystone | 03:44 | |
| *** ravelar has quit IRC | 03:55 | |
| *** catintheroof has quit IRC | 03:57 | |
| *** catintheroof has joined #openstack-keystone | 03:58 | |
| *** catintheroof has quit IRC | 03:59 | |
| *** ravelar1 has joined #openstack-keystone | 04:01 | |
| *** ravelar1 has quit IRC | 04:06 | |
| *** nicolasbock has quit IRC | 04:07 | |
| *** knangia has quit IRC | 04:11 | |
| *** adrian_otto has joined #openstack-keystone | 04:11 | |
| *** thorst has joined #openstack-keystone | 04:14 | |
| *** david-lyle has quit IRC | 04:16 | |
| *** thorst has quit IRC | 04:18 | |
| *** prashkre has quit IRC | 04:22 | |
| *** lucasxu has quit IRC | 04:24 | |
| *** adrian_otto1 has joined #openstack-keystone | 04:38 | |
| *** adrian_otto has quit IRC | 04:40 | |
| *** ravelar1 has joined #openstack-keystone | 04:43 | |
| *** wangqun has quit IRC | 04:45 | |
| *** wangqun has joined #openstack-keystone | 04:46 | |
| *** ravelar1 has quit IRC | 04:47 | |
| *** adrian_otto1 has quit IRC | 04:57 | |
| *** thorst has joined #openstack-keystone | 05:15 | |
| *** thorst has quit IRC | 05:19 | |
| *** adriant has quit IRC | 05:41 | |
| *** richm has quit IRC | 05:43 | |
| *** prashkre has joined #openstack-keystone | 06:04 | |
| *** jaosorior has joined #openstack-keystone | 06:09 | |
| *** aojea has joined #openstack-keystone | 06:12 | |
| *** Shunli has joined #openstack-keystone | 06:12 | |
| *** markvoelker has joined #openstack-keystone | 06:21 | |
| *** markvoelker has quit IRC | 06:25 | |
| *** rcernin has joined #openstack-keystone | 06:35 | |
| *** markvoelker has joined #openstack-keystone | 06:44 | |
| *** aojea has quit IRC | 06:49 | |
| *** markvoelker has quit IRC | 06:54 | |
| *** thorst has joined #openstack-keystone | 07:16 | |
| *** aojea has joined #openstack-keystone | 07:20 | |
| *** thorst has quit IRC | 07:21 | |
| *** xek has quit IRC | 07:37 | |
| *** edmondsw has joined #openstack-keystone | 07:39 | |
| *** tesseract has joined #openstack-keystone | 07:42 | |
| *** edmondsw has quit IRC | 07:44 | |
| *** aojea has quit IRC | 07:47 | |
| *** pnavarro has quit IRC | 07:47 | |
| *** aojea has joined #openstack-keystone | 07:53 | |
| *** prashkre has quit IRC | 07:57 | |
| *** h5t4_ has joined #openstack-keystone | 08:12 | |
| *** aojea has quit IRC | 08:14 | |
| *** aojea has joined #openstack-keystone | 08:15 | |
| *** prashkre has joined #openstack-keystone | 08:17 | |
| *** thorst has joined #openstack-keystone | 08:17 | |
| *** aojea has quit IRC | 08:19 | |
| *** thorst has quit IRC | 08:22 | |
| openstackgerrit | Merged openstack/ldappool master: Updated from global requirements https://review.openstack.org/431968 | 08:26 |
| *** jaosorior is now known as jaosorior_breakf | 08:33 | |
| *** prashkre has quit IRC | 08:39 | |
| *** jaosorior_breakf is now known as jaosorior | 08:48 | |
| *** zzzeek has quit IRC | 09:00 | |
| *** zzzeek has joined #openstack-keystone | 09:00 | |
| *** pnavarro has joined #openstack-keystone | 09:08 | |
| *** thorst has joined #openstack-keystone | 09:18 | |
| *** thorst has quit IRC | 09:23 | |
| *** henrynash has joined #openstack-keystone | 09:27 | |
| *** Shunli has quit IRC | 09:27 | |
| *** henrynash has quit IRC | 09:27 | |
| *** henrynash has joined #openstack-keystone | 09:32 | |
| *** aasthad has quit IRC | 09:42 | |
| *** rdo has quit IRC | 09:46 | |
| *** rdo has joined #openstack-keystone | 09:48 | |
| *** prashkre has joined #openstack-keystone | 09:51 | |
| *** rdo has quit IRC | 09:56 | |
| *** wangqun has quit IRC | 09:58 | |
| *** rdo has joined #openstack-keystone | 09:58 | |
| *** asettle has joined #openstack-keystone | 10:03 | |
| *** edmondsw has joined #openstack-keystone | 10:04 | |
| *** aloga_ has joined #openstack-keystone | 10:06 | |
| *** aojea has joined #openstack-keystone | 10:08 | |
| *** edmondsw has quit IRC | 10:09 | |
| *** zhurong has quit IRC | 10:10 | |
| *** henrynash has quit IRC | 10:13 | |
| *** richm has joined #openstack-keystone | 10:14 | |
| *** thorst has joined #openstack-keystone | 10:19 | |
| *** liujiong has quit IRC | 10:23 | |
| *** thorst has quit IRC | 10:23 | |
| *** tovin07 has quit IRC | 10:27 | |
| *** openstackgerrit has quit IRC | 10:33 | |
| *** guoshan has joined #openstack-keystone | 10:51 | |
| *** henrynash has joined #openstack-keystone | 10:52 | |
| *** nicolasbock has joined #openstack-keystone | 11:07 | |
| *** thorst has joined #openstack-keystone | 11:20 | |
| *** thorst has quit IRC | 11:24 | |
| *** links has quit IRC | 11:37 | |
| *** tuan_ has joined #openstack-keystone | 11:41 | |
| *** abhishek_k has quit IRC | 11:48 | |
| *** henrynash has quit IRC | 11:50 | |
| tuan_ | Hi Keystone community | 11:53 |
| tuan_ | if someone online, may i have some questions related to the user cred passing | 11:53 |
| tuan_ | as i know that we do not pass the normal user cred when creating client | 11:54 |
| tuan_ | except admin | 11:54 |
| *** links has joined #openstack-keystone | 11:54 | |
| tuan_ | could some body explain to me the reasons of security in this case | 11:54 |
| tuan_ | thinks in advanced | 11:54 |
| breton | .цшт 19 | 12:01 |
| breton | :( | 12:01 |
| *** aojea has quit IRC | 12:02 | |
| *** guoshan has quit IRC | 12:04 | |
| *** raildo has joined #openstack-keystone | 12:10 | |
| *** sileht has quit IRC | 12:17 | |
| *** sileht has joined #openstack-keystone | 12:18 | |
| *** sileht has quit IRC | 12:18 | |
| *** sileht has joined #openstack-keystone | 12:18 | |
| *** catintheroof has joined #openstack-keystone | 12:34 | |
| *** thorst has joined #openstack-keystone | 12:43 | |
| *** guoshan has joined #openstack-keystone | 12:43 | |
| *** frontrunner has joined #openstack-keystone | 12:55 | |
| *** sileht has quit IRC | 13:03 | |
| *** sileht has joined #openstack-keystone | 13:03 | |
| *** sileht has quit IRC | 13:03 | |
| *** sileht has joined #openstack-keystone | 13:03 | |
| *** sileht has quit IRC | 13:08 | |
| *** sileht has joined #openstack-keystone | 13:08 | |
| *** sileht has quit IRC | 13:08 | |
| *** sileht has joined #openstack-keystone | 13:10 | |
| *** guoshan has quit IRC | 13:12 | |
| breton | https://bitbucket.org/ianb/paste/issues/20/ *sigh* | 13:13 |
| breton | has anybody used ksm with django? | 13:13 |
| *** links has quit IRC | 13:17 | |
| *** guoshan has joined #openstack-keystone | 13:20 | |
| *** edmondsw has joined #openstack-keystone | 13:23 | |
| dolphm | breton: i have not, but it will certainly work | 13:25 |
| breton | i guess it will require writing a custom django middleware that will proxy requests to ksm | 13:29 |
| *** links has joined #openstack-keystone | 13:31 | |
| *** dave-mccowan has joined #openstack-keystone | 13:32 | |
| breton | and hooking all options | 13:32 |
| *** guoshan has quit IRC | 13:33 | |
| breton | hm, what do i do -- extend django-openstack-auth or write separate thing... | 13:35 |
| *** links has quit IRC | 13:39 | |
| *** spilla has joined #openstack-keystone | 13:41 | |
| *** lamt has joined #openstack-keystone | 13:47 | |
| *** aojea has joined #openstack-keystone | 13:52 | |
| *** aloga_ has quit IRC | 13:59 | |
| *** openstackgerrit has joined #openstack-keystone | 14:16 | |
| openstackgerrit | Anthony Washington proposed openstack/oslo.policy master: oslopolicy-sample-generator description support https://review.openstack.org/443330 | 14:16 |
| *** prashkre has quit IRC | 14:16 | |
| *** tuan_ has quit IRC | 14:22 | |
| *** Dinesh_Bhor has quit IRC | 14:23 | |
| *** tuan_ has joined #openstack-keystone | 14:26 | |
| *** ravelar has joined #openstack-keystone | 14:35 | |
| dstanek | tuan_: i'm not sure i understand the question | 14:42 |
| tuan_ | dstanek: Hi, thank you for replying me | 14:43 |
| tuan_ | it is about the general security in authentication | 14:43 |
| tuan_ | it means that we do not provide the creds of normal users when requesting token from keystone | 14:44 |
| tuan_ | for example, when a user wants to use novaclient to talk to keystone | 14:45 |
| tuan_ | by some reason the token is expired | 14:45 |
| tuan_ | and he wants to refresh the token | 14:45 |
| tuan_ | without providing the his creds | 14:46 |
| tuan_ | Is it a good way to go for security problem? | 14:46 |
| *** agrebennikov has joined #openstack-keystone | 14:46 | |
| *** aojea_ has joined #openstack-keystone | 14:48 | |
| dstanek | tuan_: so you want to trade in an old token for a new one so that you don't have to present your credentials again? | 14:49 |
| tuan_ | yeap | 14:49 |
| tuan_ | since providing creds which are not admin one | 14:50 |
| tuan_ | it is a safe way | 14:50 |
| tuan_ | it is my concern that it is safe enough to provide the normal user creds when trying to trade a new token | 14:50 |
| *** aojea has quit IRC | 14:52 | |
| dolphm | are UUID tokens being rebuilt on validation now? cc- lbragstad | 14:53 |
| dstanek | tuan_: the point of expiring the token is so that it can't be used. if you want to use expired ones then why not lengthen the expiration period? | 14:55 |
| tuan_ | well, for some reasons that we just set the expiration time is 1h but some our actions take more than 1h | 14:56 |
| tuan_ | meanwhile those actions require tokens | 14:56 |
| lbragstad | dolphm yeah | 14:57 |
| dolphm | ravelar: ^ | 14:57 |
| tuan_ | i would like to ask about the security reasons that if we want to trade again token | 14:57 |
| dstanek | tuan_: so you are talking about long running operations and not the user themselves trying to get another token... | 14:57 |
| tuan_ | no, the user tries to get another token | 14:57 |
| tuan_ | but by providing her/his creds seems to be not safe? | 14:58 |
| tuan_ | this is my question | 14:58 |
| dstanek | tuan_: why would providing the credentials again not be safe? | 14:58 |
| lbragstad | dolphm ravelar it's this big ole if statement - https://github.com/openstack/keystone/blob/master/keystone/token/providers/common.py#L535-L633 | 14:59 |
| tuan_ | It is actually my question :D | 14:59 |
| dstanek | tuan_: there is also ongoing work to create a *new* thing like an API key that would last longer than a token | 14:59 |
| tuan_ | is it totally safe or not | 14:59 |
| tuan_ | dstanek: oh, really, do we have bp of it | 14:59 |
| tuan_ | is it the service token besides the user token | 15:00 |
| dstanek | tuan_: it should be if you're running over SSL. the biggest concern is that you store credentials in a file on disk, which is what API keys would avoid | 15:00 |
| *** catintheroof has quit IRC | 15:00 | |
| dstanek | tuan_: a spec is in progress. the idea came out of the last day of the PTG | 15:00 |
| *** catintheroof has joined #openstack-keystone | 15:01 | |
| *** lamt has quit IRC | 15:01 | |
| tuan_ | dstanek: So it means that with SSL, providing creds is totally safe | 15:01 |
| antwash | tuan_ : https://review.openstack.org/#/c/438761/ | 15:03 |
| tuan_ | antwash: Thank you | 15:03 |
| antwash | np :) | 15:04 |
| dstanek | tuan_: yes. if providing credentials to keystone wasn't safe then we'd be doing something wrong. the only thing that could be unsafe is the password on disk or in transit, but keystone itself can't do anything about that | 15:04 |
| *** david-lyle has joined #openstack-keystone | 15:05 | |
| tuan_ | dstanek: Yeah, i totally agree on that | 15:05 |
| tuan_ | i just want to check back since i saw a providing creds when refreshing token in congress | 15:06 |
| tuan_ | https://review.openstack.org/#/c/160063/1/congress/datasources/glancev2_driver.py | 15:06 |
| tuan_ | i doubt that this creds are not provided through API | 15:06 |
| *** lamt has joined #openstack-keystone | 15:08 | |
| *** david-lyle_ has joined #openstack-keystone | 15:08 | |
| *** david-lyle_ has quit IRC | 15:08 | |
| *** david-lyle has quit IRC | 15:08 | |
| *** lucasxu has joined #openstack-keystone | 15:09 | |
| *** jaugustine has joined #openstack-keystone | 15:10 | |
| *** lamt has quit IRC | 15:10 | |
| *** chlong_ has joined #openstack-keystone | 15:15 | |
| *** phalmos has joined #openstack-keystone | 15:18 | |
| *** lucasxu has quit IRC | 15:20 | |
| breton | why do we use service user to check user's token? | 15:23 |
| *** jaosorior has quit IRC | 15:24 | |
| *** rderose has joined #openstack-keystone | 15:24 | |
| breton | why can't we use user token to check user token? | 15:24 |
| *** rderose has quit IRC | 15:24 | |
| *** rderose has joined #openstack-keystone | 15:24 | |
| *** Jack_I has joined #openstack-keystone | 15:31 | |
| *** lucasxu has joined #openstack-keystone | 15:32 | |
| *** h5t4_ has quit IRC | 15:32 | |
| baffle | I'm trying to migrate our old keystone installation to a newer version. I'm getting a bit stuck with the token cache backend; I guess the old memcache_pool is no longer an option, but what is the alternative? Not SQL. And dogpile.cache.mysql/redis seems to only handle 1 backend? I'm so confused. Oh, and we can't switch to fernet yet. PKI. | 15:32 |
| breton | baffle: how newer is the version? PKI was removed some time ago. memcache_pool is now in oslo_cache instead of keystone. | 15:34 |
| *** rdo has quit IRC | 15:35 | |
| baffle | Old version is kilo, new is mitaka. For now. | 15:36 |
| baffle | (Nova is icehouse. Don't ask.) | 15:36 |
| *** rdo has joined #openstack-keystone | 15:36 | |
| baffle | If I understand correctly, PKI was deprecated in M, and will be removed in O. | 15:37 |
| breton | baffle: oh, memcache_pool is still still there in M | 15:37 |
| breton | baffle: PKI was already removed in O | 15:38 |
| baffle | breton: Okay. So if I just keep memache_pool in M, I can use that while I migrate everything else, so I can switch to Fernet, then I can go M->N->O and beyond. | 15:40 |
| breton | baffle: probably yes. | 15:41 |
| *** chris_hultin|AWA is now known as chris_hultin | 15:43 | |
| baffle | breton: But I an still a little confused with regards to caching of everything else in keystone that needs caching.. Does every keystone instance have their own non-shared cache? | 15:44 |
| breton | baffle: no, all keystone instances should share cache and each instance must have the same set of memcache servers. | 15:49 |
| lbragstad | ravelar you're still talking about https://bugs.launchpad.net/keystone/+bug/1511775 specifically, right? | 15:49 |
| openstack | Launchpad bug 1511775 in OpenStack Identity (keystone) "Revoking a role revokes the unscoped token for a user" [Medium,In progress] | 15:49 |
| ravelar | lbragstad right, just acknowledging dolphm's comment about the direction we can now take with your change in making uuid and fernet both built at token validation time | 15:50 |
| ravelar | its the first comment on the bug | 15:50 |
| ravelar | that's what I was referring to | 15:51 |
| dstanek | breton: baffle: same set of memcached server *and* they should be listed in the config in the same order | 15:51 |
| lbragstad | ravelar aha - | 15:51 |
| lbragstad | that makes sense | 15:51 |
| ravelar | lbragstad yes :) | 15:52 |
| lbragstad | ravelar yeah - so in order to fix that bug - it might just be a matter of not persisting a revocation event when we remove a role from a user | 15:52 |
| breton | dstanek: > *and* they should be listed in the config in the same order | 15:52 |
| breton | dstanek: oh wow, i thought we fixed that | 15:52 |
| *** chris_hultin is now known as chris_hultin|AWA | 15:52 | |
| dstanek | breton: we can't. that's how memcached works | 15:53 |
| ravelar | lbragstad at all? | 15:53 |
| breton | dstanek: well, we can. sort(list_of_servers) :p | 15:53 |
| baffle | breton: So, if I understand correctly, the only working option is oslo_cache.memcache_pool if you have multiple keystone servers? Since the dogpile.cache.* seems to not really support HA. Or you could work around it by having a redis cluster behind LB.. | 15:53 |
| lbragstad | ravelar right - i think so | 15:53 |
| lbragstad | ravelar if a user has a role on a project and they get a token scoped to that project, everything works, right? | 15:53 |
| ravelar | lbragstad but isn't the role + user_id revoked together to ensure they cant use that role for that project anymore? | 15:54 |
| lbragstad | ravelar if that role is removed from the user on that project, they shouldn't have any more valid role assignments for the scope of that token | 15:54 |
| breton | baffle: dogpile.cache.memcache should work too. memcache_pool is just a funny version of dogpile.cache.memcache, with old tweaks. | 15:54 |
| lbragstad | ravelar so when they go to validate that token - they are going to hit this piece of code | 15:54 |
| baffle | breton: So there is support for specifying multiple servers in dogpile.cache.memcache? It wasn't really obvious from any docs I saw. :) | 15:54 |
| ravelar | lbragstad but what if they have multiple roles on a project? | 15:55 |
| *** chris_hultin|AWA is now known as chris_hultin | 15:55 | |
| lbragstad | ravelar https://github.com/openstack/keystone/blob/master/keystone/token/providers/common.py#L328 | 15:55 |
| lbragstad | ravelar then we should still consider it a valid token | 15:55 |
| ravelar | lbragstad but how is that solved by not revoking a role + userid at all? | 15:55 |
| breton | baffle: i think yes | 15:55 |
| ravelar | lbragstad I am missing something | 15:55 |
| lbragstad | ravelar because it's all rebuilt at validation time ;) | 15:55 |
| ravelar | vidyo right now mister! | 15:56 |
| ravelar | lol | 15:56 |
| lbragstad | ok - meet in my room | 15:57 |
| ravelar | k | 15:57 |
| *** rcernin has quit IRC | 15:59 | |
| baffle | breton: Hmm, seems "url" can be a string, or list of strings, so I guess so. What is recommended? oslo_cache.memcache_pool or dogpile.cache.memcache? I would assume the using oslo_cache is the way forward, but memcache_pool probably has lots of magic.. | 15:59 |
| baffle | Errr. dogpile.cache way forward I mean. | 16:00 |
| *** jaybeers has joined #openstack-keystone | 16:02 | |
| breton | baffle: i can recommend you only oslo_cache.memcache_pool, because we used it in Mirantis OpenStack, it worked fine and we didn't try anything else. But most of folks here use dogpile.cache.memcache. | 16:03 |
| breton | sorry, got to go | 16:04 |
| baffle | breton: Thanks! :) | 16:09 |
| *** nishaYadav has joined #openstack-keystone | 16:16 | |
| * nishaYadav waves hello o/ | 16:17 | |
| *** chlong_ has quit IRC | 16:19 | |
| *** nishaYadav_ has joined #openstack-keystone | 16:24 | |
| *** nishaYadav has quit IRC | 16:24 | |
| *** thorst is now known as thorst_afk | 16:27 | |
| openstackgerrit | Kristi Nikolla proposed openstack/keystone master: Remove keystone.common.ldap https://review.openstack.org/438209 | 16:27 |
| *** henrynash has joined #openstack-keystone | 16:28 | |
| *** pnavarro has quit IRC | 16:28 | |
| knikolla | o/ | 16:28 |
| *** henrynash has quit IRC | 16:29 | |
| *** jaosorior has joined #openstack-keystone | 16:34 | |
| gagehugo | knikolla: o/ | 16:41 |
| *** jaosorior has quit IRC | 16:42 | |
| *** dims_ has quit IRC | 16:45 | |
| openstackgerrit | Kristi Nikolla proposed openstack/keystone master: Remove keystone.common.ldap https://review.openstack.org/438209 | 16:47 |
| knikolla | rodrigods: i would appreciate some help on debugging the failures in https://review.openstack.org/#/c/441469/ | 16:49 |
| knikolla | they seem to be non-deterministic. I ran it once with 2 failures, recheck showed 14 failures. | 16:49 |
| knikolla | so probably a side effect of something | 16:50 |
| knikolla | ayoung: ^^ if you have some spare time too | 16:50 |
| *** prashkre has joined #openstack-keystone | 16:53 | |
| *** henrynash has joined #openstack-keystone | 16:54 | |
| *** lucasxu has quit IRC | 16:56 | |
| *** lucasxu has joined #openstack-keystone | 16:58 | |
| *** h5t4 has joined #openstack-keystone | 16:59 | |
| *** knangia has joined #openstack-keystone | 17:00 | |
| *** lucasxu has quit IRC | 17:02 | |
| *** aojea_ has quit IRC | 17:05 | |
| *** catintheroof has quit IRC | 17:07 | |
| *** catintheroof has joined #openstack-keystone | 17:08 | |
| *** aasthad has joined #openstack-keystone | 17:09 | |
| samueldmq | lbragstad: o/ | 17:17 |
| samueldmq | hi keystoners ! | 17:17 |
| ravelar | hiiii | 17:19 |
| lbragstad | ravelar https://bugs.launchpad.net/keystone/+bug/1671887 | 17:20 |
| openstack | Launchpad bug 1671887 in OpenStack Identity (keystone) "Revocation API is used in places where where it doesn't need to be" [Undecided,New] | 17:20 |
| *** nishaYadav has joined #openstack-keystone | 17:21 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Don't persist revocation events when deleting a role https://review.openstack.org/444424 | 17:21 |
| *** nishaYadav_ has quit IRC | 17:22 | |
| *** browne has joined #openstack-keystone | 17:24 | |
| *** david-lyle has joined #openstack-keystone | 17:28 | |
| *** lucasxu has joined #openstack-keystone | 17:29 | |
| *** jaugustine has quit IRC | 17:29 | |
| *** Jack_I has quit IRC | 17:30 | |
| *** lamt has joined #openstack-keystone | 17:37 | |
| notmorgan | lbragstad: i just had athought on validation of tokens after role is deleted | 17:39 |
| notmorgan | re ^ | 17:39 |
| lbragstad | notmorgan yeah? | 17:40 |
| lbragstad | cc ravelar ^ | 17:40 |
| notmorgan | lbragstad: you might need to make sure the token cannot validate if there at no roles | 17:40 |
| notmorgan | in the case that the only role is removed | 17:40 |
| notmorgan | some services may rely on no role == invalid token | 17:41 |
| notmorgan | not sure how a token validation will work with no roles if it is just reconstructing the token | 17:41 |
| *** nishaYadav_ has joined #openstack-keystone | 17:41 | |
| ravelar | lbragstad thats a 404 error right? | 17:42 |
| ravelar | or 401, cant remember | 17:42 |
| notmorgan | 404 | 17:43 |
| notmorgan | since it is a token validation | 17:43 |
| notmorgan | not new token issuance | 17:43 |
| notmorgan | or totally missing a token. | 17:43 |
| ravelar | ah right :) | 17:44 |
| *** nishaYadav has quit IRC | 17:46 | |
| notmorgan | ravelar: for all i know that is how it already workds | 17:46 |
| notmorgan | but i'd like to see a test for that case with the code ^ | 17:47 |
| notmorgan | just so we can be sure | 17:47 |
| *** ravelar has quit IRC | 17:51 | |
| notmorgan | mordred: if a project has setup requires pbr>=2.0 and requiremends <2.0... this seems like a generally bad idea. | 17:51 |
| mordred | notmorgan: yes | 17:51 |
| notmorgan | mordred: it seems to be ok, but the proposal bot for ksa just proposed <2.0 in requirements.txt | 17:51 |
| mordred | really? | 17:51 |
| notmorgan | yep | 17:51 |
| notmorgan | https://review.openstack.org/#/c/443809/1 | 17:52 |
| notmorgan | slapped a -2 on that for the moment. | 17:52 |
| mordred | notmorgan: that's the stable/ocata branch | 17:52 |
| notmorgan | oh | 17:52 |
| notmorgan | ok | 17:52 |
| notmorgan | i can' read | 17:52 |
| mordred | I was _really_ concerned :) | 17:53 |
| notmorgan | yes, as was I. | 17:53 |
| lbragstad | notmorgan if someone authenticates for a token, then all role assignments for that user are removed from that project, the token is considered invalid | 17:53 |
| notmorgan | lbragstad: if the user has no roles, they cannot auth with that scope | 17:53 |
| notmorgan | so validation of that token must fail | 17:53 |
| lbragstad | right | 17:53 |
| lbragstad | which it does | 17:53 |
| notmorgan | we just need to make sure since we are nolonger persisting a rev event | 17:53 |
| notmorgan | that we test that case | 17:53 |
| notmorgan | issue a token, then remove the roles, then validate the token fails | 17:54 |
| rodrigods | knikolla, maybe next week a have some time to help debug | 17:54 |
| *** ravelar has joined #openstack-keystone | 17:54 | |
| ravelar | notmorgan: you're right | 17:54 |
| ravelar | that is | 17:54 |
| notmorgan | previously we were 100% covered because rev event occured | 17:54 |
| notmorgan | i want to have a test to be sure we maintain the functionality and don't regress | 17:55 |
| lbragstad | right - and now we're covered because we rebuild everything at validation time | 17:55 |
| lbragstad | we have tests for this - i'll have to go dig them up | 17:55 |
| notmorgan | we have a test for this exact case? where a previously valid token is being re-validated when all roles are removed? | 17:56 |
| notmorgan | just making sure we do | 17:56 |
| ravelar | I will look into this. brb stepping away to get a bite | 17:57 |
| lbragstad | same here | 17:57 |
| *** tuan_ has quit IRC | 17:58 | |
| *** henrynash has quit IRC | 17:59 | |
| *** ravelar has quit IRC | 18:02 | |
| *** nishaYadav_ has quit IRC | 18:06 | |
| *** lucasxu has quit IRC | 18:08 | |
| *** nicodemus_ has joined #openstack-keystone | 18:11 | |
| *** ravelar has joined #openstack-keystone | 18:11 | |
| *** lucasxu has joined #openstack-keystone | 18:15 | |
| *** jaugustine has joined #openstack-keystone | 18:32 | |
| nicodemus_ | Hello | 18:32 |
| nicodemus_ | I'm trying to enable CORS on keystone, in order to use a grafana plugin for Gnocchi. Is the "allowed_origin" the only needed parameter for CORS to work? (I'm following the steps from https://docs.openstack.org/developer/gnocchi/grafana.html but grafana insists that Keystone doesn't have CORS properly configured) | 18:34 |
| *** Jack_I has joined #openstack-keystone | 18:40 | |
| *** henrynash has joined #openstack-keystone | 18:43 | |
| *** Jack_V has joined #openstack-keystone | 18:43 | |
| lbragstad | i think our requirements are broken for keystone | 18:44 |
| *** Jack_I has quit IRC | 18:46 | |
| *** henrynash has quit IRC | 18:46 | |
| *** henrynash has joined #openstack-keystone | 18:47 | |
| *** henrynash has quit IRC | 18:47 | |
| *** henrynash has joined #openstack-keystone | 18:48 | |
| lbragstad | installing keystone in a venv using the latest master results in http://cdn.pasteraw.com/m04prdfs9vfwl1fqrzmgasz66oifm0l | 18:48 |
| *** henrynash has quit IRC | 18:50 | |
| *** Jack_I has joined #openstack-keystone | 18:52 | |
| *** Jack_V has quit IRC | 18:54 | |
| *** MasterOfBugs has joined #openstack-keystone | 19:06 | |
| lbragstad | sigmavirus do you know why we seem to not allow requests 2.13.0? | 19:09 |
| lbragstad | and by we I mean openstack requirements? | 19:09 |
| *** aojea has joined #openstack-keystone | 19:11 | |
| *** henrynash has joined #openstack-keystone | 19:31 | |
| openstackgerrit | Merged openstack/keystone master: Remove keystone.common.ldap https://review.openstack.org/438209 | 19:41 |
| *** chlong_ has joined #openstack-keystone | 19:42 | |
| *** henrynash has quit IRC | 19:43 | |
| *** dims has joined #openstack-keystone | 19:49 | |
| *** pnavarro has joined #openstack-keystone | 19:56 | |
| *** h5t4 has quit IRC | 20:01 | |
| *** prashkre has quit IRC | 20:02 | |
| *** h5t4_ has joined #openstack-keystone | 20:03 | |
| dstanek | lbragstad: http://git.openstack.org/cgit/openstack/requirements/commit/global-requirements.txt?id=08b589c5ad0f0f49d8d5880f3a703cfae43b0a39 | 20:04 |
| lbragstad | dstanek hmm - that's seems to break with keystone | 20:05 |
| *** h5t4_ has quit IRC | 20:08 | |
| *** aojea has quit IRC | 20:08 | |
| *** aojea has joined #openstack-keystone | 20:09 | |
| *** h5t4 has joined #openstack-keystone | 20:10 | |
| *** aojea has quit IRC | 20:13 | |
| *** markvoelker has joined #openstack-keystone | 20:22 | |
| *** shewless has quit IRC | 20:25 | |
| *** raildo has quit IRC | 20:29 | |
| openstackgerrit | Richard Avelar proposed openstack/keystone master: Add group_members_are_ids to whitelisted options https://review.openstack.org/442048 | 20:35 |
| *** h5t4 has quit IRC | 20:42 | |
| *** jose-phillips has quit IRC | 20:43 | |
| *** phalmos has quit IRC | 20:44 | |
| *** jose-phillips has joined #openstack-keystone | 20:46 | |
| *** pnavarro has quit IRC | 20:48 | |
| *** lucasxu has quit IRC | 20:57 | |
| *** lucasxu has joined #openstack-keystone | 20:57 | |
| *** henrynash has joined #openstack-keystone | 21:02 | |
| *** henrynash has quit IRC | 21:05 | |
| *** thorst_afk has quit IRC | 21:26 | |
| openstackgerrit | Richard Avelar proposed openstack/keystone master: Validate rolling upgrade is run in order https://review.openstack.org/437441 | 21:28 |
| openstackgerrit | Richard Avelar proposed openstack/keystone master: Validate rolling upgrade is run in order https://review.openstack.org/437441 | 21:30 |
| dstanek | lbragstad: i'm building a new env now...hoping i don't have that issue | 21:31 |
| lbragstad | dstanek let me know if you run into it | 21:31 |
| lbragstad | we'll have to fix our requirements if so | 21:31 |
| openstackgerrit | Richard Avelar proposed openstack/keystone master: Validate rolling upgrade is run in order https://review.openstack.org/437441 | 21:32 |
| *** jose-phillips has quit IRC | 21:39 | |
| samueldmq | lbragstad: dstanek: having fun here ? | 21:43 |
| *** thorst_afk has joined #openstack-keystone | 21:44 | |
| *** henrynash has joined #openstack-keystone | 21:44 | |
| *** henrynash has quit IRC | 21:46 | |
| lbragstad | samueldmq you knowit | 21:48 |
| *** jose-phillips has joined #openstack-keystone | 21:49 | |
| *** frontrunner has quit IRC | 21:50 | |
| notmorgan | ftr: keysone v3 catalog backend is abysmal | 21:51 |
| notmorgan | as is the api to create/manage endpoints | 21:52 |
| notmorgan | it's stupid in how it creates new endpoints for every single interface | 21:52 |
| *** lucasxu has quit IRC | 21:52 | |
| notmorgan | v2 catalog was in fact superior in almost every way | 21:52 |
| notmorgan | this i think is one of the very few places i think v2 did things far far more correctly | 21:52 |
| *** lucasxu has joined #openstack-keystone | 21:52 | |
| *** aojea has joined #openstack-keystone | 21:53 | |
| openstackgerrit | Richard Avelar proposed openstack/keystone master: Validate rolling upgrade is run in order https://review.openstack.org/437441 | 21:55 |
| *** dave-mccowan has quit IRC | 21:57 | |
| samueldmq | lbragstad: need a hand with it ? | 21:59 |
| lbragstad | samueldmq the requests requirements? | 21:59 |
| samueldmq | lbragstad: yeah | 22:00 |
| samueldmq | lbragstad: want me to create a new env and test it ? | 22:00 |
| lbragstad | samueldmq sure! | 22:00 |
| lbragstad | samueldmq i've been able to consistently recreate it | 22:00 |
| *** spilla has quit IRC | 22:00 | |
| samueldmq | lbragstad: trying it. how do you do it ? just pip install keystone/ (from the local master version) | 22:02 |
| samueldmq | lbragstad: then "keystone-wsgi-admin -p 35357" in python ? | 22:02 |
| lbragstad | i created a new virtualenv and installed using `pip install -e .` | 22:02 |
| lbragstad | yep | 22:02 |
| samueldmq | lbragstad: it's working for me http://paste.openstack.org/show/602319/ | 22:05 |
| samueldmq | wait, testing again, I didn't 'git pull' :-) | 22:06 |
| dstanek | lbragstad: better now, but for a few minutes i was getting 500 errors trying to talk to rackspace identity | 22:07 |
| samueldmq | dstanek: phew! | 22:08 |
| dstanek | need to grab some dinner. be back in a bit | 22:11 |
| *** Jack_I has quit IRC | 22:14 | |
| *** jdennis1 has joined #openstack-keystone | 22:17 | |
| *** jdennis has quit IRC | 22:17 | |
| samueldmq | worked for me on masters | 22:18 |
| samueldmq | master | 22:18 |
| *** nicodemus_ has quit IRC | 22:19 | |
| lbragstad | hmm | 22:19 |
| lbragstad | interesting - i wonder if it's just something i'm hitting locally then | 22:19 |
| *** chlong_ has quit IRC | 22:21 | |
| *** catintheroof has quit IRC | 22:23 | |
| *** knikolla has left #openstack-keystone | 22:31 | |
| *** lucasxu has quit IRC | 22:35 | |
| lbragstad | stevemar working on reproposing your stable release note changes if you're interested in reviewing them https://review.openstack.org/#/c/429143/2 | 22:47 |
| lbragstad | another stable review if anyone is interested https://review.openstack.org/#/c/429179/2 | 22:50 |
| *** jaugustine has quit IRC | 22:54 | |
| *** aojea has quit IRC | 22:57 | |
| *** aojea has joined #openstack-keystone | 22:57 | |
| *** aojea has quit IRC | 23:02 | |
| openstackgerrit | Richard Avelar proposed openstack/keystone master: Add group_members_are_ids to whitelisted options https://review.openstack.org/442048 | 23:03 |
| *** nicolasbock has quit IRC | 23:23 | |
| *** nicolasbock has joined #openstack-keystone | 23:27 | |
| *** thorst_afk has quit IRC | 23:27 | |
| *** tesseract has quit IRC | 23:29 | |
| *** MasterOfBugs has quit IRC | 23:34 | |
| *** edmondsw has quit IRC | 23:35 | |
| *** edmondsw has joined #openstack-keystone | 23:37 | |
| *** edmondsw has quit IRC | 23:42 | |
| *** chris_hultin is now known as chris_hultin|AWA | 23:49 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!