| *** aojea has joined #openstack-keystone | 00:00 | |
| *** aojea has quit IRC | 00:05 | |
| *** lamt has quit IRC | 00:06 | |
| *** lamt has joined #openstack-keystone | 00:08 | |
| *** thorst has quit IRC | 00:09 | |
| *** lamt has quit IRC | 00:10 | |
| *** lamt has joined #openstack-keystone | 00:11 | |
| *** lamt has quit IRC | 00:11 | |
| *** shuyingya has joined #openstack-keystone | 00:29 | |
| *** shuyingya has quit IRC | 00:33 | |
| *** rajpatel is now known as rajpatel_away | 00:33 | |
| *** shuyingya has joined #openstack-keystone | 00:33 | |
| *** rajpatel_away has quit IRC | 00:34 | |
| *** thorst has joined #openstack-keystone | 00:35 | |
| *** shuyingya has quit IRC | 00:38 | |
| *** zhurong has joined #openstack-keystone | 00:40 | |
| *** thorst has quit IRC | 00:46 | |
| *** adriant has joined #openstack-keystone | 00:52 | |
| *** shuyingya has joined #openstack-keystone | 01:02 | |
| *** aojea has joined #openstack-keystone | 01:02 | |
| *** shuyingya has quit IRC | 01:03 | |
| *** shuyingya has joined #openstack-keystone | 01:03 | |
| *** aojea has quit IRC | 01:06 | |
| *** stradling has joined #openstack-keystone | 01:14 | |
| *** thorst has joined #openstack-keystone | 01:17 | |
| *** liujiong has joined #openstack-keystone | 01:18 | |
| *** lucasxu has joined #openstack-keystone | 01:24 | |
| *** thorst has quit IRC | 01:24 | |
| *** MasterOfBugs has quit IRC | 01:25 | |
| *** pramodrj07 has quit IRC | 01:25 | |
| openstackgerrit | D G Lee proposed openstack/keystonemiddleware master: Remove log translations https://review.openstack.org/447841 | 01:31 |
|---|---|---|
| *** lucasxu has quit IRC | 01:38 | |
| *** lucasxu has joined #openstack-keystone | 01:39 | |
| *** rderose_ has quit IRC | 01:42 | |
| *** lucasxu has quit IRC | 01:46 | |
| *** lucasxu has joined #openstack-keystone | 01:46 | |
| *** aojea has joined #openstack-keystone | 02:03 | |
| *** stradling has quit IRC | 02:04 | |
| *** jamielennox is now known as jamielennox|away | 02:07 | |
| *** aojea has quit IRC | 02:07 | |
| *** thorst has joined #openstack-keystone | 02:21 | |
| *** lucasxu has quit IRC | 02:22 | |
| *** thorst has quit IRC | 02:41 | |
| *** chason has joined #openstack-keystone | 02:51 | |
| chason | Hi, is there anybody knows the IRC channel of "keystone-specs" ? | 02:51 |
| *** chlong has joined #openstack-keystone | 03:03 | |
| *** chlong_ has joined #openstack-keystone | 03:03 | |
| *** nicolasbock has quit IRC | 03:03 | |
| *** aojea has joined #openstack-keystone | 03:03 | |
| *** aojea has quit IRC | 03:08 | |
| *** lamt has joined #openstack-keystone | 03:14 | |
| *** jamielennox|away is now known as jamielennox | 03:23 | |
| *** lamt has quit IRC | 03:43 | |
| *** lamt has joined #openstack-keystone | 03:56 | |
| *** dave-mccowan has joined #openstack-keystone | 03:57 | |
| *** rcernin has joined #openstack-keystone | 03:59 | |
| *** rcernin is now known as rcernin|wfh|mtg | 03:59 | |
| *** links has joined #openstack-keystone | 04:03 | |
| *** aojea has joined #openstack-keystone | 04:04 | |
| *** zhurong has quit IRC | 04:06 | |
| *** lamt has quit IRC | 04:08 | |
| *** aojea has quit IRC | 04:08 | |
| *** lamt has joined #openstack-keystone | 04:09 | |
| *** dave-mccowan has quit IRC | 04:16 | |
| *** dave-mccowan has joined #openstack-keystone | 04:17 | |
| *** lamt has quit IRC | 04:19 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/python-keystoneclient master: Updated from global requirements https://review.openstack.org/455995 | 04:21 |
| *** zhurong has joined #openstack-keystone | 04:34 | |
| *** lucasxu has joined #openstack-keystone | 04:36 | |
| *** thorst has joined #openstack-keystone | 04:37 | |
| *** thorst has quit IRC | 04:42 | |
| *** lamt has joined #openstack-keystone | 04:43 | |
| chason | Hi team, I am fixing this bug : https://bugs.launchpad.net/openstack-manuals/+bug/1681950 | 04:44 |
| openstack | Launchpad bug 1681950 in openstack-manuals "Broken links in federated identity docs" [Medium,Triaged] - Assigned to Chason (chen-xing) | 04:44 |
| chason | This link http://specs.openstack.org/openstack/keystone-specs/api/v3/identity-api-v3-os-federation-ext.html is dead now. | 04:45 |
| chason | I find the content of this link here: https://github.com/openstack/keystone-specs/blob/d943f673c8811b11781e8f9558fe69b9539aea00/attic/v3/identity-api-v3-os-federation-ext.rst#register-an-identity-provider | 04:46 |
| chason | But there is no html page which is generated by this rst file.. | 04:47 |
| chason | I google the key words in this page and it just show me a txt file: http://specs.openstack.org/openstack/keystone-specs/_sources/api/v3/identity-api-v3-os-federation-ext.txt | 04:49 |
| *** dave-mccowan has quit IRC | 04:50 | |
| chason | Please tell me whether I miss something, thanks! | 04:51 |
| *** lamt has quit IRC | 04:52 | |
| *** ravelar has quit IRC | 04:52 | |
| *** lamt has joined #openstack-keystone | 04:54 | |
| *** chlong_ has quit IRC | 05:03 | |
| *** chlong has quit IRC | 05:03 | |
| *** lamt has quit IRC | 05:08 | |
| *** rcernin|wfh|mtg has quit IRC | 05:11 | |
| *** jaosorior_away is now known as jaosorior | 05:13 | |
| *** rcernin has joined #openstack-keystone | 05:20 | |
| *** MasterOfBugs has joined #openstack-keystone | 05:32 | |
| *** pramodrj07 has joined #openstack-keystone | 05:32 | |
| *** thorst has joined #openstack-keystone | 05:39 | |
| *** lucasxu has quit IRC | 05:40 | |
| *** richm has quit IRC | 05:42 | |
| *** thorst has quit IRC | 05:43 | |
| *** lamt has joined #openstack-keystone | 05:49 | |
| *** lamt has quit IRC | 05:58 | |
| *** Aqsa has joined #openstack-keystone | 06:00 | |
| *** Dinesh_Bhor has quit IRC | 06:04 | |
| *** gyee has quit IRC | 06:08 | |
| *** browne has quit IRC | 06:11 | |
| *** voelzmo has joined #openstack-keystone | 06:23 | |
| *** voelzmo has quit IRC | 06:26 | |
| *** voelzmo has joined #openstack-keystone | 06:26 | |
| *** pcaruana has joined #openstack-keystone | 06:30 | |
| *** pramodrj07 has quit IRC | 06:32 | |
| *** MasterOfBugs has quit IRC | 06:32 | |
| *** Dinesh_Bhor has joined #openstack-keystone | 06:38 | |
| *** belmoreira has joined #openstack-keystone | 06:49 | |
| *** tesseract has joined #openstack-keystone | 06:49 | |
| *** jistr has quit IRC | 06:54 | |
| *** SamYaple has quit IRC | 06:55 | |
| *** SamYaple has joined #openstack-keystone | 06:55 | |
| *** jistr has joined #openstack-keystone | 06:56 | |
| *** rcernin has quit IRC | 06:59 | |
| *** aojea has joined #openstack-keystone | 07:02 | |
| *** d0ugal has joined #openstack-keystone | 07:03 | |
| *** d0ugal has quit IRC | 07:03 | |
| *** d0ugal has joined #openstack-keystone | 07:03 | |
| *** Aurelgad1o has quit IRC | 07:09 | |
| *** Aurelgadjo has joined #openstack-keystone | 07:14 | |
| *** adriant has quit IRC | 07:15 | |
| *** rcernin has joined #openstack-keystone | 07:16 | |
| *** aojea has quit IRC | 07:16 | |
| *** aojea has joined #openstack-keystone | 07:17 | |
| *** Aurelgadjo has quit IRC | 07:19 | |
| *** brad[] has joined #openstack-keystone | 07:24 | |
| *** aojea has quit IRC | 07:25 | |
| *** rcernin has quit IRC | 07:37 | |
| *** rcernin_ has joined #openstack-keystone | 07:37 | |
| *** rcernin_ has quit IRC | 07:38 | |
| *** rcernin_ has joined #openstack-keystone | 07:38 | |
| *** thorst has joined #openstack-keystone | 07:40 | |
| *** Aurelgadjo has joined #openstack-keystone | 07:42 | |
| *** thorst has quit IRC | 07:45 | |
| *** zzzeek has quit IRC | 08:00 | |
| *** zzzeek has joined #openstack-keystone | 08:00 | |
| *** xuhaigang has quit IRC | 08:04 | |
| *** xuhaigang has joined #openstack-keystone | 08:18 | |
| *** links has quit IRC | 08:35 | |
| *** thorst has joined #openstack-keystone | 08:41 | |
| *** links has joined #openstack-keystone | 08:52 | |
| *** thorst has quit IRC | 09:00 | |
| *** links has quit IRC | 09:20 | |
| *** liujiong_lj has joined #openstack-keystone | 09:30 | |
| *** liujiong has quit IRC | 09:31 | |
| *** links has joined #openstack-keystone | 09:33 | |
| *** liujiong_lj is now known as liujiong | 09:34 | |
| *** thorst has joined #openstack-keystone | 09:57 | |
| *** thorst has quit IRC | 10:01 | |
| *** richm has joined #openstack-keystone | 10:12 | |
| *** shuyingya has quit IRC | 10:32 | |
| *** shuyingya has joined #openstack-keystone | 10:32 | |
| *** nicolasbock has joined #openstack-keystone | 10:33 | |
| *** xuhaigang has quit IRC | 10:38 | |
| *** xuhaigang has joined #openstack-keystone | 10:38 | |
| *** shuyingy_ has joined #openstack-keystone | 10:40 | |
| *** shuyingya has quit IRC | 10:44 | |
| *** liujiong has quit IRC | 10:56 | |
| *** davechen has quit IRC | 11:09 | |
| *** raildo has joined #openstack-keystone | 11:11 | |
| *** zhurong has quit IRC | 11:26 | |
| *** mvk has quit IRC | 11:31 | |
| *** thorst has joined #openstack-keystone | 11:41 | |
| *** chlong_ has joined #openstack-keystone | 11:52 | |
| *** chlong has joined #openstack-keystone | 11:52 | |
| *** chlong_ has quit IRC | 11:54 | |
| *** mvk has joined #openstack-keystone | 12:03 | |
| dstanek | chason: this is the right place for that question | 12:03 |
| *** Aqsa has quit IRC | 12:07 | |
| dstanek | chason: i commented on the bug | 12:11 |
| *** edmondsw has joined #openstack-keystone | 12:13 | |
| *** Aqsa has joined #openstack-keystone | 12:21 | |
| *** xuhaigang has quit IRC | 12:25 | |
| *** shuyingy_ has quit IRC | 12:26 | |
| *** shuyingya has joined #openstack-keystone | 12:27 | |
| *** shuyingy_ has joined #openstack-keystone | 12:30 | |
| *** shuyingya has quit IRC | 12:33 | |
| rodrigods | dstanek, hey, any new thoughts about https://review.openstack.org/#/c/445505/ ? | 12:35 |
| *** markvoelker has joined #openstack-keystone | 12:37 | |
| dstanek | rodrigods: just that we shouldn't be dropping foreign keys | 12:38 |
| rodrigods | dstanek, heh did you send the email about this already? | 12:39 |
| rodrigods | could not find it in my filters | 12:39 |
| *** Tahvok has quit IRC | 12:39 | |
| *** shuyingy_ has quit IRC | 12:41 | |
| *** stradling has joined #openstack-keystone | 12:45 | |
| *** lamt has joined #openstack-keystone | 12:47 | |
| *** lamt has quit IRC | 12:48 | |
| *** dougshelley66 has left #openstack-keystone | 12:50 | |
| dstanek | rodrigods: uggg....no. i started drafting one, but got busy. since my meeting this morning was cancelled i'll go ahead an finish now | 12:51 |
| rodrigods | dstanek, i know the feeling | 12:51 |
| rodrigods | thanks | 12:52 |
| rodrigods | dstanek, i only bother because we have a backport for it: https://review.openstack.org/#/c/420893/ | 12:52 |
| rodrigods | (the version which doesn't drop the fks) | 12:52 |
| rodrigods | lbragstad, hey, i'm going to finally write some docs about our functional tests | 12:54 |
| rodrigods | lbragstad, https://docs.openstack.org/developer/keystone/devref/development_best_practices.html#testing-keystone is the correct place, right? | 12:55 |
| *** rmascena has joined #openstack-keystone | 12:57 | |
| *** lamt has joined #openstack-keystone | 12:57 | |
| *** rmascena has quit IRC | 12:57 | |
| *** rmascena has joined #openstack-keystone | 12:58 | |
| dstanek | rodrigods: that's probably a good place to start. we can always move them out later if it gets big enough\ | 12:58 |
| *** raildo has quit IRC | 12:59 | |
| rodrigods | dstanek, ++ | 12:59 |
| *** Tahvok has joined #openstack-keystone | 13:02 | |
| *** lamt has quit IRC | 13:07 | |
| *** aojea has joined #openstack-keystone | 13:12 | |
| *** Tahvok has quit IRC | 13:13 | |
| *** Tahvok has joined #openstack-keystone | 13:15 | |
| *** lamt has joined #openstack-keystone | 13:16 | |
| *** rocky_ has joined #openstack-keystone | 13:16 | |
| *** links has quit IRC | 13:17 | |
| *** erlon has joined #openstack-keystone | 13:22 | |
| dstanek | rodrigods: samueldmq: commented on that review about .idea | 13:23 |
| *** catintheroof has joined #openstack-keystone | 13:27 | |
| lbragstad | rodrigods yeah - that'd be a good place for them, thanks :) | 13:28 |
| *** markvoelker has quit IRC | 13:37 | |
| *** markvoelker has joined #openstack-keystone | 13:40 | |
| *** zhurong has joined #openstack-keystone | 13:47 | |
| *** lamt has quit IRC | 13:49 | |
| *** rajpatel has joined #openstack-keystone | 13:52 | |
| *** lamt has joined #openstack-keystone | 13:53 | |
| *** Tahvok has quit IRC | 13:54 | |
| *** Tahvok has joined #openstack-keystone | 13:56 | |
| *** shuyingya has joined #openstack-keystone | 13:56 | |
| *** Tahvok has quit IRC | 13:56 | |
| *** Tahvok has joined #openstack-keystone | 13:57 | |
| *** aojea has quit IRC | 13:58 | |
| *** zhurong_ has joined #openstack-keystone | 14:00 | |
| *** zhurong has quit IRC | 14:01 | |
| *** aojea has joined #openstack-keystone | 14:01 | |
| *** aojea has quit IRC | 14:01 | |
| *** rajpatel has quit IRC | 14:06 | |
| *** browne has joined #openstack-keystone | 14:08 | |
| *** browne has quit IRC | 14:08 | |
| *** lucasxu has joined #openstack-keystone | 14:10 | |
| *** richm has quit IRC | 14:11 | |
| *** rocky_ has quit IRC | 14:11 | |
| *** david-lyle has quit IRC | 14:15 | |
| *** aojea has joined #openstack-keystone | 14:16 | |
| *** aojea has quit IRC | 14:16 | |
| *** aojea has joined #openstack-keystone | 14:20 | |
| *** lamt has quit IRC | 14:21 | |
| *** aojea has quit IRC | 14:23 | |
| *** aojea has joined #openstack-keystone | 14:27 | |
| *** links has joined #openstack-keystone | 14:33 | |
| *** chris_hultin|AWA is now known as chris_hultin | 14:34 | |
| *** shuyingya has quit IRC | 14:34 | |
| *** shuyingya has joined #openstack-keystone | 14:34 | |
| *** links has quit IRC | 14:36 | |
| *** lamt has joined #openstack-keystone | 14:42 | |
| samueldmq | good morning keystone! | 14:43 |
| gagehugo | o/ | 14:43 |
| samueldmq | gagehugo: o/ | 14:43 |
| samueldmq | dstanek: thanks sir! | 14:43 |
| dstanek | samueldmq: np.... i'm glad you mentioned me on that review. i really dislike personal things in the ignore file | 14:45 |
| *** rajpatel has joined #openstack-keystone | 14:46 | |
| *** chris_hultin is now known as chris_hultin|AWA | 14:47 | |
| samueldmq | dstanek: nice, I was sure you would have a good view on that one! :) | 14:47 |
| *** AmazT has joined #openstack-keystone | 14:49 | |
| *** rajpatel_ has joined #openstack-keystone | 14:49 | |
| *** rajpatel_ has quit IRC | 14:50 | |
| *** rajpatel_ has joined #openstack-keystone | 14:51 | |
| *** rajpatel has quit IRC | 14:52 | |
| *** rajpatel_ has quit IRC | 14:53 | |
| *** rajpatel has joined #openstack-keystone | 14:54 | |
| *** zhurong_ has quit IRC | 14:57 | |
| *** lucasxu has quit IRC | 14:57 | |
| *** dougshelley66 has joined #openstack-keystone | 14:58 | |
| * lbragstad was this -> <- close to sending out the pre-meeting ping for the policy meeting | 14:59 | |
| *** jaosorior is now known as jaosorior_away | 15:02 | |
| *** AmazT has quit IRC | 15:03 | |
| *** rcernin_ has quit IRC | 15:04 | |
| *** voelzmo has quit IRC | 15:05 | |
| *** agrebennikov has joined #openstack-keystone | 15:05 | |
| *** lucasxu has joined #openstack-keystone | 15:18 | |
| *** lamt has quit IRC | 15:20 | |
| *** shuyingya has quit IRC | 15:21 | |
| *** richm has joined #openstack-keystone | 15:23 | |
| *** lamt has joined #openstack-keystone | 15:27 | |
| dstanek | rodrigods: email sent | 15:27 |
| openstackgerrit | Merged openstack/keystone master: Updated from global requirements https://review.openstack.org/455925 | 15:30 |
| *** d0ugal has quit IRC | 15:30 | |
| *** d0ugal has joined #openstack-keystone | 15:30 | |
| *** d0ugal has quit IRC | 15:30 | |
| *** d0ugal has joined #openstack-keystone | 15:30 | |
| *** d0ugal has quit IRC | 15:31 | |
| *** d0ugal has joined #openstack-keystone | 15:31 | |
| *** d0ugal has quit IRC | 15:31 | |
| *** d0ugal has joined #openstack-keystone | 15:31 | |
| *** belmoreira has quit IRC | 15:32 | |
| openstackgerrit | Monty Taylor proposed openstack/keystoneauth master: Shift additional_user_agent in the stack https://review.openstack.org/456259 | 15:33 |
| openstackgerrit | Monty Taylor proposed openstack/keystoneauth master: Allow setting client name on the Session https://review.openstack.org/456260 | 15:33 |
| mordred | jamielennox, morgan, samueldmq: ^^ | 15:33 |
| samueldmq | mordred: interesting.. shade uses the clients (python-*clients), so it should sit in between the app and client, which is the current behavior | 15:36 |
| samueldmq | mordred: am I missing anything ? | 15:37 |
| mordred | samueldmq: shade is moving to using keystoneauth adapter directly | 15:37 |
| mordred | samueldmq: so this is really in support of setting user agents properly for the places where we'r enot using python-*client | 15:37 |
| mordred | or, rather, I found the issue while adding support for that:) | 15:38 |
| *** richm has quit IRC | 15:38 | |
| samueldmq | mordred: hmm, isn't there another app that should be sitting in between app and client right now ? | 15:38 |
| samueldmq | mordred: I mean, couldn't this break anything ? if not I am happy to just change it so that it works properly for shade | 15:40 |
| samueldmq | mordred: I got it, thigns go to the app->additional_user_agent to then reach keystoneauth | 15:43 |
| samueldmq | I see your examples | 15:43 |
| mordred | yay! | 15:48 |
| mordred | samueldmq: here's a patch: https://review.openstack.org/456268 (that won't work yet, needs an OCC patch first) to plumb it through to shade | 15:48 |
| samueldmq | mordred: in https://review.openstack.org/#/c/456259 it should be "shade/1.19.1 os-client-config/1.26.1 keystoneauth1/2.18.0" | 15:49 |
| samueldmq | rather than "os-client-config/1.26.1 shade/1.19.1 keystoneauth1/2.18.0" (with current code) | 15:49 |
| *** rocky has joined #openstack-keystone | 15:50 | |
| mordred | samueldmq: yes- that's what I believe / how I understand the parameters | 15:51 |
| samueldmq | mordred: nice | 15:52 |
| *** lamt has quit IRC | 15:53 | |
| *** rajpatel is now known as rajpatel_away | 15:55 | |
| *** tesseract has quit IRC | 15:58 | |
| *** rajpatel_away has quit IRC | 15:58 | |
| *** shuyingya has joined #openstack-keystone | 15:58 | |
| *** shuyingya has quit IRC | 16:03 | |
| *** rocky has quit IRC | 16:16 | |
| *** mvk has quit IRC | 16:18 | |
| *** lamt has joined #openstack-keystone | 16:27 | |
| *** rocky has joined #openstack-keystone | 16:31 | |
| *** richm has joined #openstack-keystone | 16:40 | |
| openstackgerrit | Tin Lam proposed openstack/keystonemiddleware master: Replace pycrypto with cryptography https://review.openstack.org/451941 | 16:41 |
| *** david-lyle has joined #openstack-keystone | 16:45 | |
| *** gyee has joined #openstack-keystone | 16:46 | |
| *** chris_hultin|AWA is now known as chris_hultin | 16:47 | |
| *** mpjetta has joined #openstack-keystone | 16:49 | |
| *** edtubill has joined #openstack-keystone | 16:55 | |
| *** edtubill has quit IRC | 16:56 | |
| ayoung | johnthetubaguy, what do you mean by "CLosed by default?" | 17:02 |
| johnthetubaguy | so any role in a project gives you access to something | 17:02 |
| johnthetubaguy | like you have role "foo" and you can boot instances in that project | 17:03 |
| ayoung | johnthetubaguy, OK, I think we have common ground there | 17:03 |
| ayoung | johnthetubaguy, I took that to mean something different. Namely, I want it publicly avaialbe to figure out what role you need to perform an operation. That is what I would mean by "Open By Default" | 17:04 |
| ayoung | so, very different meaning | 17:04 |
| johnthetubaguy | oh, yeah, thats different | 17:04 |
| lbragstad | fwiw - we need to document and understand each problem like the one above ^ and then take our best guess as to the priority/severity of each | 17:04 |
| edmondsw | I'm definitely on board with fixing "closed by default", but that's lower priority than solving the "admin let's me do things in other projects" problem | 17:04 |
| ayoung | So one goal is to have and explicit role check for each operation instead of "any role" | 17:04 |
| lbragstad | edmondsw you have a pretty indepth/complicated set of roles | 17:05 |
| lbragstad | edmondsw i'd but very curious to get your opinion on https://github.com/lbragstad/orbac | 17:05 |
| lbragstad | ayoung ++ I would think that is the solution to implementing "closed by default" | 17:06 |
| lbragstad | or *a* solution | 17:06 |
| edmondsw | lbragstad will try to look it over and get back to you... been extremely swamped lately | 17:06 |
| ayoung | lbragstad, ok, so a bad solution there will lock us in to a specific role | 17:06 |
| lbragstad | edmondsw no worries - it was an attempt to try and define different roles in a hierarchy | 17:06 |
| ayoung | if we solve only that, we really have not solved anything | 17:06 |
| johnthetubaguy | edmondsw: ++ | 17:07 |
| lbragstad | ayoung my interpretation of that is having the project compare the role in the token to the role for the permission in policy | 17:07 |
| ayoung | well, we will have solved something, but at the expense of making real RBAC syuopport harder | 17:07 |
| lbragstad | s/project/service/ | 17:08 |
| ayoung | lbragstad, BTW, beyond Trove, I think HA might be a very powerful use case to discuss. | 17:08 |
| johnthetubaguy | so operators are making lots of use of policy today, we stop them cutting their hands off so much | 17:08 |
| johnthetubaguy | but trove, et al, is the important longer term thing here | 17:09 |
| ayoung | "I have limited resources. I need to make an application highly available. How do I set up an HA monitor process that can do only the minimum to keep my application running" | 17:09 |
| johnthetubaguy | ayoung: maybe, thats one good use case to thinking about | 17:09 |
| ayoung | johnthetubaguy, we you talking with anand about Trove? | 17:09 |
| edmondsw | what's the trove issue here? | 17:10 |
| johnthetubaguy | so I want tove, heat, etc, to consume my regular user quota | 17:10 |
| ayoung | right | 17:10 |
| johnthetubaguy | but I don't want to user to kill those instances either, ideally | 17:11 |
| ayoung | edmondsw, the Trove team wants to be able to keep a user from messing up the Hosts that Trove manages, but to be able to have quota come from the user | 17:11 |
| lbragstad | johnthetubaguy so not giving a service all the rights you have to do a minimal job | 17:11 |
| ayoung | its an impossible problem with today's definition | 17:11 |
| lbragstad | johnthetubaguy ayoung ah - never mind | 17:11 |
| ayoung | lbragstad, there is that, too | 17:12 |
| johnthetubaguy | yeah, I think both things are up there | 17:12 |
| edmondsw | ayoung did you mean instances where you said hosts? | 17:12 |
| johnthetubaguy | there is an added fun on for magnum | 17:12 |
| lbragstad | so how does policy come into the quota bits for trove? | 17:12 |
| ayoung | As I see it, the best solution, based on how trove wants to do it, is to transfer a portion of quota over to Trove, but that makes Quota into currency | 17:12 |
| ayoung | and, it falls down on network issues | 17:12 |
| ayoung | edmondsw, yes | 17:13 |
| ayoung | edmondsw, I meant VMs to be specific | 17:13 |
| johnthetubaguy | ayoung: I currently like the idea of creating a project for trove, that is a child of the user's usual project, but I have gone through several ideas in my head, this is just the current one | 17:13 |
| edmondsw | sounds like per-user policy | 17:13 |
| edmondsw | and storing ownership info for vms | 17:14 |
| edmondsw | today there's the userid that created it, but that's not sufficient because you can't pass ownership to someone else, or indicate that 3 people should own the same VM together | 17:14 |
| edmondsw | I would love to see that fixed... totally apart from Trove | 17:14 |
| johnthetubaguy | edmondsw: permissions are per project, I feel we should try keep them that way, if we can | 17:15 |
| johnthetubaguy | getting a smooth experience there is tricky | 17:15 |
| johnthetubaguy | the simple ways all seem to fall apart :( | 17:15 |
| ayoung | johnthetubaguy, OK, so, I walked through that with Anand | 17:15 |
| edmondsw | johnthetubaguy I probably mispoke... I don't mean you'd have different policy files per user or anything like that | 17:15 |
| ayoung | in order to do that, I would then need to be able to delegate some subset of my quote explicitly to that project | 17:16 |
| ayoung | lets call it MTP for my-trove-project | 17:16 |
| ayoung | I then need to delegate to Trove, somehow, the ability to operator with in that project | 17:16 |
| edmondsw | johnthetubaguy but you might have a rule that checked something like "role:admin or <I am one of this resource's owners>" | 17:16 |
| ayoung | so, say I wave a majik wand: | 17:16 |
| ayoung | end state, trove has roles on the project, but I don't | 17:17 |
| johnthetubaguy | ayoung: so hierarchical quotas, there are many ways to cut it, many ways, this just "works" | 17:17 |
| *** lamt has quit IRC | 17:17 | |
| ayoung | then, I later, I want to reclaim it, but trove has since been decommisioned | 17:17 |
| johnthetubaguy | ayoung: some models, its super hard | 17:17 |
| edmondsw | I've never really bought the notion that "if you want to keep user A from messing with user B's vms then you have to put them in separate projects" | 17:17 |
| edmondsw | hogwash | 17:17 |
| ayoung | I need to remove trove from the role assignements, and add myself back to them | 17:17 |
| johnthetubaguy | ayoung: right, so if you allow all sub projects to consume all the parents resource, this kinda works | 17:17 |
| johnthetubaguy | ayoung: yeah, that role assignment stuff is messy aftwarwards | 17:18 |
| johnthetubaguy | edmondsw: what about sub projects? | 17:18 |
| ayoung | edmondsw, you need some form of grouping, and explicitly assigning ownership to an individual does not scale well. At least you need a way to reclaim resources from that individual | 17:18 |
| edmondsw | johnthetubaguy eh... maybe | 17:19 |
| edmondsw | ayoung totally agree that if you setup ownership you have to be able to change it, as I said above | 17:19 |
| edmondsw | I think subprojects could work if we do it right | 17:19 |
| johnthetubaguy | edmondsw: +1, and thats one of those bit "ifs" | 17:21 |
| johnthetubaguy | oops, s/bit/big/ | 17:21 |
| edmondsw | yeah | 17:21 |
| edmondsw | I'm a couple hours past my normal lunch break... if we've stalled out, I'm gonna go eat :) | 17:23 |
| lbragstad | edmondsw sounds good | 17:23 |
| lbragstad | edmondsw ayoung johnthetubaguy this all sounds like things that we can work into goals on the etherpad, too | 17:24 |
| johnthetubaguy | edmondsw: food is good! | 17:24 |
| johnthetubaguy | yeah, I should get my dinner in a bit actually | 17:24 |
| ayoung | lbragstad, TBH, while the trove use case does make things clear, I think actually trying to solve it might be too far. If the end user maintains full control of the systems, but with an understand that if he messes with them, things get broke, I think that will be as far as we can reasonable get | 17:25 |
| lbragstad | ayoung that's fine for now | 17:26 |
| lbragstad | ayoung it seems like a problem we can work on eventually | 17:26 |
| lbragstad | but just documenting the use case and the end goal/user experience might help us keep that in mind as we work on other goals | 17:26 |
| dstanek | ayoung: right in line with discoverability it would be great to know all of the things that we must have | 17:31 |
| ayoung | dstanek, you mean a catalog of operations? | 17:40 |
| lbragstad | samueldmq is there anything left that needs to go into python-keystoneclient for https://github.com/openstack/python-keystoneclient/commit/34d99f0c09a253b3f51f3855fa6ce7449ffc235e ? | 17:46 |
| dstanek | ayoung: i mean just generally.... we have a list of problems and a list of solutions, but not really something that defines where we want to be... i don't even care about implementation yet... we all need to argue about what should be | 17:46 |
| lbragstad | samueldmq I'd like to do a release of python-keystoneclient for pike | 17:46 |
| dstanek | like...discovery is good and each solution needs to address it | 17:46 |
| ayoung | dstanek, If we define it in terms of Nova, we get a nova Specific solution. If we define it in terms of Delegation, we get a general Delegation mechanism that applies to other services | 17:47 |
| dstanek | rodrigods: i just replied to you on the ML, but wanted to follow up here. does that backport review introduce a new bug? | 17:47 |
| rodrigods | dstanek, not that i'm aware of | 17:48 |
| ayoung | "If I am not for myself, who will be for me? But if I am only for myself, who am I? If not now, when?" Ethics of the Fathers, 1:14. Hillel | 17:48 |
| dstanek | ayoung: exactly. that's what i want to see an architecture that is mostly absent of openstacky things | 17:48 |
| ayoung | Totally using that in my presentation | 17:48 |
| ayoung | dstanek, The Army | 17:48 |
| ayoung | Delegation in the extreme | 17:49 |
| lbragstad | samueldmq looks like https://review.openstack.org/#/c/182658 is the only thing left for that? | 17:49 |
| ayoung | void of all openstack | 17:49 |
| dstanek | ayoung: you'll notice that my diagrams used 'service', 'policy store' and other generic terms :-) | 17:49 |
| ayoung | Yep | 17:49 |
| rodrigods | dstanek, btw... i've put the reviews there just to illustrate the discussion - the details of the reviews themselves or if there is stuff missing in one of them, is not in the scope of my intents | 17:49 |
| *** rajpatel has joined #openstack-keystone | 17:51 | |
| dstanek | rodrigods: right. just wondering if there is a bug in that review | 17:52 |
| openstackgerrit | ayoung proposed openstack/keystone master: Route based RBAC Management Interface https://review.openstack.org/401808 | 17:52 |
| rodrigods | dstanek, the WIP one has a bug, not sure where | 17:52 |
| rodrigods | the functional tests are failing | 17:52 |
| *** AmazT has joined #openstack-keystone | 17:52 | |
| rodrigods | didn't try to debug it | 17:52 |
| dstanek | rodrigods: what about the potential bug i mentioned? | 17:53 |
| rodrigods | dstanek, the user_id FK is still there | 17:58 |
| dstanek | rodrigods: aren't you removing it? | 18:00 |
| * dstanek checking the review again | 18:00 | |
| rodrigods | dstanek, no... only the idp_id and protocol_id + idp_id | 18:01 |
| dstanek | rodrigods: ah, so do we do checks there or is that already done? | 18:01 |
| rodrigods | dstanek, the review adds the checks / collateral effects | 18:02 |
| dstanek | i was remembering the relationship in reverse | 18:02 |
| dstanek | redrobot: where? | 18:03 |
| dstanek | ooops...not redrobot | 18:03 |
| dstanek | rodrigods: where? | 18:03 |
| *** edtubill has joined #openstack-keystone | 18:04 | |
| rodrigods | dstanek, here: https://review.openstack.org/#/c/445505/6/keystone/federation/core.py ? not sure if i understood your question | 18:04 |
| dstanek | rodrigods: what prevents an invalid idp_id? | 18:05 |
| *** MasterOfBugs has joined #openstack-keystone | 18:06 | |
| *** pramodrj07 has joined #openstack-keystone | 18:06 | |
| *** pramodrj07 has quit IRC | 18:06 | |
| *** MasterOfBugs has quit IRC | 18:06 | |
| rodrigods | dstanek, ah, ok... the validation is done before we try to shadow the user | 18:06 |
| *** MasterOfBugs has joined #openstack-keystone | 18:06 | |
| *** pramodrj07 has joined #openstack-keystone | 18:06 | |
| rodrigods | since we only create the fed_user entry after a successful authentication | 18:06 |
| dstanek | rodrigods: is that true? i though we were working toward creating a specified user through the APi so that an operator can preload. | 18:07 |
| dstanek | rodrigods: either way, that validation is one of the problems i have with not having FKs | 18:07 |
| rodrigods | dstanek, right... this is not covering that... the code that does that didn't land yet | 18:08 |
| dstanek | rodrigods: keep that in mind if this goes through. we would have to ensure we are manually adding "FK" validation | 18:09 |
| rodrigods | dstanek, yep... i believe the code itself that will add these APIs will need to have unit tests for invalid idp IDs | 18:10 |
| *** rderose has joined #openstack-keystone | 18:11 | |
| dstanek | rodrigods: only if this change goes through :-) | 18:13 |
| rodrigods | :) | 18:13 |
| *** lamt has joined #openstack-keystone | 18:14 | |
| lbragstad | lamt for the pycrypto -> cryptography switch, does that involve a bounce of the service which drops the data in the cache? | 18:29 |
| lamt | lbragstad: no, the memcache server does not need to be bounce | 18:30 |
| lamt | lbragstad: going to test that later this week, but the switch should just be using cryptography instead of pycrypto to do the decryption | 18:31 |
| *** ayoung has quit IRC | 18:31 | |
| lbragstad | lamt will cryptography be able to decrypt things encrypted with pycrypto? | 18:31 |
| lbragstad | lamt or is that what you're going to validate? | 18:32 |
| lamt | lbragstad: there is no algorithm change | 18:32 |
| lbragstad | ok - i didn't think so but wasn't 100% sure | 18:32 |
| *** rderose has quit IRC | 18:32 | |
| lamt | lbragstad I did that already, I added a pastebin | 18:32 |
| lbragstad | lamt aha - indeed you did | 18:32 |
| lbragstad | lamt lol - i like the example | 18:33 |
| *** rderose has joined #openstack-keystone | 18:33 | |
| *** Aqsa has quit IRC | 18:34 | |
| *** amac has joined #openstack-keystone | 18:35 | |
| lamt | lbragstad it took me a bit, since there was some padding I forgot to account for | 18:37 |
| *** stradling has quit IRC | 18:38 | |
| lbragstad | lamt the values of dec_crypto_with_pycrypto and dec_crypto_with_cryptography come back as empty strings for me? | 18:40 |
| lamt | lbragstad lemme check after this meeting | 18:41 |
| lbragstad | lamt this is what i have locally - http://cdn.pasteraw.com/i9fv9kr64j8ea2oszbwcw9zzybiem3f which results in http://cdn.pasteraw.com/hcpw79xoyyhoj3aegtcznbva32wz67y | 18:42 |
| lbragstad | lamt ack - ping me whenever | 18:42 |
| lamt | lbragstad will do | 18:43 |
| *** edtubill has quit IRC | 18:46 | |
| *** ravelar has joined #openstack-keystone | 18:52 | |
| *** rajpatel has quit IRC | 19:03 | |
| *** voelzmo has joined #openstack-keystone | 19:12 | |
| *** lucasxu has quit IRC | 19:18 | |
| *** lucasxu has joined #openstack-keystone | 19:20 | |
| *** lamt has quit IRC | 19:22 | |
| *** amac has quit IRC | 19:26 | |
| *** edmondsw_ has joined #openstack-keystone | 19:34 | |
| *** amac has joined #openstack-keystone | 19:37 | |
| *** edmondsw_ has quit IRC | 19:40 | |
| *** Aqsa has joined #openstack-keystone | 19:43 | |
| *** rderose has quit IRC | 19:45 | |
| *** rderose has joined #openstack-keystone | 19:46 | |
| *** lamt has joined #openstack-keystone | 19:53 | |
| *** lamt has quit IRC | 19:54 | |
| *** ravelar has quit IRC | 19:55 | |
| *** ravelar has joined #openstack-keystone | 19:56 | |
| *** lamt has joined #openstack-keystone | 20:03 | |
| *** ravelar has quit IRC | 20:07 | |
| *** jose-phillips has joined #openstack-keystone | 20:19 | |
| *** ayoung has joined #openstack-keystone | 20:26 | |
| *** AmazT has left #openstack-keystone | 20:33 | |
| *** voelzmo has quit IRC | 20:34 | |
| *** Aqsa has quit IRC | 20:37 | |
| *** rajpatel has joined #openstack-keystone | 20:56 | |
| *** thorst has quit IRC | 21:01 | |
| *** thorst has joined #openstack-keystone | 21:02 | |
| *** amac has quit IRC | 21:05 | |
| *** thorst has quit IRC | 21:06 | |
| *** lucasxu has quit IRC | 21:09 | |
| *** lucasxu has joined #openstack-keystone | 21:13 | |
| lamt | lbragstad There are additional bytes in the pycrypto-encrypted ciphertext. I will look to see why the ciphertext for cryptography is truncated at the end and get back to you. | 21:14 |
| lbragstad | lamt sounds good | 21:16 |
| lbragstad | lamt i guess the interesting part is that when you decrypt the cryptography ciphertext, it comes back as an empty string regardless of decrypting it with pycrypto or cryptography | 21:17 |
| lamt | lbragstad I think the algorithm used to decrypt should be the same regardless of the library used. Whatever that was chopped at the end is causing it to decrypt to an empty string using either library. I guess that's good (?) in a sense. | 21:21 |
| lamt | lbragstad it would be worse if they get decrypted to different things :) | 21:22 |
| lbragstad | lamt that's a good question :) | 21:22 |
| lamt | lbragstad the cyphertext for both seem to match at the beginning - I think it might be an error on my end to encrypt using cryptography. I will poke around more. | 21:24 |
| lbragstad | lamt yeah - i noticed the same thing | 21:25 |
| lbragstad | lamt digging into the docs | 21:25 |
| -openstackstatus- NOTICE: Restarting Gerrit for our weekly memory leak cleanup. | 21:25 | |
| lbragstad | lamt > encryptor.finalize() is returning an empty string | 21:28 |
| lamt | lbragstad hmm lemme look | 21:28 |
| *** lucasxu has quit IRC | 21:31 | |
| *** edmondsw has quit IRC | 21:33 | |
| *** edmondsw has joined #openstack-keystone | 21:34 | |
| *** edmondsw has quit IRC | 21:38 | |
| *** chris_hultin is now known as chris_hultin|AWA | 21:42 | |
| openstackgerrit | ayoung proposed openstack/keystone master: Route based RBAC Management Interface https://review.openstack.org/401808 | 21:45 |
| dstanek | .b 27 | 21:47 |
| *** pcaruana has quit IRC | 21:51 | |
| *** mriedem has joined #openstack-keystone | 21:54 | |
| mriedem | no bknudson? | 21:54 |
| mriedem | anyone know where rule:admin_api is defined for policy? nova uses it in the policy sample but i don't see it defined in nova, or keystone https://github.com/openstack/keystone/blob/master/etc/policy.v3cloudsample.json | 21:54 |
| mriedem | oh nvm found it | 21:55 |
| mriedem | #"admin_api": "is_admin:True" | 21:55 |
| mriedem | it's a nova-ism | 21:55 |
| lbragstad | mriedem yep | 21:55 |
| mriedem | weird | 21:56 |
| lbragstad | mriedem also | 21:57 |
| lbragstad | mriedem policy.v3cloudsample.json isn't really used | 21:57 |
| lbragstad | mriedem that's technically just an example of a more evolved/opinionated policy that happens to take project and domains a little more seriously | 21:58 |
| mriedem | so what is? | 21:58 |
| lbragstad | mriedem https://github.com/openstack/keystone/blob/master/keystone/common/policies/base.py#L15-L31 | 21:58 |
| lbragstad | mriedem we moved everything into code | 21:58 |
| lbragstad | mriedem similar to what nova did | 21:58 |
| mriedem | gah | 21:59 |
| lbragstad | hag | 21:59 |
| *** lamt has quit IRC | 21:59 | |
| mriedem | might be nice to generate a real sample | 22:00 |
| mriedem | is that in your docs somewhere? | 22:00 |
| mriedem | like this? https://docs.openstack.org/developer/nova/sample_policy.html | 22:00 |
| lbragstad | mriedem not yet - it literally just landed | 22:01 |
| * lbragstad makes a reminder note to generate a sample and add it to the docs | 22:03 | |
| *** lamt has joined #openstack-keystone | 22:04 | |
| mriedem | where is is_admin_project defined? | 22:04 |
| mriedem | https://github.com/openstack/keystone/blob/eed29f236e251007093ae1fe29185eddbef8497d/keystone/models/token_model.py#L196 ? | 22:05 |
| mriedem | or is that something you define when you create the project? | 22:05 |
| lbragstad | mriedem https://github.com/openstack/keystone/blob/4767e58effff12290d5b01ad20b06578eab71318/keystone/conf/resource.py#L59-L69 | 22:06 |
| mriedem | so you can have the global admin, that passes any is_admin check, and a project admin, which is the is_admin_project=True flag? | 22:06 |
| *** MasterOfBugs has quit IRC | 22:06 | |
| *** pramodrj07 has quit IRC | 22:06 | |
| lbragstad | if you have the 'admin' role on the super-special is_admin project you get god-mode | 22:06 |
| lbragstad | which makes you admin across the deployment | 22:06 |
| *** pramodrj07 has joined #openstack-keystone | 22:06 | |
| *** MasterOfBugs has joined #openstack-keystone | 22:06 | |
| lbragstad | it's essentially a workaround for | 22:07 |
| mriedem | yeah what johnthetubaguy refers to global context in https://review.openstack.org/#/c/433037/21/specs/pike/approved/policy-remove-scope-checks.rst@129 | 22:07 |
| lbragstad | is_admin everywhere | 22:07 |
| lbragstad | mriedem yes - exactly | 22:07 |
| mriedem | so i want global god admin for my hosting admin, and project admin for my hosted tenant people in a hybrid cloud thingy | 22:07 |
| lbragstad | mriedem right | 22:07 |
| mriedem | e.g. the ibm guy at bluebox is god admin and the admin at acme is the project admin | 22:08 |
| mriedem | ok cool | 22:08 |
| lbragstad | yep | 22:08 |
| mriedem | let's call him jimbob | 22:08 |
| mriedem | at acme co | 22:08 |
| lbragstad | mriedem not all service have adopted this though | 22:08 |
| mriedem | jimbob makes poor life choices | 22:08 |
| lbragstad | services* | 22:08 |
| *** edmondsw has joined #openstack-keystone | 22:10 | |
| *** rajpatel has quit IRC | 22:10 | |
| lbragstad | yeah - so because jimbob is admin and makes poor life choices doesn't mean it has to result in foobar'ing your entire deployment because jimbob just deleted all projects in a domain he's not suppose to have access to | 22:10 |
| lbragstad | or one of the other million dumb things that could happen | 22:10 |
| mriedem | right | 22:11 |
| lbragstad | mriedem ayoung has a bunch of patches up somewhere to get that incorporated into the various projects | 22:12 |
| *** edmondsw has quit IRC | 22:14 | |
| lbragstad | mriedem but there are conversations to try and get better rbac support, which hopefully mean we don't have to keep that bandaid forever | 22:15 |
| *** rmascena has quit IRC | 22:15 | |
| ayoung | lbragstad, is_admin_project stuff? | 22:16 |
| lbragstad | ayoung yeah | 22:16 |
| lbragstad | ayoung mriedem was asking about it | 22:17 |
| ayoung | lets see... | 22:17 |
| mriedem | i'm just reading through https://review.openstack.org/#/c/433037/ and trying to understand all of the terms and concepts first | 22:17 |
| mriedem | before i can possibly understand what johnthetubaguy is proposing to change | 22:17 |
| ayoung | https://review.openstack.org/#/c/384655/ | 22:17 |
| ayoung | mriedem, the nova patch is here: | 22:17 |
| ayoung | https://review.openstack.org/#/c/384148/ | 22:18 |
| ayoung | I think that one is actually ready to go | 22:18 |
| mriedem | not if i dont understand anything about it, i wouldn't +2 it, that's why i'm here | 22:18 |
| mriedem | but i'm trying to get through johnthetubaguy's spec, which is why i'm here | 22:19 |
| ayoung | but, you know how OpenStack reviews get...and I am not certain I willhave the time to chase it down again in a timely manner. I don't have free reign on my time dedicated to Openstack anymore, and this is all borrowed time for me | 22:19 |
| ayoung | mriedem, which spec? He has a few | 22:19 |
| mriedem | https://review.openstack.org/#/c/433037/ | 22:19 |
| ayoung | Gah | 22:20 |
| ayoung | OK, so, sure | 22:20 |
| ayoung | but if we do that, we should just kill policy | 22:20 |
| ayoung | Frustrating | 22:20 |
| mriedem | maybe you and johnthetubaguy should talk at some point then? | 22:20 |
| ayoung | we talk regularly | 22:20 |
| mriedem | the same language? | 22:20 |
| ayoung | he's awesome, he's just coming up to speed on stuff I've spent a couple years on | 22:21 |
| ayoung | and...Keystone has to solve RBAC for a far more than Nova | 22:21 |
| ayoung | But, he is right; scope check should not be configurable | 22:21 |
| ayoung | just, that is not screwing things up right now as much as others | 22:22 |
| ayoung | and, everytime someone touches something like that, it makes me worried we are going to get even more committed to the things that are broken, | 22:22 |
| ayoung | mriedem, does that make sense? | 22:22 |
| mriedem | not to me no, i don't have the background context | 22:22 |
| ayoung | I've done a lot to work around the broken aspects of RBAC as implemented today. | 22:23 |
| ayoung | hmmmm..... | 22:23 |
| ayoung | mriedem, are you coming to the Boston Summit? | 22:23 |
| mriedem | i am | 22:23 |
| mriedem | http://forumtopics.openstack.org/cfp/details/92 is approved | 22:23 |
| ayoung | excellent. I am presenting on my approach there, and can also dedicate a lot of time to anyone interested in this stuff then | 22:23 |
| mriedem | so i assume some of this might be discussed during that? | 22:23 |
| ayoung | Yes | 22:24 |
| mriedem | or you have some actual talk to give? | 22:24 |
| ayoung | mriedem, so, yes, we want to split Role check from scope check | 22:24 |
| ayoung | yes, I have an actual talk. | 22:24 |
| mriedem | link me up | 22:24 |
| ayoung | https://www.openstack.org/summit/boston-2017/call-for-presentations/preview/17462 | 22:24 |
| mriedem | https://www.openstack.org/summit/boston-2017/summit-schedule/events/17462/ | 22:25 |
| mriedem | yeah ok | 22:25 |
| ayoung | mriedem, we are going to do a video call next Wednesday during the Policy meeting. | 22:26 |
| *** ianw is now known as ianw_pto | 22:26 | |
| ayoung | There are a lot of things to discuss, and a lot of people are looking for level setting | 22:26 |
| mriedem | geh i wish i could add things to my schedule like the old days | 22:27 |
| ayoung | mriedem, at a minimum, please review https://review.openstack.org/#/c/452198/ and you should get a sense of what I am pushing for here | 22:29 |
| ayoung | mriedem, haveto switch to dad mode here. | 22:29 |
| lbragstad | lamt it looks like the padding might be causing issues | 22:32 |
| lbragstad | lamt for example - here we're enc(data + pad) https://gist.github.com/lbragstad/0c5c831d11684f8c7def7a6c553e1c40#file-crypt-py-L15 | 22:33 |
| *** ayoung has quit IRC | 22:34 | |
| lamt | lbragstad yeah, am trying to see how to do the same with the cryptography enc with the same padding | 22:34 |
| openstackgerrit | Gage Hugo proposed openstack/keystonemiddleware master: Added "warning-is-error" sphinx check for docs https://review.openstack.org/439819 | 22:36 |
| *** rajpatel has joined #openstack-keystone | 22:36 | |
| lbragstad | lamt i ran your example by one of our crypto guys - here is a summary of our conversation http://cdn.pasteraw.com/b59al2t3wb1iru19j3buzynih07ar51 | 22:37 |
| lbragstad | lamt it was redrobot that pointed out the padding bits in both the pycrypto encrypt and decrypt functions | 22:39 |
| lbragstad | lamt i'm going to step away for a bit - but i'll probably check back in later | 22:42 |
| lbragstad | lamt we can pick this up tomorrow, too | 22:42 |
| *** lamt has quit IRC | 22:47 | |
| *** catintheroof has quit IRC | 22:48 | |
| *** lamt has joined #openstack-keystone | 22:59 | |
| lamt | lbragstad thanks, I need to step out for a bit too - I will read the paste and poke around later tonight, and I will follow up tomorrow. | 23:00 |
| *** adriant has joined #openstack-keystone | 23:02 | |
| *** rderose has quit IRC | 23:04 | |
| *** lamt has quit IRC | 23:08 | |
| *** agrebennikov has quit IRC | 23:11 | |
| *** lamt has joined #openstack-keystone | 23:11 | |
| *** lamt has quit IRC | 23:12 | |
| *** lamt has joined #openstack-keystone | 23:13 | |
| *** lamt has quit IRC | 23:13 | |
| *** lamt has joined #openstack-keystone | 23:15 | |
| *** lamt has joined #openstack-keystone | 23:16 | |
| *** lamt has quit IRC | 23:17 | |
| *** raildo has joined #openstack-keystone | 23:18 | |
| *** thorst has joined #openstack-keystone | 23:20 | |
| *** thorst has quit IRC | 23:21 | |
| *** raildo has quit IRC | 23:27 | |
| *** raildo has joined #openstack-keystone | 23:27 | |
| *** erlon has quit IRC | 23:35 | |
| *** rajpatel has quit IRC | 23:41 | |
| *** stradling has joined #openstack-keystone | 23:43 | |
| *** raildo has quit IRC | 23:43 | |
| *** ayoung has joined #openstack-keystone | 23:43 | |
| *** agrebennikov has joined #openstack-keystone | 23:53 | |
| *** raildo has joined #openstack-keystone | 23:55 | |
| *** stradling has quit IRC | 23:57 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!