| *** markvoelker has quit IRC | 00:01 | |
| *** markvoelker has joined #openstack-keystone | 00:02 | |
| *** markvoelker has quit IRC | 00:04 | |
| *** jrist has joined #openstack-keystone | 00:04 | |
| *** markvoelker has joined #openstack-keystone | 00:04 | |
| *** d0ugal has quit IRC | 00:17 | |
| *** thorst has joined #openstack-keystone | 00:25 | |
| *** thorst has quit IRC | 00:27 | |
| *** shuyingya has joined #openstack-keystone | 00:36 | |
| *** shuyingya has quit IRC | 00:41 | |
| *** piliman974 has quit IRC | 00:44 | |
| *** thorst has joined #openstack-keystone | 00:57 | |
| *** harlowja has quit IRC | 01:08 | |
| *** d0ugal has joined #openstack-keystone | 01:13 | |
| morgan | hey | 01:15 |
|---|---|---|
| *** thorst has quit IRC | 01:16 | |
| morgan | lbragstad servers that run many many many threads | 01:16 |
| morgan | lbragstad: where we might run into issues with exaughsting the memcache server sockets available | 01:17 |
| morgan | lbragstad Eventlet hits that because it spins up a connection per greenlet. | 01:18 |
| *** gyee has quit IRC | 01:22 | |
| *** oomichi has quit IRC | 01:25 | |
| *** oomichi has joined #openstack-keystone | 01:25 | |
| *** gyee has joined #openstack-keystone | 01:26 | |
| *** dave-mccowan has quit IRC | 01:28 | |
| *** thorst has joined #openstack-keystone | 01:31 | |
| *** thorst has quit IRC | 01:33 | |
| *** shuyingya has joined #openstack-keystone | 01:43 | |
| *** gongysh has joined #openstack-keystone | 01:47 | |
| *** dave-mccowan has joined #openstack-keystone | 01:52 | |
| *** shuyingy_ has joined #openstack-keystone | 02:14 | |
| *** thorst has joined #openstack-keystone | 02:18 | |
| *** shuyingya has quit IRC | 02:18 | |
| *** thorst has quit IRC | 02:19 | |
| *** prashkre has joined #openstack-keystone | 02:26 | |
| *** thorst has joined #openstack-keystone | 02:29 | |
| *** thorst has quit IRC | 02:29 | |
| *** gyee has quit IRC | 02:35 | |
| *** shuyingy_ has quit IRC | 02:40 | |
| *** shuyingya has joined #openstack-keystone | 02:41 | |
| *** dave-mccowan has quit IRC | 02:42 | |
| *** Shunli has joined #openstack-keystone | 02:44 | |
| *** nicolasbock has quit IRC | 02:51 | |
| *** shuyingya has quit IRC | 02:59 | |
| *** thorst has joined #openstack-keystone | 03:00 | |
| *** shuyingya has joined #openstack-keystone | 03:00 | |
| *** prashkre has quit IRC | 03:08 | |
| *** shuyingy_ has joined #openstack-keystone | 03:13 | |
| *** oomichi has quit IRC | 03:14 | |
| *** shuyingya has quit IRC | 03:17 | |
| *** thorst has quit IRC | 03:18 | |
| *** oomichi has joined #openstack-keystone | 03:19 | |
| *** shuyingy_ has quit IRC | 03:20 | |
| *** shuyingya has joined #openstack-keystone | 03:20 | |
| openstackgerrit | Merged openstack/keystonemiddleware master: Remove log translations https://review.openstack.org/447841 | 03:30 |
| *** dikonoor has joined #openstack-keystone | 03:42 | |
| *** links has joined #openstack-keystone | 03:43 | |
| *** zsli_ has joined #openstack-keystone | 03:49 | |
| *** links has quit IRC | 03:51 | |
| *** Shunli has quit IRC | 03:52 | |
| *** links has joined #openstack-keystone | 03:55 | |
| *** shuyingy_ has joined #openstack-keystone | 04:13 | |
| *** thorst has joined #openstack-keystone | 04:15 | |
| *** gongysh has quit IRC | 04:15 | |
| *** shuyingya has quit IRC | 04:16 | |
| *** namnh has joined #openstack-keystone | 04:16 | |
| *** thorst has quit IRC | 04:20 | |
| *** shuyingy_ has quit IRC | 04:21 | |
| *** links has quit IRC | 04:24 | |
| *** dikonoor has quit IRC | 04:32 | |
| *** harlowja has joined #openstack-keystone | 04:33 | |
| *** dikonoor has joined #openstack-keystone | 04:50 | |
| *** gongysh has joined #openstack-keystone | 04:53 | |
| *** aojea has joined #openstack-keystone | 04:56 | |
| *** aojea has quit IRC | 05:00 | |
| *** links has joined #openstack-keystone | 05:06 | |
| *** shuyingya has joined #openstack-keystone | 05:10 | |
| *** shuyingy_ has joined #openstack-keystone | 05:11 | |
| *** shuyingya has quit IRC | 05:15 | |
| openstackgerrit | rocky proposed openstack/keystone master: Change info and baseclass of LDAPServerConnectionError https://review.openstack.org/463506 | 05:15 |
| *** thorst has joined #openstack-keystone | 05:16 | |
| openstackgerrit | rocky proposed openstack/keystone master: Change info and baseclass of LDAPServerConnectionError https://review.openstack.org/463506 | 05:17 |
| *** thorst has quit IRC | 05:21 | |
| *** dikonoor has quit IRC | 05:26 | |
| *** dikonoor has joined #openstack-keystone | 05:43 | |
| *** pcaruana has joined #openstack-keystone | 05:48 | |
| *** harlowja has quit IRC | 05:54 | |
| *** prashkre has joined #openstack-keystone | 05:54 | |
| *** tobberydberg has joined #openstack-keystone | 05:56 | |
| *** thorst has joined #openstack-keystone | 06:17 | |
| *** rcernin has joined #openstack-keystone | 06:18 | |
| *** thorst has quit IRC | 06:22 | |
| *** henrynash has joined #openstack-keystone | 06:27 | |
| openstackgerrit | rocky proposed openstack/keystone master: Migrate render_token_data_response to keystone.common.controller https://review.openstack.org/464956 | 06:30 |
| *** gongysh has quit IRC | 06:31 | |
| *** gongysh has joined #openstack-keystone | 06:44 | |
| *** henrynash has quit IRC | 06:44 | |
| *** belmoreira has joined #openstack-keystone | 06:51 | |
| *** mgagne has quit IRC | 06:53 | |
| *** mgagne has joined #openstack-keystone | 06:56 | |
| *** mgagne is now known as Guest24103 | 06:56 | |
| *** rcernin has quit IRC | 06:57 | |
| *** rcernin has joined #openstack-keystone | 07:13 | |
| *** thorst has joined #openstack-keystone | 07:18 | |
| *** thorst has quit IRC | 07:22 | |
| *** aojea has joined #openstack-keystone | 07:28 | |
| *** rcernin has quit IRC | 07:29 | |
| *** rcernin has joined #openstack-keystone | 07:35 | |
| *** rcernin has quit IRC | 07:35 | |
| *** rcernin has joined #openstack-keystone | 07:35 | |
| *** jaosorior_away is now known as jaosorior | 07:48 | |
| *** gongysh has quit IRC | 07:56 | |
| *** tobberyd_ has joined #openstack-keystone | 07:56 | |
| *** tobberydberg has quit IRC | 07:59 | |
| *** zzzeek has quit IRC | 08:00 | |
| breton | jamielennox: turns out there is already a plugin for that | 08:00 |
| *** prashkre has quit IRC | 08:01 | |
| breton | jamielennox: keystoneauth1.identity.access.AccessInfoPlugin | 08:01 |
| breton | jamielennox: you wrote it in 2014! | 08:03 |
| *** zzzeek has joined #openstack-keystone | 08:04 | |
| *** thorst has joined #openstack-keystone | 08:18 | |
| *** thorst has quit IRC | 08:23 | |
| *** dikonoo has joined #openstack-keystone | 08:24 | |
| *** dikonoor has quit IRC | 08:24 | |
| *** gongysh has joined #openstack-keystone | 08:34 | |
| *** prashkre has joined #openstack-keystone | 08:49 | |
| breton | jamielennox: well, actually no, it reuires to already have AccessInfo | 08:54 |
| *** tobberyd_ has quit IRC | 09:12 | |
| *** tobberydberg has joined #openstack-keystone | 09:13 | |
| *** gongysh has quit IRC | 09:14 | |
| *** gongysh has joined #openstack-keystone | 09:15 | |
| *** thorst has joined #openstack-keystone | 09:19 | |
| breton | fg | 09:27 |
| breton | :( | 09:27 |
| *** jdennis has quit IRC | 09:27 | |
| *** jdennis1 has joined #openstack-keystone | 09:27 | |
| *** zsli_ has quit IRC | 09:30 | |
| *** thorst has quit IRC | 09:39 | |
| *** shuyingy_ has quit IRC | 09:46 | |
| *** links has quit IRC | 09:48 | |
| *** stingaci has joined #openstack-keystone | 09:56 | |
| *** links has joined #openstack-keystone | 10:00 | |
| *** johnthetubaguy has left #openstack-keystone | 10:05 | |
| *** dikonoo has quit IRC | 10:12 | |
| *** faizy has joined #openstack-keystone | 10:14 | |
| *** Daviey_ is now known as Daviey | 10:15 | |
| *** stingaci has quit IRC | 10:28 | |
| *** stingaci has joined #openstack-keystone | 10:30 | |
| *** namnh has quit IRC | 10:30 | |
| *** thorst has joined #openstack-keystone | 10:35 | |
| *** thorst has quit IRC | 10:40 | |
| openstackgerrit | rocky proposed openstack/keystone master: Migrate render_token_data_response to keystone.common.controller https://review.openstack.org/464956 | 10:52 |
| -openstackstatus- NOTICE: gerrit is being restarted to help stuck git replication issues | 10:53 | |
| *** nicolasbock has joined #openstack-keystone | 10:54 | |
| *** links has quit IRC | 11:05 | |
| *** raildo has joined #openstack-keystone | 11:07 | |
| *** gongysh has quit IRC | 11:18 | |
| *** gongysh has joined #openstack-keystone | 11:18 | |
| *** gongysh has quit IRC | 11:19 | |
| *** gongysh has joined #openstack-keystone | 11:19 | |
| *** gongysh has quit IRC | 11:19 | |
| *** gongysh has joined #openstack-keystone | 11:20 | |
| *** gongysh has quit IRC | 11:20 | |
| *** links has joined #openstack-keystone | 11:22 | |
| *** prashkre has quit IRC | 11:27 | |
| breton | what do you think about changing the Token plugin so that it would not re-authenticate using the token, but instead just fetch token's data? | 11:34 |
| *** prashkre has joined #openstack-keystone | 11:35 | |
| *** henrynash has joined #openstack-keystone | 11:36 | |
| breton | for mistral i had to do this: https://review.openstack.org/#/c/465521/1 | 11:38 |
| *** henrynash has quit IRC | 11:40 | |
| *** thorst has joined #openstack-keystone | 11:46 | |
| *** gongysh has joined #openstack-keystone | 11:49 | |
| *** chlong has quit IRC | 11:57 | |
| *** gongysh has quit IRC | 11:58 | |
| openstackgerrit | Jose Castro Leon proposed openstack/keystone master: Fix ec2tokens validation in v2 after regresion in metadata_ref removal https://review.openstack.org/465530 | 12:03 |
| *** prashkre has quit IRC | 12:28 | |
| openstackgerrit | Jose Castro Leon proposed openstack/keystoneauth master: Parameter to tune mutual authentication in kerberos https://review.openstack.org/455330 | 12:34 |
| *** ma9_ has joined #openstack-keystone | 12:37 | |
| *** stingaci has quit IRC | 12:39 | |
| *** stingaci has joined #openstack-keystone | 12:40 | |
| *** xuhaigang has quit IRC | 12:40 | |
| *** edmondsw has joined #openstack-keystone | 12:41 | |
| jamielennox | breton: i'm not really here - the problem with fetching the token is that lots of people actually use that to rescope | 12:43 |
| *** stingaci has quit IRC | 12:44 | |
| jamielennox | so if you were to fetch the existing data you would have to compare it to the scope parameters you were given and see if it actually does what you want | 12:44 |
| jamielennox | and given that keystone will happily rescope a token to a new token in the same project with the same expiry - it never really made much difference if you fetched it, or just rescoped it to what you actually needed | 12:45 |
| *** jrist has quit IRC | 12:47 | |
| *** xuhaigang has joined #openstack-keystone | 12:52 | |
| openstackgerrit | Eric Fried proposed openstack/keystone-specs master: Block sphinx 1.6.1 https://review.openstack.org/465543 | 12:53 |
| openstackgerrit | Eric Fried proposed openstack/keystone-specs master: Outline policy goals https://review.openstack.org/460344 | 12:53 |
| breton | jamielennox: well, it matters -- because trust-scoped tokens cannot be rescoped. But i got your point. | 12:56 |
| *** lamt has joined #openstack-keystone | 12:58 | |
| *** jrist has joined #openstack-keystone | 13:14 | |
| *** chlong has joined #openstack-keystone | 13:16 | |
| openstackgerrit | Gaëtan Trellu proposed openstack/keystoneauth master: [adapter.py] Add application/json header https://review.openstack.org/465555 | 13:27 |
| openstackgerrit | Gaëtan Trellu proposed openstack/keystoneauth master: Sorry, first review. I'm discovering the process. https://review.openstack.org/465559 | 13:34 |
| *** thorst is now known as thorst_afk | 13:36 | |
| openstackgerrit | Gaëtan Trellu proposed openstack/keystoneauth master: [adapter.py] Add application/json header https://review.openstack.org/465555 | 13:38 |
| *** zzzeek has quit IRC | 13:43 | |
| *** piliman974 has joined #openstack-keystone | 13:43 | |
| openstackgerrit | Tin Lam proposed openstack/keystonemiddleware master: Replace pycrypto with cryptography https://review.openstack.org/451941 | 13:43 |
| *** ducttape_ has joined #openstack-keystone | 13:45 | |
| *** lamt has quit IRC | 13:47 | |
| *** ducttape_ has quit IRC | 13:48 | |
| *** ducttape_ has joined #openstack-keystone | 13:48 | |
| *** stingaci has joined #openstack-keystone | 13:48 | |
| *** zzzeek has joined #openstack-keystone | 13:49 | |
| *** jdennis1 is now known as jdennis | 13:49 | |
| *** jdennis has quit IRC | 13:50 | |
| *** jdennis has joined #openstack-keystone | 13:50 | |
| *** jdennis has quit IRC | 13:50 | |
| *** jdennis has joined #openstack-keystone | 13:51 | |
| *** ma9_ has left #openstack-keystone | 13:51 | |
| *** johnthetubaguy has joined #openstack-keystone | 13:53 | |
| *** stingaci has quit IRC | 13:53 | |
| *** lamt has joined #openstack-keystone | 13:53 | |
| *** Adri2000 has joined #openstack-keystone | 13:58 | |
| Adri2000 | hello | 13:58 |
| Adri2000 | I've got a keystone ocata with a domain configured on an active directory backend. issue is: listing users in groups returns empty lists - listing users works, listing groups works, but listing groups' contents doesn't | 14:01 |
| Adri2000 | any idea where I should look? | 14:02 |
| *** shuyingya has joined #openstack-keystone | 14:06 | |
| knikolla | Adri2000: check that your group_member_attribute is set correctly in keystone.conf | 14:06 |
| *** shuyingya has quit IRC | 14:09 | |
| Adri2000 | knikolla: it's set to "member". when I do ldapsearch on a group, I see a list of "member" attributes, making references to the DN of users | 14:11 |
| Adri2000 | I'm not sure how keystone is supposed to make the link, between the DN referenced in the "member" attributes of the group and the users themselves | 14:11 |
| *** shuyingya has joined #openstack-keystone | 14:11 | |
| Adri2000 | how should I set user_id_attribute and user_name_attribute? cn? dn? samaccountname? | 14:12 |
| *** ducttape_ has quit IRC | 14:14 | |
| *** shuyingya has quit IRC | 14:14 | |
| *** neal has joined #openstack-keystone | 14:20 | |
| knikolla | Adri2000: what ldap are you using? cn should be fine for id. | 14:20 |
| lbragstad | rm_work: GET /v3/auth/projects should give you a list of projects you have a role assignment one | 14:20 |
| lbragstad | on* | 14:20 |
| Adri2000 | knikolla: active directory :( | 14:21 |
| lbragstad | morgan: thanks for the info - is it possible to place a number on *many*? | 14:21 |
| neal | hello Keystone. | 14:21 |
| knikolla | Adri2000: go through https://docs.openstack.org/admin-guide/identity-integrate-with-ldap.html | 14:22 |
| knikolla | there's a couple of tips and suggestions for active directory | 14:22 |
| morgan | lbragstad: no, because you can modify memcached params to mitigate it some. | 14:22 |
| morgan | lbragstad: in short, something running threads in the very high numbers though, with threads counting in the 100s or more probably | 14:23 |
| neal | i have a question about "Allow retrieving an expired token", does openstack provide an api handle it? | 14:23 |
| *** stingaci has joined #openstack-keystone | 14:27 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone-specs master: Add policy roadmap for security https://review.openstack.org/462733 | 14:28 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone-specs master: Specification for global roles https://review.openstack.org/464763 | 14:29 |
| knikolla | neal: what do you mean by api handle? | 14:30 |
| lbragstad | neal are you asking if keystone support the ability to validate expired tokens? | 14:31 |
| lbragstad | supports* | 14:31 |
| *** stingaci has quit IRC | 14:31 | |
| breton | neal: service user needs to pass ?allow_expired=1 to keystone when validating a token | 14:31 |
| *** Guest24103 is now known as mgagne | 14:32 | |
| *** mgagne has quit IRC | 14:32 | |
| *** mgagne has joined #openstack-keystone | 14:32 | |
| *** gyee has joined #openstack-keystone | 14:33 | |
| neal | tks breton. but when i access other api,like nova,cinder, i just send api request to other component(nova,cinder) rathan than keystone, how can i pass the ?allow_expired to keystone. | 14:37 |
| *** ducttape_ has joined #openstack-keystone | 14:38 | |
| *** dave-mccowan has joined #openstack-keystone | 14:38 | |
| lbragstad | neal: that logic is done in keystonemiddleware - since that's what sits in front of the services and handles token validation on behalf of the service | 14:38 |
| knikolla | neal: you don't have to do anything as a user sending a token if the service has been configured correctly. however keep in mind that allow_expired only works for tokens sent from a service to another service, ex. when nova sends a request with your token to cinder to fetch a volume. so you cannot initiate an operation with an expired token, it only help with long running operations during which the token might expire after y | 14:41 |
| knikolla | ou initiate the request. | 14:41 |
| neal | @lbragstad: tku. | 14:42 |
| *** henrynash has joined #openstack-keystone | 14:44 | |
| *** ducttape_ has quit IRC | 14:46 | |
| lbragstad | neal: we have some additional documentation on it | 14:47 |
| lbragstad | neal: let me grab that for you | 14:47 |
| lbragstad | neal: http://specs.openstack.org/openstack/keystone-specs/specs/keystone/ocata/allow-expired.html | 14:47 |
| neal | knikolla: thu. but i think lots of a 3rd party component also have long running operations. now my components only have the admin's username and password, it also have the user token, i use user token to do some action(this action may be an long running operations), so i need to use expired token if token expire during long opertions. so in this scenario, how can i hanle it? | 14:48 |
| neal | @lbragstad: 3ku. i'll check it. | 14:48 |
| lbragstad | neal: does your third party component have or require it's own service user? | 14:49 |
| lbragstad | neal: if your third party component needs to validate a token and it has it's own service user and that user has the service role assigned to it, then it should be able to validate expired user tokens using a service token | 14:50 |
| lbragstad | neal: that's exactly how keystonemiddleware works in front of nova for example | 14:50 |
| *** ducttape_ has joined #openstack-keystone | 14:52 | |
| *** tobberyd_ has joined #openstack-keystone | 14:52 | |
| *** tobberydberg has quit IRC | 14:52 | |
| knikolla | neal: basically when forwarding the request, your service should add an x-service-token header which contains a token with the service role in it. the service role is defined in the service configuration for the middleware. | 14:54 |
| neal | @lbragstad: if i don't have , i could add it in user list and assign right role to it? | 14:54 |
| *** ducttape_ has quit IRC | 14:54 | |
| *** links has quit IRC | 14:55 | |
| *** ducttape_ has joined #openstack-keystone | 14:55 | |
| *** tobberyd_ has quit IRC | 14:56 | |
| neal | knikolla: tku. what u said is just i want. | 14:58 |
| neal | knikolla: where can i find the configuration instruction about Service conf of the middleware? | 14:59 |
| ayoung | Policy meeting now? | 15:00 |
| gagehugo | I think in an hour | 15:00 |
| knikolla | neal: https://docs.openstack.org/developer/keystonemiddleware/middlewarearchitecture.html | 15:01 |
| gagehugo | or my DST is still off | 15:01 |
| knikolla | there's a section with the default configuration file. the comments on each configuration option are pretty detailed. look for the service_token_roles section. | 15:01 |
| knikolla | option* | 15:01 |
| knikolla | neal: ^^ | 15:01 |
| neal | @knikolla:tks for your help.... | 15:02 |
| ayoung | https://www.timeanddate.com/worldclock/fixedtime.html?hour=16&min=00&sec=0 | 15:02 |
| ayoung | 1 hour | 15:02 |
| *** rcernin has quit IRC | 15:04 | |
| *** piliman974 has quit IRC | 15:08 | |
| *** spilla has joined #openstack-keystone | 15:09 | |
| *** prashkre has joined #openstack-keystone | 15:09 | |
| lbragstad | gagehugo: knikolla proper fix for the PBR/sphinx issues we ran into yesterday - https://review.openstack.org/#/c/465489/2 | 15:13 |
| lbragstad | ayoung: gagehugo johnthetubaguy edmondsw yep - it's in an hour | 15:14 |
| lbragstad | er - 45 minutes | 15:14 |
| *** tobberydberg has joined #openstack-keystone | 15:19 | |
| knikolla | lbragstad: cool | 15:20 |
| *** henrynash has left #openstack-keystone | 15:21 | |
| *** tobberydberg has quit IRC | 15:24 | |
| *** piliman974 has joined #openstack-keystone | 15:24 | |
| knikolla | lbragstad: is it gonna be a hangout meeting or irc? | 15:40 |
| gagehugo | lbragstad nice | 15:40 |
| lbragstad | knikolla: either or? | 15:41 |
| knikolla | lbragstad: either is fine for me. came prepared with laptop and headphones. | 15:43 |
| *** stingaci has joined #openstack-keystone | 15:45 | |
| *** prashkre has quit IRC | 15:47 | |
| lbragstad | sounds good - we can see what kind of attendance we get and go from there | 15:49 |
| *** prashkre has joined #openstack-keystone | 15:52 | |
| *** aojea has quit IRC | 16:02 | |
| lbragstad | ayoung: are you going to come policy with us? | 16:02 |
| *** rderose has joined #openstack-keystone | 16:09 | |
| *** gyee_ has joined #openstack-keystone | 16:11 | |
| *** pcaruana has quit IRC | 16:11 | |
| *** neal has quit IRC | 16:15 | |
| *** jaosorior is now known as jaosorior_away | 16:17 | |
| *** belmoreira has quit IRC | 16:20 | |
| *** gyee has quit IRC | 16:20 | |
| *** stingaci has quit IRC | 16:32 | |
| *** stingaci has joined #openstack-keystone | 16:32 | |
| *** harlowja has joined #openstack-keystone | 16:32 | |
| *** stingaci has quit IRC | 16:37 | |
| *** prashkre has quit IRC | 16:39 | |
| *** prashkre has joined #openstack-keystone | 16:55 | |
| prashkre | ayoung: Hi. Could you pls take a min to review this https://review.openstack.org/#/c/465395/ | 17:02 |
| ayoung | prashkre, think a fix for that just went in | 17:02 |
| ayoung | knikolla, ^^ | 17:02 |
| knikolla | ayoung: prashkre: that is the backport of my fix. you need someone with +2 on stable. | 17:03 |
| ayoung | prashkre, knikolla added the stable-main-core group to the review | 17:04 |
| ayoung | heh, dolphm still in that group | 17:05 |
| prashkre | ayoung: knikolla: thank you! | 17:05 |
| ayoung | lbragstad, johnthetubaguy gagehugo would it make more sense to make this work in Nova first? | 17:06 |
| ayoung | gagehugo, could do the work, but johnthetubaguy could provide guidance. | 17:06 |
| gagehugo | could yeah | 17:06 |
| ayoung | once we have it there, we extract into oslo- and duplicate in the other projects | 17:06 |
| johnthetubaguy | I think keystone and nova together makes some sense | 17:07 |
| johnthetubaguy | this is blocked for this cycle in Nova though | 17:07 |
| ayoung | does not have to work *everywhere* in order to move to oslo-db, just shake out the logic in a few API calls | 17:07 |
| johnthetubaguy | spec has missed the deadline | 17:07 |
| ayoung | its a bug fix | 17:07 |
| ayoung | Which some clown moved from Critical to Wishlist | 17:07 |
| johnthetubaguy | I am confused, I have to go cook now, lets catch up later | 17:07 |
| ayoung | johnthetubaguy, and by Clown, I mean sdague whom I do not really think is a clown | 17:08 |
| ayoung | https://bugs.launchpad.net/keystone/+bug/968696/comments/55 | 17:09 |
| openstack | Launchpad bug 968696 in OpenStack Identity (keystone) ""admin"-ness not properly scoped" [High,In progress] - Assigned to Gage Hugo (gagehugo) | 17:09 |
| *** aojea has joined #openstack-keystone | 17:15 | |
| *** aojea has quit IRC | 17:19 | |
| *** harlowja has quit IRC | 17:26 | |
| lbragstad | ayoung: johnthetubaguy yeah - let's sync up later, ping when you're available | 17:29 |
| *** jamielennox is now known as jamielennox|away | 17:59 | |
| *** aojea has joined #openstack-keystone | 18:00 | |
| *** jamielennox|away is now known as jamielennox | 18:05 | |
| *** aojea has quit IRC | 18:21 | |
| *** aojea has joined #openstack-keystone | 18:31 | |
| *** ayoung has quit IRC | 18:41 | |
| openstackgerrit | Felipe Monteiro proposed openstack/keystone-specs master: Patrole (RBAC) Keystone Gating https://review.openstack.org/464678 | 18:41 |
| openstackgerrit | Felipe Monteiro proposed openstack/keystone-specs master: Patrole (RBAC) Keystone Gating https://review.openstack.org/464678 | 18:46 |
| *** catintheroof has joined #openstack-keystone | 18:59 | |
| *** prashkre has quit IRC | 19:00 | |
| *** raildo has quit IRC | 19:05 | |
| *** mordred has quit IRC | 19:05 | |
| *** mordred has joined #openstack-keystone | 19:07 | |
| *** piliman974 has quit IRC | 19:18 | |
| openstackgerrit | Gage Hugo proposed openstack/keystone master: Prep for is_admin_project check for scoped operations https://review.openstack.org/462670 | 19:30 |
| openstackgerrit | Gage Hugo proposed openstack/keystone master: Add is_admin_project check to policy for non scoped operations https://review.openstack.org/257636 | 19:30 |
| *** tobberydberg has joined #openstack-keystone | 19:31 | |
| *** jose-phillips has quit IRC | 19:34 | |
| *** clenimar has joined #openstack-keystone | 19:34 | |
| *** harlowja has joined #openstack-keystone | 19:39 | |
| *** stingaci has joined #openstack-keystone | 19:40 | |
| *** piliman974 has joined #openstack-keystone | 19:41 | |
| *** jose-phillips has joined #openstack-keystone | 19:46 | |
| *** jose-phillips has quit IRC | 19:52 | |
| *** harlowja has quit IRC | 19:53 | |
| *** harlowja has joined #openstack-keystone | 19:57 | |
| *** harlowja has quit IRC | 20:00 | |
| *** raildo has joined #openstack-keystone | 20:12 | |
| *** raildo has quit IRC | 20:19 | |
| *** lamt has quit IRC | 20:33 | |
| *** lamt has joined #openstack-keystone | 20:35 | |
| *** jose-phillips has joined #openstack-keystone | 20:39 | |
| *** ducttape_ has quit IRC | 20:45 | |
| *** ducttape_ has joined #openstack-keystone | 20:45 | |
| *** stingaci has quit IRC | 20:47 | |
| *** aojea has quit IRC | 20:50 | |
| *** chlong has quit IRC | 20:52 | |
| *** catintheroof has quit IRC | 21:01 | |
| *** thorst_afk has quit IRC | 21:03 | |
| *** jrist has quit IRC | 21:04 | |
| *** spilla has quit IRC | 21:26 | |
| *** edmondsw has quit IRC | 21:27 | |
| *** edmondsw has joined #openstack-keystone | 21:28 | |
| *** edmondsw_ has joined #openstack-keystone | 21:31 | |
| *** edmondsw has quit IRC | 21:32 | |
| *** edmondsw_ has quit IRC | 21:36 | |
| *** stingaci has joined #openstack-keystone | 21:48 | |
| *** tobberydberg has quit IRC | 21:49 | |
| *** stingaci has quit IRC | 21:53 | |
| *** thorst_afk has joined #openstack-keystone | 22:00 | |
| *** harlowja has joined #openstack-keystone | 22:02 | |
| *** stingaci has joined #openstack-keystone | 22:05 | |
| *** ducttape_ has quit IRC | 22:07 | |
| *** stingaci has quit IRC | 22:09 | |
| *** ducttape_ has joined #openstack-keystone | 22:11 | |
| *** harlowja has quit IRC | 22:18 | |
| *** rderose has quit IRC | 22:19 | |
| *** thorst_afk has quit IRC | 22:20 | |
| rm_work | hey hey | 22:30 |
| rm_work | trying to distinguish between auth_url and auth_uri in [keystone_authtoken], anyone have a link to a good resource on this? | 22:31 |
| rm_work | googing around now | 22:31 |
| rm_work | I don't even see auth_url mentioned in docs | 22:32 |
| rm_work | did someone invent this at some point and it made it into our example config and is now stuck like old gum under the seat in a movie theater? | 22:32 |
| rm_work | seems so | 22:33 |
| rm_work | possibly got copied from [service_auth] which is used by ... I'm not sure what | 22:33 |
| rm_work | yeah ok I think I answered my own question, but would be awesome if someone wanted to confirm that "auth_url" isn't a real thing and only to use "auth_uri" | 22:36 |
| *** erhudy has quit IRC | 22:55 | |
| *** lamt has quit IRC | 22:57 | |
| rm_work | This page has "identity_uri": https://docs.openstack.org/admin-guide/identity-auth-token-middleware.html | 22:58 |
| rm_work | What does providing both that and auth_uri do? | 22:58 |
| *** piliman974 has quit IRC | 22:58 | |
| rm_work | THIS: https://github.com/openstack/keystonemiddleware/blob/master/keystonemiddleware/auth_token/__init__.py#L191 | 23:00 |
| rm_work | Seems to show "auth_url"! | 23:00 |
| rm_work | and is completely different option names from ANYTHING in the docs above | 23:00 |
| rm_work | the actual options file seems to show "auth_uri" being correct: https://github.com/openstack/keystonemiddleware/blob/master/keystonemiddleware/auth_token/_opts.py#L31 | 23:02 |
| rm_work | but, since that's the public endpoint and not the admin endpoint, that can't be what the service uses to actually check tokens, right? :/ | 23:04 |
| rm_work | everything I see seems to contradict everything else, I could use some advice T_T | 23:04 |
| *** lbragstad has quit IRC | 23:10 | |
| rm_work | The example here uses yet a different combination of things: http://www.jamielennox.net/blog/2015/02/23/v3-authentication-with-auth-token-middleware/ | 23:15 |
| rm_work | now we've got "project_name" instead of "admin_tenant_name" | 23:15 |
| rm_work | which I can't even find when searching the keystone_middleware github project | 23:16 |
| rm_work | jamielennox: advice? | 23:16 |
| *** dikonoor has joined #openstack-keystone | 23:19 | |
| rm_work | trying to follow the code, I've ended up ... here? https://github.com/openstack/keystoneauth/blob/master/keystoneauth1/loading/_plugins/identity/v3.py | 23:20 |
| *** thorst_afk has joined #openstack-keystone | 23:20 | |
| *** ducttape_ has quit IRC | 23:25 | |
| *** thorst_afk has quit IRC | 23:41 | |
| rm_work | jamielennox: your guide is the most useful/accurate one i've found so far -- using those things, it seems to actually *work*, unlike any of the actual openstack docs... though I'm still unsure what auth_uri is for | 23:41 |
| rm_work | since it seems to work with only auth_url | 23:42 |
| rm_work | OH I need to just read the text of your article more closely, derp | 23:42 |
| *** piliman974 has joined #openstack-keystone | 23:44 | |
| *** tobberydberg has joined #openstack-keystone | 23:50 | |
| *** tobberydberg has quit IRC | 23:54 | |
| jamielennox | rm_work: whoa, sorry, just got here | 23:55 |
| rm_work | lol no worries, I have a tendency to just spit out words :P | 23:55 |
| rm_work | thanks for the good blog post though | 23:56 |
| rm_work | the configs recommended in the openstack deploy guides just *don't work* | 23:56 |
| jamielennox | so auth_uri is a poorly named variable - but really all it does is when you get a 401 Unauthorized it puts it in to the headers as the place to go for auth | 23:56 |
| jamielennox | which AFAIK no client actually respects | 23:56 |
| rm_work | lol ... yeah | 23:56 |
| jamielennox | auth_url is a required field of most of the auth plugins | 23:56 |
| rm_work | the config docs all say use "admin_tenant_name" not "project_name" | 23:56 |
| rm_work | which ... doesn't work | 23:57 |
| jamielennox | really? which ones | 23:57 |
| rm_work | https://docs.openstack.org/admin-guide/identity-auth-token-middleware.html | 23:57 |
| jamielennox | i... where does that even come from? | 23:57 |
| rm_work | it was somewhere else too, looking... | 23:58 |
| jamielennox | auth_strategy=keystone? that's a purely nova thing i think we tried to deprecate | 23:58 |
| rm_work | ah it's in my own project's example config | 23:58 |
| rm_work | yeah my project does have that too | 23:58 |
| jamielennox | as was putting config into paste.ini | 23:58 |
| rm_work | but that isn't actually keystone_middleware related | 23:58 |
| jamielennox | that whole file is basically wrong | 23:58 |
| rm_work | yes. | 23:58 |
| rm_work | seems so | 23:58 |
| rm_work | also "admin_user" and "admin_password" | 23:59 |
| rm_work | don't work | 23:59 |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!