| *** edmondsw has quit IRC | 00:01 | |
| *** thegreenhundred has joined #openstack-keystone | 00:14 | |
| *** markvoelker_ has quit IRC | 00:27 | |
| *** markvoelker has joined #openstack-keystone | 00:28 | |
| *** markvoelker has quit IRC | 00:28 | |
| *** thorst_afk has joined #openstack-keystone | 00:31 | |
| *** catintheroof has quit IRC | 00:35 | |
| *** markvoelker has joined #openstack-keystone | 00:44 | |
| *** rama_y has quit IRC | 00:48 | |
| *** markvoelker has quit IRC | 00:48 | |
| *** zhurong has joined #openstack-keystone | 00:49 | |
| *** Shunli has joined #openstack-keystone | 00:55 | |
| *** spotz has quit IRC | 01:00 | |
| *** wxy has joined #openstack-keystone | 01:14 | |
| *** spotz has joined #openstack-keystone | 01:35 | |
| *** mjax has quit IRC | 01:36 | |
| *** mjax has joined #openstack-keystone | 01:38 | |
| *** mjax has quit IRC | 01:39 | |
| *** mjax has joined #openstack-keystone | 01:40 | |
| *** thorst_afk has quit IRC | 01:41 | |
| *** mjax has quit IRC | 01:41 | |
| *** sapd has joined #openstack-keystone | 01:42 | |
| *** markvoelker has joined #openstack-keystone | 01:44 | |
| *** aselius has quit IRC | 01:46 | |
| *** sapd has quit IRC | 01:49 | |
| *** thorst_afk has joined #openstack-keystone | 02:00 | |
| *** jmlowe has quit IRC | 02:00 | |
| *** jmlowe has joined #openstack-keystone | 02:01 | |
| *** sapd has joined #openstack-keystone | 02:02 | |
| *** catintheroof has joined #openstack-keystone | 02:03 | |
| *** ducttape_ has joined #openstack-keystone | 02:17 | |
| *** markvoelker has quit IRC | 02:18 | |
| *** otleimat has quit IRC | 02:29 | |
| *** jamesbenson has joined #openstack-keystone | 02:32 | |
| *** jamesbenson has quit IRC | 02:37 | |
| *** thorst_afk has quit IRC | 02:45 | |
| *** thorst_afk has joined #openstack-keystone | 02:46 | |
| *** thorst_afk has quit IRC | 02:50 | |
| *** ducttape_ has quit IRC | 02:57 | |
| *** nicolasbock has quit IRC | 03:05 | |
| *** catintheroof has quit IRC | 03:07 | |
| *** jmlowe has quit IRC | 03:13 | |
| *** jmlowe has joined #openstack-keystone | 03:14 | |
| *** markvoelker has joined #openstack-keystone | 03:15 | |
| *** mjax has joined #openstack-keystone | 03:27 | |
| *** rama_y has joined #openstack-keystone | 03:28 | |
| *** rama_y has quit IRC | 03:29 | |
| *** mjax has quit IRC | 03:29 | |
| *** rama_y has joined #openstack-keystone | 03:29 | |
| *** itlinux has quit IRC | 03:33 | |
| *** links has joined #openstack-keystone | 03:39 | |
| *** thorst_afk has joined #openstack-keystone | 03:47 | |
| *** markvoelker has quit IRC | 03:48 | |
| *** thorst_afk has quit IRC | 03:51 | |
| *** ducttape_ has joined #openstack-keystone | 03:54 | |
| *** rama_y has quit IRC | 04:21 | |
| *** gyee has quit IRC | 04:23 | |
| *** zhurong has quit IRC | 04:29 | |
| *** itlinux has joined #openstack-keystone | 04:35 | |
| *** markvoelker has joined #openstack-keystone | 04:45 | |
| *** thorst_afk has joined #openstack-keystone | 04:47 | |
| *** zhurong has joined #openstack-keystone | 04:48 | |
| *** itlinux has quit IRC | 04:52 | |
| *** thorst_afk has quit IRC | 04:52 | |
| *** ducttape_ has quit IRC | 04:53 | |
| *** aojea has joined #openstack-keystone | 05:16 | |
| *** markvoelker has quit IRC | 05:19 | |
| *** markvoelker has joined #openstack-keystone | 05:24 | |
| *** markvoelker_ has joined #openstack-keystone | 05:25 | |
| *** oomichi has quit IRC | 05:28 | |
| *** markvoelker has quit IRC | 05:29 | |
| *** oomichi has joined #openstack-keystone | 05:30 | |
| *** aojea has quit IRC | 05:41 | |
| *** markvoelker_ has quit IRC | 05:48 | |
| *** thorst_afk has joined #openstack-keystone | 05:48 | |
| *** aojea has joined #openstack-keystone | 05:50 | |
| *** ducttape_ has joined #openstack-keystone | 05:51 | |
| *** edmondsw has joined #openstack-keystone | 05:52 | |
| *** thorst_afk has quit IRC | 05:53 | |
| *** aojea has quit IRC | 06:07 | |
| *** aojea has joined #openstack-keystone | 06:07 | |
| *** jamesbenson has joined #openstack-keystone | 06:09 | |
| *** aojea has quit IRC | 06:12 | |
| *** jamesbenson has quit IRC | 06:13 | |
| *** links has quit IRC | 06:15 | |
| *** pcaruana has joined #openstack-keystone | 06:22 | |
| *** david-lyle has quit IRC | 06:28 | |
| *** david-lyle has joined #openstack-keystone | 06:28 | |
| *** rcernin has joined #openstack-keystone | 06:40 | |
| *** david-lyle has quit IRC | 06:47 | |
| *** dklyle has joined #openstack-keystone | 06:47 | |
| *** thorst_afk has joined #openstack-keystone | 06:49 | |
| *** dklyle has quit IRC | 06:53 | |
| *** david-lyle has joined #openstack-keystone | 06:53 | |
| *** thorst_afk has quit IRC | 06:54 | |
| *** hoonetorg has quit IRC | 07:04 | |
| *** david-lyle has quit IRC | 07:17 | |
| *** hoonetorg has joined #openstack-keystone | 07:17 | |
| *** aojea has joined #openstack-keystone | 07:21 | |
| openstackgerrit | YongMing Zeng proposed openstack/keystone master: Closes-Bug:#1714179 modified: sql.py https://review.openstack.org/499486 | 07:28 |
|---|---|---|
| *** links has joined #openstack-keystone | 07:29 | |
| *** tesseract has joined #openstack-keystone | 07:32 | |
| *** david-lyle has joined #openstack-keystone | 07:35 | |
| *** cfriesen_ has quit IRC | 07:38 | |
| *** oomichi has quit IRC | 07:44 | |
| *** oomichi has joined #openstack-keystone | 07:44 | |
| *** mjax has joined #openstack-keystone | 07:47 | |
| *** mjax has quit IRC | 07:48 | |
| *** thorst_afk has joined #openstack-keystone | 07:50 | |
| *** thorst_afk has quit IRC | 07:55 | |
| *** zsli_ has joined #openstack-keystone | 08:02 | |
| *** zsli_ has quit IRC | 08:03 | |
| *** zsli_ has joined #openstack-keystone | 08:04 | |
| *** Shunli has quit IRC | 08:05 | |
| *** zsli_ has quit IRC | 08:05 | |
| *** zsli_ has joined #openstack-keystone | 08:06 | |
| *** edmondsw has quit IRC | 08:08 | |
| *** zsli_ has quit IRC | 08:17 | |
| *** zsli__ has joined #openstack-keystone | 08:17 | |
| *** openstackgerrit has quit IRC | 08:17 | |
| *** thorst_afk has joined #openstack-keystone | 08:51 | |
| *** thorst_afk has quit IRC | 08:55 | |
| *** zsli__ has quit IRC | 09:11 | |
| *** zsli__ has joined #openstack-keystone | 09:12 | |
| *** Shunli has joined #openstack-keystone | 09:16 | |
| *** Nakato has quit IRC | 09:18 | |
| *** zsli__ has quit IRC | 09:19 | |
| *** Nakato has joined #openstack-keystone | 09:20 | |
| *** Shunli has quit IRC | 09:21 | |
| *** openstackgerrit has joined #openstack-keystone | 09:26 | |
| openstackgerrit | chenaidong1 proposed openstack/keystone master: error sql function https://review.openstack.org/499535 | 09:26 |
| *** jamesbenson has joined #openstack-keystone | 09:28 | |
| *** jamesbenson has quit IRC | 09:32 | |
| openstackgerrit | YongMing Zeng proposed openstack/keystone master: add project extra filed Closes-Bug:#1714179 modified: sql.py https://review.openstack.org/499486 | 09:35 |
| *** hoonetorg has quit IRC | 09:36 | |
| *** thorst_afk has joined #openstack-keystone | 09:51 | |
| *** hoonetorg has joined #openstack-keystone | 09:53 | |
| *** thorst_afk has quit IRC | 09:56 | |
| *** nicolasbock has joined #openstack-keystone | 10:02 | |
| *** nicolasbock has quit IRC | 10:06 | |
| *** nicolasbock has joined #openstack-keystone | 10:19 | |
| *** szaher has quit IRC | 10:41 | |
| *** szaher has joined #openstack-keystone | 10:46 | |
| *** thorst_afk has joined #openstack-keystone | 10:52 | |
| *** thorst_afk has quit IRC | 10:57 | |
| *** jistr is now known as jistr|biab | 11:12 | |
| *** dave-mccowan has joined #openstack-keystone | 11:18 | |
| zhurong | hi, all, I am use session to auth the keystone client, and can list the uses and projects, but can not get the service_catalog info from the client by using `client.service_catalog`, can someone give me some suggestions? thanks | 11:28 |
| *** thorst_afk has joined #openstack-keystone | 11:40 | |
| efried_off | zhurong You should be using keystoneauth1, not keystoneclient. | 11:42 |
| efried_off | And discovery methods, not direct access to the service catalag. | 11:44 |
| cmurphy | zhurong: what's the error message when you try? | 11:48 |
| cmurphy | efried_off: you can still use keystoneclient for keystoney things like users and projects | 11:49 |
| *** efried_off is now known as efried | 11:50 | |
| cmurphy | and it doesn't look lik the service_catalog property of httpclient should be broken afaict | 11:50 |
| efried | cmurphy Okay; thought we were trying to phase ksc out entirely. | 11:50 |
| cmurphy | efried: for auth, but ksa won't ever do things like list projects and whatnot | 11:50 |
| efried | Duly noted, thanks. | 11:51 |
| *** thegreenhundred has quit IRC | 11:55 | |
| zhurong | cmurphy how can we get the service_catalog? | 11:55 |
| *** aojea has quit IRC | 11:56 | |
| cmurphy | zhurong: well the client has a service_catalog property http://git.openstack.org/cgit/openstack/python-keystoneclient/tree/keystoneclient/httpclient.py#n441 so i would think what you're trying would work, i'm wondering what the error message was when you tried it | 11:59 |
| cmurphy | zhurong: efried has a point though, why are you trying to access the catalog directly? | 11:59 |
| zhurong | cmurphy there are no error messages, just None | 12:00 |
| *** raildo has joined #openstack-keystone | 12:01 | |
| zhurong | cmurphy I want get the endpoint using kc.client.service_catalog.url_for(service_type='compute', endpoint_type='publicURL') | 12:02 |
| *** mvk has joined #openstack-keystone | 12:03 | |
| zhurong | cmurphy This code used to work | 12:04 |
| cmurphy | zhurong: ah that is definitely something that keystoneauth should be doing, see https://docs.openstack.org/keystoneauth/latest/using-sessions.html | 12:04 |
| zhurong | cmurphy yeah, I am using the session way like the docs | 12:04 |
| zhurong | cmurphy and then can not get the endpoint from this code `kc.client.service_catalog.url_for(service_type='compute', endpoint_type='publicURL')` | 12:05 |
| zhurong | cmurphy seems we can not get service_catalog directly, thanks. I will change the way | 12:09 |
| cmurphy | zhurong: hmm it could be that all of the recent changes in keystoneauth broke something in keystoneclient :( | 12:14 |
| cmurphy | zhurong: let us know if you can't get it working | 12:14 |
| *** jistr|biab is now known as jistr | 12:20 | |
| *** catintheroof has joined #openstack-keystone | 12:30 | |
| *** rama_y has joined #openstack-keystone | 12:34 | |
| *** jaosorior has quit IRC | 12:37 | |
| *** thegreenhundred has joined #openstack-keystone | 12:38 | |
| *** jaosorior has joined #openstack-keystone | 12:38 | |
| *** hidekazu has joined #openstack-keystone | 12:44 | |
| *** hidekazu has quit IRC | 12:44 | |
| *** jaosorior has quit IRC | 12:44 | |
| *** jaosorior has joined #openstack-keystone | 12:45 | |
| *** jaosorior has quit IRC | 12:45 | |
| *** jaosorior has joined #openstack-keystone | 12:46 | |
| *** dave-mccowan has quit IRC | 12:57 | |
| *** dave-mcc_ has joined #openstack-keystone | 13:09 | |
| *** zhurong has quit IRC | 13:14 | |
| openstackgerrit | Luke Hinds proposed openstack/python-keystoneclient master: Adds bandit nosec flag to hashlib.sha1 https://review.openstack.org/499595 | 13:22 |
| *** rama_y has quit IRC | 13:34 | |
| *** gyee has joined #openstack-keystone | 13:41 | |
| *** edmondsw has joined #openstack-keystone | 13:51 | |
| *** ducttape_ has quit IRC | 13:56 | |
| *** ducttape_ has joined #openstack-keystone | 13:57 | |
| *** josecastroleon has quit IRC | 13:57 | |
| *** jaosorior has quit IRC | 13:57 | |
| *** jaosorior has joined #openstack-keystone | 13:59 | |
| *** josecastroleon has joined #openstack-keystone | 13:59 | |
| *** cristicalin has joined #openstack-keystone | 14:05 | |
| *** ducttape_ has quit IRC | 14:11 | |
| *** itlinux has joined #openstack-keystone | 14:15 | |
| *** gyee has quit IRC | 14:17 | |
| *** gyee has joined #openstack-keystone | 14:17 | |
| openstackgerrit | Luke Hinds proposed openstack/python-keystoneclient master: Adds bandit nosec flag to hashlib.sha1 https://review.openstack.org/499595 | 14:22 |
| *** ioggstream has joined #openstack-keystone | 14:22 | |
| gagehugo | lbragstad ^ | 14:24 |
| gagehugo | there's a ps in bandit to add sha1 to the list of unsecure hashes, but it currently fails on keystone and ksc, but we use hmac-sha1 which isn't "insecure" so it's more or less a false flag | 14:27 |
| *** cfriesen_ has joined #openstack-keystone | 14:31 | |
| lbragstad | kmalloc: do you happen to know why groups don't have an `enabled` attribute? | 14:41 |
| *** jamesbenson has joined #openstack-keystone | 14:42 | |
| *** ducttape_ has joined #openstack-keystone | 14:44 | |
| *** ducttap__ has joined #openstack-keystone | 14:45 | |
| *** rama_y has joined #openstack-keystone | 14:45 | |
| *** rama_y has quit IRC | 14:46 | |
| *** josecastroleon has quit IRC | 14:48 | |
| *** ducttape_ has quit IRC | 14:48 | |
| *** josecastroleon has joined #openstack-keystone | 14:51 | |
| *** josecastroleon has quit IRC | 14:53 | |
| *** cristicalin has quit IRC | 15:08 | |
| *** cristicalin has joined #openstack-keystone | 15:10 | |
| *** kbaegis has joined #openstack-keystone | 15:12 | |
| *** cristicalin has quit IRC | 15:13 | |
| *** lwanderley has joined #openstack-keystone | 15:17 | |
| kmalloc | uh | 15:23 |
| kmalloc | because we never needed it? | 15:23 |
| kmalloc | groups themselves kindof never justified an enabled/disabled attr | 15:23 |
| kmalloc | if we need it, it is easy to add, but it would only affect user->(group)role->project not anything else | 15:23 |
| kmalloc | unless we break functionality (aka disabled group = user disabled) | 15:23 |
| kmalloc | vs domain disable | 15:24 |
| lbragstad | yeah - just curious, | 15:26 |
| lbragstad | for some reason i thought that was implemented given the pattern in the rest of the keystone entities | 15:27 |
| lbragstad | so i wrote a test for it in the global roles work | 15:27 |
| lbragstad | then i realized it wasn't possible | 15:27 |
| lbragstad | :) | 15:27 |
| lbragstad | cc hrybacki ^ | 15:27 |
| kmalloc | i am not opposed to adding it | 15:28 |
| kmalloc | but *shrug* i'd like a clear story on what we're using it for | 15:28 |
| kmalloc | lbragstad: i have a chunk of the code for removing the @dependency decorators | 15:29 |
| lbragstad | kmalloc: yeah - let's wait for that | 15:29 |
| kmalloc | working on it npow | 15:29 |
| lbragstad | kmalloc: damn... which ones? | 15:29 |
| kmalloc | now* | 15:29 |
| kmalloc | all of them. | 15:29 |
| lbragstad | i have a string of patches, too | 15:29 |
| kmalloc | my code is deleting the entire @provides and @requires | 15:29 |
| lbragstad | oh... | 15:29 |
| lbragstad | wait | 15:29 |
| lbragstad | nevermind | 15:29 |
| kmalloc | though we could keep @requires | 15:29 |
| lbragstad | sorry - i thought you were talkinhg about @v2_deprecated | 15:29 |
| kmalloc | no no, that was on my list for post PTG | 15:30 |
| kmalloc | i didn't want to touch it until people were back and fully engaged | 15:30 |
| kmalloc | in short... | 15:31 |
| kmalloc | https://www.irccloud.com/pastebin/Fzshpyyv/ | 15:32 |
| kmalloc | ^ | 15:32 |
| lbragstad | nice | 15:32 |
| kmalloc | manager (on __init__) registers with that object | 15:32 |
| *** pcaruana has quit IRC | 15:32 | |
| kmalloc | and then we do provider_api.<blah>_api | 15:32 |
| kmalloc | instead of self.<blah>_api | 15:32 |
| kmalloc | basically, we make the managers (effectively) singletons | 15:33 |
| kmalloc | i have a couple more enhancements to make (such as locking the provider_api registry) | 15:34 |
| lbragstad | yeah - i guess my main motivation for digging into dstanek's stuff was to get rid of the anti-pattern of having to register providers] | 15:34 |
| kmalloc | well, this will simplify it all | 15:34 |
| kmalloc | no more registering | 15:34 |
| lbragstad | aweseome | 15:34 |
| kmalloc | no more decorators | 15:34 |
| lbragstad | i'm game | 15:34 |
| kmalloc | just use the api you need. | 15:34 |
| lbragstad | ++ | 15:34 |
| kmalloc | and if it's a manager, it is auto-registered | 15:34 |
| kmalloc | i did add a __provides_api attribute | 15:35 |
| kmalloc | to the manager | 15:35 |
| kmalloc | felt easier than decorators or other magic | 15:35 |
| lbragstad | right | 15:36 |
| *** edmondsw has quit IRC | 15:40 | |
| *** otleimat has joined #openstack-keystone | 15:42 | |
| *** itlinux has quit IRC | 15:46 | |
| kmalloc | lbragstad: hm | 15:47 |
| kmalloc | lbragstad: this change is going to be massive | 15:47 |
| kmalloc | lbragstad: i think i'm going to undo it and still lean on self.XXX_api | 15:48 |
| knikolla | o/ | 15:48 |
| kmalloc | simply to not have a 5000+line change | 15:48 |
| lbragstad | kmalloc: yeah... that's a lot | 15:48 |
| kmalloc | because every single self.XXX_api call would be changed. | 15:48 |
| kmalloc | that is uuuugly | 15:48 |
| lbragstad | kmalloc: can we do it in two steps? | 15:49 |
| lbragstad | somehow? | 15:49 |
| kmalloc | yeah | 15:49 |
| kmalloc | well i'm just going to lean on __getattrr__ | 15:49 |
| *** ayoung has joined #openstack-keystone | 15:50 | |
| *** edmondsw has joined #openstack-keystone | 15:51 | |
| *** kbaegis has quit IRC | 15:55 | |
| *** kbaegis has joined #openstack-keystone | 15:55 | |
| *** edmondsw has quit IRC | 15:56 | |
| *** mvk has quit IRC | 15:59 | |
| *** lwanderley has quit IRC | 15:59 | |
| knikolla | lbragstad: starting today, i'm back to my usual level of keystone involvement. | 16:05 |
| lbragstad | knikolla: whew :) that's good to hear | 16:06 |
| *** rama_y has joined #openstack-keystone | 16:11 | |
| *** lwanderley has joined #openstack-keystone | 16:11 | |
| lbragstad | knikolla: did you get the ceph thing figured out? | 16:15 |
| knikolla | lbragstad: unfortunately not. we declared death yesterday. | 16:17 |
| lbragstad | :( | 16:17 |
| knikolla | a manual step went awry and there was a big % of placement groups lost, so chances of getting a full multi-gigabyte rbd object out of it are very small. | 16:18 |
| *** hoonetorg has quit IRC | 16:18 | |
| knikolla | i'll probably blog a write-up in the coming days. | 16:18 |
| *** jamesbenson has quit IRC | 16:19 | |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone master: WIP: Remove dependency injection https://review.openstack.org/499703 | 16:23 |
| kmalloc | lbragstad: ^ that is the 1st WIP, i could split it into 2 patches though. | 16:24 |
| kmalloc | add functionality, and then a delete decorators | 16:24 |
| kmalloc | it wont pass tests. | 16:24 |
| kmalloc | because injection tests just aren't fixed | 16:24 |
| kmalloc | (it wont pep8 either) | 16:24 |
| kmalloc | lbragstad: but i wanted your opinion on the direction before doing the next round of cleanup | 16:24 |
| *** jamesbenson has joined #openstack-keystone | 16:28 | |
| *** jamesbenson has quit IRC | 16:30 | |
| *** jistr is now known as jistr|afk | 16:31 | |
| lbragstad | kmalloc: awesome - i'll take a look | 16:31 |
| *** kbaegis has quit IRC | 16:31 | |
| *** kbaegis1 has joined #openstack-keystone | 16:31 | |
| lbragstad | i'm about to push a bunch of cleanup myself | 16:31 |
| *** browne has joined #openstack-keystone | 16:42 | |
| *** jamesbenson has joined #openstack-keystone | 16:45 | |
| *** mjax has joined #openstack-keystone | 16:46 | |
| *** itlinux has joined #openstack-keystone | 16:46 | |
| *** jamesbenson has quit IRC | 16:48 | |
| *** lwanderley has quit IRC | 16:58 | |
| *** lwanderley has joined #openstack-keystone | 16:58 | |
| *** dave-mcc_ is now known as dave-mccowan | 17:01 | |
| openstackgerrit | Gage Hugo proposed openstack/keystone master: Add JSON schema validation for project tags https://review.openstack.org/484483 | 17:02 |
| openstackgerrit | Gage Hugo proposed openstack/keystone master: Add database migration for project tags https://review.openstack.org/484456 | 17:02 |
| openstackgerrit | Gage Hugo proposed openstack/keystone master: Add policy for project tags https://review.openstack.org/486757 | 17:02 |
| openstackgerrit | Gage Hugo proposed openstack/keystone master: Refactor removal of duplicate projects/domains https://review.openstack.org/491574 | 17:02 |
| openstackgerrit | Gage Hugo proposed openstack/keystone master: Implement backend logic for project tags https://review.openstack.org/499726 | 17:02 |
| openstackgerrit | Gage Hugo proposed openstack/keystone master: Implement project tags logic into manager https://review.openstack.org/499727 | 17:02 |
| openstackgerrit | Gage Hugo proposed openstack/keystone master: Implement project tags API controller and router https://review.openstack.org/499728 | 17:02 |
| *** aojea has joined #openstack-keystone | 17:07 | |
| *** jamesbenson has joined #openstack-keystone | 17:07 | |
| *** ayoung has quit IRC | 17:07 | |
| *** aojea has quit IRC | 17:10 | |
| *** aojea has joined #openstack-keystone | 17:10 | |
| *** jamesbenson has quit IRC | 17:10 | |
| *** rcernin has quit IRC | 17:12 | |
| *** tesseract has quit IRC | 17:14 | |
| itlinux | hi all, what's the best way to assign roles to a group? | 17:18 |
| *** aojea has quit IRC | 17:19 | |
| *** aojea has joined #openstack-keystone | 17:20 | |
| *** aojea has quit IRC | 17:24 | |
| *** kbaegis1 has quit IRC | 17:31 | |
| lbragstad | itlinux: we have an api for that here https://developer.openstack.org/api-ref/identity/v3/index.html#roles | 17:33 |
| *** aahh has joined #openstack-keystone | 17:33 | |
| lbragstad | PUT /v3/projects/{project_id}/groups/{group_id}/roles/{role_id} will grant a group a role on a project | 17:33 |
| lbragstad | for example | 17:33 |
| *** browne has quit IRC | 17:37 | |
| *** kbaegis has joined #openstack-keystone | 17:42 | |
| *** edmondsw has joined #openstack-keystone | 17:42 | |
| *** edmondsw_ has joined #openstack-keystone | 17:44 | |
| *** edmondsw has quit IRC | 17:46 | |
| *** edmondsw_ has quit IRC | 17:48 | |
| *** jistr|afk is now known as jistr | 17:50 | |
| *** links has quit IRC | 17:52 | |
| *** ioggstream has quit IRC | 17:57 | |
| aahh | hi @lbragstad | 18:02 |
| lbragstad | o/ | 18:02 |
| aahh | how exactly do we sanitize our logs | 18:02 |
| aahh | which has passwords and cookies | 18:02 |
| lbragstad | aahh: what debug level are you using/ | 18:03 |
| aahh | i hapened to read up https://security.openstack.org/guidelines/dg_protect-sensitive-data-in-files.html | 18:03 |
| lbragstad | if you use debug level logging it can be insecure | 18:03 |
| aahh | yeah right now its not secure | 18:04 |
| lbragstad | yeah - ^ that's an example of DEBUG log level exposing sensitive information | 18:04 |
| lbragstad | if you use a lower debug level, that information shouldn't be exposed | 18:04 |
| aahh | okay besides the debug levels , is there a way I can handle the sensitive information on the logs | 18:05 |
| lbragstad | aahh: this is a related bug report that has some context - https://bugs.launchpad.net/keystoneauth/+bug/1638978 | 18:05 |
| openstack | Launchpad bug 1638978 in keystoneauth "Debug data isn't sanitized" [Medium,Triaged] - Assigned to Dinesh Bhor (dinesh-bhor) | 18:05 |
| *** ducttap__ has quit IRC | 18:06 | |
| cmurphy | in theory even debug shouldn't expose super-sensitive things https://bugs.launchpad.net/keystone/+bug/1479523 | 18:06 |
| openstack | Launchpad bug 1479523 in OpenStack Identity (keystone) "Stop using debug for insecure responses" [Wishlist,Fix released] - Assigned to Brant Knudson (blk-u) | 18:06 |
| lbragstad | cmurphy: ++ | 18:07 |
| lbragstad | it would be good to get that fixed, too | 18:07 |
| lbragstad | i know the debug level stuff has been proposed as a work around | 18:07 |
| *** dave-mccowan has quit IRC | 18:07 | |
| aahh | how exactly does the config files protection work , what i mean is based on the link here https://security.openstack.org/guidelines/dg_protect-sensitive-data-in-files.html | 18:09 |
| aahh | is it possible to leverage this | 18:09 |
| *** jdennis has quit IRC | 18:09 | |
| lbragstad | aahh: that's all oslo specific stuff | 18:09 |
| lbragstad | those libraries are what implement the masking of sensitive data | 18:09 |
| aahh | okay , i guess then this still doesnt help securing what we want to if the debug levels are high | 18:11 |
| *** ducttape_ has joined #openstack-keystone | 18:11 | |
| lbragstad | which options are being leaked and are they not flagged with `secret=True` in the project? | 18:12 |
| *** edmondsw has joined #openstack-keystone | 18:12 | |
| *** dave-mccowan has joined #openstack-keystone | 18:15 | |
| aahh | not right now , am just developing a new identity driver and it handles few cookie information which are not declared as 'secret=True' at the moment | 18:15 |
| lbragstad | ah - if you set secret does that fix the issue? | 18:15 |
| *** ducttape_ has quit IRC | 18:16 | |
| aahh | i havent tested yet , I wanted to know where is the file location where we can setup this | 18:16 |
| *** edmondsw has quit IRC | 18:17 | |
| *** edmondsw has joined #openstack-keystone | 18:17 | |
| lbragstad | aahh: i assume you're setting configuration options for your identity driver? | 18:19 |
| lbragstad | aahh: you could probably tack those options into keystone or create a separate configuration file | 18:19 |
| *** brad[]` has quit IRC | 18:20 | |
| aahh | I prefer to write a seperate config file but for now , could you point out where in keystone can we have that set up | 18:20 |
| *** browne has joined #openstack-keystone | 18:20 | |
| *** ducttape_ has joined #openstack-keystone | 18:21 | |
| *** jistr is now known as jistr|off | 18:21 | |
| *** edmondsw has quit IRC | 18:21 | |
| *** browne has quit IRC | 18:22 | |
| aahh | is it keystone/conf/auth.py | 18:22 |
| *** kbaegis has quit IRC | 18:23 | |
| *** kbaegis has joined #openstack-keystone | 18:24 | |
| *** edmondsw has joined #openstack-keystone | 18:25 | |
| *** jdennis has joined #openstack-keystone | 18:26 | |
| *** edmondsw has quit IRC | 18:29 | |
| *** lwanderley has quit IRC | 18:30 | |
| *** lwanderley has joined #openstack-keystone | 18:32 | |
| lbragstad | aahh: https://github.com/openstack/keystone/blob/master/keystone/conf/identity.py is where the identity options are registered | 18:37 |
| aahh | great, so I create an entry point for the cookie in this file and fetch it from this file as keystone.conf.identity.cookie inside my identity driver | 18:39 |
| lbragstad | right - so long as it's registered you should be able to use the oslo.config CONF object to retrieve it | 18:46 |
| lbragstad | CONF.identity.cookie, for example | 18:46 |
| *** jamesbenson has joined #openstack-keystone | 18:59 | |
| *** rcernin has joined #openstack-keystone | 19:01 | |
| *** jamesbenson has quit IRC | 19:03 | |
| *** jose-phillips has quit IRC | 19:04 | |
| *** jose-phillips has joined #openstack-keystone | 19:07 | |
| *** edmondsw has joined #openstack-keystone | 19:07 | |
| knikolla | lbragstad: so the spec for global roles hasn't merged yet right? | 19:10 |
| lbragstad | knikolla: no - i need to respin it | 19:10 |
| lbragstad | some have reviewed it and pointed out some useful bits | 19:10 |
| aahh | @lbragstad : however when i try to retrieve on the code , it throws an error on the type found. Expected string and the server could not comply with the request | 19:11 |
| lbragstad | aahh: do you have a paste? | 19:11 |
| *** edmondsw has quit IRC | 19:12 | |
| *** hoonetorg has joined #openstack-keystone | 19:14 | |
| aahh | @lbragstad : http://paste.openstack.org/show/DtOn6ZVIjb1fy6XA2LnT/ | 19:17 |
| lbragstad | aahh: did you add the new opt to https://github.com/openstack/keystone/blob/master/keystone/conf/auth.py#L80 | 19:19 |
| lbragstad | >? | 19:19 |
| aahh | I have only modified the existing password opt | 19:20 |
| aahh | i just set that one to 'secret = True' | 19:20 |
| *** brad[] has joined #openstack-keystone | 19:21 | |
| *** jose-phillips has quit IRC | 19:22 | |
| lbragstad | aahh: oh - that's the name of a plugin - it's not actually used as a passwor d | 19:23 |
| lbragstad | so protecting it with secret=True won't do much | 19:23 |
| lbragstad | you might need to add a different option to pull in the value you want | 19:24 |
| aahh | where exactly do we set up the config for this specific user case , is it possible | 19:24 |
| lbragstad | aahh: maybe something like http://paste.openstack.org/show/620133/ | 19:25 |
| *** jamesbenson has joined #openstack-keystone | 19:27 | |
| *** ducttape_ has quit IRC | 19:27 | |
| *** ducttape_ has joined #openstack-keystone | 19:27 | |
| *** edmondsw has joined #openstack-keystone | 19:28 | |
| *** jamesbenson has quit IRC | 19:31 | |
| *** edmondsw has quit IRC | 19:32 | |
| *** jamesbenson has joined #openstack-keystone | 19:34 | |
| *** aselius has joined #openstack-keystone | 19:35 | |
| aahh | okay , i guess there is a problem with that , the input that I make use to get the cookie is the password itself . So technically I need a way to sanitize them on the logs | 19:36 |
| aahh | sorry for the confusion | 19:36 |
| aahh | @lbragstad | 19:36 |
| lbragstad | ahh - so you were passing the cookie in the actual request to keystone? | 19:37 |
| lbragstad | not by specifying it in configuration | 19:37 |
| *** brad[] has quit IRC | 19:38 | |
| aahh | its the same password we get in from the client and checked in the identity driver whether its a password or cookie and then validated accordingly , handled on the code | 19:40 |
| *** tonytan4ever has joined #openstack-keystone | 19:50 | |
| *** brad[] has joined #openstack-keystone | 20:06 | |
| *** cristicalin has joined #openstack-keystone | 20:09 | |
| *** lwanderley has quit IRC | 20:12 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Remove v2.0 service and endpoint APIs https://review.openstack.org/499779 | 20:16 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: more catalog things for pep8 https://review.openstack.org/499780 | 20:16 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Remove v2.0 assignment APIs https://review.openstack.org/499781 | 20:16 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Remove v2.0 resource APIs https://review.openstack.org/499782 | 20:16 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Remove v2.0 identity APIs https://review.openstack.org/499783 | 20:16 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Remove v2.0 token APIs https://review.openstack.org/499784 | 20:16 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Remove the v2_deprecated decorator https://review.openstack.org/499785 | 20:16 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Remove the v2_deprecated decorator https://review.openstack.org/499785 | 20:18 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Remove v2.0 token APIs https://review.openstack.org/499784 | 20:18 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Remove v2.0 service and endpoint APIs https://review.openstack.org/499779 | 20:18 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Remove v2.0 assignment APIs https://review.openstack.org/499781 | 20:18 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Remove v2.0 identity APIs https://review.openstack.org/499783 | 20:18 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Remove v2.0 resource APIs https://review.openstack.org/499782 | 20:18 |
| gagehugo | oh my | 20:18 |
| lbragstad | yeah... | 20:18 |
| lbragstad | i'm fried | 20:19 |
| knikolla | that is beautiful | 20:19 |
| lbragstad | i just about cried when i deleted the keystone.resource.controllers.Tenant | 20:20 |
| lbragstad | straight up tears of joy | 20:20 |
| gagehugo | are we keeping anything from v2? | 20:21 |
| knikolla | auth | 20:21 |
| lbragstad | we haev to keep the v2 authentication api and ec2 api | 20:21 |
| gagehugo | ah | 20:21 |
| lbragstad | until the T release | 20:21 |
| gagehugo | ew | 20:21 |
| lbragstad | but... we've gotten rid of a lot of intermix testing as a result | 20:22 |
| lbragstad | which should actually give us an opportunity to clean up a lot of our tests | 20:22 |
| knikolla | lbragstad: won't they fail tempest? | 20:28 |
| lbragstad | knikolla: yeah - i'm sure they will | 20:28 |
| lbragstad | i still need to get a patch up to address that | 20:29 |
| knikolla | so i'll hold my horses on the +2 button. | 20:30 |
| lbragstad | knikolla: yeah - mostly just wanted to get that proposed for the PTG in case we need to run it by anyone there | 20:32 |
| knikolla | cool :) | 20:32 |
| openstackgerrit | Gage Hugo proposed openstack/python-keystoneclient master: Adds bandit nosec flag to hashlib.sha1 https://review.openstack.org/499595 | 20:34 |
| *** jose-phillips has joined #openstack-keystone | 20:35 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Remove unused v2.0 test utilities https://review.openstack.org/499791 | 20:35 |
| *** jamesbenson has quit IRC | 20:41 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Remove deprecated secure_proxy_ssl_header config https://review.openstack.org/499798 | 20:50 |
| *** jamesbenson has joined #openstack-keystone | 20:51 | |
| breton | wow | 20:52 |
| *** jamesbenson has quit IRC | 20:55 | |
| lbragstad | i feel like i just deleted half of keystone | 21:00 |
| kmalloc | lbragstad: lol | 21:04 |
| kmalloc | lbragstad: dude. i will so be happy to +2/+A those | 21:04 |
| kmalloc | i hope it only fails v2-identity specific tests in tempest | 21:05 |
| kmalloc | lbragstad: i will be *very* stoked to see that go away | 21:05 |
| *** nkinder has quit IRC | 21:08 | |
| *** thorst_afk has quit IRC | 21:08 | |
| *** tonytan4ever has quit IRC | 21:12 | |
| lbragstad | kmalloc: me too | 21:14 |
| *** raildo has quit IRC | 21:16 | |
| *** dave-mccowan has quit IRC | 21:20 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Remove deprecated secure_proxy_ssl_header config https://review.openstack.org/499798 | 21:23 |
| *** nkinder has joined #openstack-keystone | 21:23 | |
| *** catintheroof has quit IRC | 21:31 | |
| *** cfriesen_ is now known as cfriesen | 21:34 | |
| *** thorst_afk has joined #openstack-keystone | 21:34 | |
| *** thorst_afk has quit IRC | 21:36 | |
| *** thorst_afk has joined #openstack-keystone | 21:39 | |
| cfriesen | is there a way to list which users are in a group via the openstack client? | 22:12 |
| lbragstad | openstack role assignment list should help with that | 22:13 |
| lbragstad | cfriesen: openstack group contains user is specifically built for that | 22:16 |
| *** ducttape_ has quit IRC | 22:17 | |
| *** ducttape_ has joined #openstack-keystone | 22:18 | |
| cfriesen | lbragstad: that's not quite what I'm looking for though, since it asks for the user/group up front. "openstack role assignment list" seems to work | 22:18 |
| lbragstad | cfriesen: `openstack group contains user $GROUP $USER` | 22:18 |
| *** cristicalin has quit IRC | 22:19 | |
| lbragstad | cfriesen: oh - you're looking for who is in a group? | 22:19 |
| cfriesen | lbragstad: yes | 22:19 |
| lbragstad | cfriesen: we do have an api for that | 22:19 |
| lbragstad | https://developer.openstack.org/api-ref/identity/v3/index.html#groups | 22:19 |
| lbragstad | but it doesn't look like it's being covered by the openstack client | 22:20 |
| lbragstad | GET v | 22:20 |
| lbragstad | GET /v3/groups/{group_id}/users | 22:20 |
| *** aojea has joined #openstack-keystone | 22:20 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Remove the v2_deprecated decorator https://review.openstack.org/499785 | 22:21 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Remove v2.0 token APIs https://review.openstack.org/499784 | 22:21 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Remove unused v2.0 test utilities https://review.openstack.org/499791 | 22:21 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Remove v2.0 assignment APIs https://review.openstack.org/499781 | 22:21 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Remove v2.0 identity APIs https://review.openstack.org/499783 | 22:21 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Remove v2.0 resource APIs https://review.openstack.org/499782 | 22:21 |
| cfriesen | "openstack role assignment list --project <project_id>" comes close enough for my purposes, though maybe a bit indirect. | 22:21 |
| lbragstad | cfriesen: sounds good | 22:22 |
| *** ducttape_ has quit IRC | 22:22 | |
| *** aojea has quit IRC | 22:25 | |
| *** edmondsw has joined #openstack-keystone | 22:30 | |
| *** rcernin has quit IRC | 22:30 | |
| *** itlinux has quit IRC | 22:34 | |
| *** aojea has joined #openstack-keystone | 22:37 | |
| *** thegreenhundred has quit IRC | 22:38 | |
| *** nkinder has quit IRC | 22:41 | |
| *** nkinder has joined #openstack-keystone | 22:53 | |
| *** aojea has quit IRC | 22:58 | |
| *** aojea has joined #openstack-keystone | 22:58 | |
| *** aojea has quit IRC | 23:03 | |
| *** aahh has quit IRC | 23:07 | |
| *** kbaegis has quit IRC | 23:20 | |
| *** thorst_afk has quit IRC | 23:39 | |
| *** ducttape_ has joined #openstack-keystone | 23:41 | |
| *** rama_y has quit IRC | 23:48 | |
| *** edmondsw has quit IRC | 23:48 | |
| *** catintheroof has joined #openstack-keystone | 23:55 | |
| *** flwang has left #openstack-keystone | 23:55 | |
| *** edmondsw has joined #openstack-keystone | 23:59 | |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!