| *** gyee has quit IRC | 00:04 | |
| *** oikiki has quit IRC | 00:53 | |
| *** aselius has quit IRC | 00:53 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystonemiddleware master: Updated from global requirements https://review.openstack.org/500005 | 01:02 |
|---|---|---|
| openstackgerrit | OpenStack Proposal Bot proposed openstack/pycadf master: Updated from global requirements https://review.openstack.org/470137 | 01:10 |
| *** prashkre has joined #openstack-keystone | 01:17 | |
| *** erlon has quit IRC | 01:22 | |
| *** jhesketh has quit IRC | 01:51 | |
| *** jhesketh has joined #openstack-keystone | 01:51 | |
| *** dave-mcc_ has quit IRC | 01:57 | |
| *** rarora has quit IRC | 02:00 | |
| *** gagehugo has quit IRC | 02:01 | |
| *** tsufiev has quit IRC | 02:01 | |
| *** timothyb89 has quit IRC | 02:01 | |
| *** hoonetorg has quit IRC | 02:02 | |
| *** afazekas has quit IRC | 02:02 | |
| *** afazekas has joined #openstack-keystone | 02:02 | |
| *** timothyb89 has joined #openstack-keystone | 02:02 | |
| *** tsufiev has joined #openstack-keystone | 02:03 | |
| *** hoonetorg has joined #openstack-keystone | 02:04 | |
| *** gagehugo has joined #openstack-keystone | 02:04 | |
| *** rarora has joined #openstack-keystone | 02:15 | |
| *** oikiki has joined #openstack-keystone | 02:16 | |
| *** oikiki has quit IRC | 02:19 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystonemiddleware master: Updated from global requirements https://review.openstack.org/500005 | 02:35 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/pycadf master: Updated from global requirements https://review.openstack.org/470137 | 02:42 |
| *** nicolasbock has quit IRC | 02:43 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/pycadf master: Updated from global requirements https://review.openstack.org/470137 | 02:58 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystonemiddleware master: Updated from global requirements https://review.openstack.org/500005 | 03:06 |
| *** lbragstad has joined #openstack-keystone | 03:12 | |
| *** ChanServ sets mode: +o lbragstad | 03:12 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/pycadf master: Updated from global requirements https://review.openstack.org/470137 | 03:14 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystonemiddleware master: Updated from global requirements https://review.openstack.org/500005 | 03:27 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/pycadf master: Updated from global requirements https://review.openstack.org/470137 | 03:34 |
| *** markvoelker has quit IRC | 03:36 | |
| *** zzzeek has quit IRC | 03:46 | |
| *** links has joined #openstack-keystone | 03:48 | |
| *** lbragstad has quit IRC | 03:50 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystonemiddleware master: Updated from global requirements https://review.openstack.org/500005 | 03:56 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/pycadf master: Updated from global requirements https://review.openstack.org/470137 | 04:04 |
| *** jdwidari has quit IRC | 04:11 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystonemiddleware master: Updated from global requirements https://review.openstack.org/500005 | 04:12 |
| *** jamielennox has quit IRC | 04:14 | |
| *** cburgess has quit IRC | 04:16 | |
| *** jamielennox has joined #openstack-keystone | 04:18 | |
| *** cburgess has joined #openstack-keystone | 04:19 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/pycadf master: Updated from global requirements https://review.openstack.org/470137 | 04:20 |
| *** prashkre has quit IRC | 04:26 | |
| *** oikiki has joined #openstack-keystone | 04:27 | |
| *** gyee has joined #openstack-keystone | 04:33 | |
| *** zzzeek has joined #openstack-keystone | 04:38 | |
| *** chlong_ has joined #openstack-keystone | 04:51 | |
| *** gyee has quit IRC | 05:05 | |
| *** oikiki has quit IRC | 05:05 | |
| *** prashkre has joined #openstack-keystone | 05:08 | |
| *** oikiki has joined #openstack-keystone | 05:08 | |
| *** oikiki has quit IRC | 05:21 | |
| *** oikiki has joined #openstack-keystone | 05:21 | |
| *** markvoelker has joined #openstack-keystone | 05:37 | |
| openstackgerrit | Adrian Turjak proposed openstack/keystone master: Make name fields a consistent size of 255 https://review.openstack.org/440941 | 05:37 |
| *** oikiki has quit IRC | 05:51 | |
| *** oikiki has joined #openstack-keystone | 05:58 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystonemiddleware master: Updated from global requirements https://review.openstack.org/500005 | 06:04 |
| *** markvoelker has quit IRC | 06:11 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/pycadf master: Updated from global requirements https://review.openstack.org/470137 | 06:12 |
| *** chlong_ has quit IRC | 06:13 | |
| *** rcernin has joined #openstack-keystone | 06:24 | |
| *** prashkre has quit IRC | 06:31 | |
| *** prashkre has joined #openstack-keystone | 06:34 | |
| *** spectr has quit IRC | 06:34 | |
| *** spectr has joined #openstack-keystone | 06:34 | |
| *** tesseract has joined #openstack-keystone | 07:07 | |
| *** markvoelker has joined #openstack-keystone | 07:08 | |
| *** pcaruana has joined #openstack-keystone | 07:08 | |
| *** cfriesen has quit IRC | 07:20 | |
| *** markvoelker has quit IRC | 07:42 | |
| *** daidv has joined #openstack-keystone | 07:48 | |
| *** prashkre_ has joined #openstack-keystone | 07:50 | |
| *** prashkre has quit IRC | 07:54 | |
| *** spectr has quit IRC | 08:09 | |
| *** spectr has joined #openstack-keystone | 08:09 | |
| *** spectr has quit IRC | 08:17 | |
| *** spectr has joined #openstack-keystone | 08:18 | |
| *** oikiki has quit IRC | 08:19 | |
| *** daidv has quit IRC | 08:29 | |
| *** daidv has joined #openstack-keystone | 08:30 | |
| *** markvoelker has joined #openstack-keystone | 08:38 | |
| *** oikiki has joined #openstack-keystone | 08:43 | |
| *** oikiki has quit IRC | 08:48 | |
| *** oikiki has joined #openstack-keystone | 08:55 | |
| *** namnh has joined #openstack-keystone | 09:04 | |
| *** oikiki has quit IRC | 09:06 | |
| *** markvoelker has quit IRC | 09:12 | |
| *** mvk has quit IRC | 09:28 | |
| *** iurygregory has quit IRC | 09:34 | |
| *** rob_d_ has joined #openstack-keystone | 09:34 | |
| *** rob_d_ has left #openstack-keystone | 09:44 | |
| *** mvk has joined #openstack-keystone | 09:47 | |
| *** prashkre_ has quit IRC | 10:00 | |
| *** prashkre_ has joined #openstack-keystone | 10:03 | |
| *** markvoelker has joined #openstack-keystone | 10:09 | |
| *** rob_d_ has joined #openstack-keystone | 10:23 | |
| *** magicboiz has quit IRC | 10:39 | |
| *** rob_d_ has quit IRC | 10:40 | |
| *** markvoelker has quit IRC | 10:42 | |
| *** rob_d_ has joined #openstack-keystone | 10:46 | |
| rob_d_ | mapping federated users into projects and groups reads like somebodys science project https://docs.openstack.org/keystone/latest/advanced-topics/federation/federated_identity.html#mapping-rules | 10:47 |
| *** spectr has quit IRC | 10:54 | |
| *** nicolasbock has joined #openstack-keystone | 10:59 | |
| *** dave-mccowan has joined #openstack-keystone | 11:04 | |
| *** aloga has quit IRC | 11:04 | |
| *** aloga has joined #openstack-keystone | 11:04 | |
| *** nicolasbock has quit IRC | 11:05 | |
| *** nicolasbock has joined #openstack-keystone | 11:05 | |
| openstackgerrit | Davanum Srinivas (dims) proposed openstack/oslo.policy master: http/https check rules as stevedore extensions https://review.openstack.org/507098 | 11:16 |
| *** jdwidari has joined #openstack-keystone | 11:19 | |
| *** nrado has joined #openstack-keystone | 11:37 | |
| *** dikonoor has joined #openstack-keystone | 11:39 | |
| *** markvoelker has joined #openstack-keystone | 11:39 | |
| *** jdwidari has quit IRC | 11:43 | |
| dikonoor | Hi I just installed Pike/devstack and see that keystone isn't accessible at 5000. When I tried last with Ocata, it was. I was trying to register openstack from manageiq and it asks for keystone port , which I gave as 5000 and it doesn't connect. | 11:45 |
| cmurphy | dikonoor: in devstack it now listens on 80/443 at the /identity location | 11:49 |
| dikonoor | cmurphy: ah ok..so <ip> : 5000 no longer works..Thanks | 11:51 |
| dikonoor | and this is only from Pike, right? | 11:51 |
| cmurphy | dikonoor: i think so | 11:52 |
| dikonoor | cmurphy: pok | 11:52 |
| dikonoor | ok :) | 11:53 |
| *** prashkre_ has quit IRC | 11:59 | |
| nrado | Hi there, perhaps someone can help me. I'm using OpenStack Ocata and want to configure keystone in that way that it pushes all notifications messages into multiple queues. The reason is that I want a dedicated queue for barbican keystone listener. I configured barbican to use the topic barbican_notifications and in keystone.conf I configured it in this way: | 12:02 |
| nrado | [oslo_messaging_notifications] | 12:02 |
| nrado | topics = notifications,barbican_notifications | 12:02 |
| nrado | In Rabbitmq I can see now the new barbican_notifications.info queue and the listener consumer, but I don't get any messages there | 12:03 |
| nrado | Did I forget something? | 12:03 |
| nrado | some bindings perhaps? But how I can do this in OpenStack and not in RabbitMQ manually? | 12:06 |
| *** namnh has quit IRC | 12:10 | |
| *** raildo has joined #openstack-keystone | 12:11 | |
| *** markvoelker has quit IRC | 12:12 | |
| *** edmondsw has joined #openstack-keystone | 12:13 | |
| *** edmondsw_ has joined #openstack-keystone | 12:16 | |
| *** edmondsw has quit IRC | 12:17 | |
| *** nrado1 has joined #openstack-keystone | 12:18 | |
| *** nrado has quit IRC | 12:21 | |
| *** jdwidari has joined #openstack-keystone | 12:22 | |
| *** edmondsw_ has quit IRC | 12:22 | |
| openstackgerrit | Colleen Murphy proposed openstack/keystonemiddleware master: Rename auth_uri to www_authenticate_uri https://review.openstack.org/508522 | 12:23 |
| *** markvoelker has joined #openstack-keystone | 12:28 | |
| *** edmondsw has joined #openstack-keystone | 12:29 | |
| *** edmondsw has quit IRC | 12:33 | |
| *** edmondsw has joined #openstack-keystone | 12:36 | |
| *** iurygregory has joined #openstack-keystone | 12:38 | |
| openstackgerrit | Davanum Srinivas (dims) proposed openstack/oslo.policy master: http/https check rules as stevedore extensions https://review.openstack.org/507098 | 12:40 |
| *** links has quit IRC | 12:44 | |
| *** jdwidari is now known as plan908 | 12:48 | |
| *** plan908 is now known as jdwidari | 12:49 | |
| *** catintheroof has joined #openstack-keystone | 12:50 | |
| *** catintheroof has quit IRC | 12:51 | |
| *** catintheroof has joined #openstack-keystone | 12:51 | |
| *** panbalag has joined #openstack-keystone | 12:55 | |
| *** magicboiz has joined #openstack-keystone | 12:57 | |
| *** magicboiz has quit IRC | 13:02 | |
| *** spectr has joined #openstack-keystone | 13:02 | |
| *** lbragstad has joined #openstack-keystone | 13:06 | |
| *** ChanServ sets mode: +o lbragstad | 13:06 | |
| *** magicboiz has joined #openstack-keystone | 13:09 | |
| *** magicboiz has quit IRC | 13:20 | |
| *** magicboiz has joined #openstack-keystone | 13:20 | |
| knikolla | o/ | 13:23 |
| *** prashkre_ has joined #openstack-keystone | 13:26 | |
| *** erlon has joined #openstack-keystone | 13:28 | |
| *** jaosorior has quit IRC | 13:35 | |
| lbragstad | o/ | 13:40 |
| *** spectr has quit IRC | 13:40 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystonemiddleware master: Updated from global requirements https://review.openstack.org/500005 | 13:42 |
| *** chlong_ has joined #openstack-keystone | 13:46 | |
| openstackgerrit | Colleen Murphy proposed openstack/keystonemiddleware master: Rename auth_uri to www_authenticate_uri https://review.openstack.org/508522 | 13:48 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/pycadf master: Updated from global requirements https://review.openstack.org/470137 | 13:50 |
| *** spectr has joined #openstack-keystone | 13:57 | |
| *** cfriesen has joined #openstack-keystone | 13:58 | |
| *** spzala has joined #openstack-keystone | 14:02 | |
| *** zzzeek has quit IRC | 14:03 | |
| *** zzzeek has joined #openstack-keystone | 14:07 | |
| *** spectr has quit IRC | 14:07 | |
| *** spectr has joined #openstack-keystone | 14:08 | |
| *** jaosorior has joined #openstack-keystone | 14:10 | |
| openstackgerrit | Merged openstack/keystonemiddleware master: Correct docs usage of keystoneauth1 session https://review.openstack.org/503197 | 14:14 |
| lbragstad | knikolla: what does MOC use to store users? | 14:16 |
| lbragstad | magicboiz: is setting up a new keystone deployment and has some requirements for two-factor/certificate authentication | 14:16 |
| knikolla | lbragstad: right now plain ol' sql | 14:16 |
| lbragstad | keystone might not fit both requirements, so wondering if there other suggestions to look into (LDAP/IDP related0 | 14:16 |
| knikolla | hmm... | 14:17 |
| lbragstad | cc magicboiz ^ | 14:17 |
| lbragstad | knikolla: you were saying something about keycloak at the conference? | 14:17 |
| knikolla | lbragstad: yeah, i'll be working on deploying that in the coming month so people can use their university login | 14:18 |
| knikolla | but right now it's just sql | 14:18 |
| knikolla | lbragstad: keystone support mfa and otp right? | 14:18 |
| knikolla | woulnd't that fit his use case? | 14:18 |
| lbragstad | knikolla: i should let magicboiz reiterate his usecase | 14:19 |
| lbragstad | s/his/their/ | 14:19 |
| lbragstad | knikolla: from what i can tell, there are two requirements | 14:20 |
| lbragstad | 1.) internal users live in an AD deployment and need to be able to sign in using certificates | 14:20 |
| lbragstad | 2.) external users must use TOTP | 14:20 |
| lbragstad | or some form of two-factor authenticate | 14:21 |
| lbragstad | authentication* | 14:21 |
| knikolla | lbragstad: there are idps that support mfa with totp (at least keycloak). for certificates, i don't know, don't have much experience with them. but again, most idps should be able to pull users from AD. | 14:24 |
| magicboiz | knikolla: thanks!! | 14:32 |
| magicboiz | I'll check keycloak | 14:32 |
| knikolla | magicboiz: np. keystone should work with any saml/oidc idp so shop around for the features you need. | 14:33 |
| magicboiz | Regarding X509 certs, well, we have our own Microsoft AD domain, we have a domain CA, which issues X509 to users. I have my X509 installed into my win laptop. The idea is to configure Horizon/Keystone to accept my x509 cert as a valid auth | 14:33 |
| knikolla | ayoung: ^^ | 14:34 |
| knikolla | (if around) | 14:34 |
| *** prashkre_ has quit IRC | 14:39 | |
| *** prashkre_ has joined #openstack-keystone | 14:39 | |
| nrado1 | can someone tell why I don't see notfications from keystone (like project create and delete) in the notifications.info queue? Shouldn't they end in this queue? | 14:42 |
| *** magicboiz has quit IRC | 14:43 | |
| *** magicboiz has joined #openstack-keystone | 14:44 | |
| *** jamesbenson has joined #openstack-keystone | 14:45 | |
| lbragstad | nrado1: yeah - they should be it can depend on how you have keystone configured | 14:46 |
| lbragstad | there is a section in keystone's configuration file dedicated to oslo.messaging options that handle those bits | 14:47 |
| lbragstad | (keystone reuses the oslo.messaging library to implement notifications) | 14:47 |
| nrado1 | in keystone.conf I have just this setting for oslo: | 14:47 |
| nrado1 | [oslo_messaging_notifications] | 14:47 |
| nrado1 | topics = notifications,barbican_notifications | 14:47 |
| nrado1 | no driver nor transport_url like in other services | 14:48 |
| lbragstad | you probably need to configure the oslo_messaging section to use the right driver | 14:49 |
| lbragstad | https://github.com/openstack/keystone/blob/master/etc/keystone.conf.sample#L1708 | 14:49 |
| *** magicboiz has quit IRC | 14:49 | |
| lbragstad | if you want notification delivered on a message bus, you'll have to configure the transport URL | 14:49 |
| *** gyee has joined #openstack-keystone | 14:51 | |
| nrado1 | ok, got it | 14:51 |
| nrado1 | thank you lbragstad | 14:51 |
| *** smatzek has joined #openstack-keystone | 14:51 | |
| lbragstad | nrado1: this might be helpful for you, too | 14:51 |
| lbragstad | https://docs.openstack.org/oslo.messaging/latest/admin/index.html | 14:51 |
| lbragstad | keystone barely does anything with the actual configuration of the notification delivery system - keystone just expects it to be there when it should and passes it a payload | 14:52 |
| lbragstad | since that was such a common patterns across several openstack projects, the notification functionality was abstracted away into it's own library | 14:52 |
| *** magicboiz has joined #openstack-keystone | 14:55 | |
| nrado1 | ok, good to know | 14:56 |
| nrado1 | thanks lbragstad | 14:56 |
| nrado1 | but lbragstad, it's not 100% clear for me. where does the message at the end land? When I create a project the payload is just generated, but not forwarded in any of these queues? | 15:00 |
| nrado1 | I mean a client is doing a request sends a message to the queue, the broker or router sends it from the queue to the server | 15:02 |
| *** jaosorior has quit IRC | 15:07 | |
| lbragstad | nrado1: it depends on how you configure oslo.messaging | 15:13 |
| lbragstad | you can tell oslo.messaging to deliver messages on a message bus, to a log file, or noop the delivery all together | 15:14 |
| lbragstad | where the message ends up depends on how you configure things | 15:15 |
| lbragstad | nrado1: i think that's where https://docs.openstack.org/oslo.messaging/latest/admin/AMQP1.0.html comes in useful because it attempts to explain how those things work | 15:17 |
| nrado1 | thx, I will read through it. Definitely need some rabbitmq basics ;) | 15:23 |
| *** McClymontS_ has joined #openstack-keystone | 15:30 | |
| smatzek | fwiw, the removal of the Keystone V2 APIs has broken the Trove gates. Apparently the dsvm/scenario tests of Trove are using >3 year old 'compat' path in the Trove pythonclient that only has support for V2. | 15:38 |
| *** pcaruana has quit IRC | 15:39 | |
| smatzek | the "new" client in trove's pythonclient that has Session /v3 support is not a direct drop in, so that is being worked now. | 15:41 |
| *** jmlowe_ has joined #openstack-keystone | 15:41 | |
| *** jmlowe has quit IRC | 15:43 | |
| *** nrado1 has quit IRC | 15:44 | |
| lbragstad | smatzek: cool - let us know if you need any reviews | 15:50 |
| *** spectr has quit IRC | 15:51 | |
| *** nicolasbock_ has joined #openstack-keystone | 15:56 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Remove the v2_deprecated decorator https://review.openstack.org/499785 | 16:13 |
| *** rcernin has quit IRC | 16:13 | |
| *** rcernin has joined #openstack-keystone | 16:13 | |
| *** rcernin has quit IRC | 16:14 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Remove v2.0 identity API documentation https://review.openstack.org/509510 | 16:18 |
| *** tesseract has quit IRC | 16:29 | |
| *** mvk has quit IRC | 16:33 | |
| *** jessegler has joined #openstack-keystone | 16:39 | |
| *** nrado has joined #openstack-keystone | 16:43 | |
| *** spzala has quit IRC | 16:44 | |
| *** prashkre_ has quit IRC | 16:45 | |
| *** tesseract has joined #openstack-keystone | 16:50 | |
| lbragstad | FYI - opinion here would be good https://review.openstack.org/#/c/509835/ | 16:51 |
| lbragstad | ^ that is a patch for the same schedule deadlines we followed for the pike release - so if anyone wants to see something different, now would be a good time to discuss those changes | 17:02 |
| * lbragstad runs to grab lunch quick | 17:03 | |
| gagehugo | lbragstad feature proposal on xmas week? | 17:07 |
| gagehugo | freeze* | 17:07 |
| *** aselius has joined #openstack-keystone | 17:22 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystonemiddleware master: Updated from global requirements https://review.openstack.org/500005 | 17:22 |
| *** tesseract has quit IRC | 17:22 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/pycadf master: Updated from global requirements https://review.openstack.org/470137 | 17:30 |
| openstackgerrit | Merged openstack/keystone master: Remove the v3 to v2 resource test case https://review.openstack.org/509519 | 17:31 |
| *** raildo has quit IRC | 17:31 | |
| *** mvk has joined #openstack-keystone | 17:32 | |
| *** oikiki has joined #openstack-keystone | 17:34 | |
| *** prashkre_ has joined #openstack-keystone | 17:36 | |
| *** lbragstad has quit IRC | 17:37 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystonemiddleware master: Updated from global requirements https://review.openstack.org/500005 | 17:38 |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/pycadf master: Updated from global requirements https://review.openstack.org/470137 | 17:46 |
| *** raildo has joined #openstack-keystone | 17:47 | |
| *** jessegler has quit IRC | 17:49 | |
| *** panbalag has quit IRC | 17:49 | |
| *** dikonoor has quit IRC | 18:05 | |
| *** lbragstad has joined #openstack-keystone | 18:10 | |
| *** ChanServ sets mode: +o lbragstad | 18:10 | |
| lbragstad | gagehugo: yeah - that's probably not the best timing | 18:10 |
| *** oikiki has quit IRC | 18:16 | |
| *** oikiki has joined #openstack-keystone | 18:17 | |
| *** oikiki has quit IRC | 18:18 | |
| *** oikiki has joined #openstack-keystone | 18:22 | |
| ayoung | knikolla, did you rub my lamp? | 18:36 |
| ayoung | magicboiz, use mod_ssl with client cert authentication as a Federated protocol and you should be able to do what you want | 18:36 |
| knikolla | ayoung: genies exist! | 18:37 |
| ayoung | https://www.youtube.com/watch?v=Ww6EvNDPfwE | 18:38 |
| *** prashkre_ has quit IRC | 18:40 | |
| knikolla | haha! | 18:40 |
| *** chlong_ has quit IRC | 18:44 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/keystonemiddleware master: Updated from global requirements https://review.openstack.org/500005 | 18:51 |
| dims | @lbragstad : should this curl command return catalog or not? https://docs.openstack.org/keystone/latest/api_curl_examples.html#tokens | 18:55 |
| dims | @lbragstad : latest devstack - does not seem to be - http://paste.openstack.org/show/622786/ | 18:56 |
| lbragstad | dims: it depends | 18:56 |
| dims | on? | 18:57 |
| lbragstad | dims: if that user doesn't have a default project or a role on a default project (per the default_project_id in the user reference) then it will be an unscoped token | 18:57 |
| lbragstad | unscoped tokens do not have service catalogs | 18:57 |
| lbragstad | project scoped tokens do have service catalogs | 18:57 |
| lbragstad | i'd double check the assignments that user has | 18:57 |
| lbragstad | the authenticate request you're making doesn't specify a scope | 18:58 |
| lbragstad | in which case keystone will check if that user has a default_project_id in the user reference | 18:58 |
| dims | i tried both the admin and demo accounts set up by devstack | 18:59 |
| lbragstad | if it does, keystone will check to make sure that user actually has a role assignment on it, if that is true - then you'll get a project scoped token to the default_project in your user reference even though you didn't explicitly specify that scope | 18:59 |
| *** chlong_ has joined #openstack-keystone | 19:00 | |
| lbragstad | dims: https://docs.openstack.org/keystone/latest/admin/identity-tokens.html#authorization-scopes | 19:03 |
| *** MasterOfBugs has joined #openstack-keystone | 19:11 | |
| dims | y got it. @lbragstad, fyi, trying v3 keystone API from gophercloud via the kubernetes cloud provider tests | 19:13 |
| *** markvoelker_ has joined #openstack-keystone | 19:15 | |
| *** markvoelker has quit IRC | 19:15 | |
| lbragstad | dims: nice | 19:23 |
| lbragstad | yeah - try passing scope explicitly | 19:23 |
| *** chlong_ has quit IRC | 19:44 | |
| *** panbalag has joined #openstack-keystone | 19:54 | |
| *** panbalag has left #openstack-keystone | 19:55 | |
| *** smatzek has quit IRC | 19:59 | |
| adriant | hello! Anyone able to help me figure out why this is failing: https://review.openstack.org/#/c/440941 ? | 20:00 |
| *** ianw|pto is now known as ianw | 20:00 | |
| adriant | The failure makes no sense since the migrations in those folders don't do anything... | 20:01 |
| * adriant is very confused | 20:01 | |
| adriant | do I have to have "contact" in the file name of the migration? | 20:03 |
| adriant | contract* | 20:04 |
| *** edmondsw has quit IRC | 20:07 | |
| *** edmondsw has joined #openstack-keystone | 20:08 | |
| openstackgerrit | Adrian Turjak proposed openstack/keystone master: Make name fields a consistent size of 255 https://review.openstack.org/440941 | 20:09 |
| *** edmondsw_ has joined #openstack-keystone | 20:09 | |
| *** edmondsw has quit IRC | 20:12 | |
| *** edmondsw_ has quit IRC | 20:14 | |
| *** bigjools has quit IRC | 20:27 | |
| *** bigjools has joined #openstack-keystone | 20:29 | |
| samueldmq | adriant: perhaps we only allow additive migrations, so you wouldn't be able to do a column alter | 20:29 |
| adriant | samueldmq: but there are alters in the contract migration folder :( | 20:29 |
| samueldmq | maybe you'd need to create a second column and migrate the data to it, so we guarantee the rolling upgrade stuff | 20:29 |
| samueldmq | in the contract phase is allowed maybe | 20:30 |
| *** lbragstad has quit IRC | 20:30 | |
| samueldmq | check the rules for that, that's breaking one of those | 20:30 |
| samueldmq | that's why it's failing | 20:30 |
| adriant | samueldmq: but the alter is in the migration phase :/ isn't it? the failure message mentions expand which I have a blank migration for | 20:31 |
| adriant | I mean, in the contract phase | 20:31 |
| adriant | samueldmq: https://review.openstack.org/#/c/440941/5/keystone/common/sql/contract_repo/versions/030_contract_consistent_name_fields.py | 20:32 |
| adriant | the default tox tests pass locally | 20:32 |
| samueldmq | HMM | 20:33 |
| samueldmq | the msg says b'keystone.tests.unit.test_sql_banned_operations.DBOperationNotAllowed: Operation Column.alter() is not allowed in data_migration_repo database migrations' | 20:33 |
| adriant | but the zuul/jenkins error says that alters aren't allowed in the expand phase, but my code simply does not do anything | 20:33 |
| adriant | but that migration just does "pass" | 20:33 |
| adriant | :( | 20:33 |
| samueldmq | interesting | 20:33 |
| adriant | yeah | 20:33 |
| adriant | I don't get it | 20:33 |
| adriant | samueldmq: just 'pass' https://review.openstack.org/#/c/440941/5/keystone/common/sql/data_migration_repo/versions/030_migrate_consistent_name_fields.py | 20:36 |
| adriant | :P | 20:36 |
| * adriant is questioning his sanity a bit | 20:36 | |
| samueldmq | yeah, maybe it is not allowed and the error message is not accurate | 20:37 |
| samueldmq | but you said it works locally | 20:37 |
| adriant | is zuul running the tests actually against mysql? or sqlite? could be the failure only occurs when run with a real db | 20:38 |
| adriant | I assume my local tests by default are using sqlite | 20:38 |
| *** edmondsw has joined #openstack-keystone | 20:40 | |
| *** lbragstad has joined #openstack-keystone | 20:40 | |
| *** ChanServ sets mode: +o lbragstad | 20:40 | |
| lbragstad | adriant: that is failing because you're doing operatings in places where we've blacklisted specific types of schema changes | 20:42 |
| adriant | lbragstad: so where do alters happen? | 20:42 |
| adriant | when I originally wrote this I did read through the migration rules you had, I thought alters occurred in the contract stage | 20:43 |
| lbragstad | i think alters can happen in expand | 20:44 |
| lbragstad | where additive changes happen during the expand phase | 20:44 |
| adriant | oh? | 20:44 |
| lbragstad | and migration happens during the migrate phase | 20:44 |
| lbragstad | and removals happen during the contract | 20:44 |
| adriant | kk, will shift the code and update the patch | 20:44 |
| lbragstad | adriant: this might help you | 20:45 |
| lbragstad | https://docs.openstack.org/keystone/latest/contributor/database-migrations.html | 20:45 |
| adriant | "Contract phase: | 20:46 |
| adriant | Only contractive schema changes are allowed, such as dropping or altering columns, tables, indices, and triggers." | 20:46 |
| adriant | ^ that's what confused me i think | 20:46 |
| adriant | Expand: "Data insertion, modification, and removal is not allowed." < which I would assume includes alter | 20:47 |
| lbragstad | huh - we apparently have a contradicting unit test somewhere | 20:51 |
| adriant | that's what I think may be happening :( | 20:51 |
| adriant | i have weird luck with finding broken unit tests | 20:52 |
| *** catintheroof has quit IRC | 20:56 | |
| *** nrado has quit IRC | 21:05 | |
| *** gagehugo has quit IRC | 21:14 | |
| *** gagehugo has joined #openstack-keystone | 21:15 | |
| *** rybridges has joined #openstack-keystone | 21:17 | |
| rybridges | Hello. I have a quick question about the python-keystoneclient. I am trying to add a user to a role under a project. I am wondering how I can do this in python. Previously on a really old version of the keystone client, I could do: client.tenants.add_user(tenant_name, user_name, role_name) | 21:19 |
| rybridges | Obivously this API does not exist in the newer versions though | 21:19 |
| rybridges | How can I do this with the latest keystone clietn | 21:19 |
| rybridges | client? | 21:19 |
| adriant | v3 client client.roles.add | 21:20 |
| adriant | sec, lemme link you | 21:20 |
| adriant | grant! not add | 21:21 |
| adriant | that's right | 21:21 |
| adriant | https://github.com/openstack/python-keystoneclient/blob/master/keystoneclient/v3/roles.py#L211 | 21:21 |
| adriant | rybridges: ^ that's what you're after | 21:21 |
| *** rcernin has joined #openstack-keystone | 21:22 | |
| *** raildo has quit IRC | 21:22 | |
| *** edmondsw has quit IRC | 21:41 | |
| *** edmondsw has joined #openstack-keystone | 21:41 | |
| *** edmondsw has quit IRC | 21:46 | |
| *** MasterOfBugs has quit IRC | 21:46 | |
| *** MasterOfBugs has joined #openstack-keystone | 21:46 | |
| lbragstad | dims: still around? | 21:47 |
| openstackgerrit | Lance Bragstad proposed openstack/oslo.policy master: WIP: Add functionality to deprecate policies https://review.openstack.org/509909 | 21:49 |
| lbragstad | dims: ^ that's *super* rough, but i'd like to get some early feedback and see if i'm even headed in the right direction | 21:50 |
| *** jamesbenson has quit IRC | 21:51 | |
| lbragstad | cc hrybacki ^ | 22:00 |
| *** pramodrj07 has joined #openstack-keystone | 22:04 | |
| *** rcernin has quit IRC | 22:06 | |
| *** MasterOfBugs has quit IRC | 22:07 | |
| dims | @lbragstad : looking | 22:11 |
| dims | @lbragstad : warnings.warn may be a better way than a LOG.warning. looks good otherwise! | 22:17 |
| openstackgerrit | Gage Hugo proposed openstack/keystone master: Add database migration for project tags https://review.openstack.org/484456 | 22:24 |
| openstackgerrit | Gage Hugo proposed openstack/keystone master: Implement backend logic for project tags https://review.openstack.org/499726 | 22:24 |
| openstackgerrit | Gage Hugo proposed openstack/keystone master: Implement project tags logic into manager https://review.openstack.org/499727 | 22:24 |
| openstackgerrit | Gage Hugo proposed openstack/keystone master: Implement project tags API controller and router https://review.openstack.org/499728 | 22:24 |
| *** nkinder has quit IRC | 22:31 | |
| adriant | lbragstad, samueldmq: zuul appears to now be passing after I renamed the migration files to include "contract" and such in the file names.... | 22:31 |
| adriant | alter is still exactly where it was before | 22:32 |
| adriant | it appears the file naming is important to the tests, and now at least they are consistent with the other migration file names | 22:32 |
| *** lbragstad has quit IRC | 22:38 | |
| *** jdwidari has quit IRC | 22:44 | |
| *** erlon has quit IRC | 23:01 | |
| *** panbalag has joined #openstack-keystone | 23:06 | |
| adriant | samueldmq: passed now: https://review.openstack.org/#/c/440941 | 23:08 |
| *** panbalag has left #openstack-keystone | 23:12 | |
| *** edmondsw has joined #openstack-keystone | 23:28 | |
| *** edmondsw has quit IRC | 23:32 | |
| *** markvoelker_ has quit IRC | 23:51 | |
| *** pramodrj07 has quit IRC | 23:56 | |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!