| ayoung | jamielennox, so we need a conversion between when ATM runs and when oslo-context gets the values | 00:00 |
|---|---|---|
| jamielennox | what i'm saying is that it's not something we made up | 00:00 |
| jamielennox | ayoung: so what i found yesterday is that the header setting is not happening in the thing we subclass | 00:00 |
| jamielennox | so we can't do the from_environ thing in keystone | 00:00 |
| ayoung | right | 00:00 |
| ayoung | jamielennox, lookat my latest on your patch | 00:01 |
| jamielennox | i'm guessing i expected to pull it from the token model instead because there's more variables for keystone to pull out | 00:01 |
| ayoung | jamielennox, how do you want to work it? | 00:02 |
| jamielennox | so environ is out and it'd take too long to fix that, is the TokenModel interpretted anywhere here? | 00:03 |
| *** david-lyle has quit IRC | 00:03 | |
| *** dklyle has joined #openstack-keystone | 00:03 | |
| jamielennox | what's putting those other vals in the environ | 00:03 |
| *** rderose has joined #openstack-keystone | 00:03 | |
| ayoung | I added the call in auth.py | 00:04 |
| ayoung | https://review.openstack.org/#/c/523650/3/keystone/middleware/auth.py | 00:04 |
| ayoung | request.set_user_headers(request.token_auth.user) | 00:04 |
| jamielennox | oh, right | 00:04 |
| jamielennox | yea, ok that could work | 00:05 |
| ayoung | the base class doesn't do that, just the ATM subclass | 00:05 |
| ayoung | but it has them in the pre-processed form, X- not HTTP_X | 00:05 |
| jamielennox | ayoung: it shouldn't matter | 00:06 |
| jamielennox | if you set request.header['X-User-Id'] it internally sets environ['HTTP_X_USER_ID'] | 00:06 |
| ayoung | the context code to build from the environment expects it in the other form | 00:06 |
| jamielennox | it'll transform it | 00:06 |
| ayoung | http://git.openstack.org/cgit/openstack/oslo.context/tree/oslo_context/context.py#n433 | 00:06 |
| jamielennox | or it should | 00:06 |
| ayoung | nope | 00:07 |
| ayoung | it does a string compare with the values from here http://git.openstack.org/cgit/openstack/oslo.context/tree/oslo_context/context.py#n45 | 00:07 |
| *** thorst has joined #openstack-keystone | 00:07 | |
| *** david-lyle has joined #openstack-keystone | 00:07 | |
| jamielennox | oh, it looks like it converts the whole dict once and caches it | 00:07 |
| *** dklyle has quit IRC | 00:08 | |
| jamielennox | i guess this is why our context still works like this | 00:08 |
| ayoung | how about a Keystone specific from_environment for now, and we work that fix up into oslo context after? | 00:08 |
| jamielennox | nope | 00:09 |
| jamielennox | it's on the fly: https://github.com/Pylons/webob/blob/master/src/webob/headers.py#L117 | 00:09 |
| ayoung | are we using that? | 00:09 |
| jamielennox | yea, request.headers | 00:10 |
| ayoung | because that match is not happening. I ran it throughh the debugger a bunch of times. | 00:10 |
| ayoung | Are you set up for debugging yet? | 00:10 |
| jamielennox | kindof | 00:11 |
| *** thorst has quit IRC | 00:11 | |
| jamielennox | in an office today | 00:12 |
| jamielennox | but i'm basically debugging packer so noone will know the difference | 00:12 |
| ayoung | heh | 00:14 |
| ayoung | I can keep on this. Let me ensure we have the right class in place. | 00:14 |
| *** edmondsw has quit IRC | 00:15 | |
| *** phalmos has quit IRC | 00:17 | |
| *** phalmos has joined #openstack-keystone | 00:18 | |
| ayoung | print request.headers.__class__ | 00:20 |
| ayoung | <class 'webob.headers.EnvironHeaders'> | 00:20 |
| kmalloc | jamielennox: are you still working on openstack things... or no? | 00:20 |
| kmalloc | or just some sparetime stuff? | 00:20 |
| jamielennox | kmalloc: no, not at all, just saw things coming past that i knew about | 00:20 |
| kmalloc | ah so sparetime... if/when you feel like it | 00:20 |
| jamielennox | for various reasons this week is quiet so i had some time | 00:20 |
| ayoung | print request.headers['X-User-Id'] | 00:21 |
| ayoung | b505a552c9294f4c94aafb71ccb1da30 | 00:21 |
| *** threestrands has quit IRC | 00:21 | |
| ayoung | so that is good | 00:21 |
| ayoung | print request.headers['HTTP_X_USER_ID'] | 00:21 |
| ayoung | *** KeyError: 'HTTP_HTTP_X_USER_ID' | 00:21 |
| ayoung | (Pdb) print request.headers.__contains__('HTTP_X_USER_ID') | 00:23 |
| ayoung | print request.headers.__contains__('HTTP_X_USER_ID') | 00:23 |
| ayoung | what am I missing here... | 00:23 |
| *** thorst has joined #openstack-keystone | 00:25 | |
| *** dklyle has joined #openstack-keystone | 00:29 | |
| *** david-lyle has quit IRC | 00:30 | |
| *** phalmos has quit IRC | 00:38 | |
| *** david-lyle has joined #openstack-keystone | 00:55 | |
| *** dklyle has quit IRC | 00:55 | |
| *** jose-phillips has joined #openstack-keystone | 01:00 | |
| *** david-lyle has quit IRC | 01:01 | |
| *** thorst has quit IRC | 01:05 | |
| *** links has joined #openstack-keystone | 01:09 | |
| ayoung | jamielennox, yeah, that is messing things up like nobody's business | 01:13 |
| ayoung | if the key is | 01:13 |
| ayoung | HTTP_X_SERVICE_TOKEN | 01:13 |
| ayoung | it looks for HTTP_HTTP_X_SERVICE_TOKEN | 01:13 |
| *** panbalag has left #openstack-keystone | 01:16 | |
| *** nicolasbock has quit IRC | 01:22 | |
| *** edmondsw has joined #openstack-keystone | 01:24 | |
| *** edmondsw has quit IRC | 01:29 | |
| *** thorst has joined #openstack-keystone | 01:34 | |
| *** daidv has joined #openstack-keystone | 01:34 | |
| *** thorst has quit IRC | 01:34 | |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Deprecate member_role_id and member_role_name https://review.openstack.org/522461 | 01:36 |
| *** annp has joined #openstack-keystone | 01:56 | |
| *** spzala has joined #openstack-keystone | 02:01 | |
| *** spzala has quit IRC | 02:01 | |
| *** rderose has quit IRC | 02:06 | |
| *** namnh has joined #openstack-keystone | 02:11 | |
| *** dave-mccowan has quit IRC | 02:18 | |
| jamielennox | ayoung: it's not headers['HTTP_X..'] it's environ['HTTP_X_'] | 02:23 |
| ayoung | hmmm. | 02:23 |
| jamielennox | headers['X-User-Id'] == environ['HTTP_X_USER_ID'] | 02:23 |
| ayoung | damnit... | 02:23 |
| jamielennox | and environ is the standard wsgi definition of environ | 02:24 |
| ayoung | yep, that worked...let me try the whole suite | 02:25 |
| jamielennox | that's why the oslo.context thing is from_environ() because that's standard across frameworks | 02:25 |
| ayoung | ok...lots of tests failing due to KeyError: 'openstack.request_id' which comes from the tests | 02:26 |
| ayoung | setup that is | 02:26 |
| ayoung | I added that...ok, not properly defaulting... | 02:27 |
| ayoung | better.... | 02:27 |
| ayoung | jamielennox, it seems to have Trust issues | 02:29 |
| jamielennox | ayoung: don't we all | 02:29 |
| ayoung | :) | 02:29 |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Add new tables for unified limits https://review.openstack.org/523041 | 02:29 |
| jamielennox | yea - so trusts are not something that auth_token deals with because the services don't care how the user_id etc is set | 02:29 |
| jamielennox | so that's what i meant that you can get the standard variables filled, but there are some things that you would need to set on context manually | 02:30 |
| ayoung | except that they should. Or we should come up with a better abstraction | 02:30 |
| ayoung | if they are checking for userid, we're going to be back in the impersonation business | 02:30 |
| ayoung | - Failed: 119 | 02:31 |
| ayoung | much better | 02:31 |
| ayoung | I'm going to post this revision. | 02:31 |
| openstackgerrit | ayoung proposed openstack/keystone master: Use oslo-context https://review.openstack.org/523650 | 02:31 |
| ayoung | jamielennox, I think we need to append a couple of the values from http://git.openstack.org/cgit/openstack/keystone/tree/keystone/common/authorization.py#n78 so we get the oauth and trusts values | 02:33 |
| openstackgerrit | ayoung proposed openstack/keystone master: Use oslo-context https://review.openstack.org/523650 | 02:36 |
| *** dave-mccowan has joined #openstack-keystone | 02:46 | |
| *** zhurong has joined #openstack-keystone | 02:46 | |
| *** rderose has joined #openstack-keystone | 02:54 | |
| *** threestrands has joined #openstack-keystone | 02:55 | |
| *** thorst has joined #openstack-keystone | 02:59 | |
| *** masber has joined #openstack-keystone | 03:03 | |
| *** masuberu has quit IRC | 03:07 | |
| *** edmondsw has joined #openstack-keystone | 03:13 | |
| *** edmondsw has quit IRC | 03:17 | |
| *** aselius has quit IRC | 03:21 | |
| openstackgerrit | ChangBo Guo(gcb) proposed openstack/oslo.policy master: add bandit to pep8 job https://review.openstack.org/524055 | 03:30 |
| *** masber has quit IRC | 03:30 | |
| *** masber has joined #openstack-keystone | 03:34 | |
| *** thorst has quit IRC | 03:46 | |
| *** zhurong has quit IRC | 03:46 | |
| *** d0ugal_ has joined #openstack-keystone | 03:50 | |
| *** d0ugal has quit IRC | 03:52 | |
| *** rderose has quit IRC | 03:58 | |
| *** sticker has quit IRC | 03:58 | |
| openstackgerrit | wangxiyuan proposed openstack/keystone-specs master: Limits API https://review.openstack.org/455709 | 04:01 |
| *** dave-mccowan has quit IRC | 04:07 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 04:15 | |
| *** thorst has joined #openstack-keystone | 04:16 | |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Add new tables for unified limits https://review.openstack.org/523041 | 04:18 |
| *** AlexeyAbashkin has quit IRC | 04:20 | |
| *** thorst has quit IRC | 04:22 | |
| *** thorst has joined #openstack-keystone | 04:25 | |
| *** thorst has quit IRC | 04:29 | |
| *** thorst has joined #openstack-keystone | 04:55 | |
| *** thorst has quit IRC | 04:57 | |
| *** rderose has joined #openstack-keystone | 05:27 | |
| errr | cmurphy: that warning stuff was coming from my newton install. I do not get the wanrings in my fresh pip installed OSC virtualenv | 05:29 |
| errr | cmurphy: and as for the missing identity_provider_url that is set in my env but its not being used for some reason.. like its ignored by openstackclient | 05:30 |
| *** thorst has joined #openstack-keystone | 05:31 | |
| errr | cmurphy: you can even do: openstack --help|grep identity and see that identity-provider-url isnt even listed as being a param you can pass | 05:32 |
| *** thorst has quit IRC | 05:35 | |
| *** pcaruana has joined #openstack-keystone | 06:05 | |
| *** thorst has joined #openstack-keystone | 06:07 | |
| *** thorst has quit IRC | 06:12 | |
| *** rderose has quit IRC | 06:14 | |
| *** pcaruana has quit IRC | 06:16 | |
| openstackgerrit | wangxiyuan proposed openstack/keystone-specs master: Limits API https://review.openstack.org/455709 | 06:21 |
| *** chason has joined #openstack-keystone | 06:23 | |
| *** masuberu has joined #openstack-keystone | 06:42 | |
| *** masber has quit IRC | 06:46 | |
| *** thorst has joined #openstack-keystone | 06:46 | |
| openstackgerrit | wangxiyuan proposed openstack/keystone-specs master: Limits API https://review.openstack.org/455709 | 06:47 |
| *** edmondsw has joined #openstack-keystone | 06:49 | |
| *** threestrands has quit IRC | 06:50 | |
| *** thorst has quit IRC | 06:51 | |
| *** edmondsw has quit IRC | 06:54 | |
| *** aojea has joined #openstack-keystone | 07:07 | |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Add new tables for unified limits https://review.openstack.org/523041 | 07:13 |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Add db operation for unified limit https://review.openstack.org/524082 | 07:13 |
| *** aojea has quit IRC | 07:14 | |
| *** david-lyle has joined #openstack-keystone | 07:19 | |
| *** rcernin has quit IRC | 07:20 | |
| *** thorst has joined #openstack-keystone | 07:20 | |
| openstackgerrit | Merged openstack/oslo.policy master: Updated from global requirements https://review.openstack.org/523783 | 07:22 |
| *** nsingh has joined #openstack-keystone | 07:25 | |
| *** thorst has quit IRC | 07:25 | |
| nsingh | i am facing an issue Call to Nova to create snapshot failed: NotFound: (http://10.232.48.205/identity/v2.0/tokens): The resource could not be found. (HTTP 404). i enabled SSL in devstack. Any help | 07:28 |
| *** markvoelker has quit IRC | 07:37 | |
| *** thorst has joined #openstack-keystone | 07:52 | |
| *** pcaruana has joined #openstack-keystone | 07:55 | |
| *** thorst has quit IRC | 07:57 | |
| *** aloga has quit IRC | 08:03 | |
| *** aloga has joined #openstack-keystone | 08:03 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 08:06 | |
| *** rcernin has joined #openstack-keystone | 08:07 | |
| *** hoonetorg has quit IRC | 08:11 | |
| *** jaosorior has quit IRC | 08:13 | |
| *** hoonetorg has joined #openstack-keystone | 08:25 | |
| *** hoonetorg has quit IRC | 08:26 | |
| *** hoonetorg has joined #openstack-keystone | 08:27 | |
| *** thorst has joined #openstack-keystone | 08:27 | |
| *** thorst has quit IRC | 08:32 | |
| *** jaosorior has joined #openstack-keystone | 08:34 | |
| *** edmondsw has joined #openstack-keystone | 08:38 | |
| *** markvoelker has joined #openstack-keystone | 08:38 | |
| *** gmann is now known as gmann_afk | 08:41 | |
| *** AlexeyAbashkin has quit IRC | 08:41 | |
| *** edmondsw has quit IRC | 08:42 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 08:42 | |
| *** thorst has joined #openstack-keystone | 09:00 | |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Add new tables for unified limits https://review.openstack.org/523041 | 09:02 |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Add db operation for unified limit https://review.openstack.org/524082 | 09:02 |
| cmurphy | errr: i'm flummoxed o.0 I have this in my environment: http://paste.openstack.org/show/627806/ I'd also try taking osc out of the mix and just making sure ksa works http://paste.openstack.org/show/627814/ | 09:02 |
| cmurphy | nsingh: we removed the v2.0 API from keystone so latest devstack won't work with it, where are you seeing that message? whatever is using v2.0/tokens should be moved over to v3/auth/tokens | 09:03 |
| *** thorst has quit IRC | 09:05 | |
| nsingh | cmurphy:i am working with cinder nova interaction. I seen this message while passing request. | 09:05 |
| cmurphy | nsingh: i guess make sure cinder is using v3 for auth when it is calling to nova | 09:08 |
| nsingh | cmurphy: in cinder.conf it is auth_url = https://10.232.48.205/identity under [keystone_authtoken] | 09:09 |
| cmurphy | nsingh: that should use the right endpoint automatically, do you have user_domain_name/id and project_domain_name/id set in that section? | 09:11 |
| cmurphy | nsingh: also won't hurt to set auth_url = https://10.232.48.205/identity/v3 | 09:11 |
| nsingh | cmurphy: options under [keystone_authtoken] http://paste.openstack.org/show/627815/ | 09:13 |
| *** belmoreira has joined #openstack-keystone | 09:13 | |
| cmurphy | nsingh: it looks fine to me | 09:15 |
| cmurphy | nsingh: and devstack should be doing the right thing anyway | 09:15 |
| nsingh | cmurphy: i am implementing service token for cinder to nova and using nfs backend. Is there any thing related with this. | 09:16 |
| *** d0ugal_ has quit IRC | 09:17 | |
| cmurphy | nsingh: maybe the nfs backend is bypassing the authtoken middleware and has v2.0 hardcoded? | 09:17 |
| *** d0ugal has joined #openstack-keystone | 09:18 | |
| *** d0ugal has quit IRC | 09:18 | |
| *** d0ugal has joined #openstack-keystone | 09:18 | |
| nsingh | cmurphy: ok i will check. | 09:19 |
| nsingh | cmurphy: i have situation while implementing service token for cinder to glance interaction. can you please look into this. http://paste.openstack.org/show/627817/ | 09:21 |
| *** namnh has quit IRC | 09:21 | |
| cmurphy | nsingh: not sure how i can help there, you could look and see what e.g. nova has done for it | 09:25 |
| *** ktibi has joined #openstack-keystone | 09:25 | |
| nsingh | cmurphy: ok thank you | 09:26 |
| ktibi | Hi all, I try to use keystone with LDAP and domain. I use pike version. So my LDAP users and groups works, but sometimes, commands fail. keystone.log have Could not find domain: fakedomain or Could not find group: gDemo2. But If I retry command, which works. | 09:30 |
| ktibi | I don't know why keystone have " DomainNotFound " but I can see domain with "openstack domain list" | 09:31 |
| cmurphy | ktibi: the "Could not find domain: domainname" is a normal (annoying) message, it just happens because openstackclient tries to search by id first | 09:31 |
| cmurphy | ktibi: so i would look for something else in the logs when it happens | 09:31 |
| ktibi | cmurphy e.g http://paste.openstack.org/show/627818/ | 09:32 |
| *** thorst has joined #openstack-keystone | 09:32 | |
| cmurphy | ktibi: is gDemo1 and ldap group? | 09:33 |
| ktibi | yes | 09:33 |
| cmurphy | an* | 09:33 |
| cmurphy | is it consistent? does it always work the second time? | 09:34 |
| ktibi | yes | 09:34 |
| ktibi | sometimes I have "Could not find group: 13e8bcf2-6251-1037-90a3-8b533bec51be. (HTTP 404) (Request-ID: req-db0f452c-3853-48e2-bc3e-fbcf8fd4bda1)" | 09:34 |
| ktibi | it's like keystone try to open ldap connection first time and fail or timeout but after works | 09:35 |
| cmurphy | yeah that is pretty weird | 09:35 |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Add limit provider https://review.openstack.org/524109 | 09:35 |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Expose unified limit APIs https://review.openstack.org/524110 | 09:35 |
| cmurphy | if you turn on debug logging that will show the ldap bind and queries | 09:36 |
| cmurphy | which could help show what's going on | 09:36 |
| ktibi | cmurphy ldap conf : http://paste.openstack.org/show/627820/ | 09:36 |
| ktibi | need to add debug_level = 4095 ? | 09:37 |
| cmurphy | ktibi: no, in the [DEFAULT] section in the main keystone.conf set debug = true | 09:37 |
| *** thorst has quit IRC | 09:37 | |
| ktibi | ok I'll try | 09:38 |
| cmurphy | not sure if the ldap debug levels will help | 09:38 |
| *** asettle_ has joined #openstack-keystone | 09:38 | |
| *** EmilienM_ has joined #openstack-keystone | 09:39 | |
| *** asettle has quit IRC | 09:39 | |
| *** EmilienM has quit IRC | 09:39 | |
| *** andymccr has quit IRC | 09:39 | |
| *** pcaruana has quit IRC | 09:39 | |
| *** pcaruana has joined #openstack-keystone | 09:40 | |
| *** EmilienM_ is now known as EmilienM | 09:40 | |
| *** andymccr has joined #openstack-keystone | 09:40 | |
| *** EmilienM has quit IRC | 09:41 | |
| *** EmilienM has joined #openstack-keystone | 09:41 | |
| ktibi | cmurphy http://paste.openstack.org/show/627821/ | 09:41 |
| *** gagehugo has quit IRC | 09:42 | |
| *** magicboiz has quit IRC | 09:44 | |
| *** gagehugo has joined #openstack-keystone | 09:44 | |
| cmurphy | ktibi: is there more after that? after it tries GET http://cloud-interne.poc.poc:5000/v3/groups/gDemo1 it should try /v3/groups?name=gDemo1 or something | 09:44 |
| ktibi | nop | 09:44 |
| cmurphy | ktibi: I don't see any LDAP connection stuff, you should be seeing "LDAP init: url=..." logs there | 09:44 |
| *** chason has quit IRC | 09:45 | |
| *** chason has joined #openstack-keystone | 09:45 | |
| *** magicboiz has joined #openstack-keystone | 09:45 | |
| *** david-lyle has quit IRC | 09:46 | |
| ktibi | hum I have but no in keystone.log but in my elasticsearch | 09:47 |
| ktibi | WARNING keystone.common.wsgi [req-95ab2a73-69e8-4576-bf01-5becf328e8fa 40672e3cf2f84d7c9676120ec31367be 941bb14cdb1544ea8c33977d3ec01ad0 - default default] Could not find group: gDemo1.: GroupNotFound: Could no | 09:49 |
| ktibi | cmurphy Payload": "ldap.url = ldap://localhost log_opt_values /usr/lib/python2.7/site-packages/oslo_config/cfg.py:2887" | 09:49 |
| ktibi | oups wrong copy paste for the WARNING | 09:49 |
| ktibi | very strange, keytone try ldap://localhost | 09:49 |
| cmurphy | ktibi: are you using domain specific configs for your ldap backend? https://docs.openstack.org/keystone/pike/admin/identity-domain-specific-config.html | 09:50 |
| ktibi | yes | 09:51 |
| cmurphy | ldap://localhost is the default url so maybe something is mismatched, like you have [identity]/driver=ldap in your main config instead of the domain config? | 09:52 |
| *** magicboiz has quit IRC | 09:53 | |
| ktibi | cmurphy conf keystone http://paste.openstack.org/show/627824/ | 09:54 |
| cmurphy | ktibi: is cloud.poc.poc the name of the keystone domain? | 09:55 |
| ktibi | but works 90% of the time | 09:55 |
| ktibi | yes | 09:55 |
| ktibi | | b4929df46fb245c28e0854bb53305c48 | cloud.poc.poc | True | Domaine de connexion LDAP | 09:56 |
| cmurphy | ktibi: that ldap.url = ldap://localhost in the log might just be from it loading the defaults from the main config, not the value it read from the domain config | 09:57 |
| cmurphy | i think that's probably not the issue | 09:58 |
| cmurphy | but there should be "LDAP init: ..." and "LDAP search: ..." stuff in there after you make a request | 09:58 |
| ktibi | the log LDAP : localhost appears just when command fail | 09:59 |
| ktibi | so fail because keystone try localhost | 09:59 |
| *** magicboiz has joined #openstack-keystone | 10:00 | |
| cmurphy | can you paste the whole thing? or at least more context around that log | 10:00 |
| ktibi | ok I restart keystone and first command fail | 10:01 |
| ktibi | and 3 log ldap | 10:02 |
| ktibi | cmurphy http://paste.openstack.org/show/627827/ | 10:03 |
| *** belmoreira has quit IRC | 10:03 | |
| cmurphy | ktibi: do you have access to the original keystone log? i don't think your kibana logs are showing the whole thing | 10:04 |
| cmurphy | the log_opt_values logs only happen when keystone is starting up and loading its configs | 10:05 |
| cmurphy | so maybe there is a delay | 10:05 |
| cmurphy | it's not a log from a request | 10:05 |
| *** belmoreira has joined #openstack-keystone | 10:07 | |
| ktibi | ho when keystone start ==> DEBUG mod_wsgi [-] ldap.url = ldap://localhost log_opt_values /usr/lib/python2.7/site-packages/oslo_config/cfg.py:2887 | 10:07 |
| ktibi | ok it's the log in my kibana >< | 10:08 |
| cmurphy | i think that's fine, it's just reporting that the main config is loading the default ldap url but that's not what is loaded for the domain-specific config | 10:08 |
| ktibi | I tried to search log for ldap but nothing else :/ | 10:09 |
| *** ayoung has quit IRC | 10:09 | |
| *** kong has quit IRC | 10:09 | |
| *** dgonzalez has quit IRC | 10:09 | |
| *** lxnch has quit IRC | 10:09 | |
| *** tommylikehu has quit IRC | 10:09 | |
| ktibi | cmurphy I don't know why keystone doesn't log ldap :/ | 10:13 |
| cmurphy | ktibi: not sure either :/ | 10:14 |
| *** ayoung has joined #openstack-keystone | 10:15 | |
| *** kong has joined #openstack-keystone | 10:15 | |
| *** dgonzalez has joined #openstack-keystone | 10:15 | |
| *** lxnch has joined #openstack-keystone | 10:15 | |
| *** tommylikehu has joined #openstack-keystone | 10:15 | |
| *** tommylikehu has quit IRC | 10:15 | |
| *** tommylikehu has joined #openstack-keystone | 10:15 | |
| ktibi | cmurphy do you know if I use '.' in my domain name can be an issue ? | 10:18 |
| cmurphy | ktibi: I don't think it should | 10:18 |
| ktibi | cmurphy ok I have log, I need to use a ldap user | 10:23 |
| ktibi | If I use admin in default domain, no log | 10:23 |
| *** annp has quit IRC | 10:23 | |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Add new tables for unified limits https://review.openstack.org/523041 | 10:28 |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Add db operation for unified limit https://review.openstack.org/524082 | 10:28 |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Add limit provider https://review.openstack.org/524109 | 10:28 |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Expose unified limit APIs https://review.openstack.org/524110 | 10:28 |
| *** daidv has quit IRC | 10:35 | |
| *** thorst has joined #openstack-keystone | 10:45 | |
| *** masuberu has quit IRC | 10:49 | |
| *** thorst has quit IRC | 10:50 | |
| *** raildo has joined #openstack-keystone | 11:00 | |
| *** jmlowe has quit IRC | 11:01 | |
| *** ayoung has quit IRC | 11:10 | |
| *** efried has quit IRC | 11:10 | |
| *** Dave has quit IRC | 11:12 | |
| *** efried has joined #openstack-keystone | 11:14 | |
| *** Dave has joined #openstack-keystone | 11:15 | |
| *** ayoung has joined #openstack-keystone | 11:15 | |
| *** thorst has joined #openstack-keystone | 11:24 | |
| *** mvk has quit IRC | 11:25 | |
| *** thorst has quit IRC | 11:28 | |
| *** Adobeman_ has quit IRC | 11:29 | |
| *** Battousai has joined #openstack-keystone | 11:29 | |
| *** Battousai has left #openstack-keystone | 11:30 | |
| *** baffle has quit IRC | 11:45 | |
| *** rcernin has quit IRC | 11:52 | |
| *** nicolasbock has joined #openstack-keystone | 11:55 | |
| *** thorst has joined #openstack-keystone | 11:55 | |
| *** thorst has quit IRC | 12:01 | |
| *** tbh has joined #openstack-keystone | 12:02 | |
| *** dave-mccowan has joined #openstack-keystone | 12:07 | |
| *** sakth has joined #openstack-keystone | 12:12 | |
| sakth | Hi, these days with the latest devstack, I am facing lot of errors like the one "Failed to discover available identity versions when contacting http://192.168.10.42/identity. Attempting to parse version from URL.". Couldn;t find where to look exact logs | 12:12 |
| sakth | can anyone point to the exact logs location or any solution for this? | 12:12 |
| *** edmondsw has joined #openstack-keystone | 12:14 | |
| *** mvk has joined #openstack-keystone | 12:14 | |
| *** edmondsw has quit IRC | 12:20 | |
| openstackgerrit | Colleen Murphy proposed openstack/keystone master: Deprecate member_role_id and member_role_name https://review.openstack.org/522461 | 12:26 |
| cmurphy | sakth: where are you seeing those errors? in the devstack output? | 12:28 |
| sakth | yes cmurphy | 12:29 |
| cmurphy | sakth: it usually means it couldn't reach keystone, so check that keystone is running and accessible at that url | 12:29 |
| sakth | cmurphy: but I see the status of apache as active | 12:32 |
| cmurphy | sakth: on devstack keystone runs as it's own service so check `systemctl status devstack@keystone` | 12:33 |
| *** belmoreira has quit IRC | 12:33 | |
| *** belmoreira has joined #openstack-keystone | 12:53 | |
| gagehugo | o/ | 13:02 |
| *** thorst has joined #openstack-keystone | 13:05 | |
| *** spilla has joined #openstack-keystone | 13:06 | |
| cmurphy | \o | 13:11 |
| gagehugo | it's too early still | 13:13 |
| *** edmondsw has joined #openstack-keystone | 13:18 | |
| *** jmlowe has joined #openstack-keystone | 13:19 | |
| *** markvoelker has quit IRC | 13:23 | |
| *** markvoelker has joined #openstack-keystone | 13:24 | |
| *** magicboiz has quit IRC | 13:31 | |
| *** magicboiz has joined #openstack-keystone | 13:39 | |
| *** tbh has quit IRC | 13:44 | |
| *** panbalag has joined #openstack-keystone | 13:46 | |
| *** sakth has quit IRC | 13:47 | |
| *** panbalag has left #openstack-keystone | 13:48 | |
| *** rderose has joined #openstack-keystone | 13:54 | |
| *** links has quit IRC | 13:54 | |
| *** magicboiz has quit IRC | 13:56 | |
| *** gmann_afk is now known as gmann | 14:00 | |
| *** d0ugal has quit IRC | 14:03 | |
| *** magicboiz has joined #openstack-keystone | 14:06 | |
| *** d0ugal has joined #openstack-keystone | 14:17 | |
| *** jmlowe has quit IRC | 14:24 | |
| *** ktibi has left #openstack-keystone | 14:34 | |
| *** gmann is now known as gmann_afk | 14:40 | |
| mordred | efried: oy, I'm so behind ... I still haven't updated https://review.openstack.org/#/c/484341/ | 14:44 |
| efried | mordred If you're looking for ways to catch up, I would really appreciate it if you could finish https://review.openstack.org/#/c/491947/ for me. It would allow me to clean up a bunch of ugly hacks in nova. | 14:48 |
| efried | mordred I just have not been able to figure out the unit tests. | 14:48 |
| mordred | efried: will do | 14:49 |
| efried | mordred Thank you much, sir. I know you've been super busy, really appreciate it. | 14:49 |
| mordred | efried: I also need to finish this: https://review.openstack.org/#/c/505764/ | 14:49 |
| efried | I don't think I was aware of that one. | 14:50 |
| mordred | so maybe the three of them will make a nice stack | 14:50 |
| mordred | that one came from me trying to get the right level of logging in a log file and failing :) | 14:50 |
| *** McClymontS has joined #openstack-keystone | 14:57 | |
| *** panbalag has joined #openstack-keystone | 15:06 | |
| *** jrist has quit IRC | 15:08 | |
| *** panbalag1 has joined #openstack-keystone | 15:08 | |
| *** jrist has joined #openstack-keystone | 15:09 | |
| *** panbalag has quit IRC | 15:10 | |
| *** magicboiz has quit IRC | 15:16 | |
| *** magicboiz has joined #openstack-keystone | 15:17 | |
| *** jmlowe has joined #openstack-keystone | 15:19 | |
| errr | cmurphy: will the identity-provider-url be listed in the metadata that the idp provides? | 15:24 |
| errr | cmurphy: Im trying to make sure I have the right url because the ones Im trying arent working, but its at least trying to work just using ksa | 15:24 |
| cmurphy | errr: yes, it should look something like <SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" Location="https://idp.testshib.org/idp/profile/SAML2/SOAP/ECP"/> | 15:26 |
| errr | cmurphy: ok thats what Im trying. Im getting an error about the response | 15:26 |
| cmurphy | it should be that SOAP binding | 15:26 |
| cmurphy | errr: what's the error? | 15:26 |
| errr | http://paste.openstack.org/show/627879/ | 15:27 |
| errr | also ksa seems to need lxml and its not pulled down when installing so I had to add that myself. I guess it must be missing from the requirements.tt? | 15:28 |
| errr | txt* | 15:29 |
| cmurphy | that might be true | 15:29 |
| errr | https://github.com/openstack/keystoneauth/blob/master/keystoneauth1/extras/_saml2/v3/base.py#L14 | 15:30 |
| errr | and its not in the requirements.txt I just looked | 15:30 |
| cmurphy | it's in setup.cfg http://git.openstack.org/cgit/openstack/keystoneauth/tree/setup.cfg#n29 so i think you can install it with something like pip install keystoneauth1[saml2] | 15:31 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Implement controller logic for system group assignments https://review.openstack.org/524017 | 15:32 |
| cmurphy | errr: anyways that error does look like it's the wrong url but i'm not sure why that is | 15:33 |
| errr | hmm | 15:33 |
| cmurphy | errr: did you try any of the other SingleSignOnService urls? | 15:33 |
| errr | cmurphy: in my metadata.xml there are only 2 and they are both the same | 15:34 |
| *** McClymontS has quit IRC | 15:35 | |
| cmurphy | errr: is the other one for HTTP-POST? | 15:35 |
| errr | cmurphy: yes, and one for HTTP-Redirect | 15:36 |
| errr | both have the same value | 15:36 |
| cmurphy | errr: it sort of sounds like ECP might not be enabled on your idp | 15:36 |
| errr | ok, Ill look into seeing if its possible to enable that | 15:37 |
| errr | thanks! | 15:37 |
| cmurphy | no problem | 15:37 |
| -openstackstatus- NOTICE: if you receieved a result of "RETRY_LIMIT" after 14:15 UTC, it was likely due to an error since corrected. please "recheck" | 15:37 | |
| *** jaypipes has joined #openstack-keystone | 15:43 | |
| jaypipes | lbragstad: quick ? for you... for the mapping tables in keystone federation, can I use a user *name* instead of a user ID? | 15:44 |
| lbragstad | jaypipes: in the mapping itself? | 15:44 |
| jaypipes | lbragstad: yeah. instead of having to know a bunch of UUIDs, if each Keystone in my deployment of N OpenStacks has a database table of user records where the user name is the same but the user UUID/ID is not, I'm wondering if I can use the user name instead of the user ID in the role mapping thingee | 15:46 |
| lbragstad | jaypipes: yeah - that should be possible, the mapping engine is really there to make sure we map things from SAML to openstack attributes | 15:47 |
| lbragstad | so as long as it is availabe in the saml assertion and understood by shib/mellon, exposing it to keystone, then you should be able to build off of it | 15:47 |
| jaypipes | lbragstad: danke | 15:48 |
| lbragstad | we have a bunch of examples in our docs | 15:48 |
| lbragstad | jaypipes: this might be what you're looking for https://docs.openstack.org/keystone/latest/admin/federated-identity.html#mapping-examples | 15:48 |
| jaypipes | ok, cool, thanks much Lance | 15:48 |
| lbragstad | anytime | 15:48 |
| lbragstad | and more docs - https://docs.openstack.org/keystone/latest/advanced-topics/federation/federated_identity.html#mapping-rules because we haven't consolidated them yet | 15:49 |
| knikolla | o/ | 16:00 |
| spilla | if anyone has the time to check out the kcs project-tags implementation patch, would be much appreciated! :) https://review.openstack.org/#/c/481223/ | 16:07 |
| *** magicboiz has quit IRC | 16:09 | |
| *** magicboiz has joined #openstack-keystone | 16:15 | |
| *** magicboiz has quit IRC | 16:19 | |
| *** magicboiz has joined #openstack-keystone | 16:20 | |
| openstackgerrit | Gage Hugo proposed openstack/keystone master: Migrate jobs to zuulV3 https://review.openstack.org/523231 | 16:23 |
| lbragstad | spilla: i have that on my review list this week | 16:26 |
| lbragstad | spilla: i'll for sure get to it tomorrow if not today | 16:26 |
| spilla | lbragstad: thanks! :D | 16:27 |
| lbragstad | thanks for working on it! | 16:27 |
| spilla | np, also shoutout other who did too | 16:29 |
| *** aselius has joined #openstack-keystone | 16:30 | |
| openstackgerrit | Gage Hugo proposed openstack/keystone master: Migrate jobs to zuulV3 https://review.openstack.org/523231 | 16:31 |
| *** panbalag has joined #openstack-keystone | 16:33 | |
| *** panbalag1 has quit IRC | 16:34 | |
| openstackgerrit | Gage Hugo proposed openstack/keystone master: Migrate jobs to zuulV3 https://review.openstack.org/523231 | 16:37 |
| *** belmoreira has quit IRC | 16:37 | |
| *** McClymontS has joined #openstack-keystone | 16:38 | |
| *** rderose has quit IRC | 16:39 | |
| *** McClymontS has quit IRC | 16:40 | |
| *** aselius has quit IRC | 16:42 | |
| *** thorst has quit IRC | 16:42 | |
| *** aselius has joined #openstack-keystone | 16:42 | |
| *** thorst has joined #openstack-keystone | 16:42 | |
| *** sudodude has joined #openstack-keystone | 16:43 | |
| cmurphy | sudodude: o/ | 16:43 |
| sudodude | hi | 16:43 |
| sudodude | so, my current error is the following: ERROR keystone.common.wsgi REFERRAL: {'info': 'Referral:\nldap://domain.com/OU=Users,OU=openstack,OU=accounts,DC=domain,DC=com', 'desc': 'Referral'} | 16:44 |
| *** thorst has quit IRC | 16:44 | |
| cmurphy | sudodude: can you use paste.openstack.org to paste your [ldap] config in your keystone configs? | 16:44 |
| sudodude | sure, one sec | 16:45 |
| cmurphy | sudodude: could you also paste that log with some of the context around it? | 16:46 |
| sudodude | Paste #627892 | 16:47 |
| sudodude | what do you mean by context? | 16:47 |
| cmurphy | sudodude: in your keystone logs the few lines before and after the error appears | 16:47 |
| sudodude | ah | 16:48 |
| cmurphy | the chase_referrals keystone option might be relevant here, trying to find where that's documented | 16:49 |
| cmurphy | https://docs.openstack.org/keystone/pike/configuration/config-options.html#ldap | 16:50 |
| sudodude | If I understand that correctly, the controller is saying that the account exists in another domain, right? | 16:52 |
| sudodude | when I set up the user option as "user = openstackadadmin@example.domain.com", i get the invalid credentials error instead | 16:53 |
| *** d0ugal has quit IRC | 16:55 | |
| cmurphy | sudodude: yeah i think that is what it is saying | 16:55 |
| cmurphy | sudodude: i don't know a whole lot about AD tbh :/ but i think it's not following the referral for some reason | 16:56 |
| cmurphy | setting chase_referrals to true might help or there might need to be something changed on the AD server | 16:57 |
| sudodude | ok, I'll try that then | 16:57 |
| cmurphy | sudodude: you can try using ldapsearch to bind with that user, if that works then it's a keystone problem | 16:58 |
| *** david-lyle has joined #openstack-keystone | 16:59 | |
| sudodude | well this is what I'm getting: text: 000004DC: LdapErr: DSID-0C09073B, comment: In order to perform this opera tion a successful bind must be completed on the connection., data 0, v1772 | 17:00 |
| *** AlexeyAbashkin has quit IRC | 17:01 | |
| sudodude | if I use the -w to specify the password, I get an invalid credentials error instead... | 17:01 |
| sudodude | looks like the problem might be with AD then eh | 17:01 |
| cmurphy | could be | 17:02 |
| sudodude | ok, I'll work on it some more see what else I can figure out. Thanks for the help! | 17:03 |
| cmurphy | no problem | 17:03 |
| *** jmlowe has quit IRC | 17:06 | |
| *** pcaruana has quit IRC | 17:08 | |
| *** d0ugal has joined #openstack-keystone | 17:08 | |
| *** kmalloc has quit IRC | 17:11 | |
| *** d0ugal has quit IRC | 17:24 | |
| *** jlvacation is now known as jlvillal | 17:25 | |
| *** panbalag has left #openstack-keystone | 17:26 | |
| *** jmlowe has joined #openstack-keystone | 17:31 | |
| *** d0ugal has joined #openstack-keystone | 17:35 | |
| *** mvk has quit IRC | 17:48 | |
| *** ricolin_ has joined #openstack-keystone | 17:56 | |
| lbragstad | this is kinda frustrating http://paste.openstack.org/show/627906/ | 18:00 |
| lbragstad | especially when parameteres.yaml is ~1500 lines | 18:00 |
| *** thorst has joined #openstack-keystone | 18:08 | |
| lbragstad | that warning could totally hint at alphabetical ordering | 18:09 |
| lbragstad | git st | 18:20 |
| * lbragstad sigh | 18:20 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Add system role assignment documentation https://review.openstack.org/524307 | 18:22 |
| ricolin_ | lbragstad, it seems the default behavior for policy.Enforcer.enforce and authorize when we can't find the rule and default_rule is provided, enforce() will check against default rule, in authorize() we directly raise exception when policy not registered | 18:22 |
| ricolin_ | lbragstad, is that right? | 18:22 |
| lbragstad | ricolin_: that sounds correct | 18:24 |
| lbragstad | you also have the ability to tell oslo.policy which exception you want raised if the check fails | 18:25 |
| ricolin_ | lbragstad, got it, just have to check | 18:25 |
| ricolin_ | lbragstad, thx | 18:26 |
| lbragstad | ricolin_: yep! | 18:31 |
| lbragstad | so everything in https://review.openstack.org/#/q/topic:bp/system-scope+(status:open+OR+status:merged) should be all that's needed to implement https://trello.com/c/7Mx8a8sl/30-implement-system-role-assignments | 18:33 |
| lbragstad | mordred: cmurphy fyi =- https://blueprints.launchpad.net/keystone/+spec/application-credentials | 18:38 |
| cmurphy | thanks lbragstad | 18:40 |
| lbragstad | cmurphy: no problem | 18:41 |
| *** openstackgerrit has quit IRC | 18:48 | |
| *** ricolin_ has quit IRC | 18:49 | |
| mordred | lbragstad: woot! | 18:49 |
| mordred | thanks cmurphy | 18:49 |
| *** pcaruana has joined #openstack-keystone | 18:50 | |
| *** amito-infinidat is now known as amito | 18:59 | |
| *** mvk has joined #openstack-keystone | 18:59 | |
| *** avi_ has joined #openstack-keystone | 19:03 | |
| lbragstad | weird client/API question for anyone up to it | 19:40 |
| lbragstad | should it be /role_assignments?scope.system=True&group.id=$GROUP_ID or /role_assignments?scope.system&group.id=$GROUP_ID | 19:41 |
| lbragstad | ? | 19:41 |
| *** baffle has joined #openstack-keystone | 19:52 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 19:52 | |
| *** AlexeyAbashkin has quit IRC | 19:59 | |
| *** kmalloc has joined #openstack-keystone | 20:07 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 20:12 | |
| *** AlexeyAbashkin has quit IRC | 20:17 | |
| *** panbalag has joined #openstack-keystone | 20:31 | |
| *** panbalag has left #openstack-keystone | 20:36 | |
| knikolla | the former I think | 20:46 |
| lbragstad | scope.system=True? | 20:47 |
| knikolla | yes | 20:47 |
| lbragstad | cool - because that's how it works today :) | 20:47 |
| knikolla | because then you can make scope.system=False :) | 20:47 |
| lbragstad | yeah | 20:47 |
| lbragstad | good point | 20:47 |
| lbragstad | alright - i have a couple super hacky client patches coming | 20:48 |
| ayoung | lbragstad, where do I look for policy-in-code? | 20:49 |
| lbragstad | ayoung: https://www.lbragstad.com/policy-burndown/ | 20:49 |
| ayoung | how far down the stack did we decide to push it? | 20:50 |
| ayoung | lbragstad, I mean in the code | 20:50 |
| lbragstad | oh | 20:50 |
| lbragstad | nevermind | 20:50 |
| lbragstad | i got excited thinking you wanted to review stuff! | 20:50 |
| ayoung | lbragstad, still chasing the "oslo-context" fix first | 20:50 |
| ayoung | I'll def be into reviewing once I have this down | 20:50 |
| ayoung | jamie got me over the hurdle here, and this needs to go in before the is_admin fixes.... | 20:51 |
| lbragstad | everything should be registered at this point https://github.com/openstack/keystone/blob/master/keystone/common/policy.py#L35 | 20:51 |
| ayoung | lbragstad, I'm seeing this message | 20:52 |
| ayoung | enforce identity:get_auth_projects: | 20:52 |
| lbragstad | which pretty much just passes a list of RuleDefault and DocumentedRuleDefault objects to a method in oslo.policy | 20:52 |
| lbragstad | https://github.com/openstack/keystone/blob/master/keystone/common/policy.py#L66-L67 | 20:52 |
| ayoung | what generats the policy line for that | 20:52 |
| ayoung | ah...centralized | 20:52 |
| lbragstad | yeah - that's all handled by oslo.policy | 20:52 |
| ayoung | https://github.com/openstack/keystone/tree/master/keystone/common/policies | 20:53 |
| lbragstad | keystone just looks for a policy file, parses it if present, and fills in the gaps with the defaults if needed | 20:53 |
| lbragstad | https://github.com/openstack/keystone/blob/master/keystone/common/policies/auth.py#L34 | 20:53 |
| lbragstad | ^ that's the default for that policy | 20:53 |
| *** pcaruana has quit IRC | 20:55 | |
| ayoung | check_str='', means...what? Default rule applies? | 20:55 |
| lbragstad | if it is an empty string, it just checks that the token is valid i believe | 20:55 |
| lbragstad | it's means the same thing as what was in the old policy.json file | 20:56 |
| lbragstad | it just moved into code | 20:56 |
| ayoung | hmmm...what I broke has to be something to do with oslo-context. | 20:56 |
| ayoung | random_project = random.randint(0, len(projects) - 1) | 20:56 |
| ayoung | and this is on federation... | 20:56 |
| lbragstad | random_project = random.choice(projects) | 20:57 |
| ayoung | group_ids = request.auth_context.get('group_ids') | 21:01 |
| ayoung | bet its that... | 21:01 |
| lbragstad | are those actually there? | 21:01 |
| lbragstad | oh... | 21:01 |
| lbragstad | auth_context isn't oslo.context | 21:02 |
| lbragstad | is it? | 21:02 |
| ayoung | lbragstad, not yet it isn't, but it will be soon | 21:08 |
| ayoung | my guess is the next speed bump will be oauth | 21:09 |
| ayoung | a bit of the authorization.py code is going to live on in the one-offs for Keystone specific context values. I think that is OK | 21:10 |
| *** raildo has quit IRC | 21:12 | |
| *** threestrands has joined #openstack-keystone | 21:12 | |
| ayoung | - Failed: 33 | 21:16 |
| *** McClymontS has joined #openstack-keystone | 21:19 | |
| *** McClymontS has quit IRC | 21:21 | |
| *** pcaruana has joined #openstack-keystone | 21:24 | |
| *** dave-mccowan has quit IRC | 21:35 | |
| *** pcaruana has quit IRC | 21:39 | |
| *** gyee has quit IRC | 21:54 | |
| *** openstackgerrit has joined #openstack-keystone | 22:03 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Add ability to list all system role assignments https://review.openstack.org/524407 | 22:03 |
| *** rcernin has joined #openstack-keystone | 22:18 | |
| *** rcernin has quit IRC | 22:21 | |
| *** rcernin has joined #openstack-keystone | 22:21 | |
| *** edmondsw has quit IRC | 22:24 | |
| *** edmondsw has joined #openstack-keystone | 22:24 | |
| *** edmondsw has quit IRC | 22:25 | |
| *** edmondsw_ has joined #openstack-keystone | 22:27 | |
| *** spilla has quit IRC | 22:27 | |
| *** edmondsw_ has quit IRC | 22:31 | |
| breton | what | 22:38 |
| breton | what should i write in "classification"? | 22:38 |
| openstackgerrit | Lance Bragstad proposed openstack/python-keystoneclient master: Add system role functionality https://review.openstack.org/524415 | 22:45 |
| openstackgerrit | Lance Bragstad proposed openstack/python-keystoneclient master: Add system role functionality https://review.openstack.org/524415 | 22:49 |
| lbragstad | breton: respond to everyone on the thread and ask? i bet others are wondering the same :) | 22:54 |
| *** jmlowe has quit IRC | 22:58 | |
| openstackgerrit | Colleen Murphy proposed openstack/keystone master: WIP Add Application Credentials controller https://review.openstack.org/524423 | 23:01 |
| *** jmlowe has joined #openstack-keystone | 23:09 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 23:12 | |
| *** AlexeyAbashkin has quit IRC | 23:16 | |
| *** itlinux has joined #openstack-keystone | 23:35 | |
| *** thorst has quit IRC | 23:41 | |
| *** itlinux has quit IRC | 23:56 | |
| kmalloc | hm. | 23:57 |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!