Wednesday, 2018-01-10

*** AlexeyAbashkin has joined #openstack-keystone00:01
*** adriant has joined #openstack-keystone00:04
*** panbalag has quit IRC00:04
*** adriant has quit IRC00:05
*** adriant has joined #openstack-keystone00:05
*** AlexeyAbashkin has quit IRC00:05
openstackgerritGage Hugo proposed openstack/keystone master: WIP - Add functional testing gate  https://review.openstack.org/53101400:11
*** raildo has quit IRC00:17
*** andymccr has quit IRC00:36
*** panbalag has joined #openstack-keystone00:37
*** andymccr has joined #openstack-keystone00:40
*** markvoelker has joined #openstack-keystone00:43
*** markvoelker has quit IRC00:45
*** markvoelker has joined #openstack-keystone00:49
*** markvoelker has quit IRC00:50
*** andymccr has quit IRC00:51
*** panbalag has left #openstack-keystone00:55
*** andymccr has joined #openstack-keystone00:55
*** david-lyle has joined #openstack-keystone00:58
*** dave-mccowan has joined #openstack-keystone01:07
*** markvoelker has joined #openstack-keystone01:08
*** markvoelker has quit IRC01:09
*** daidv has quit IRC01:18
*** daidv has joined #openstack-keystone01:19
*** zhurong has joined #openstack-keystone01:24
*** sbezverk has left #openstack-keystone01:31
*** dave-mccowan has quit IRC01:42
*** d0ugal has quit IRC01:43
*** d0ugal has joined #openstack-keystone02:01
lbragstadwxy: how goes it?02:06
lbragstada couple of the unified limit patches should be gating02:07
*** david-lyle has quit IRC02:07
wxylbragstad: Yeah. Thanks very much. And I'll refresh the rest ones this afternoon. I'm working with some internal work now.02:09
lbragstadwxy: no worries - just curious if there is anything i can help with02:09
wxylbragstad: :)02:12
*** dave-mccowan has joined #openstack-keystone02:15
*** harlowja has quit IRC02:24
*** panbalag has joined #openstack-keystone02:26
*** panbalag has left #openstack-keystone02:40
*** mordred has quit IRC02:42
*** mordred has joined #openstack-keystone02:44
*** dave-mccowan has quit IRC02:47
openstackgerritMerged openstack/keystoneauth master: Fix masked variable name  https://review.openstack.org/48434002:52
*** lbragstad has quit IRC02:54
*** annp has joined #openstack-keystone03:20
*** zhurong has quit IRC03:23
*** jistr has quit IRC03:31
*** zhurong has joined #openstack-keystone03:32
*** DinaBelova has quit IRC03:44
*** andreykurilin has quit IRC03:44
*** andreykurilin has joined #openstack-keystone03:44
*** DinaBelova has joined #openstack-keystone03:46
*** AlexeyAbashkin has joined #openstack-keystone03:52
*** AlexeyAbashkin has quit IRC03:57
*** tbh_ has joined #openstack-keystone04:00
*** AlexeyAbashkin has joined #openstack-keystone04:25
*** AlexeyAbashkin has quit IRC04:29
openstackgerritGage Hugo proposed openstack/keystone master: Remove whitespace from policy sample file  https://review.openstack.org/53224804:37
*** links has joined #openstack-keystone04:37
*** itlinux has quit IRC04:39
*** zhurong has quit IRC04:40
*** links has quit IRC04:40
*** namnh has joined #openstack-keystone04:44
*** david-lyle has joined #openstack-keystone04:46
*** links has joined #openstack-keystone04:46
*** david-lyle has quit IRC04:53
*** hoonetorg has quit IRC05:00
*** brad[] has quit IRC05:10
*** hoonetorg has joined #openstack-keystone05:14
*** harlowja has joined #openstack-keystone05:24
*** gyee has quit IRC05:36
*** markvoelker has joined #openstack-keystone05:39
*** edmondsw has joined #openstack-keystone06:00
*** edmondsw has quit IRC06:04
*** zhurong has joined #openstack-keystone06:16
*** pcaruana has joined #openstack-keystone06:27
*** pcaruana has quit IRC06:33
*** pcaruana has joined #openstack-keystone06:34
openstackgerritwangxiyuan proposed openstack/keystone master: Add schema check for authorize request token  https://review.openstack.org/52629606:34
openstackgerritwangxiyuan proposed openstack/keystone master: Added support for a ``description`` attribute for Identity Roles  https://review.openstack.org/48434806:40
*** masber has quit IRC07:08
openstackgerritwangxiyuan proposed openstack/keystone master: Fix list users by name  https://review.openstack.org/52991407:08
*** rcernin has quit IRC07:15
*** sileht has quit IRC07:31
*** threestrands has quit IRC07:36
*** harlowja has quit IRC07:49
*** hoonetorg has quit IRC07:50
*** AlexeyAbashkin has joined #openstack-keystone07:57
*** hoonetorg has joined #openstack-keystone08:07
*** tesseract has joined #openstack-keystone08:14
*** tbh_ has quit IRC08:20
*** alex_xu has quit IRC08:28
*** alex_xu has joined #openstack-keystone08:29
*** jaosorior has joined #openstack-keystone08:54
*** jistr has joined #openstack-keystone08:57
*** blake has joined #openstack-keystone08:58
*** magicboiz has joined #openstack-keystone09:02
*** magicboiz has quit IRC09:02
*** tommylikehu has quit IRC09:07
*** tommylikehu has joined #openstack-keystone09:08
*** markvoelker has quit IRC09:08
*** sxc731 has joined #openstack-keystone09:11
openstackgerritColleen Murphy proposed openstack/keystone master: Add application credentials db migration  https://review.openstack.org/52492709:17
openstackgerritColleen Murphy proposed openstack/keystone master: Add application credentials driver  https://review.openstack.org/52492809:17
openstackgerritColleen Murphy proposed openstack/keystone master: Add Application Credentials manager  https://review.openstack.org/52474709:17
openstackgerritColleen Murphy proposed openstack/keystone master: Extract expiration validation to utils  https://review.openstack.org/53225709:17
openstackgerritColleen Murphy proposed openstack/keystone master: WIP Add Application Credentials controller  https://review.openstack.org/52442309:17
*** sileht has joined #openstack-keystone09:20
*** blake has quit IRC09:53
*** sambetts|afk is now known as sambetts10:13
*** threestrands has joined #openstack-keystone10:21
*** annp has quit IRC10:34
*** ebbex has quit IRC10:49
*** namnh has quit IRC10:51
*** zhurong has quit IRC10:56
*** StefanPaetowJisc has joined #openstack-keystone11:01
*** StefanPaetowJisc has quit IRC11:08
*** markvoelker has joined #openstack-keystone11:08
*** AlexeyAbashkin has quit IRC11:18
*** AlexeyAbashkin has joined #openstack-keystone11:18
*** d0ugal has quit IRC11:39
*** markvoelker has quit IRC11:42
*** StefanPaetowJisc has joined #openstack-keystone11:50
*** StefanPaetowJisc has quit IRC11:53
*** d0ugal has joined #openstack-keystone11:57
*** nicolasbock has joined #openstack-keystone11:57
*** raildo has joined #openstack-keystone12:02
*** brad[] has joined #openstack-keystone12:29
*** markvoelker has joined #openstack-keystone12:39
bhagyashrismordred: Hi,12:47
bhagyashrismordred: I wan to discuss with you regarding the patch https://review.openstack.org/#/c/505764/ I am trying to fix the unit test case which is added in the patch for the fix12:50
bhagyashrismordred: s/wan/want12:51
bhagyashrismordred: the issue is when i ran the whole test suite again and again randomly 2 to 3 unit test case are failing12:55
bhagyashrismordred: same ran the whole test suite on master and all the test are passing12:56
*** links has quit IRC12:58
*** edmondsw has joined #openstack-keystone13:01
openstackgerritColleen Murphy proposed openstack/keystone master: Add application credentials db migration  https://review.openstack.org/52492713:09
openstackgerritColleen Murphy proposed openstack/keystone master: Add application credentials driver  https://review.openstack.org/52492813:09
openstackgerritColleen Murphy proposed openstack/keystone master: Add Application Credentials manager  https://review.openstack.org/52474713:09
openstackgerritColleen Murphy proposed openstack/keystone master: Extract expiration validation to utils  https://review.openstack.org/53225713:09
openstackgerritColleen Murphy proposed openstack/keystone master: WIP Add Application Credentials controller  https://review.openstack.org/52442313:09
*** markvoelker has quit IRC13:12
*** mvk has quit IRC13:14
*** rcherrueau has joined #openstack-keystone13:22
*** sxc731 has quit IRC13:30
*** daidv has quit IRC13:32
*** panbalag has joined #openstack-keystone13:49
rcherrueauHello, I try to activate the logging of SQL queries when I run unit tests, but I cannot figure out how to do it.13:51
rcherrueauThere is a key in /etc/keystone/keystone.conf that is supposed to do this (i.e., connection_debug = 50).13:51
rcherrueaubut it is not take into account when I do the `tox -epy27`. I suppose that the keystone.conf file is not read during unit tests.13:51
rcherrueauSo how am I supposed to set this? Any idea? Thanks13:52
cmurphyrcherrueau: I don't know the specific answer to your question but I know the unit tests don't read /etc/keystone/keystone.conf, they set up their own configs13:57
*** panbalag has left #openstack-keystone13:59
rcherrueaucmurphy: OK thanks. Do you know where this "own configs" is defined? Directly in the unit tests code?13:59
cmurphyrcherrueau: there are some stub files in keystone/tests/unit/config_files but mostly the configs are defined in the unit test code14:01
*** blake has joined #openstack-keystone14:02
rcherrueaucmurphy: I will take a look in stub files. Thanks a lot.14:02
openstackgerritColleen Murphy proposed openstack/keystone master: Add Application Credentials controller  https://review.openstack.org/52442314:03
*** sxc731 has joined #openstack-keystone14:04
*** markvoelker has joined #openstack-keystone14:10
*** mvk has joined #openstack-keystone14:22
rcherrueaucmurphy: This is not neat but I can get it works by setting the default configuration in oslo.db ;) See https://github.com/openstack/oslo.db/blob/stable/pike/oslo_db/options.py#L10114:28
*** raildo has quit IRC14:34
cmurphyrcherrueau: if it helps with debugging then that's all that matters :)14:36
*** lbragstad has joined #openstack-keystone14:38
*** ChanServ sets mode: +o lbragstad14:38
*** jmlowe has quit IRC14:39
*** markvoelker has quit IRC14:43
*** afred312 has quit IRC14:46
*** afred312 has joined #openstack-keystone14:46
*** markvoelker has joined #openstack-keystone14:51
-openstackstatus- NOTICE: Gerrit is being restarted due to slowness and to apply kernel patches14:58
*** openstackgerrit has quit IRC15:01
*** markvoelker has quit IRC15:03
*** dave-mccowan has joined #openstack-keystone15:09
*** dave-mcc_ has joined #openstack-keystone15:12
*** dave-mccowan has quit IRC15:14
knikollao/15:19
*** sxc731 has quit IRC15:25
*** markvoelker has joined #openstack-keystone15:37
*** david-lyle has joined #openstack-keystone15:43
*** ksalman has left #openstack-keystone15:46
gagehugoo/15:47
lbragstado/15:48
*** sxc731 has joined #openstack-keystone15:50
*** blake has quit IRC15:59
*** jmlowe has joined #openstack-keystone16:00
*** dklyle has joined #openstack-keystone16:04
*** david-lyle has quit IRC16:04
*** mfisch` has joined #openstack-keystone16:06
*** itlinux has joined #openstack-keystone16:09
*** mfisch has quit IRC16:10
*** openstackgerrit has joined #openstack-keystone16:13
openstackgerritGage Hugo proposed openstack/keystone master: WIP - Add functional testing gate  https://review.openstack.org/53101416:13
*** spilla has joined #openstack-keystone16:13
*** markvoelker has quit IRC16:19
*** raildo has joined #openstack-keystone16:22
*** markvoelker has joined #openstack-keystone16:22
*** markvoelker has quit IRC16:27
*** jamiec has quit IRC16:29
*** aloga_ has joined #openstack-keystone16:37
*** d0ugal has quit IRC16:46
*** jaosorior has quit IRC16:47
*** clarkb has quit IRC16:53
*** gyee has joined #openstack-keystone16:54
*** AlexeyAbashkin has quit IRC16:55
*** StefanPaetowJisc has joined #openstack-keystone16:57
*** dklyle has quit IRC17:03
*** StefanPaetowJisc has quit IRC17:05
*** dave-mcc_ has quit IRC17:11
*** pcaruana has quit IRC17:11
*** phalmos has joined #openstack-keystone17:15
*** harlowja has joined #openstack-keystone17:16
*** david-lyle has joined #openstack-keystone17:16
*** dave-mccowan has joined #openstack-keystone17:18
*** phalmos has quit IRC17:20
*** mfisch` has quit IRC17:23
*** phalmos has joined #openstack-keystone17:27
*** jamiec has joined #openstack-keystone17:29
*** breton has quit IRC17:31
openstackgerritColleen Murphy proposed openstack/keystone master: Extract expiration validation to utils  https://review.openstack.org/53225717:31
openstackgerritColleen Murphy proposed openstack/keystone master: Add Application Credentials controller  https://review.openstack.org/52442317:31
*** itlinux has quit IRC17:35
*** StefanPaetowJisc has joined #openstack-keystone17:36
*** ldbragst has joined #openstack-keystone17:39
*** ldbragst has left #openstack-keystone17:40
*** itlinux has joined #openstack-keystone17:41
*** StefanPaetowJisc has quit IRC17:41
*** ldbragst has joined #openstack-keystone17:42
*** ldbragst has quit IRC17:44
*** StefanPaetowJisc has joined #openstack-keystone17:48
*** david-lyle has quit IRC18:07
*** sxc731 has quit IRC18:10
*** StefanPaetowJisc has quit IRC18:12
*** openstack has joined #openstack-keystone18:29
*** ChanServ sets mode: +o openstack18:29
*** rcherrueau has quit IRC18:30
*** AlexeyAbashkin has joined #openstack-keystone18:31
*** sxc731 has joined #openstack-keystone18:32
*** AlexeyAbashkin has quit IRC18:35
*** tesseract has quit IRC18:36
*** harlowja has quit IRC18:37
*** jmlowe has quit IRC18:40
*** jmlowe has joined #openstack-keystone18:41
* lbragstad walks over to the office stereo and turns up Fleetwood Mac18:47
poojaHi.. Is there a keystone v3 api to allow a non-admin user to list other users in his own tenant?18:48
poojaIn v2 api, there was a get_project_users api with admin_or_owner policy, but I was unable to find a v3 equivalent for it.18:49
poojaAppreciate any pointers on this!18:49
lbragstadpooja: i assume  you're using the GET /v3/users/ API?18:50
poojalbragstad: yes, I am.. that api seems to have admin_only policy enforcement though18:52
poojaI would like to make it admin_or_owner policy if there was a way to specify project id somehow18:52
lbragstadright - i don't think there is an api that exposes other users to non-admins in a project18:52
lbragstadpooja: what's your usecase?18:52
poojaHmm.. in nova, I would like to see the instance owner names when I list instances in my tenant.. currently they just show up as UUIDs18:53
poojaI was trying to use keystone v3 api to map nova user id to a username18:53
lbragstadahh18:57
*** mvk has quit IRC18:57
poojalbragstad: Would it make sense to expose such an api in v3 to keep it compatible with v2 api?18:59
*** david-lyle has joined #openstack-keystone18:59
lbragstadthat might be something we can fix once we address https://review.openstack.org/#/c/526203/3/keystone/common/policies/user.py@3519:02
lbragstadthen you could achieve that by having something like:19:03
*** aloga_ has quit IRC19:03
lbragstadidentity:list_users: role:admin OR role:writer OR role:reader19:03
lbragstadin policy19:03
lbragstadthen if a user makes that call with a project scoped token, and they have one of those roles, they will be able to list all users within that project (for example)19:04
lbragstadbut if a user calls that API with a system-scoped token, then they get a list of all users19:04
lbragstadit's the same API but different behavior depending on the authorization context of the user making the request19:05
*** sambetts is now known as sambetts|afk19:10
openstackgerritGage Hugo proposed openstack/keystone master: WIP - Add functional testing gate  https://review.openstack.org/53101419:12
*** harlowja has joined #openstack-keystone19:13
*** harlowja_ has joined #openstack-keystone19:16
*** harlowja has quit IRC19:19
*** breton has joined #openstack-keystone19:30
*** mvk has joined #openstack-keystone19:33
*** raildo has quit IRC19:33
openstackgerritGage Hugo proposed openstack/keystone master: WIP - Add functional testing gate  https://review.openstack.org/53101419:35
*** raildo has joined #openstack-keystone19:42
*** aloga_ has joined #openstack-keystone19:50
*** nicolasbock has quit IRC19:56
lbragstadall: if you're in need of travel support for the PTG, don't forget that the application process is open19:58
lbragstadhttps://openstackfoundation.formstack.com/forms/travelsupportptg_dublin19:58
lbragstad^ has to be filled out by Jan 25th19:59
poojalbragstad: thanks for sharing that approach! sorry had stepped away from my computer earlier20:08
lbragstadpooja: no worries20:08
poojaSo to clarify, role:reader or role:writer are new roles or they can be replaced with role:_member_?20:08
lbragstadi just used that as an example - those could be replaced with something else depending on your deployment20:09
sxc731lbragstad: actually one more odd thing I noticed while running KS with debug; the first time a req-id is traced, it seems to contain the previous req-id.  Not sure if serious?20:10
lbragstadi don't think it is20:11
poojaoh okay.. got it!20:11
lbragstadbut i'm not super familiar with req-id internals20:12
lbragstadpooja: since we're adding a new scope type this release (for system scope)20:12
lbragstadwe'll be able to fix a lot of those issues20:12
sxc731OK, cool.  HEre's an example: http://paste.openstack.org/show/642496/ (line feeds added manually for legibility).  20:30:38.035 has "req-e4456225-01a5-498e-9b73-ad9772a54781" which clearly belongs to the previous req; then 20:30:38.044 picks up the correct req-id20:12
lbragstadpooja: i recorded a demo of the stuff that is in flight with system-scope20:12
sxc731Could it hint at stuff running with an incorrect context?20:13
lbragstadchecking20:13
lbragstadsxc731: i could be wrong here - but that all might be the same request20:15
lbragstadthe first validate_token request you see is probably keystone validating the x-auth-token20:15
lbragstadand then it moves on to the x-subject-token20:15
sxc731Don't think so because you can see that this same "req-e4456225..." is actually used 13s earlier (top of log file).20:17
lbragstadoh - good call20:17
sxc731I discovered this when I was looking for my 5s delays (the first interaction is an example of this: 20:30:20.476, then 20:30:25.957)20:17
sxc731and then I noticed this weirdness.  Still if you say this isn't cause for worry, let's leave it at that...20:18
lbragstadworth following up20:19
sxc731Should I raise a KS ticket on this one?20:19
lbragstadlooks like it's an openstack-spec20:19
lbragstadyeah - we can make it a keystone bug for no20:19
lbragstadnow*20:19
sxc731Cool, will do20:20
lbragstadgood find20:20
sxc731Thanks again for taking all the time20:20
lbragstadsure thing - happy to help20:20
sxc731^well as you can see, I've been digging quite deep ;-)20:20
lbragstadpooja: here is the demo showing some of how that is done - https://www.youtube.com/watch?v=NI4MVMG7FGw20:26
*** blake has joined #openstack-keystone20:27
*** dave-mccowan has quit IRC20:27
*** dave-mccowan has joined #openstack-keystone20:38
poojalbragstad: thanks for the video link!20:53
lbragstadpooja: no problem - hopefully it helps20:58
lbragstadat least describe what we're trying to do20:58
lbragstadto address some of those issues20:58
poojadefinitely, this would help! Is this something that would get backported to Pike release though?20:59
*** AlexeyAbashkin has joined #openstack-keystone21:00
lbragstadsince it relies on a new feature, system-scope, it won't be back ported21:00
poojaah okay21:00
openstackgerritGage Hugo proposed openstack/keystone master: WIP - Add functional testing gate  https://review.openstack.org/53101421:03
*** AlexeyAbashkin has quit IRC21:04
openstackgerritLance Bragstad proposed openstack/keystone master: Implement controller logic for system user assignments  https://review.openstack.org/51521521:05
*** dave-mccowan has quit IRC21:29
*** sxc731 has quit IRC21:31
openstackgerritColleen Murphy proposed openstack/keystone master: WIP Add application credential auth plugin  https://review.openstack.org/52534621:32
*** pcaruana has joined #openstack-keystone21:42
*** jmlowe has quit IRC21:42
*** pcaruana has quit IRC21:43
*** raildo has quit IRC21:47
*** threestrands_ has joined #openstack-keystone21:52
*** threestrands_ has quit IRC21:53
*** threestrands_ has joined #openstack-keystone21:53
*** threestrands_ has quit IRC21:53
*** threestrands_ has joined #openstack-keystone21:53
*** threestrands has quit IRC21:54
openstackgerritLance Bragstad proposed openstack/keystone master: Implement controller logic for system user assignments  https://review.openstack.org/51521521:55
*** masber has joined #openstack-keystone22:02
*** blake has quit IRC22:05
*** rcernin has joined #openstack-keystone22:11
*** spilla has quit IRC22:16
-openstackstatus- NOTICE: The zuul system is being restarted to apply security updates and will be offline for several minutes. It will be restarted and changes re-equeued; changes approved during the downtime will need to be rechecked or re-approved.22:23
*** dtruong has joined #openstack-keystone22:26
*** afred312 has quit IRC22:27
*** jmlowe has joined #openstack-keystone22:28
*** panbalag has joined #openstack-keystone22:28
*** threestrands_ has quit IRC22:41
*** blake has joined #openstack-keystone22:42
openstackgerritGage Hugo proposed openstack/keystone master: WIP - Add functional testing gate  https://review.openstack.org/53101422:48
*** jmlowe has quit IRC22:52
*** threestrands has joined #openstack-keystone22:55
*** threestrands has quit IRC22:55
*** threestrands has joined #openstack-keystone22:55
openstackgerritLance Bragstad proposed openstack/oslo.policy master: WIP: Render deprecated policy names when generating files  https://review.openstack.org/53268522:56
*** afred312 has joined #openstack-keystone22:58
*** edmondsw has quit IRC22:59
*** afred312 has quit IRC23:03
*** aloga_ has quit IRC23:04
*** afred312 has joined #openstack-keystone23:07
openstackgerritLance Bragstad proposed openstack/oslo.policy master: WIP: Render deprecated policy names when generating files  https://review.openstack.org/53268523:10
*** threestrands has quit IRC23:11
*** jmlowe has joined #openstack-keystone23:12
*** threestrands has joined #openstack-keystone23:20
*** jmlowe has quit IRC23:44
*** jmlowe has joined #openstack-keystone23:46
*** phalmos has quit IRC23:47
*** freerunner has quit IRC23:52
*** andreykurilin has quit IRC23:52
*** andreykurilin has joined #openstack-keystone23:53
*** freerunner has joined #openstack-keystone23:53
*** edmondsw has joined #openstack-keystone23:55
*** blake has quit IRC23:57

Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!