| *** odyssey4me has quit IRC | 00:02 | |
| *** odyssey4me has joined #openstack-keystone | 00:03 | |
| *** felipemonteiro__ has joined #openstack-keystone | 00:07 | |
| *** oikiki has quit IRC | 00:07 | |
| *** Guest85132 has joined #openstack-keystone | 00:08 | |
| *** Guest85132 has quit IRC | 00:13 | |
| *** Krenair_ has joined #openstack-keystone | 00:21 | |
| *** mvk has joined #openstack-keystone | 00:27 | |
| *** Dinesh_Bhor has joined #openstack-keystone | 00:36 | |
| *** Dinesh_Bhor has quit IRC | 00:39 | |
| *** felipemonteiro__ has quit IRC | 00:40 | |
| *** Dinesh_Bhor has joined #openstack-keystone | 00:42 | |
| *** zhurong has joined #openstack-keystone | 00:45 | |
| *** wes_dillingham has quit IRC | 00:53 | |
| *** wes_dillingham has joined #openstack-keystone | 00:54 | |
| *** Dinesh_Bhor has quit IRC | 00:59 | |
| *** Dinesh_Bhor has joined #openstack-keystone | 01:16 | |
| *** wes_dillingham has quit IRC | 01:22 | |
| *** oikiki has joined #openstack-keystone | 01:27 | |
| *** harlowja has quit IRC | 01:31 | |
| *** Dinesh_Bhor has quit IRC | 01:35 | |
| *** Dinesh_Bhor has joined #openstack-keystone | 01:36 | |
| openstackgerrit | yangweiwei proposed openstack/keystone master: Fix user email in federated shadow users https://review.openstack.org/549723 | 01:37 |
|---|---|---|
| *** hoonetorg has quit IRC | 01:56 | |
| *** hoonetorg has joined #openstack-keystone | 01:57 | |
| lbragstad | kmalloc: yeah - that's all handled by mint() now | 01:58 |
| lbragstad | that new contract would be that whoever implements a new token provider would need to pass back the id and the issued at time | 01:58 |
| *** zhurong has quit IRC | 02:02 | |
| adriant | lbragstad, cmurphy: is it a bug that when you supple a versionless auth url to a v3 plugin in keystoneauth, it can't work out the version? But doing it with generic appears to work. | 02:09 |
| adriant | supple... supply | 02:10 |
| adriant | the E and Y buttons aren't even near each other | 02:10 |
| *** idlemind has quit IRC | 02:23 | |
| *** idlemind has joined #openstack-keystone | 02:24 | |
| *** edmondsw has joined #openstack-keystone | 02:42 | |
| *** oikiki has quit IRC | 02:47 | |
| *** edmondsw has quit IRC | 02:49 | |
| *** germs has quit IRC | 02:52 | |
| *** germs has joined #openstack-keystone | 02:52 | |
| *** germs has quit IRC | 02:52 | |
| *** germs has joined #openstack-keystone | 02:52 | |
| *** germs has quit IRC | 02:52 | |
| *** germs has joined #openstack-keystone | 02:53 | |
| *** germs has quit IRC | 02:53 | |
| *** germs has joined #openstack-keystone | 02:53 | |
| *** zhurong has joined #openstack-keystone | 02:56 | |
| *** dave-mccowan has quit IRC | 03:11 | |
| *** annp has joined #openstack-keystone | 03:14 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 03:17 | |
| *** oikiki has joined #openstack-keystone | 03:21 | |
| *** AlexeyAbashkin has quit IRC | 03:21 | |
| *** harlowja has joined #openstack-keystone | 03:32 | |
| *** oikiki has quit IRC | 03:35 | |
| *** d0ugal_ has joined #openstack-keystone | 03:38 | |
| *** d0ugal has quit IRC | 03:39 | |
| *** harlowja has quit IRC | 03:54 | |
| *** edmondsw has joined #openstack-keystone | 04:05 | |
| *** edmondsw has quit IRC | 04:10 | |
| wxy | adriant: I think it works as it is. Can I know that why you think it's a bug? generic plugin is used to support both v2 and v3. Maybe you think we can totally ignore version, because now keystone only support V3 now? | 04:12 |
| adriant | wxy: because with all the other services we now have version discovery built in for the most part, and I assumed with the v3 plugins for keystoneauth, if you supply a versionless url, it will use keystone's version discovery to get the right url for v3. | 04:14 |
| adriant | for example, we have the catalog entry for keystone versionless | 04:14 |
| adriant | and I was playing with throwing that into keystoneauth v3 plugins as is, but that failed. | 04:15 |
| adriant | wxy: basically, if we encourage versionless urls in the catalogs because version discovery is a thing, then why should the v3 auth plugin require a version in the url? | 04:18 |
| adriant | not to mention the error message you get from keystoneauth when you do that is 404 because it can't find the token endpoint, which doesn't help you realise what you did wrong. | 04:19 |
| *** Dinesh_Bhor has quit IRC | 04:34 | |
| *** Dinesh_Bhor has joined #openstack-keystone | 04:36 | |
| *** zhurong has quit IRC | 04:45 | |
| *** felipemonteiro__ has joined #openstack-keystone | 04:45 | |
| *** germs has quit IRC | 04:49 | |
| *** germs has joined #openstack-keystone | 04:49 | |
| *** germs has quit IRC | 04:49 | |
| *** germs has joined #openstack-keystone | 04:49 | |
| *** germs has quit IRC | 04:54 | |
| *** felipemonteiro__ has quit IRC | 04:57 | |
| *** Dinesh__Bhor has joined #openstack-keystone | 05:03 | |
| *** Dinesh_Bhor has quit IRC | 05:03 | |
| *** isssp has joined #openstack-keystone | 05:03 | |
| *** idlemind has quit IRC | 05:05 | |
| *** burned has quit IRC | 05:06 | |
| *** isssp has quit IRC | 05:09 | |
| *** isssp has joined #openstack-keystone | 05:12 | |
| *** gyankum has joined #openstack-keystone | 05:26 | |
| *** jaosorior_ is now known as jaosorior | 05:26 | |
| *** zhurong has joined #openstack-keystone | 05:34 | |
| *** rcernin has quit IRC | 05:34 | |
| *** oikiki has joined #openstack-keystone | 05:43 | |
| *** rcernin has joined #openstack-keystone | 05:46 | |
| *** links has joined #openstack-keystone | 05:53 | |
| *** edmondsw has joined #openstack-keystone | 05:54 | |
| *** edmondsw has quit IRC | 05:59 | |
| *** pcichy has joined #openstack-keystone | 06:03 | |
| *** rcernin has quit IRC | 06:06 | |
| *** rcernin has joined #openstack-keystone | 06:08 | |
| *** Dinesh__Bhor has quit IRC | 06:12 | |
| *** Dinesh__Bhor has joined #openstack-keystone | 06:16 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 06:16 | |
| *** AlexeyAbashkin has quit IRC | 06:21 | |
| *** threestrands has quit IRC | 06:25 | |
| wxy | adriant: sorry that just backing now after lunch. | 06:28 |
| wxy | adriant: sounds we can improve the identity plugin to add version automatically in keystoneauth | 06:30 |
| *** zhurong has quit IRC | 06:34 | |
| adriant | wxy: that's what I was thinking. Shouldn't be too hard, but makes life a little nicer | 06:34 |
| adriant | the code that does that exists, since the generic plugin must do that :P | 06:34 |
| *** oikiki has quit IRC | 06:41 | |
| *** pcichy has quit IRC | 06:58 | |
| *** masber has quit IRC | 07:05 | |
| *** masber has joined #openstack-keystone | 07:06 | |
| *** deepak_ has quit IRC | 07:07 | |
| *** pcichy has joined #openstack-keystone | 07:11 | |
| *** d0ugal_ has quit IRC | 07:14 | |
| *** zhurong has joined #openstack-keystone | 07:14 | |
| *** d0ugal has joined #openstack-keystone | 07:14 | |
| *** d0ugal has quit IRC | 07:14 | |
| *** d0ugal has joined #openstack-keystone | 07:14 | |
| *** links has quit IRC | 07:15 | |
| *** deepak_ has joined #openstack-keystone | 07:19 | |
| *** belmoreira has joined #openstack-keystone | 07:22 | |
| *** links has joined #openstack-keystone | 07:23 | |
| *** martinus__ has joined #openstack-keystone | 07:25 | |
| *** deepak_ has quit IRC | 07:25 | |
| *** isssp has quit IRC | 07:25 | |
| *** jaosorior has quit IRC | 07:25 | |
| *** hrybacki has quit IRC | 07:25 | |
| *** Anticimex has quit IRC | 07:25 | |
| *** timss has quit IRC | 07:25 | |
| *** jaosorior has joined #openstack-keystone | 07:26 | |
| *** hrybacki has joined #openstack-keystone | 07:26 | |
| *** isssp has joined #openstack-keystone | 07:26 | |
| *** timss has joined #openstack-keystone | 07:27 | |
| *** deepak_ has joined #openstack-keystone | 07:28 | |
| *** gagehugo has quit IRC | 07:28 | |
| *** rcernin has quit IRC | 07:31 | |
| *** markvoelker has quit IRC | 07:35 | |
| *** gagehugo has joined #openstack-keystone | 07:35 | |
| *** edmondsw has joined #openstack-keystone | 07:42 | |
| *** pcaruana has joined #openstack-keystone | 07:42 | |
| *** pcaruana has quit IRC | 07:44 | |
| *** pcaruana has joined #openstack-keystone | 07:44 | |
| *** pcaruana has quit IRC | 07:45 | |
| *** pcaruana has joined #openstack-keystone | 07:45 | |
| *** edmondsw has quit IRC | 07:46 | |
| *** pcaruana has quit IRC | 07:47 | |
| *** pcaruana has joined #openstack-keystone | 07:47 | |
| *** pcaruana has quit IRC | 07:48 | |
| *** pcaruana has joined #openstack-keystone | 07:48 | |
| *** pcaruana has quit IRC | 07:50 | |
| *** pcaruana has joined #openstack-keystone | 07:50 | |
| *** masber has quit IRC | 07:51 | |
| *** pcaruana has quit IRC | 07:51 | |
| *** pcaruana has joined #openstack-keystone | 07:51 | |
| *** pcaruana has quit IRC | 07:53 | |
| *** pcaruana has joined #openstack-keystone | 07:53 | |
| *** pcaruana has quit IRC | 07:54 | |
| *** pcaruana has joined #openstack-keystone | 07:55 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 07:56 | |
| *** pcaruana has quit IRC | 07:56 | |
| *** belmorei_ has joined #openstack-keystone | 07:57 | |
| *** ispp has joined #openstack-keystone | 07:58 | |
| *** asettle has quit IRC | 07:59 | |
| *** belmoreira has quit IRC | 07:59 | |
| *** andymccr has quit IRC | 07:59 | |
| *** isssp has quit IRC | 08:00 | |
| cmurphy | adriant: i'm not so sure that's a bug | 08:01 |
| cmurphy | from https://docs.openstack.org/keystoneauth/latest/authentication-plugins.html "V3 identity plugins must use an auth_url that points to the root of a V3 identity server URL, i.e.: http://hostname:5000/v3." | 08:01 |
| adriant | cmurphy: can be change that? That wouldn't exactly be a breaking change, and makes life a little nicer | 08:02 |
| *** belmorei_ has quit IRC | 08:02 | |
| *** belmore__ has joined #openstack-keystone | 08:02 | |
| adriant | can we* | 08:02 |
| cmurphy | maybe | 08:03 |
| adriant | kmalloc: would have a better insight, but I doubt anyone in their right mind is relying on that failing... | 08:04 |
| cmurphy | mordred: also a good person to ask about it | 08:04 |
| *** andymccr has joined #openstack-keystone | 08:05 | |
| *** dstanek has quit IRC | 08:06 | |
| *** asettle has joined #openstack-keystone | 08:06 | |
| *** pcaruana has joined #openstack-keystone | 08:06 | |
| *** asettle is now known as Guest66969 | 08:06 | |
| *** pcaruana has quit IRC | 08:07 | |
| *** pcaruana has joined #openstack-keystone | 08:08 | |
| *** pcaruana has quit IRC | 08:09 | |
| *** pcaruana has joined #openstack-keystone | 08:10 | |
| *** pcaruana has quit IRC | 08:10 | |
| *** pcaruana has joined #openstack-keystone | 08:11 | |
| *** tesseract has joined #openstack-keystone | 08:11 | |
| *** masber has joined #openstack-keystone | 08:11 | |
| *** dstanek has joined #openstack-keystone | 08:11 | |
| *** pcaruana has quit IRC | 08:12 | |
| *** pcaruana has joined #openstack-keystone | 08:13 | |
| *** pcaruana has quit IRC | 08:15 | |
| *** pcaruana has joined #openstack-keystone | 08:15 | |
| cmurphy | you should also be able to use the generic plugin and it should do the right thing | 08:15 |
| *** pcaruana has quit IRC | 08:16 | |
| *** AlexeyAbashkin has quit IRC | 08:17 | |
| *** pcaruana has joined #openstack-keystone | 08:18 | |
| *** masber has quit IRC | 08:18 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 08:18 | |
| *** pcaruana has quit IRC | 08:20 | |
| *** pcaruana has joined #openstack-keystone | 08:20 | |
| *** pcaruana has quit IRC | 08:21 | |
| *** pcaruana has joined #openstack-keystone | 08:21 | |
| *** pcaruana has quit IRC | 08:22 | |
| openstackgerrit | Andreas Jaeger proposed openstack/keystoneauth master: Remove tox_install.sh and align with constraints consumption https://review.openstack.org/550837 | 08:23 |
| *** pcaruana has joined #openstack-keystone | 08:29 | |
| *** pcaruana has quit IRC | 08:30 | |
| *** markvoelker has joined #openstack-keystone | 08:34 | |
| *** pcaruana has joined #openstack-keystone | 08:36 | |
| *** pcaruana has quit IRC | 08:37 | |
| *** pcaruana has joined #openstack-keystone | 08:38 | |
| *** pcaruana has quit IRC | 08:39 | |
| *** pcaruana has joined #openstack-keystone | 08:40 | |
| openstackgerrit | Nguyen Hai proposed openstack/keystone master: Follow the new PTI for document build https://review.openstack.org/555196 | 08:40 |
| *** pcaruana has quit IRC | 08:40 | |
| *** pcaruana has joined #openstack-keystone | 08:41 | |
| *** pcaruana has quit IRC | 08:41 | |
| *** sapd has quit IRC | 08:44 | |
| *** sapd has joined #openstack-keystone | 08:45 | |
| *** masber has joined #openstack-keystone | 08:55 | |
| adriant | cmurphy: oh I am, but I would like to use v3 directly :P | 08:57 |
| adriant | just for clarity as to which auth version I care about | 08:57 |
| *** pcaruana has joined #openstack-keystone | 09:02 | |
| *** pcaruana has quit IRC | 09:03 | |
| *** pcaruana has joined #openstack-keystone | 09:03 | |
| *** pcaruana has quit IRC | 09:05 | |
| *** zhurong has quit IRC | 09:16 | |
| *** masber has quit IRC | 09:17 | |
| *** Dinesh__Bhor has quit IRC | 09:25 | |
| *** masber has joined #openstack-keystone | 09:28 | |
| *** edmondsw has joined #openstack-keystone | 09:30 | |
| *** edmondsw has quit IRC | 09:35 | |
| *** Guest66969 is now known as asettle | 09:46 | |
| *** masuberu has joined #openstack-keystone | 10:27 | |
| *** masber has quit IRC | 10:30 | |
| *** pcichy has quit IRC | 10:48 | |
| openstackgerrit | Monty Taylor proposed openstack/keystoneauth master: Remove tox_install.sh and align with constraints consumption https://review.openstack.org/550837 | 10:55 |
| *** AlexeyAbashkin has quit IRC | 11:00 | |
| mordred | cmurphy, adriant: I thnk we should fix v3 to allow versionless url - although I'd argue that if you hand a versionless auth_url to v3 plugin, if it can't get a v3 endpoint through discovery it should be a hard error | 11:00 |
| *** AlexeyAbashkin has joined #openstack-keystone | 11:00 | |
| mordred | cmurphy, adriant: while we're at it, we should do the same thing for v2 - the restriction doens't make any sense, and it undercuts our efforts to get people to use versionless auth urls | 11:01 |
| *** wes_dillingham has joined #openstack-keystone | 11:21 | |
| *** belmore__ has quit IRC | 11:23 | |
| adriant | mordred: ty! ++ for quality of life fixes :P | 11:31 |
| *** zhurong has joined #openstack-keystone | 11:39 | |
| *** dklyle has quit IRC | 11:49 | |
| *** masuberu has quit IRC | 11:52 | |
| *** masuberu has joined #openstack-keystone | 11:52 | |
| *** odyssey4me has quit IRC | 12:07 | |
| *** odyssey4me has joined #openstack-keystone | 12:08 | |
| *** belmoreira has joined #openstack-keystone | 12:09 | |
| *** edmondsw has joined #openstack-keystone | 12:15 | |
| *** aojea has joined #openstack-keystone | 12:18 | |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Clean up token extra code https://review.openstack.org/555279 | 12:23 |
| *** panbalag has joined #openstack-keystone | 12:29 | |
| *** markvoelker has quit IRC | 12:34 | |
| *** markvoelker has joined #openstack-keystone | 12:34 | |
| *** zhurong has quit IRC | 13:00 | |
| *** idlemind has joined #openstack-keystone | 13:05 | |
| *** dulek has joined #openstack-keystone | 13:06 | |
| dulek | Hi guys! Any idea of a recent change that was related to certificates? Our Kuryr jobs started to fail because it can't find /opt/stack/data/ca-bundle.pem. | 13:07 |
| dulek | I mean - when connecting to Keystone. :) | 13:07 |
| lbragstad | dulek: nothing on our end afaik | 13:08 |
| lbragstad | dulek: do you have an example failure? | 13:09 |
| dulek | http://logs.openstack.org/54/555254/1/experimental/kuryr-kubernetes-tempest-daemon-containerized-lbaasv2/9ecada1/controller/logs/screen-kuryr-kubernetes.txt.gz#_Mar_22_11_50_32_981299 | 13:09 |
| dulek | lbragstad: ^ | 13:09 |
| dulek | lbragstad: It's probably because this is being run from inside the container with Kuryr. And this container has no access to /opt/stack/data from the host. | 13:10 |
| *** NM has joined #openstack-keystone | 13:10 | |
| lbragstad | ahh | 13:10 |
| lbragstad | did that work before? | 13:10 |
| dulek | So seeing a change that triggered this would be helpful to understand how it should be fixed properly. | 13:10 |
| dulek | lbragstad: Well… Yes. :) | 13:10 |
| lbragstad | how long has it been failing? | 13:10 |
| dulek | lbragstad: It's a bit hard to tell - that's experimental job, but I'd say that around a week. | 13:11 |
| lbragstad | there hasn't been a whole lot of activity in the last two weeks, most folks are reviewing specs | 13:12 |
| lbragstad | nothing cert related from keystone-server https://github.com/openstack/keystone/commits/master | 13:12 |
| dulek | lbragstad: Okay, thank you. I think this might have been a DevStack change. | 13:12 |
| lbragstad | i just started looking there - https://github.com/openstack-dev/devstack/commits/master | 13:13 |
| dulek | :) | 13:13 |
| dulek | lbragstad: Hm, not much activity there since we've fixed our gates. And I've definitely checked experimental back then. That's a bit odd. | 13:15 |
| dulek | lbragstad: Anyway thanks again, we'll figure it out ourselves. :) | 13:15 |
| lbragstad | dulek: no worries - let us know if there is anything we can help with | 13:16 |
| *** germs has joined #openstack-keystone | 13:33 | |
| *** germs has quit IRC | 13:33 | |
| *** germs has joined #openstack-keystone | 13:33 | |
| *** germs has quit IRC | 13:33 | |
| *** germs has joined #openstack-keystone | 13:34 | |
| *** germs has quit IRC | 13:34 | |
| *** germs has joined #openstack-keystone | 13:34 | |
| openstackgerrit | Nguyen Hai proposed openstack/keystone master: Follow the new PTI for document build https://review.openstack.org/555196 | 13:34 |
| *** aojea has quit IRC | 13:36 | |
| *** aojea has joined #openstack-keystone | 13:46 | |
| *** aojea has quit IRC | 13:50 | |
| *** felipemonteiro__ has joined #openstack-keystone | 13:55 | |
| *** wes_dillingham has quit IRC | 14:00 | |
| *** wes_dillingham has joined #openstack-keystone | 14:00 | |
| *** wes_dillingham has quit IRC | 14:00 | |
| *** wes_dillingham has joined #openstack-keystone | 14:01 | |
| *** wes_dillingham has quit IRC | 14:01 | |
| kmalloc | adriant: either mordred or I can look into that, but FTR - keystoneauth has an extremely strict contract. We adhere to "The behavior will not change once it is released*" * == unless there is a major security flaw and there is no other solution | 14:01 |
| *** wes_dillingham has joined #openstack-keystone | 14:02 | |
| *** wes_dillingham has quit IRC | 14:02 | |
| *** wes_dillingham has joined #openstack-keystone | 14:02 | |
| *** wes_dillingham has quit IRC | 14:03 | |
| *** wes_dillingham has joined #openstack-keystone | 14:03 | |
| *** wes_dillingham has quit IRC | 14:03 | |
| *** felipemonteiro_ has joined #openstack-keystone | 14:03 | |
| *** wes_dillingham has joined #openstack-keystone | 14:04 | |
| *** wes_dillingham has quit IRC | 14:04 | |
| kmalloc | adriant: the v3 plugin requires a version because you're asking for a versioned plugin and that is the historical behavior | 14:04 |
| kmalloc | adriant: it is not a bug. (cmurphy thanks for fielding the question!) | 14:04 |
| *** wes_dillingham has joined #openstack-keystone | 14:05 | |
| *** wes_dillingham has quit IRC | 14:05 | |
| *** wes_dillingham has joined #openstack-keystone | 14:06 | |
| *** wes_dillingham has quit IRC | 14:06 | |
| *** wes_dillingham has joined #openstack-keystone | 14:06 | |
| *** wes_dillingham has quit IRC | 14:07 | |
| *** wes_dillingham has joined #openstack-keystone | 14:07 | |
| *** wes_dillingham has quit IRC | 14:07 | |
| *** felipemonteiro__ has quit IRC | 14:07 | |
| *** pcichy has joined #openstack-keystone | 14:07 | |
| *** wes_dillingham has joined #openstack-keystone | 14:08 | |
| *** wes_dillingham has quit IRC | 14:08 | |
| *** links has quit IRC | 14:10 | |
| *** itlinux has quit IRC | 14:11 | |
| *** pcichy has quit IRC | 14:12 | |
| *** pcichy has joined #openstack-keystone | 14:12 | |
| *** dklyle has joined #openstack-keystone | 14:15 | |
| *** spilla has joined #openstack-keystone | 14:17 | |
| *** germs_ has joined #openstack-keystone | 14:18 | |
| *** germs has quit IRC | 14:20 | |
| *** r-daneel has joined #openstack-keystone | 14:27 | |
| *** wes_dillingham has joined #openstack-keystone | 14:40 | |
| *** felipemonteiro__ has joined #openstack-keystone | 14:53 | |
| *** felipemonteiro_ has quit IRC | 14:57 | |
| *** gyankum has quit IRC | 14:58 | |
| *** jessegler has joined #openstack-keystone | 15:04 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: WIP: rewrite keystone https://review.openstack.org/545450 | 15:06 |
| lbragstad | passes unit tests, including python3 ^ ' | 15:06 |
| *** aojea_ has joined #openstack-keystone | 15:09 | |
| lbragstad | so - fun fact | 15:14 |
| *** aojea_ has quit IRC | 15:14 | |
| mordred | kmalloc: I contend it's a bug - but I can go along with not fixing it due to strict contract | 15:15 |
| lbragstad | keystone will break when running in python 3 if CONF.token.cache_on_issue is False | 15:15 |
| *** dave-mccowan has joined #openstack-keystone | 15:15 | |
| gagehugo | oof | 15:15 |
| lbragstad | mmmhmm | 15:16 |
| mordred | lbragstad: wow. fun patch | 15:17 |
| lbragstad | i literally went crossed staring at https://github.com/openstack/keystone/blob/master/keystone/auth/plugins/core.py#L63-L97 | 15:17 |
| lbragstad | because it returned two different things depending on the version of python you run it in | 15:17 |
| lbragstad | so i was like "oh, typing issue somewhere, right?" | 15:17 |
| lbragstad | nope, all types are consistent | 15:17 |
| lbragstad | but python3 is more precise with rounding than python 2, which automatically floors results | 15:17 |
| lbragstad | hence... integers always being expected... | 15:18 |
| lbragstad | but the only reason I found it was because i commented out https://github.com/openstack/keystone/blob/master/keystone/token/provider.py#L173 | 15:18 |
| lbragstad | which cause the token to be rebuilt when validated... | 15:18 |
| *** germs_ has quit IRC | 15:20 | |
| lbragstad | we obviously short-circuit that code if we stuff the token in the cache on our way out the door when we authenticate the token... | 15:20 |
| *** germs has joined #openstack-keystone | 15:20 | |
| *** germs has quit IRC | 15:20 | |
| *** germs has joined #openstack-keystone | 15:20 | |
| *** felipemonteiro__ has quit IRC | 15:21 | |
| lbragstad | so - if you're running keystone in python3 and disable the configuration option... token validation will break for your deployment | 15:21 |
| *** felipemonteiro__ has joined #openstack-keystone | 15:21 | |
| gagehugo | hmm | 15:21 |
| *** idlemind_ has joined #openstack-keystone | 15:33 | |
| *** idlemind has quit IRC | 15:33 | |
| *** wes_dillingham has quit IRC | 15:37 | |
| *** itlinux has joined #openstack-keystone | 15:37 | |
| *** itlinux has quit IRC | 15:39 | |
| *** itlinux has joined #openstack-keystone | 15:39 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: WIP: Expose python3 bug when cache_on_issue is False https://review.openstack.org/555339 | 15:40 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Cast division product to int when inflating auth https://review.openstack.org/555340 | 15:40 |
| lbragstad | gagehugo: ^ | 15:40 |
| lbragstad | i think it happens with that specific test because it's using more authentication methods | 15:40 |
| gagehugo | ack | 15:40 |
| gagehugo | interesting | 15:40 |
| lbragstad | i need to open a bug yet.. but just in case you were curious | 15:40 |
| lbragstad | otherwise we're using relatively nice numbers in the method_map | 15:41 |
| lbragstad | and i think they divide nicely, instead of taking 5 / 4 and getting 1.25 | 15:42 |
| gagehugo | yeah | 15:42 |
| *** pcaruana has joined #openstack-keystone | 15:42 | |
| *** pcaruana has quit IRC | 15:44 | |
| lbragstad | mordred: it's a real fun patch, you should review it ;) | 15:44 |
| lbragstad | if getting rid of technical debt is your thing, you'll love it | 15:45 |
| *** wes_dillingham has joined #openstack-keystone | 15:46 | |
| *** pcaruana has joined #openstack-keystone | 15:48 | |
| kmalloc | mordred: well, that is the deal with ksa, strict contract (also, the doc explicitly calls out this behavior) | 15:53 |
| kmalloc | lbragstad: ugh, the pre-population cache off breaks keystone?! ugh | 15:53 |
| kmalloc | oh that is just dumb... | 15:54 |
| *** Supun has joined #openstack-keystone | 15:54 | |
| lbragstad | kmalloc: :) | 15:57 |
| lbragstad | it's one big short circuit | 15:57 |
| lbragstad | and with that.. i'm going to take lunch quick | 15:58 |
| *** harlowja has joined #openstack-keystone | 16:04 | |
| *** felipemonteiro_ has joined #openstack-keystone | 16:05 | |
| *** felipemonteiro__ has quit IRC | 16:09 | |
| *** harlowja has quit IRC | 16:09 | |
| openstackgerrit | Gage Hugo proposed openstack/keystone master: Add functional testing gate https://review.openstack.org/531014 | 16:34 |
| *** AlexeyAbashkin has quit IRC | 16:34 | |
| *** masuberu has quit IRC | 16:36 | |
| *** aojea_ has joined #openstack-keystone | 16:58 | |
| *** wes_dillingham has quit IRC | 16:58 | |
| *** gyee has joined #openstack-keystone | 17:00 | |
| *** Supun has quit IRC | 17:00 | |
| *** aojea_ has quit IRC | 17:02 | |
| *** idlemind_ has quit IRC | 17:02 | |
| *** idlemind has joined #openstack-keystone | 17:03 | |
| *** belmoreira has quit IRC | 17:15 | |
| *** jessegler has quit IRC | 17:18 | |
| openstackgerrit | Johannes Grassler proposed openstack/keystone-specs master: Add whitelist-extension-for-app-creds https://review.openstack.org/396331 | 17:22 |
| gagehugo | lbragstad you alright with me submitting a change to governance to add the vmt tag for keystonemiddleware? | 17:32 |
| *** wes_dillingham has joined #openstack-keystone | 17:36 | |
| *** Supun has joined #openstack-keystone | 17:39 | |
| *** Anticimex has joined #openstack-keystone | 17:50 | |
| lbragstad | gagehugo: go for it! | 17:56 |
| *** felipemonteiro has joined #openstack-keystone | 17:56 | |
| *** felipemonteiro_ has quit IRC | 17:59 | |
| ayoung | lbragstad, something we don't do, and need to, is address how to clean up all resources in the service catalog when you delete a projects | 18:11 |
| ayoung | I was trying to think through how that would work, and my head hurts | 18:11 |
| ayoung | lets assume, for the moment, that we generate a special token for that use case | 18:11 |
| ayoung | it is scoped to the user that performed delete project, and it never expires, but can only be used to delete things in that project | 18:12 |
| ayoung | that would be the magic case | 18:12 |
| ayoung | and so, we have some workflow that goes to every .... endpoint? | 18:12 |
| *** boris_42_ has joined #openstack-keystone | 18:12 | |
| ayoung | and calls "delete-all-resources-for-project" on each endpoint, validated by that magic token | 18:13 |
| ayoung | so...short of adding Ansible tower into the OpenStack family of services, I have no idea how to make that happen. Mistral, I guess? | 18:13 |
| *** harlowja has joined #openstack-keystone | 18:15 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 18:15 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Fix integer -> method conversion for python3 https://review.openstack.org/555339 | 18:16 |
| lbragstad | ayoung: that was brought to mistral a while ago, but it was never accepted upstream | 18:17 |
| *** harlowja_ has joined #openstack-keystone | 18:17 | |
| ayoung | lbragstad, the problem is keeping track of the set of resources that should be deleted | 18:17 |
| ayoung | and the order...tearing down a network in Neutron has to be done in the right order or you get dependency issues | 18:18 |
| ayoung | ideally, the services would implement that themselves: | 18:18 |
| ayoung | delete all resources in project | 18:18 |
| ayoung | and...I wonder if there is even an ordering there that is necessary | 18:19 |
| lbragstad | i wouldn't be surprised | 18:19 |
| ayoung | like, what happens in Nova if you delete the network in neutron and the volume in cinder | 18:19 |
| ayoung | and the image in glance | 18:19 |
| *** harlowja has quit IRC | 18:19 | |
| *** AlexeyAbashkin has quit IRC | 18:20 | |
| *** dave-mccowan has quit IRC | 18:20 | |
| ayoung | We could do the workflow outside of Keystone after the project is deleted, but right now it needs a super-power token | 18:23 |
| ayoung | and that I don't like. | 18:24 |
| *** wes_dillingham has quit IRC | 18:27 | |
| kmalloc | ayoung: it needs to be an API on the service (aka Nova) | 18:28 |
| kmalloc | ayoung: it is NOT a keystone problem to do that | 18:28 |
| kmalloc | ayoung: the way openstack is architected, it just isn't viable to make it a keystone problem to do that. | 18:28 |
| ayoung | kmalloc, I think it is a general OpenStack problem to solve, but Keystone is the only service in position to guide the discussion | 18:28 |
| kmalloc | ayoung: so yeah, mistral, ansible tower, something? iterate over endpoints in keystone and call "clean-up-for-project/<project-id> | 18:29 |
| kmalloc | ayoung: making a scoped token for a deleted project is a no-go. really, either we do "work outside keystone" or have the services support a cleanup-for-project type API. | 18:30 |
| ayoung | kmalloc, if I had to do it today, I would have a listener get the project delete notification, use an admin scoped token to list all resources of one kind in an end point, delete them, then move on to the next one" | 18:30 |
| ayoung | I would rather be able to do that with a scoped token | 18:30 |
| kmalloc | this really needs to be a service-api for the services. | 18:30 |
| kmalloc | it is absurd to have to do a delete-all-instances in nova, if you have say 10000 instances under a project | 18:31 |
| kmalloc | that is a lot of tear down, vs. "hey nova, schedule delete all things for project X" | 18:31 |
| ayoung | what if....we generated an app credential and used the Whitelist to limit it to the delete operations? | 18:31 |
| kmalloc | and let nova handle scheduling that | 18:31 |
| ayoung | It would fail validation | 18:31 |
| *** tesseract has quit IRC | 18:32 | |
| ayoung | kmalloc, I hear you, but getting agreement on that API across all the services in OpenStack would be a full time job | 18:32 |
| ayoung | The fact that we don't even have a clean way to scope/workflow it now is sad | 18:32 |
| kmalloc | i'm going to reierate, this isn't a keystone problem, *we cannot fix this* we cna paper over it in some bad ways that don't help much | 18:32 |
| ayoung | what if... | 18:32 |
| ayoung | we disable the project, but allow someone to get tokens scoped to it in order to do the clean up | 18:33 |
| ayoung | the disable is to prevent new resources from being created | 18:33 |
| kmalloc | this sounds like a terrrrrrible idea but that is somewhat better | 18:33 |
| ayoung | meanwhile, we can try to drive the long term api changes | 18:33 |
| kmalloc | mostly concerns me from a security standpoint | 18:33 |
| kmalloc | if a disabled project can get tokens.. it is somewhat of a security issue, but i'm less concerned than scoping to a random project (that may or may not be deleted) | 18:34 |
| kmalloc | since we have a record of the project to base it on | 18:34 |
| kmalloc | i am not sure i like the prospect of maintaining auth for disabled projects, but again -- that is less of a red flag (very bad no good) feeling than the scope to deleted projects | 18:36 |
| *** germs has quit IRC | 18:36 | |
| *** germs has joined #openstack-keystone | 18:37 | |
| *** germs has quit IRC | 18:37 | |
| *** germs has joined #openstack-keystone | 18:37 | |
| *** germs has quit IRC | 18:39 | |
| *** germs has joined #openstack-keystone | 18:39 | |
| *** germs has quit IRC | 18:39 | |
| *** germs has joined #openstack-keystone | 18:39 | |
| *** felipemonteiro has quit IRC | 18:42 | |
| *** felipemonteiro has joined #openstack-keystone | 18:43 | |
| *** Krenair_ is now known as Krenair | 18:45 | |
| *** Krenair has joined #openstack-keystone | 18:45 | |
| *** aojea has joined #openstack-keystone | 18:46 | |
| *** aojea has quit IRC | 18:50 | |
| *** wes_dillingham has joined #openstack-keystone | 18:51 | |
| *** itlinux has quit IRC | 18:59 | |
| *** itlinux has joined #openstack-keystone | 18:59 | |
| *** voelzmo has joined #openstack-keystone | 19:01 | |
| *** aojea has joined #openstack-keystone | 19:01 | |
| *** wes_dillingham has quit IRC | 19:01 | |
| *** r-daneel_ has joined #openstack-keystone | 19:02 | |
| *** r-daneel has quit IRC | 19:02 | |
| *** r-daneel_ is now known as r-daneel | 19:02 | |
| *** voelzmo has quit IRC | 19:10 | |
| *** voelzmo has joined #openstack-keystone | 19:11 | |
| kmalloc | adriant: one more round of updates for MFA-receipts | 19:18 |
| kmalloc | adriant: but you're close. we're at the point where it's just clarifying sections and making sure we're not leaving ourselves open to misinterpretation of the spec during implementation. This is ready for a +2 with the changes i outlined. | 19:19 |
| *** voelzmo has quit IRC | 19:22 | |
| kmalloc | jgr: the recent spec for whitelist is looking reaaaaaaally good | 19:22 |
| kmalloc | jgr: +1, will be doing more in depth after food. | 19:22 |
| *** aojea has quit IRC | 19:23 | |
| *** aojea has joined #openstack-keystone | 19:43 | |
| *** devx has joined #openstack-keystone | 19:44 | |
| *** aojea has quit IRC | 19:45 | |
| *** aojea has joined #openstack-keystone | 19:45 | |
| *** aojea has quit IRC | 19:46 | |
| devx | hello, I was hopping to get a bit of direction. I'm using AD with keystone and I've encounter what I think it's a bug where I get a Duplicate Entry error. resulting in | 19:47 |
| devx | "An error occurred authenticating", any direction would be appreciated | 19:47 |
| *** devx is now known as DevX | 19:49 | |
| *** wes_dillingham has joined #openstack-keystone | 19:49 | |
| *** aojea has joined #openstack-keystone | 19:49 | |
| *** r-daneel_ has joined #openstack-keystone | 19:49 | |
| *** r-daneel has quit IRC | 19:50 | |
| *** r-daneel_ is now known as r-daneel | 19:50 | |
| *** panbalag has quit IRC | 19:58 | |
| *** wes_dillingham has quit IRC | 19:59 | |
| *** Supun has quit IRC | 19:59 | |
| lbragstad | DevX: how are you authenticating? | 20:03 |
| DevX | via ldaps | 20:04 |
| DevX | i can share my config if you like to see | 20:04 |
| DevX | this is the error I'm getting https://gist.github.com/devx/046fa81d1bafb78086d9d20c4831b003 | 20:04 |
| lbragstad | sure - i'll take a look | 20:04 |
| lbragstad | oh... | 20:05 |
| lbragstad | hey DevX :) | 20:05 |
| DevX | let me generate a gist ;) | 20:05 |
| lbragstad | i thought that github profile picture looked familiar | 20:06 |
| DevX | btw cloudnull says hi. | 20:06 |
| * lbragstad waves | 20:06 | |
| lbragstad | is cloudnull creeping over your shoulder? | 20:06 |
| DevX | he was | 20:07 |
| DevX | give me a sec need to sanitize | 20:07 |
| DevX | btw i've validated ldap connectivity and all that stuff | 20:07 |
| *** josecastroleon has joined #openstack-keystone | 20:08 | |
| * cloudnull is lurking in the shadows | 20:08 | |
| lbragstad | huh... | 20:09 |
| lbragstad | the four lines of that trace is interesting | 20:09 |
| lbragstad | it looks like the user you're authenticating with is in fact shadowed in keystone | 20:09 |
| lbragstad | but it attempts to shadow it anyway? | 20:09 |
| DevX | yeah | 20:09 |
| DevX | https://gist.github.com/devx/ccee034943961b60f55aeed377426325 | 20:10 |
| DevX | the ldap stuff has been sanitized but they work. | 20:10 |
| DevX | i've manually tested using ldapsearch | 20:10 |
| lbragstad | is this queens? | 20:11 |
| DevX | TLDR: it was working last week when there was an edir in place alongside AD servers. However, the edir has now been removed and it's all AD and we are getting this error | 20:11 |
| DevX | :( | 20:11 |
| DevX | newton | 20:11 |
| * DevX hides in shame | 20:11 | |
| lbragstad | so which one was keystone backed to? | 20:12 |
| lbragstad | edir or ad? | 20:12 |
| DevX | AD | 20:12 |
| DevX | so not sure why the problem started to happen it does not make sense | 20:12 |
| lbragstad | right... that's strange | 20:13 |
| DevX | the fact that the insert happens lead me to believe that it migth be a bug in Newton not sure if it happens in queens though | 20:14 |
| * lbragstad tries to find a copy of newton code | 20:16 | |
| DevX | I have tested this via openstack cli client and horizion and same error. Via horizon shows up as a 409 | 20:16 |
| lbragstad | we do seem to have a very clear case in master | 20:17 |
| lbragstad | we enter here - https://github.com/openstack/keystone/blob/d4f3160334838c592cc8616bba85c13f308468f6/keystone/identity/core.py#L917 | 20:17 |
| lbragstad | we get into this - https://github.com/openstack/keystone/blob/d4f3160334838c592cc8616bba85c13f308468f6/keystone/identity/core.py#L606 | 20:17 |
| *** aojea has quit IRC | 20:17 | |
| lbragstad | which should be a single user case | 20:18 |
| lbragstad | judging by the trace | 20:18 |
| *** aojea has joined #openstack-keystone | 20:18 | |
| DevX | i see | 20:18 |
| lbragstad | we very clearly hit - https://github.com/openstack/keystone/blob/d4f3160334838c592cc8616bba85c13f308468f6/keystone/identity/core.py#L643 | 20:18 |
| lbragstad | which is the only place we emit the log in your trace | 20:19 |
| DevX | right | 20:19 |
| lbragstad | and we don't bother inserting that public id | 20:19 |
| lbragstad | we have this in newton https://git.openstack.org/cgit/openstack/keystone/tree/keystone/identity/core.py?h=newton-eol#n599 | 20:21 |
| DevX | right | 20:22 |
| DevX | it's just logging it | 20:22 |
| DevX | let me grab the full trace and update the gist | 20:27 |
| lbragstad | ok.. i'm wondering if for some weird reason it's not finding the user after successfully authenticating... | 20:29 |
| lbragstad | https://git.openstack.org/cgit/openstack/keystone/tree/keystone/identity/core.py?h=newton-eol#n1249 | 20:29 |
| lbragstad | did AD have it's own domain configuration? | 20:30 |
| DevX | yes | 20:31 |
| openstackgerrit | Gage Hugo proposed openstack/keystone master: Remove the TokenAuth middleware https://review.openstack.org/508412 | 20:32 |
| *** aojea has quit IRC | 20:33 | |
| *** rarora has quit IRC | 20:33 | |
| *** aojea has joined #openstack-keystone | 20:34 | |
| DevX | Ok, I've updated the gist with the entire gist. (sorry, I should have done that in the first place) | 20:38 |
| lbragstad | checking | 20:39 |
| *** MeltedLux has joined #openstack-keystone | 20:39 | |
| *** boris_42_ has quit IRC | 20:41 | |
| lbragstad | there has to be a mismatch somewhere... | 20:42 |
| lbragstad | has this user existed since edir was removed? | 20:42 |
| DevX | yes, this happening for all the users | 20:42 |
| DevX | I even ran the mappings purge to ensure it was not not a stale mapping | 20:43 |
| lbragstad | huh - that was my next suggestion | 20:43 |
| DevX | have also added users to the AD group | 20:43 |
| DevX | and same effect | 20:43 |
| DevX | this is affecting all AD users, all local users are ok | 20:43 |
| DevX | at first thought it was a cert issue so i switch to `tls_req_cert = allow` | 20:45 |
| DevX | which checks the certs but will continue no matter what | 20:45 |
| *** AlexeyAbashkin has joined #openstack-keystone | 20:45 | |
| DevX | this LDAP/AD setup was working for a couple of months but broke when the edir was removed | 20:46 |
| lbragstad | that's really weird... | 20:47 |
| lbragstad | and edir wasn't integrated into keystone at all? | 20:47 |
| DevX | tell me about it | 20:47 |
| DevX | I went as far as setting an incorrect password to verify connectivity | 20:48 |
| DevX | and it failed to connect as expected. aka failed to bind. | 20:48 |
| lbragstad | hmm | 20:49 |
| DevX | I can re-run the clear mappings again and see if that helps | 20:49 |
| DevX | I can try it per domain or per user | 20:49 |
| lbragstad | are you able patch the system? | 20:49 |
| lbragstad | i assume this is using osa in some form or fashion? | 20:49 |
| DevX | correct | 20:49 |
| DevX | OSA | 20:49 |
| DevX | i could try to do the domain ID and domain name when i do `keystone-manage mapping_purge --domain-name DOMAIN` | 20:50 |
| lbragstad | http://paste.openstack.org/raw/709012/ | 20:52 |
| *** AlexeyAbashkin has quit IRC | 20:52 | |
| lbragstad | i was going to see if there is something weird going on that results in that use not getting found | 20:52 |
| *** edmondsw has quit IRC | 20:56 | |
| *** edmondsw has joined #openstack-keystone | 20:56 | |
| *** aojea has quit IRC | 20:57 | |
| lbragstad | but yeah - you could double check that the mapping purge tooling is actually removing the reference | 20:57 |
| *** spilla has quit IRC | 20:57 | |
| *** spilla has joined #openstack-keystone | 20:57 | |
| *** spilla has quit IRC | 20:58 | |
| DevX | ok, let me go do that | 20:58 |
| *** josecastroleon has quit IRC | 20:59 | |
| *** edmondsw has quit IRC | 21:01 | |
| *** aojea has joined #openstack-keystone | 21:07 | |
| DevX | so i purged the mappins and i checked the `id_mapping` table and was empty and it get's populated again when a user checks in. I'm checking the logs to see if still get the same errors | 21:07 |
| lbragstad | ok - cool, does "check in" mean "authenticate" | 21:08 |
| DevX | yes | 21:10 |
| DevX | same outcome - 'Conflict occurred attempting to store nonlocal_user - Duplicate Entry' | 21:12 |
| lbragstad | what in the world | 21:12 |
| DevX | I think i figured it out | 21:14 |
| DevX | https://github.com/openstack/keystone/blob/newton-eol/keystone/identity/core.py#L578 | 21:14 |
| *** itlinux has quit IRC | 21:14 | |
| DevX | nevermind, i don't think it's that | 21:15 |
| lbragstad | are you able to apply https://gist.github.com/lbragstad/eab71ffc7c8c6c38cbd41bbb7930c82b#file-logging-patch ? | 21:16 |
| *** AlexeyAbashkin has joined #openstack-keystone | 21:17 | |
| *** AlexeyAbashkin has quit IRC | 21:21 | |
| *** raildo has quit IRC | 21:24 | |
| *** pcichy has quit IRC | 21:27 | |
| *** NM has quit IRC | 21:32 | |
| DevX | yes, i'm restarting and testing | 21:32 |
| lbragstad | sweet | 21:33 |
| DevX | adding those extra loggin statements I see the following: Could not find user: u'1366748ea7987e003bb020cbd87c8e89fd64e1e753c0008075a528895d61d5cd' | 21:51 |
| *** Drankis has quit IRC | 21:52 | |
| *** pcaruana has quit IRC | 21:53 | |
| lbragstad | ok - so that appears to be the public id | 21:53 |
| lbragstad | https://gist.github.com/devx/046fa81d1bafb78086d9d20c4831b003#file-keystone-ad-conflict-nonlocal_user-L26 | 21:53 |
| lbragstad | how is https://git.openstack.org/cgit/openstack/keystone/tree/keystone/identity/core.py?h=newton-eol#n1249 getting hit? | 21:55 |
| lbragstad | this kinda blows my mind | 21:55 |
| DevX | give me a sec I'll share the trace | 21:57 |
| *** martinus__ has quit IRC | 21:57 | |
| DevX | lbragstad: I just shared with you a gist | 22:04 |
| lbragstad | checking | 22:04 |
| lbragstad | and edir wasn't integrated into keystone anyway? | 22:06 |
| lbragstad | that might be affecting how users are retrieved from AD? | 22:07 |
| DevX | no it was just hitting the LB | 22:07 |
| DevX | I can create a new domain and try it maybe that's the problem | 22:07 |
| DevX | or a later version of keystone | 22:08 |
| lbragstad | the code looks pretty much the same between newton and queens | 22:08 |
| openstackgerrit | Gage Hugo proposed openstack/keystone master: Remove the TokenAuth middleware https://review.openstack.org/508412 | 22:08 |
| lbragstad | (the shadow users stuff hasn't changed much since then) | 22:08 |
| lbragstad | but it's really strange that edir being involved prevented this from breaking | 22:08 |
| DevX | yeah, let me go test some things I'll hit you up tomorrow after I tried a couple of things | 22:10 |
| lbragstad | sounds good | 22:10 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: WIP: rewrite keystone https://review.openstack.org/545450 | 22:10 |
| *** itlinux has joined #openstack-keystone | 22:11 | |
| adriant | kmalloc: just about to go do those last few spec changes | 22:14 |
| kmalloc | adriant: nice | 22:14 |
| adriant | kmalloc: and as for Keystone auth, I assumed it wasn't really a bug, but much like mordred I think changing it if we can wouldn't be a bad idea | 22:14 |
| kmalloc | strict contract and behavioral changes = no change | 22:15 |
| adriant | :( | 22:15 |
| kmalloc | it's even documented as such | 22:15 |
| kmalloc | we can't change it. | 22:15 |
| kmalloc | that is the rule with ksa | 22:16 |
| adriant | kmalloc, even for something as benign as that? | 22:16 |
| kmalloc | could someone be relying on that behavior on old clouds with v2 and v3 | 22:16 |
| kmalloc | if the answer is yes. | 22:16 |
| kmalloc | then we can't change | 22:17 |
| kmalloc | could someone be realying on that error for any reason, again, if the answer is yes, we can't change it | 22:17 |
| kmalloc | KSA's contract is "we will not break you, we will not change behavior unless we have a serious security concern and it is the only way: | 22:17 |
| kmalloc | EVEN for behaviors we don't like. | 22:18 |
| adriant | kmalloc: but we can add new behavior in the form of better plugins and such as we go as long as we keep the existing ones? | 22:18 |
| kmalloc | as long as we keep the same behavior for existing things, yes | 22:18 |
| kmalloc | but once it's been released in KSA it's permanent | 22:18 |
| kmalloc | we can't remove it. | 22:18 |
| kmalloc | so we're very careful about adding to KSA. | 22:18 |
| adriant | k, because I am going to have to do a lot of stuff in KSA for the MFA stuff, but we can do it as new plugins | 22:19 |
| kmalloc | now, you can make old plugins smarter about features like MFA-- or allow KSA itself to handle a receipt for MFA (opt-in) | 22:20 |
| kmalloc | but you can't break old behaviors. | 22:20 |
| kmalloc | you're going to need to work aroudn the old plugins, you probably want the maintain use of the old plugins. | 22:21 |
| adriant | kmalloc: yep, that was my intention, keep the behavior, but add some wrapping, but also add some plugins that you can specify: "auth with these multiple methods" | 22:21 |
| kmalloc | yeah a multi-method plugin (somehow) is needed :) | 22:21 |
| kmalloc | you're on the right track :) | 22:21 |
| adriant | the trick will be not duplicating too much code, and seeing if... we can ideally split the existing plugin logic into generic 'method' definitions that the multi-method plugin can use, while the existing ones only use the single method they used to. | 22:22 |
| adriant | All without changing the behavior... | 22:22 |
| adriant | I think start with duplication, and then refactor | 22:23 |
| *** rcernin has joined #openstack-keystone | 22:34 | |
| cmurphy | I have a hard time imagining how someone could be relying on that behavior | 22:35 |
| *** edmondsw has joined #openstack-keystone | 22:46 | |
| adriant | cmurphy: me too, but I understand kmalloc's point as much as stuff like that can suck :( | 22:46 |
| adriant | cmurphy: the annoying part is that that error isn't useful, it doesn't actually tell you what failed really | 22:47 |
| adriant | or, it does tell you, but not exactly | 22:47 |
| *** aojea has quit IRC | 22:49 | |
| cmurphy | it just tries to POST directly to /auth/tokens and blows up there right? | 22:50 |
| adriant | yep | 22:50 |
| openstackgerrit | Adrian Turjak proposed openstack/keystone-specs master: Add spec for MFA auth receipts https://review.openstack.org/553670 | 22:50 |
| adriant | and throws a 404 | 22:50 |
| cmurphy | that seems really unuseful | 22:50 |
| adriant | which is accurate just not useful | 22:50 |
| adriant | things like that, I'm of the opinion: if you rely on that error you're doing something stupid | 22:51 |
| cmurphy | someone once told me every bugfix is backwards incompatible if someone is relying on the bug | 22:51 |
| adriant | kmalloc, cmurphy, lbragstad: spec updated, all yours | 22:52 |
| cmurphy | sweet | 22:52 |
| adriant | I'm a bit terrified because when it is merged, I actually have to implement it :P | 22:53 |
| *** masber has joined #openstack-keystone | 22:56 | |
| *** felipemonteiro has quit IRC | 23:03 | |
| *** r-daneel has quit IRC | 23:12 | |
| *** masuberu has joined #openstack-keystone | 23:13 | |
| *** AlexeyAbashkin has joined #openstack-keystone | 23:16 | |
| *** masber has quit IRC | 23:17 | |
| *** masber has joined #openstack-keystone | 23:18 | |
| *** masuberu has quit IRC | 23:18 | |
| *** AlexeyAbashkin has quit IRC | 23:20 | |
| *** masber has quit IRC | 23:29 | |
| *** masber has joined #openstack-keystone | 23:29 | |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!