| *** nicodemus_ has quit IRC | 00:04 | |
| *** edmondsw has joined #openstack-keystone | 01:05 | |
| *** edmondsw has quit IRC | 01:09 | |
| *** agrebennikov has joined #openstack-keystone | 01:19 | |
| *** yikun has joined #openstack-keystone | 01:52 | |
| *** felipemonteiro has joined #openstack-keystone | 01:55 | |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Expose endpoint to return enforcement model https://review.openstack.org/562716 | 02:14 |
|---|---|---|
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Filter project_id for list limits https://review.openstack.org/581177 | 02:14 |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Strict two level limit model https://review.openstack.org/557696 | 02:14 |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Add project_id filter for listing limit https://review.openstack.org/579330 | 02:14 |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: [WIP]Add show hierarchy filter https://review.openstack.org/579331 | 02:14 |
| openstackgerrit | Merged openstack/python-keystoneclient master: Add release note link in README https://review.openstack.org/578652 | 02:49 |
| *** edmondsw has joined #openstack-keystone | 02:53 | |
| openstackgerrit | Vu Cong Tuan proposed openstack/python-keystoneclient master: Switch to stestr https://review.openstack.org/581213 | 02:57 |
| *** edmondsw has quit IRC | 02:57 | |
| *** felipemonteiro has quit IRC | 03:04 | |
| *** felipemonteiro has joined #openstack-keystone | 03:14 | |
| openstackgerrit | Merged openstack/oslo.limit master: Implement ProjectClaim objects https://review.openstack.org/579686 | 03:43 |
| openstackgerrit | Merged openstack/oslo.limit master: Implement basic Enforcer context manager https://review.openstack.org/579687 | 03:43 |
| openstackgerrit | Merged openstack/oslo.limit master: Add .zuul.yaml https://review.openstack.org/579688 | 03:48 |
| *** david-lyle has joined #openstack-keystone | 03:57 | |
| *** dklyle has quit IRC | 03:58 | |
| *** dklyle has joined #openstack-keystone | 04:00 | |
| *** david-lyle has quit IRC | 04:01 | |
| *** dklyle has quit IRC | 04:14 | |
| *** dklyle has joined #openstack-keystone | 04:14 | |
| *** felipemonteiro has quit IRC | 04:17 | |
| *** david-lyle has joined #openstack-keystone | 04:20 | |
| *** dklyle has quit IRC | 04:21 | |
| *** david-lyle has quit IRC | 04:23 | |
| *** dklyle has joined #openstack-keystone | 04:23 | |
| *** links has joined #openstack-keystone | 05:03 | |
| *** deepak_mourya has joined #openstack-keystone | 05:05 | |
| *** ianw is now known as ianw_pto | 06:00 | |
| *** martinus__ has joined #openstack-keystone | 06:36 | |
| *** ispp has joined #openstack-keystone | 06:39 | |
| *** agrebennikov has quit IRC | 06:40 | |
| *** kimamisa has joined #openstack-keystone | 06:46 | |
| openstackgerrit | Sami Makki proposed openstack/keystone master: Invalidate 'computed assignments' cache when creating a project. https://review.openstack.org/581346 | 06:53 |
| *** tesseract has joined #openstack-keystone | 07:12 | |
| *** bhagyashri_s has quit IRC | 07:12 | |
| *** jmlowe has quit IRC | 07:17 | |
| *** peereb has joined #openstack-keystone | 07:17 | |
| *** ispp has quit IRC | 07:21 | |
| *** kimamisa has quit IRC | 07:22 | |
| *** ispp has joined #openstack-keystone | 07:25 | |
| *** amoralej|off is now known as amoralej | 07:34 | |
| *** tosky has joined #openstack-keystone | 07:37 | |
| *** kimamisa has joined #openstack-keystone | 07:58 | |
| *** s10 has joined #openstack-keystone | 07:59 | |
| openstackgerrit | Merged openstack/keystone master: Expose endpoint to return enforcement model https://review.openstack.org/562716 | 08:02 |
| *** rcernin has quit IRC | 08:03 | |
| *** itlinux has joined #openstack-keystone | 08:05 | |
| *** markvoelker has quit IRC | 08:07 | |
| *** belmoreira has joined #openstack-keystone | 08:12 | |
| *** belmoreira has quit IRC | 08:26 | |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Add project_id filter for listing limit https://review.openstack.org/579330 | 08:27 |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: [WIP]Add show hierarchy filter https://review.openstack.org/579331 | 08:27 |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Update project depth check https://review.openstack.org/580258 | 08:29 |
| *** bhagyashris has joined #openstack-keystone | 08:29 | |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Add project hierarchical tree check when Keystone start https://review.openstack.org/580331 | 08:29 |
| *** belmoreira has joined #openstack-keystone | 08:33 | |
| *** itlinux has quit IRC | 08:37 | |
| *** itlinux has joined #openstack-keystone | 08:55 | |
| *** s10 has quit IRC | 09:02 | |
| *** issp has joined #openstack-keystone | 09:38 | |
| *** ispp has quit IRC | 09:41 | |
| *** belmoreira has quit IRC | 09:43 | |
| *** belmoreira has joined #openstack-keystone | 09:48 | |
| *** jmlowe has joined #openstack-keystone | 09:50 | |
| *** belmoreira has quit IRC | 09:57 | |
| *** markvoelker has joined #openstack-keystone | 10:08 | |
| *** jmlowe has quit IRC | 10:11 | |
| *** markvoelker has quit IRC | 10:42 | |
| *** kimamisa_ has joined #openstack-keystone | 11:35 | |
| *** kimamisa has quit IRC | 11:35 | |
| *** EvilienM is now known as EmilienM | 11:36 | |
| *** aloga has quit IRC | 11:37 | |
| *** markvoelker has joined #openstack-keystone | 11:40 | |
| *** raildo has joined #openstack-keystone | 12:02 | |
| *** markvoelker has quit IRC | 12:12 | |
| *** jmlowe has joined #openstack-keystone | 12:16 | |
| *** amoralej is now known as amoralej|lunch | 12:20 | |
| *** markvoelker has joined #openstack-keystone | 12:22 | |
| *** edmondsw has joined #openstack-keystone | 12:27 | |
| knikolla | o/ | 12:31 |
| *** belmoreira has joined #openstack-keystone | 12:57 | |
| lamt | o/ knikolla : forgot to thank you for your help with the openidc configuration a few weeks back. The proof-of-concept I was working on worked wonder. | 12:58 |
| knikolla | lamt: awesome! glad i could help | 12:58 |
| *** belmoreira has quit IRC | 12:59 | |
| *** openstack has joined #openstack-keystone | 13:02 | |
| *** ChanServ sets mode: +o openstack | 13:02 | |
| *** lifeless has quit IRC | 13:04 | |
| *** amoralej|lunch is now known as amoralej | 13:13 | |
| *** itlinux has quit IRC | 13:14 | |
| lbragstad | o/ | 13:30 |
| *** lifeless has joined #openstack-keystone | 13:47 | |
| *** jistr is now known as jistr|mtg | 13:56 | |
| lbragstad | kmalloc: do you know where the _RevokeEventHandler tests are? | 14:04 |
| *** felipemonteiro_ has joined #openstack-keystone | 14:08 | |
| *** xinran__ has joined #openstack-keystone | 14:08 | |
| *** ayoung has quit IRC | 14:11 | |
| *** vrv_ has joined #openstack-keystone | 14:15 | |
| *** felipemonteiro__ has joined #openstack-keystone | 14:16 | |
| *** felipemonteiro_ has quit IRC | 14:20 | |
| *** linkmark has joined #openstack-keystone | 14:28 | |
| kmalloc | Uhm | 14:37 |
| kmalloc | Nope | 14:38 |
| *** markvoelker has quit IRC | 14:44 | |
| *** markvoelker has joined #openstack-keystone | 14:44 | |
| *** markvoelker has quit IRC | 14:49 | |
| *** jistr|mtg is now known as jistr | 14:54 | |
| *** spilla has joined #openstack-keystone | 15:00 | |
| *** markvoelker has joined #openstack-keystone | 15:14 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Add serialization for TokenModel object https://review.openstack.org/578434 | 15:15 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Simplify the token provider API https://review.openstack.org/545450 | 15:15 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Remove remnants of token bind https://review.openstack.org/578435 | 15:15 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Cleanup keystone.token.providers.common https://review.openstack.org/577507 | 15:15 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Remove KeystoneToken object https://review.openstack.org/577567 | 15:15 |
| *** links has quit IRC | 15:16 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Add serialization for TokenModel object https://review.openstack.org/578434 | 15:27 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Simplify the token provider API https://review.openstack.org/545450 | 15:27 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Remove remnants of token bind https://review.openstack.org/578435 | 15:27 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Cleanup keystone.token.providers.common https://review.openstack.org/577507 | 15:27 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Remove KeystoneToken object https://review.openstack.org/577567 | 15:27 |
| *** jmlowe has quit IRC | 15:28 | |
| *** spilla has quit IRC | 15:30 | |
| *** spilla has joined #openstack-keystone | 15:33 | |
| *** spilla has quit IRC | 15:34 | |
| *** felipemonteiro__ has quit IRC | 15:40 | |
| lbragstad | kmalloc: added tests to the token handler patch | 15:44 |
| *** peereb has quit IRC | 15:46 | |
| *** issp has quit IRC | 15:55 | |
| *** tesseract has quit IRC | 16:01 | |
| *** ayoung has joined #openstack-keystone | 16:11 | |
| kmalloc | thnx | 16:25 |
| lbragstad | ayoung: let me know when you wanna go through the token provider api | 16:38 |
| *** kimamisa_ has quit IRC | 16:44 | |
| *** felipemonteiro has joined #openstack-keystone | 16:50 | |
| lbragstad | fyi https://review.openstack.org/#/c/581800/ | 16:51 |
| *** markvoelker has quit IRC | 16:52 | |
| *** amoralej is now known as amoralej|off | 17:05 | |
| *** xinran__ has quit IRC | 17:08 | |
| *** gyee has joined #openstack-keystone | 17:21 | |
| *** markvoelker has joined #openstack-keystone | 17:24 | |
| *** belmoreira has joined #openstack-keystone | 17:39 | |
| *** felipemonteiro has quit IRC | 17:42 | |
| *** kimamisa has joined #openstack-keystone | 17:45 | |
| *** vrv_ has quit IRC | 18:02 | |
| ayoung | lbragstad, heh. your request was timely. Was talking with a customer about customizing policy. | 18:04 |
| lbragstad | nice | 18:04 |
| lbragstad | i'm around to walk through that chain if you're still interested | 18:06 |
| *** edmondsw has quit IRC | 18:07 | |
| *** edmondsw has joined #openstack-keystone | 18:07 | |
| ayoung | lbragstad, yeah, lets do it | 18:11 |
| *** spilla has joined #openstack-keystone | 18:11 | |
| ayoung | lbragstad, what review should I start with? | 18:12 |
| lbragstad | this is the first review in the chain | 18:12 |
| lbragstad | https://review.openstack.org/#/c/559129/17 | 18:12 |
| lbragstad | the series is linear | 18:12 |
| lbragstad | all i'm doing there is adding the underlying token model code so that we can work it into the token provider API in subsequent patches | 18:13 |
| lbragstad | the only thing relying on the TokenModel object in that patch is the tests | 18:14 |
| lbragstad | the big thing to notice IMO is that we're not build token reference on __init__(), instead we're using composition | 18:19 |
| lbragstad | we're also not using reflection based on a dictionary | 18:19 |
| lbragstad | and attributes used within the model are loaded on demand | 18:19 |
| openstackgerrit | Merged openstack/keystone master: Filter project_id for list limits https://review.openstack.org/581177 | 18:20 |
| ayoung | lbragstad, so, I had this idea of a builder+immutable model | 18:27 |
| ayoung | if you look way back at my code (which I think merged? Maybe) | 18:27 |
| lbragstad | kmalloc: and i had the idea of making models immutable once they are minted | 18:27 |
| ayoung | the idea was the builder was mutable, and you called things like add_trust etc. When you were done, you called build and got an immutable model object...what I htinnk you are calling minting | 18:27 |
| ayoung | builder design patter, gang of 4 | 18:28 |
| ayoung | so, I thin we are on the same philosophical bent here | 18:28 |
| lbragstad | yeah | 18:28 |
| lbragstad | my big thing is that i want the object to contain parts of the business logic currently found in keystone/token/providers/common.py | 18:28 |
| ayoung | I think you've merged the builder and the immutable into a single object. Probably fine. | 18:29 |
| *** felipemonteiro has joined #openstack-keystone | 18:29 | |
| lbragstad | later in the series i work the model object in to token provider API business logic | 18:29 |
| ayoung | so...I would caution this: | 18:30 |
| ayoung | the model should be able to support changs of the business rules | 18:30 |
| ayoung | the rules depend on the model, not the other way around, and not co-mingled | 18:30 |
| ayoung | the model SHOULD enforce invariants, though | 18:30 |
| ayoung | i.e. a Trust must have a trustor and A Trustee | 18:31 |
| ayoung | and so on | 18:31 |
| ayoung | so, business logic and invariants are two distinct things, which I think you get intuitively, but I figure should be stated explicitly | 18:31 |
| lbragstad | ok | 18:33 |
| ayoung | lbragstad, also...we should not be calling these tokens | 18:33 |
| ayoung | this is really auth_data in our literature | 18:33 |
| ayoung | the token is the think that points to the auth data | 18:34 |
| ayoung | I think I was guilty of perpetuating that mistake | 18:34 |
| ayoung | http://git.openstack.org/cgit/openstack/keystone/tree/keystone/models/token_model.py was mine (pretty sure) | 18:34 |
| lbragstad | traditionally - i think it's easy to refer to it as a token since the current approach is dealing with a token "reference" or response | 18:34 |
| lbragstad | which might have led to the all the token, token_data, token_ref terminology we have | 18:35 |
| ayoung | maybe. Chew it over for a day or two, to see if you see the value in keeping the two concepts separate | 18:36 |
| ayoung | heh | 18:36 |
| ayoung | the _ref thing was from termie | 18:36 |
| ayoung | It made sense at one point, but was everywhere: user_ref, etc | 18:36 |
| lbragstad | yeah | 18:36 |
| lbragstad | specifically in the token provider API we overloaded it | 18:36 |
| lbragstad | especially in the transition from persistent formats to non-persistent formats | 18:37 |
| ayoung | we all used the short auth_ to avoid saying authencitcation vs authorization | 18:38 |
| ayoung | I called mine KeystoneToken which was even more of a sin | 18:38 |
| ayoung | http://git.openstack.org/cgit/openstack/keystone/tree/keystone/models/token_model.py#n34 | 18:38 |
| lbragstad | i'm not a huge fan of auth_ because it leaves out precisely that information (n vs z) | 18:38 |
| ayoung | I'm ok with calling it authz data | 18:39 |
| ayoung | for unscoped tokens and federation, it really is just authn, but that is a minor quibble | 18:39 |
| *** felipemonteiro_ has joined #openstack-keystone | 18:39 | |
| ayoung | lbragstad, so the idea is to reimplement at the bottom of the file, then go back later and delete KeystoneToken? | 18:39 |
| lbragstad | yes | 18:39 |
| ayoung | WFM | 18:40 |
| lbragstad | build the new model, covert the existing logic to use it, redefine the interfaces, then delete the old model | 18:40 |
| ayoung | ah right...I was doing alll that introspection stuff to keep from explicitly duplicating every property | 18:41 |
| ayoung | I've battled that pattern in every language I've worked in | 18:41 |
| ayoung | I really want immutable structures. | 18:41 |
| ayoung | OK...I see where you are headed. I can track along with it. | 18:42 |
| *** felipemonteiro has quit IRC | 18:42 | |
| lbragstad | do you have any more questions on the model specifically? | 18:43 |
| ayoung | I'll let you chew on the authz_model versus token_model naming | 18:43 |
| ayoung | Nah, I think you are following the same path I did, but then abandonded. I get it | 18:43 |
| lbragstad | well \ | 18:43 |
| ayoung | and I had forgotten the actual checked in state of my code, vs what I wanted it to be end state | 18:43 |
| lbragstad | to be fair.. it's a lot easier to do now | 18:43 |
| ayoung | I really wanted the model to be in keystone client, and be a Data Transfer object, but Jamie wanted that to be oslo-context | 18:44 |
| ayoung | I was looking for Don't Repeat Yourself in the code. | 18:44 |
| lbragstad | mmm | 18:44 |
| lbragstad | the next patch in the series is pretty trivial https://review.openstack.org/#/c/578434/5 | 18:45 |
| lbragstad | it's just making it so that we can cache the model because we're not dealing with dictionaries anymore | 18:46 |
| lbragstad | (e.g. serializing python objects) | 18:46 |
| ayoung | lbragstad, so, one thing I like about that is we should be able to use what Flask gets us for serializing to Json | 18:48 |
| ayoung | make sure it does not change from what we produce now | 18:48 |
| ayoung | and we should be able to getsomething to serialize to any other format we want to support in the future | 18:49 |
| *** itlinux has joined #openstack-keystone | 18:49 | |
| lbragstad | i think that makes sense - but that's at the API layer? | 18:49 |
| lbragstad | this bit is specific to the token manager and the cache backend | 18:50 |
| ayoung | Yeah, but we should be serializing this model at the API layer, or its not a useful abstraction | 18:50 |
| ayoung | should be common to both | 18:50 |
| lbragstad | oh - sure | 18:50 |
| lbragstad | it's technically passed up to the controllers and serialized to json | 18:50 |
| ayoung | chew on whehter you really want 2 distinct models to keep in sync, and I think you'll find this is the better approach | 18:51 |
| lbragstad | er - represented as a python dictionary then serialized to json | 18:51 |
| ayoung | yep | 18:51 |
| ayoung | and the model to dict should be consistent | 18:51 |
| lbragstad | i think it makes sense at least for now | 18:51 |
| lbragstad | the dict is a representation of the v3 api contract | 18:51 |
| ayoung | it looks right | 18:51 |
| ayoung | I'll dig in deeper shortly...need to run now | 18:51 |
| lbragstad | ok | 18:52 |
| *** harlowja has joined #openstack-keystone | 19:00 | |
| *** itlinux has quit IRC | 19:02 | |
| *** ayoung has quit IRC | 19:03 | |
| *** belmoreira has quit IRC | 19:21 | |
| *** spilla has quit IRC | 19:23 | |
| *** spilla has joined #openstack-keystone | 19:27 | |
| *** jmlowe has joined #openstack-keystone | 19:30 | |
| *** edmondsw has quit IRC | 19:42 | |
| *** edmondsw has joined #openstack-keystone | 19:43 | |
| *** raildo has quit IRC | 19:51 | |
| *** itlinux has joined #openstack-keystone | 19:55 | |
| *** itlinux has quit IRC | 19:57 | |
| *** ayoung has joined #openstack-keystone | 20:25 | |
| *** itlinux has joined #openstack-keystone | 20:38 | |
| *** itlinux has quit IRC | 20:50 | |
| *** spilla has quit IRC | 20:52 | |
| *** jmlowe has quit IRC | 21:29 | |
| *** martinus__ has quit IRC | 21:29 | |
| *** spilla has joined #openstack-keystone | 21:30 | |
| *** raildo has joined #openstack-keystone | 21:31 | |
| *** felipemonteiro_ has quit IRC | 21:38 | |
| *** jmlowe has joined #openstack-keystone | 21:45 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: WIP: alternative implementation for strict-two-level https://review.openstack.org/581894 | 21:54 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: WIP: alternative implementation for strict-two-level https://review.openstack.org/581894 | 21:58 |
| *** mchlumsky has quit IRC | 22:00 | |
| lbragstad | cc wxy - i took a shot at trying to address my comment from yesterday ^ | 22:04 |
| *** kimamisa has quit IRC | 22:07 | |
| *** rcernin has joined #openstack-keystone | 22:15 | |
| *** rmascena has joined #openstack-keystone | 22:20 | |
| *** raildo has quit IRC | 22:21 | |
| *** felipemonteiro_ has joined #openstack-keystone | 22:32 | |
| *** felipemonteiro__ has joined #openstack-keystone | 22:34 | |
| *** felipemonteiro_ has quit IRC | 22:37 | |
| *** harlowja has quit IRC | 23:05 | |
| *** felipemonteiro__ has quit IRC | 23:08 | |
| *** edmondsw has quit IRC | 23:12 | |
| *** edmondsw has joined #openstack-keystone | 23:13 | |
| *** edmondsw has quit IRC | 23:17 | |
| *** spilla has quit IRC | 23:28 | |
| *** rmascena has quit IRC | 23:33 | |
| *** tosky has quit IRC | 23:35 | |
| *** gyee has quit IRC | 23:48 | |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!