| *** rcernin_ has joined #openstack-keystone | 00:02 | |
| *** rcernin has quit IRC | 00:03 | |
| *** orange_julius74 has joined #openstack-keystone | 00:14 | |
| openstackgerrit | Nick Wilburn proposed openstack/ldappool master: fix ldappool bad password retry logic https://review.openstack.org/591174 | 00:26 |
|---|---|---|
| *** rcernin has joined #openstack-keystone | 00:29 | |
| *** rcernin has quit IRC | 00:29 | |
| *** rcernin has joined #openstack-keystone | 00:30 | |
| *** rcernin_ has quit IRC | 00:32 | |
| *** zhurong has joined #openstack-keystone | 00:33 | |
| *** lbragstad has joined #openstack-keystone | 00:44 | |
| *** ChanServ sets mode: +o lbragstad | 00:44 | |
| *** nicolasbock has quit IRC | 00:45 | |
| lbragstad | kmalloc: fyi - i'm planning on picking up the /polices conversion to flask after this week (i'm unable to pull patches from gerrit) | 00:47 |
| lbragstad | policies* | 00:47 |
| *** gmann has quit IRC | 00:57 | |
| *** jdennis has quit IRC | 00:57 | |
| *** wxy-xiyuan has quit IRC | 00:57 | |
| *** hugokuo has quit IRC | 00:57 | |
| *** DinaBelova has quit IRC | 00:57 | |
| *** yankcrime has quit IRC | 00:57 | |
| *** nicolasbock has joined #openstack-keystone | 00:58 | |
| *** jdennis has joined #openstack-keystone | 01:00 | |
| *** gmann has joined #openstack-keystone | 01:04 | |
| *** wxy-xiyuan has joined #openstack-keystone | 01:04 | |
| *** hugokuo has joined #openstack-keystone | 01:04 | |
| *** DinaBelova has joined #openstack-keystone | 01:04 | |
| *** yankcrime has joined #openstack-keystone | 01:04 | |
| *** DinaBelova has quit IRC | 01:04 | |
| *** DinaBelova has joined #openstack-keystone | 01:05 | |
| kmalloc | lbragstad: np | 01:05 |
| *** openstackgerrit has quit IRC | 01:06 | |
| *** Nel1x has joined #openstack-keystone | 01:13 | |
| *** openstackgerrit has joined #openstack-keystone | 01:21 | |
| openstackgerrit | Merged openstack/oslo.limit master: ADD i18n file https://review.openstack.org/586759 | 01:21 |
| *** zhurong has quit IRC | 01:39 | |
| openstackgerrit | Merged openstack/keystone master: Allow wrap_member and wrap_collection to specify target https://review.openstack.org/589288 | 02:01 |
| openstackgerrit | Merged openstack/keystone master: Convert regions API to flask native dispatching https://review.openstack.org/589640 | 02:12 |
| *** zhurong has joined #openstack-keystone | 02:15 | |
| openstackgerrit | Bi wei proposed openstack/keystone master: Fix a bug that issue token with project-scope gets error https://review.openstack.org/587399 | 02:43 |
| *** orange_julius74 has quit IRC | 02:59 | |
| *** Nel1x has quit IRC | 03:12 | |
| *** zhurong has quit IRC | 03:14 | |
| *** dave-mccowan has quit IRC | 04:12 | |
| *** gyee has quit IRC | 05:05 | |
| *** shyamb has joined #openstack-keystone | 05:51 | |
| *** shyamb has quit IRC | 05:57 | |
| *** shyamb has joined #openstack-keystone | 06:03 | |
| *** odyssey4me has quit IRC | 06:14 | |
| *** odyssey4me has joined #openstack-keystone | 06:14 | |
| *** pcaruana has joined #openstack-keystone | 06:44 | |
| *** shyamb has quit IRC | 06:48 | |
| *** shyamb has joined #openstack-keystone | 06:53 | |
| *** rcernin has quit IRC | 07:02 | |
| cmurphy | lbragstad: you can't pull patches from gerrit? you might try switching your remotes to https https://docs.openstack.org/infra/manual/developers.html#accessing-gerrit-over-https | 07:19 |
| lbragstad | oh - nice | 07:19 |
| lbragstad | i'll try that - right now my port is getting blocked | 07:20 |
| lbragstad | but i assume 443 to work | 07:21 |
| lbragstad | i can't access it from the office - but i might be able to from the hotel | 07:26 |
| *** shyamb has quit IRC | 07:27 | |
| *** shyamb has joined #openstack-keystone | 07:27 | |
| mbuil | cmurphy: I am finally at "Testing it all out" part ==> https://docs.openstack.org/keystone/latest/advanced-topics/federation/federated_identity.html#testing-it-all-out. When it creates the k2ksession, it passes a string 'mysp', what should I write there? I have an entityID which identifies the IdP but I don't remember having an id to identify the SP | 07:42 |
| cmurphy | mbuil: that should be the name of the service provider entry you created on the identity provider in this step https://docs.openstack.org/keystone/latest/advanced-topics/federation/federated_identity.html#create-a-service-provider-sp | 07:43 |
| *** shyamb has quit IRC | 07:48 | |
| mbuil | cmurphy: Oh, I missed that step. That should be executed in the IdP part? | 07:48 |
| cmurphy | mbuil: yes | 07:48 |
| mbuil | Regarding the sp_url, when creating the SP, I added in /etc/shibboleth/shibboleth2.xml the following ==> <ApplicationDefaults entityID="http://mysp.example.com/shibboleth">. However, the example sp_url is 'http://mysp.example.com/Shibboleth.sso/SAML2/ECP'. Is that ok? | 07:54 |
| mbuil | cmurphy: I actually haven't written anywhere in the SP config 'http://mysp.example.com/Shibboleth.sso/SAML2/ECP' | 07:55 |
| cmurphy | mbuil: the entityID is just an identifier string, it doesn't route to anything | 07:59 |
| cmurphy | the /Shibboleth.sso/SAML2/ECP is provided by the shibboleth mod, you can query /Shibboleth.sso/Metadata or something like that to get all the endpoints it provides | 08:00 |
| cmurphy | so yes you're all good | 08:00 |
| mbuil | cmurphy: good. Let's try. Fingers crossed | 08:04 |
| mbuil | cmurphy: one extra thing. From Keystone IdP I should be able to wget http://mysp.example.com:5000/v3/OS-FEDERATION/identity_providers/myidp/protocols/saml2/auth, right? | 08:04 |
| *** mchlumsky has quit IRC | 08:12 | |
| *** openstackstatus has quit IRC | 08:12 | |
| *** mchlumsky has joined #openstack-keystone | 08:13 | |
| *** mvkr has quit IRC | 08:20 | |
| cmurphy | mbuil: sort of, you'd have to POST the ECP assertion with the request, it would be easier to just let keystoneauth handle it (and openstackclient supports it now too) | 08:23 |
| *** shyamb has joined #openstack-keystone | 08:28 | |
| openstackgerrit | Colleen Murphy proposed openstack/keystone master: Use osc in k2k example https://review.openstack.org/591587 | 08:30 |
| cmurphy | mbuil: ^ | 08:30 |
| mbuil | cmurphy: something must be wrong. This line returns None :( https://github.com/openstack/keystoneauth/blob/master/keystoneauth1/identity/v3/k2k.py#L166 | 08:32 |
| mbuil | cmurphy: let me check that patch | 08:32 |
| *** mvkr has joined #openstack-keystone | 08:52 | |
| *** jaosorior has quit IRC | 08:53 | |
| *** shyamb has quit IRC | 09:24 | |
| *** markvoelker has joined #openstack-keystone | 09:33 | |
| *** shyamb has joined #openstack-keystone | 09:34 | |
| *** openstackstatus has joined #openstack-keystone | 09:41 | |
| *** ChanServ sets mode: +v openstackstatus | 09:41 | |
| *** hoonetorg has quit IRC | 09:43 | |
| mbuil | cmurphy: I need a bit of help debugging. It seems everything goes ok between "User Agent" and IdP. However, when "User Agent" accesses SP, I see in the logs of SP_Apache2: | 09:48 |
| mbuil | 172.29.236.11 - - [14/Aug/2018:09:33:05 +0000] "POST /Shibboleth.sso/SAML2/ECP HTTP/1.1" 500 915 "-" "osc-lib/1.9.0 keystoneauth1/3.4.0 python-requests/2.18.4 CPython/2.7.13" | 09:48 |
| mbuil | cmurphy: /var/log/apache2/keystone.log says ==> 2018-08-14 09:33:43.538256 Issuer must have TextContent. | 09:48 |
| mbuil | cmurphy: any idea what is referring to with TextContent? | 09:49 |
| *** hoonetorg has joined #openstack-keystone | 09:57 | |
| cmurphy | mbuil: it's saying that the assertion is invalid, it's referring to a field called Issuer and saying it's empty | 09:58 |
| cmurphy | I'm not sure why it would be empty, that should be the [saml]/idp_entity_id set in keystone.conf on the IdP | 09:58 |
| cmurphy | you might try regenerating the metadata on the IdP and restarting keystone/apache | 09:59 |
| mbuil | cmurphy: aaah ok, thanks. I guess the problem seems to be in the IdP then | 09:59 |
| mbuil | cmurphy: the shibboleth log in SP supports your guess: | 10:00 |
| mbuil | 2018-08-14 09:33:43 INFO Shibboleth-TRANSACTION [3]: New session (ID: ) with (applicationId: default) for principal from (IdP: none) at (ClientAddress: 172.29.236.11) with (NameIdentifier: none) using (Protocol: urn:oasis:names:tc:SAML:2.0:protocol) from (AssertionID: ) | 10:00 |
| *** markvoelker has quit IRC | 10:07 | |
| *** lbragstad has quit IRC | 10:12 | |
| *** shyamb has quit IRC | 10:14 | |
| *** mvkr has quit IRC | 10:22 | |
| *** shyamb has joined #openstack-keystone | 10:45 | |
| *** jaosorior has joined #openstack-keystone | 10:51 | |
| *** markvoelker has joined #openstack-keystone | 11:04 | |
| *** jaosorior has quit IRC | 11:17 | |
| mbuil | cmurphy: I am again stuck but I feel I am close to the final line! Now I get in /var/log/keystone/keystone.log: "Could not map any federated user properties to identity values. Check debug logs or the mapping used for additional details.". I added some logs to the code and I realized that it never this line never returns anything: https://github.com/openstack/keystone/blob/master/keystone/federation/utils.py#L776 | 11:17 |
| *** jaosorior has joined #openstack-keystone | 11:17 | |
| mbuil | cmurphy: it compares the rules, which in my case are: https://hastebin.com/itetericiy.py with the assertion which in my case is: https://hastebin.com/gulimuwiye.py | 11:18 |
| mbuil | cmurphy: so, it searches for a key "openstack_user" in the assertion but there is nothing like that. Do you think the problem is that the assertion is wrong? | 11:19 |
| cmurphy | mbuil: did you modify attribute-map.xml like in this step? https://docs.openstack.org/keystone/latest/advanced-topics/federation/federated_identity.html#keystone-to-keystone | 11:23 |
| *** s10 has joined #openstack-keystone | 11:27 | |
| *** josecastroleon has quit IRC | 11:28 | |
| *** josecastroleon has joined #openstack-keystone | 11:28 | |
| mbuil | cmurphy: not exactly, I did this mapping ==> https://docs.openstack.org/keystone/latest/advanced-topics/federation/configure_federation.html#mapping | 11:31 |
| *** shyamb has quit IRC | 11:31 | |
| *** shyamb has joined #openstack-keystone | 11:32 | |
| mbuil | and this one https://docs.openstack.org/keystone/latest/advanced-topics/federation/shibboleth.html | 11:32 |
| cmurphy | mbuil: you need to edit /etc/shibboleth/attribute-map.xml too, it's a quirk of the shibboleth SP that by default it won't pass through attributes it doesn't understand | 11:32 |
| mbuil | cmurphy: I edited it and added https://hastebin.com/olutuhevaz.xml | 11:35 |
| cmurphy | mbuil: ah you need to keep id="openstack_user" etc, the id parameter in that xml node doesn't refer to the actual ID of the user, it's an internal identifier that needs to be unique | 11:36 |
| mbuil | cmurphy: aaaah ok, thanks! | 11:37 |
| *** markvoelker has quit IRC | 11:37 | |
| mbuil | cmurphy: look at this ==> https://hastebin.com/mutetusabe.rb, success?? | 11:39 |
| cmurphy | mbuil: looks like it!!! | 11:40 |
| mbuil | ole! | 11:40 |
| *** nicolasbock has quit IRC | 11:49 | |
| *** shyamb has quit IRC | 12:02 | |
| *** shyamb has joined #openstack-keystone | 12:06 | |
| *** raildo has joined #openstack-keystone | 12:33 | |
| *** shyamb has quit IRC | 12:34 | |
| *** shyamb has joined #openstack-keystone | 12:34 | |
| openstackgerrit | Merged openstack/keystone master: Fix a bug that issue token with project-scope gets error https://review.openstack.org/587399 | 12:35 |
| *** josecastroleon has quit IRC | 12:39 | |
| *** jaosorior has quit IRC | 12:39 | |
| *** shyamb has quit IRC | 12:40 | |
| *** dave-mccowan has joined #openstack-keystone | 12:43 | |
| *** josecastroleon has joined #openstack-keystone | 12:46 | |
| *** raildo_ has joined #openstack-keystone | 13:09 | |
| *** raildo has quit IRC | 13:10 | |
| *** _ix has joined #openstack-keystone | 13:26 | |
| *** _ix has quit IRC | 13:34 | |
| *** lbragstad has joined #openstack-keystone | 13:37 | |
| *** ChanServ sets mode: +o lbragstad | 13:37 | |
| *** josecastroleon has quit IRC | 13:40 | |
| *** jaosorior has joined #openstack-keystone | 13:44 | |
| *** wxy| has joined #openstack-keystone | 13:48 | |
| *** _ix has joined #openstack-keystone | 13:51 | |
| *** _ix has quit IRC | 13:57 | |
| *** josecastroleon has joined #openstack-keystone | 14:08 | |
| *** _ix has joined #openstack-keystone | 14:40 | |
| knikolla | o/ | 14:55 |
| lbragstad | o/ | 14:57 |
| knikolla | schedule for berlin is live | 15:01 |
| *** jdennis has quit IRC | 15:20 | |
| *** jdennis has joined #openstack-keystone | 15:31 | |
| *** fiddletwix has joined #openstack-keystone | 15:39 | |
| openstackgerrit | Doug Hellmann proposed openstack/oslo.limit master: fix gate https://review.openstack.org/591162 | 15:49 |
| openstackgerrit | Doug Hellmann proposed openstack/oslo.limit master: import zuul job settings from project-config https://review.openstack.org/588697 | 15:49 |
| openstackgerrit | Doug Hellmann proposed openstack/oslo.limit master: add python 3.6 unit test job https://review.openstack.org/589599 | 15:49 |
| openstackgerrit | Doug Hellmann proposed openstack/oslo.limit master: add lib-forward-testing-python3 test job https://review.openstack.org/591185 | 15:49 |
| openstackgerrit | Doug Hellmann proposed openstack/oslo.limit master: fix doc gate https://review.openstack.org/591162 | 15:50 |
| openstackgerrit | Doug Hellmann proposed openstack/oslo.limit master: import zuul job settings from project-config https://review.openstack.org/588697 | 15:50 |
| openstackgerrit | Doug Hellmann proposed openstack/oslo.limit master: add python 3.6 unit test job https://review.openstack.org/589599 | 15:50 |
| openstackgerrit | Doug Hellmann proposed openstack/oslo.limit master: add lib-forward-testing-python3 test job https://review.openstack.org/591185 | 15:50 |
| *** itlinux has joined #openstack-keystone | 15:54 | |
| lbragstad | kmalloc: i fixed up a bunch of the failures in the policy conversion patch, i should be able to clean up the last couple bits and get a new version up earlier than i thought | 15:59 |
| *** gyee has joined #openstack-keystone | 16:02 | |
| *** pcaruana has quit IRC | 16:02 | |
| *** ayoung has joined #openstack-keystone | 16:03 | |
| kmalloc | Cool | 16:09 |
| *** jrist has quit IRC | 16:12 | |
| *** s10 has quit IRC | 16:28 | |
| *** d0ugal has quit IRC | 16:28 | |
| *** shyamb has joined #openstack-keystone | 16:29 | |
| *** jrist has joined #openstack-keystone | 16:38 | |
| *** wxy| has quit IRC | 16:39 | |
| *** lbragstad has quit IRC | 16:41 | |
| *** shyamb has quit IRC | 17:05 | |
| kmalloc | knikolla: i think i have a fix for OS-FEDERATION now | 17:44 |
| kmalloc | knikolla: almost there. | 17:44 |
| kmalloc | knikolla: running local tests to make sure it is working at least in unit. | 17:45 |
| knikolla | kmalloc: awesome! | 17:45 |
| kmalloc | knikolla: also, running unit tests on a threadripper is nice. 32 threads of unit tests, <100s for full run | 17:46 |
| knikolla | kmalloc: cool! | 17:47 |
| knikolla | i usually run mine on a 16 vcpu vm | 17:47 |
| kmalloc | notmorgan@tardis:~/Documents/openstack_dev/keystone$ docker-tox -epep8,py35 -> | 17:48 |
| kmalloc | https://www.irccloud.com/pastebin/sKuIKFqp/ | 17:48 |
| knikolla | kmalloc: 94 seconds, yup. impressive! | 17:49 |
| knikolla | i think best i've got is about 3 minutes. | 17:49 |
| kmalloc | docker-tox is an alias to `docker run --rm -v `pwd`:/opt/src keystone-dev:16.04 tox | 17:49 |
| kmalloc | Docker File for keystone-dev (16.04) https://www.irccloud.com/pastebin/BtGV79Dq/Dockerfile | 17:50 |
| kmalloc | knikolla: ^ if you want to use my dockerfile. | 17:51 |
| kmalloc | that'll build a keystone dev docker image, assuming your PWD is one level outside of the keystone drectory | 17:51 |
| kmalloc | and it'll do the bindep work for you. | 17:51 |
| kmalloc | so you get all the bindeps needed. | 17:51 |
| kmalloc | it could even work for non-keystone things with an env for OS_PROJ | 17:52 |
| kmalloc | OS_PROJECT* | 17:52 |
| knikolla | kmalloc: i only have a lowly dual core laptop | 17:52 |
| knikolla | until then i have this https://gist.github.com/knikolla/a921573ded94538796ee5ce1383eb1fb | 17:52 |
| kmalloc | right, but this means i don't need to install all the deps | 17:53 |
| kmalloc | and i could mod the dockerfile to use centos, fedora, etc | 17:53 |
| kmalloc | i'd need to modify the explicit apt-get bit, i think i could do it 100$ with bindep | 17:53 |
| kmalloc | 100%* | 17:53 |
| kmalloc | my system has basic IDE support, but i run all the code [inc dependencies] in docker, even for the IDE inspections. | 17:54 |
| knikolla | true | 17:54 |
| knikolla | interesting | 17:54 |
| kmalloc | i also don't have py27 installed | 17:54 |
| kmalloc | locally, just in docker | 17:54 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone master: Convert OS-FEDERATION to flask native dispatching https://review.openstack.org/591082 | 17:55 |
| knikolla | hmmm... i never thought of installing the dependencies in docker and running IDE inspection from that | 17:56 |
| kmalloc | knikolla: it works explicitly with pycharm | 17:56 |
| kmalloc | i think vscode will support "Remote interpreter" soon too | 17:56 |
| kmalloc | and as soon as it does, i'll move to vscode | 17:56 |
| kmalloc | I can never get atom.io to do what i want it to | 17:56 |
| kmalloc | =/ i want to like it | 17:56 |
| kmalloc | i really do. | 17:56 |
| knikolla | i tried vs code, but there were some annoyances | 17:57 |
| knikolla | pycharm works best for me | 17:57 |
| knikolla | atom is sluggish | 17:57 |
| kmalloc | but pycharm supporting remote environments is huge | 17:57 |
| kmalloc | i spent yesterday setting it all up | 17:57 |
| kmalloc | currently in my living room, coding on my 65" TV 4k TV ;) | 17:58 |
| knikolla | sweet | 17:58 |
| kmalloc | and my workstation is a TR4 (threadripper, 1950x) with 128GB of ram, running on mirrored NVMe (full encryption) drives, 2x WD RED [slow] rust, and boot/EFI on a usb-stick. | 17:59 |
| kmalloc | encryption keys in the dTPM chip, so i can walk off with the USB stick and the machine is about as secure as you can get. | 17:59 |
| knikolla | whoa, that's a beast. | 17:59 |
| kmalloc | it has a 1080ti in it, and will have an AMD 9100wx tomorrow | 17:59 |
| kmalloc | so VMs will get VT-D, sr-iov slice of a gpu. | 18:00 |
| kmalloc | the machine also has a 10G (SFP+) intel nic in it, with a DAC to my switch | 18:00 |
| kmalloc | and my new keyboard is a WASD cherry-mx clear 10keyless :) | 18:01 |
| knikolla | overkill | 18:01 |
| kmalloc | though i really want a speed silver keyboard for my gaming PC | 18:01 |
| kmalloc | (which is, being built now), Watercooled, 8086K i7, 32GB of ram, GTX 1080ti | 18:01 |
| kmalloc | on mirrored NVME drives. | 18:02 |
| knikolla | your screen alone is as big as my entire apartment, lol. | 18:02 |
| kmalloc | i have 3 (soon to be 4) monitors at my desk. | 18:02 |
| kmalloc | going to be replacing my broken 4k monitor with dual ultra-wide monitors | 18:02 |
| orange_julius | Yea well I am getting a desk this week so that I don't have to sit on the floor anymore. So there! | 18:02 |
| kmalloc | orange_julius: ++ don't sit on the floor! it hurts after too long | 18:03 |
| kmalloc | :) | 18:03 |
| kmalloc | knikolla: and i think i got my RH issued X1C6 to work... it at least suspends to s0i3 now. | 18:03 |
| kmalloc | so battery lasts longer than ... 3 hrs sleeping | 18:03 |
| kmalloc | (5-8 days suspend now) | 18:03 |
| knikolla | kmalloc: didn't they issue you a p52? | 18:03 |
| kmalloc | nope. | 18:04 |
| kmalloc | it was denied | 18:04 |
| kmalloc | like out of hand, even though my manager approved it | 18:04 |
| kmalloc | so i settled on an X1C6 | 18:04 |
| kmalloc | and it's "ok" but not great. | 18:04 |
| knikolla | that's what i asked them for, but they gave me a used x270. | 18:05 |
| kmalloc | next step is install my NUC for my openstack control plane, stand up a FreeIPA server, and get all my virtualization under management | 18:05 |
| kmalloc | xick on the x270 | 18:05 |
| kmalloc | i was issued a useless t460 or whatever the last gen was | 18:05 |
| kmalloc | with like 8GB of ram | 18:05 |
| kmalloc | and 256GB hdd | 18:06 |
| knikolla | hdd?? in 2018? | 18:06 |
| kmalloc | it was m.2 SSD | 18:06 |
| kmalloc | but not even nvme | 18:06 |
| kmalloc | or maybe it was 2.5" ssd | 18:06 |
| kmalloc | whatever, it was not usable. it's why i used my X1C4 for the last 2 years (even with it being a lemon of a laptop) | 18:07 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone master: Fix a translation of log https://review.openstack.org/591164 | 18:07 |
| knikolla | kmalloc: how's the screen on the X1C6? | 18:08 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone master: Refactor ProviderAPIs object to better design pattern https://review.openstack.org/571955 | 18:08 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone master: Convert OS-INHERIT API to flask native dispatching https://review.openstack.org/591165 | 18:08 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone master: Fix RBACEnforcer get_member_from_driver mechanism https://review.openstack.org/591146 | 18:08 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone master: Convert groups API to flask native dispatching https://review.openstack.org/591147 | 18:09 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone master: Fix a translation of log https://review.openstack.org/591164 | 18:09 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone master: Convert OS-INHERIT API to flask native dispatching https://review.openstack.org/591165 | 18:09 |
| kmalloc | knikolla: the one i have is trash, since it's 1080p | 18:09 |
| knikolla | kmalloc: right. though 1440p isn't that big of a step up. | 18:11 |
| kmalloc | but i'm used to 1440p and 4k monitors | 18:11 |
| knikolla | do you run them with 2x scaling? | 18:12 |
| kmalloc | so 1080p is pretty hard to drop down to. | 18:12 |
| kmalloc | nope, 1x scaling | 18:12 |
| knikolla | you must have impressive eyesight | 18:12 |
| knikolla | i'm running my 12.5" 1080p screen with 1.5 font scaling. | 18:12 |
| kmalloc | though i admit when i am on the TV, i'm almost 10' away, so i go to ~1.25x or so | 18:12 |
| kmalloc | hm. | 18:13 |
| kmalloc | sigh. | 18:13 |
| kmalloc | this is ugly, going to have a ton more TRY/EXCEPt in the OS-INHERIT build_enforcement_target. | 18:13 |
| kmalloc | maybe i should just explicitly raise out Forbidden on the raise instead of 404* | 18:14 |
| kmalloc | knikolla: this is dangerous | 18:14 |
| kmalloc | https://www.irccloud.com/pastebin/JE4eFJMG/ | 18:14 |
| kmalloc | should i log the 404s and raise up 403s? | 18:14 |
| kmalloc | since this is part of the enforcement line. | 18:15 |
| knikolla | kmalloc: hmmm... i think yes | 18:18 |
| kmalloc | the other option is to just leave the target/enforcement epty | 18:18 |
| kmalloc | empty*( | 18:18 |
| kmalloc | which means it's on the enforcement_str to handle if it is allowed or not. | 18:18 |
| kmalloc | which is probably most correct. | 18:18 |
| kmalloc | since an empty target['user'] dict means we can't enforce on it, so enforcement should behave as expected. | 18:19 |
| knikolla | that wouldn't raise the correct 404 though, right? | 18:20 |
| kmalloc | in both cases it should net a 403 | 18:20 |
| kmalloc | it just means the enforcement rule is responsible vs keystone saying "WHOA, NO USER! FORBIDDEN" | 18:20 |
| knikolla | oh, i see what you're saying. yes. | 18:21 |
| kmalloc | ok, going to LOG.INFO this and set the target empty | 18:21 |
| kmalloc | and see what happens with testing | 18:21 |
| knikolla | ++ | 18:22 |
| *** jaypipes has joined #openstack-keystone | 18:34 | |
| kmalloc | ooh it's a jaypipes | 18:35 |
| kmalloc | hi jaypipes | 18:35 |
| jaypipes | kmalloc, cmurphy: heya. if I want to get a list of users within a project via the keystone v3 client, how would I do that? did the behaviour between the v2 and v3 client call for keystone_client.users.list(project_id) change? | 18:35 |
| kmalloc | jaypipes: hm, i don't think it changed. | 18:36 |
| kmalloc | but... let me check. | 18:36 |
| kmalloc | jaypipes: wait, you're looking for what users have access/roles on a project? | 18:37 |
| kmalloc | jaypipes: just to confirm not something else. | 18:37 |
| *** sapd1 has quit IRC | 18:38 | |
| jaypipes | kmalloc: users that have any role in the supplied project, yes. | 18:39 |
| jaypipes | kmalloc: I have a report that this behaviour changed from v2 to v3. | 18:39 |
| jaypipes | kmalloc: and it was surprising to me. | 18:39 |
| jaypipes | kmalloc: the report is stating that v3 doesn't filter any more. it just returns all users in the entire keystone database, regardless of what gets passed to list(project_id) | 18:40 |
| kmalloc | right. | 18:40 |
| kmalloc | i'm looking at the code, and it looks like project/defauilt_project is a filter on the user's default project | 18:40 |
| kmalloc | instead of what you want. | 18:41 |
| kmalloc | i think you want to hit role_assignments, let me see how that works really quickly | 18:41 |
| jaypipes | kmalloc: I'm more interested in whether this behaviour *changed* from v2 to v3? | 18:41 |
| kmalloc | i think the behavior did change. but the report was probably giving incorrect information in v2 | 18:41 |
| kmalloc | the change is we don't filter on default_project anymore, in either case | 18:41 |
| kmalloc | which is what the argument was doing in both cases. | 18:42 |
| kmalloc | what you're looking for now, is role_assignments() https://github.com/openstack/python-keystoneclient/blob/master/keystoneclient/v3/role_assignments.py#L64 filtering on project | 18:43 |
| kmalloc | and that, while hitting v3 API, would return v2 assignments as well | 18:43 |
| kmalloc | (since v2 assignments == v3 assignments with domain(default)) | 18:43 |
| jaypipes | ack | 18:44 |
| kmalloc | ah, i am wrong, v2 did filter on tenant_id like role_assignments does | 18:44 |
| kmalloc | v3 filtered on default_project id (terrible ux) | 18:44 |
| kmalloc | so, behavior in ksc changed a lot between 2 and 3 | 18:45 |
| kmalloc | but i think that is because the udnerlying APIs didn't work even remotely the same | 18:45 |
| kmalloc | and we have role_assignments which expands out implied_roles (if asked), inherited roles, etc. | 18:45 |
| openstackgerrit | Morgan Fainberg proposed openstack/keystone master: Convert OS-INHERIT API to flask native dispatching https://review.openstack.org/591165 | 18:46 |
| kmalloc | knikolla: ^ lets see how that ends up. I think that is the most correct option. | 18:46 |
| kmalloc | knikolla: note the HUGE comment in the function. | 18:47 |
| kmalloc | i need to replicate that in the groups version too | 18:47 |
| jaypipes | kmalloc: ack, thx for the information. appreciated. | 18:47 |
| jaypipes | kmalloc: to sum up, we should be using the role assignments functionality for listing users, instead of... well, listing users. :) | 18:47 |
| kmalloc | jaypipes: if you want role assignment information. NOTE that API is very punative. it has to do a ton of work behind the scenes to map users, roles, projects, domains, and expansions | 18:48 |
| kmalloc | jaypipes: so i wouldn't run it in a tight loop or anything. | 18:48 |
| kmalloc | tl;dr hits the DB a lot | 18:49 |
| kmalloc | and may be very slow if you have a ton of users. | 18:49 |
| jaypipes | kmalloc: k, good to know. | 18:49 |
| kmalloc | knikolla: is it wrong i want to buy a tv-sized screen for my office now :P | 18:50 |
| jaypipes | kmalloc: if I just want to get a list of users in a project, why is the UX so different now? | 18:50 |
| jaypipes | kmalloc: not trying to bitch... just this kind of hit us HARD :) | 18:50 |
| kmalloc | jaypipes: because users are owned by potentially many domains | 18:50 |
| jaypipes | kmalloc: you can imagine automation scripts that were processing a dozen user accounts in a loop now processing 6K+ users in each loop over a tenant. blew up the entire service when the v3 client patches were used. | 18:51 |
| kmalloc | oh totally. i get it | 18:51 |
| kmalloc | the semantics of the scope of where users are and the types of roles are more expansive in v3 | 18:51 |
| kmalloc | inherited roles notably, and implied roles. | 18:51 |
| kmalloc | and that users live in more places (ldap, sql, etc) there is potential you have 5 sources of users | 18:52 |
| jaypipes | kmalloc: for some reason, I thought domains were no longer a thing... is that not the case? | 18:52 |
| kmalloc | domains are a specialized container that is just a project behind the scenes | 18:52 |
| jaypipes | oh, ok. so just the implementation of domains was changed? | 18:53 |
| kmalloc | that was for maintenance clarity, so we didn't need all sorts of extra magic to handle a domain role assignment | 18:53 |
| jaypipes | concept is still around? | 18:53 |
| kmalloc | yep | 18:53 |
| jaypipes | gotcha. | 18:53 |
| kmalloc | i would love to ditch domains... but lets jsut say API contract hell and v4. | 18:53 |
| kmalloc | so, we douibled down, but made domains much easier to work with | 18:53 |
| kmalloc | domains are just projects witha bit flipped and can be referenced via either API | 18:54 |
| jaypipes | sure. there seem to have been some casualties of that war, though ;P | 18:54 |
| kmalloc | yup =/ | 18:54 |
| jaypipes | :) no worries mate, shit happens. | 18:54 |
| kmalloc | functionally we didn't change v3's semantics, we made it much easier to be consistent internally though | 18:54 |
| kmalloc | but v3 has always been very different (unfortunately/fortunately) from v2 | 18:55 |
| jaypipes | kmalloc: I might touch back with you later to validate some code I'll put together to get a list of users within a tenant the v3 way (efficiently that is) | 18:55 |
| kmalloc | sure thing. | 18:55 |
| jaypipes | appreciated :) | 18:55 |
| kmalloc | role_assignments, fwiw, is on a short list of "how can we make this better" | 18:55 |
| kmalloc | that i want to tackle. but i'm amidst a giant refactor to drop webob on the cutting room floor :P | 18:55 |
| jaypipes | hehe :) | 18:56 |
| kmalloc | and i'm down to ~5 major apis. | 18:56 |
| kmalloc | but it's been a beast. Flask makes this all MUCH better... but seeing it has been hard too keep in focus | 18:56 |
| orange_julius | Do you mind me asking why flask makes this better? | 18:58 |
| kmalloc | orange_julius: it's allowing us to clean up a lot of bits, mostly around enforcement in a much cleaner way; centralized access to request data, so we don't need to pass request objects around | 19:00 |
| kmalloc | orange_julius: and flask-RESTful takes a bunch of load off us to implement rendering of the response. | 19:00 |
| kmalloc | in a clean json-form. | 19:00 |
| kmalloc | and we can handle things directly in the request instead of needing to process it as a middleware stack | 19:01 |
| kmalloc | e.g. "is this a json request body" | 19:01 |
| kmalloc | so we collapse the stack of things that have to process the request significantly. and we'll be able to more easily support things such as etags | 19:02 |
| kmalloc | so the request jaypipes is going to make for a report could be highly cachable on the client side, with webob adding such features is a real beast. | 19:02 |
| kmalloc | the final benefit is.. flask is something more folks understand than Routes and our custom wsgi bits | 19:03 |
| kmalloc | as we move forward we'll have less and less custom wrappers for flask and more and more basic flask/flask-restful code | 19:04 |
| kmalloc | :) | 19:04 |
| orange_julius | Ah nice. Thanks! I wasn't aware there was a lot of custom bits. I havn't poked my head into the Keystone code too much, and truthfully wouldn't know where to start. I am always curious though =D | 19:04 |
| kmalloc | we had nearly 100% custom wsgi stack in our code | 19:05 |
| kmalloc | all webob/pastedeploy | 19:05 |
| kmalloc | and Python Routes | 19:05 |
| kmalloc | it was hard to work with. | 19:05 |
| kmalloc | and our policy enforcement suffered. | 19:05 |
| knikolla | kmalloc: what do you do with all that screen real estate? | 19:09 |
| *** jaosorior has quit IRC | 19:45 | |
| *** jaosorior has joined #openstack-keystone | 19:58 | |
| *** rmascena__ has joined #openstack-keystone | 20:32 | |
| *** rmascena__ has quit IRC | 20:35 | |
| *** raildo_ has quit IRC | 20:35 | |
| *** rmascena__ has joined #openstack-keystone | 20:35 | |
| *** jaosorior has quit IRC | 20:56 | |
| *** rmascena__ has quit IRC | 20:59 | |
| *** s10 has joined #openstack-keystone | 21:30 | |
| *** itlinux has quit IRC | 21:54 | |
| *** s10 has quit IRC | 22:23 | |
| *** s10 has joined #openstack-keystone | 22:23 | |
| *** s10 has joined #openstack-keystone | 22:24 | |
| *** s10 has quit IRC | 22:24 | |
| *** s10 has joined #openstack-keystone | 22:25 | |
| *** s10 has quit IRC | 22:25 | |
| *** s10 has joined #openstack-keystone | 22:26 | |
| *** s10 has quit IRC | 22:26 | |
| *** s10 has joined #openstack-keystone | 22:26 | |
| *** s10 has quit IRC | 22:27 | |
| kmalloc | knikolla: watch movies, and surf the web,m what else? ;) | 22:32 |
| *** imacdonn has quit IRC | 22:38 | |
| *** imacdonn has joined #openstack-keystone | 22:38 | |
| *** _ix has quit IRC | 22:57 | |
| *** mvkr has joined #openstack-keystone | 23:05 | |
| kmalloc | knikolla: if you have some time, eyes on the OS-FEDERATION bits would be useful | 23:49 |
| kmalloc | knikolla: i am not sure why we're getting Role Not Found. | 23:49 |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!