Friday, 2018-10-12

« Thursday, 2018-10-11 Index Saturday, 2018-10-13 »
*** gyee has quit IRC00:29
openstackgerritMorgan Fainberg proposed openstack/keystone master: Remove paste-ini  https://review.openstack.org/60984100:34
openstackgerritMorgan Fainberg proposed openstack/keystone master: Remove paste-ini  https://review.openstack.org/60984100:36
*** mattoliverau has joined #openstack-keystone00:38
*** aojea has joined #openstack-keystone00:51
wxy-xiyuankmalloc: amazing!01:16
wxy-xiyuankmalloc: lbragstad: mordred : BTW, https://review.openstack.org/#/q/status:open+project:openstack/openstacksdk+branch:master+topic:unified_limit this is the openstacksdk patch for unified limit APIs.01:18
*** aojea has quit IRC01:21
*** Dinesh_Bhor has joined #openstack-keystone01:43
*** aojea has joined #openstack-keystone02:12
*** zigo has quit IRC02:29
*** aojea has quit IRC02:45
*** lbragstad has joined #openstack-keystone02:45
*** ChanServ sets mode: +o lbragstad02:45
*** Dinesh_Bhor has quit IRC02:57
*** Dinesh_Bhor has joined #openstack-keystone03:05
*** dave-mccowan has quit IRC03:05
*** aojea has joined #openstack-keystone03:38
openstackgerritayoung proposed openstack/keystone master: Re-enable REMOTE_USER tests  https://review.openstack.org/60983403:48
*** Dinesh_Bhor has quit IRC03:56
*** felipemonteiro has joined #openstack-keystone04:06
*** aojea has quit IRC04:09
*** lbragstad has quit IRC04:21
*** Dinesh_Bhor has joined #openstack-keystone04:29
*** breton has quit IRC04:30
*** aojea has joined #openstack-keystone05:00
*** pcaruana has joined #openstack-keystone05:15
*** felipemonteiro has quit IRC05:31
*** aojea has quit IRC05:34
*** aojea has joined #openstack-keystone06:27
*** Dinesh_Bhor has quit IRC06:45
*** aojea has quit IRC07:00
*** rcernin has quit IRC07:03
*** aojea has joined #openstack-keystone07:52
openstackgerritAndreas Jaeger proposed openstack/keystone master: Use tempest-pg-full  https://review.openstack.org/60995108:06
*** d0ugal has quit IRC08:07
*** d0ugal has joined #openstack-keystone08:08
*** Dinesh_Bhor has joined #openstack-keystone08:11
*** aojea has quit IRC08:24
*** zigo has joined #openstack-keystone08:34
*** devx has quit IRC08:39
*** devx has joined #openstack-keystone08:40
*** aojea has joined #openstack-keystone09:16
openstackgerritJose Castro Leon proposed openstack/keystone master: Add caching on trust role validation to improve performance  https://review.openstack.org/60896309:40
*** aojea has quit IRC09:48
*** josecastroleon has joined #openstack-keystone09:49
*** imacdonn has quit IRC09:53
*** imacdonn has joined #openstack-keystone09:53
*** Dinesh_Bhor has quit IRC09:57
*** rdopiera has joined #openstack-keystone10:25
rdopieraHello, I would like to ask you if there is a better way of doing this? https://review.openstack.org/#/c/609999/1/openstack_dashboard/api/keystone.py10:25
openstackgerritVishakha Agarwal proposed openstack/keystone master: Fixing update registered limit api-ref  https://review.openstack.org/61000010:26
*** Dinesh_Bhor has joined #openstack-keystone10:35
*** aojea has joined #openstack-keystone10:39
openstackgerritMerged openstack/pycadf master: Use templates for cover and lower-constraints  https://review.openstack.org/60660611:02
*** Dinesh_Bhor has quit IRC11:10
*** aojea has quit IRC11:12
openstackgerritVishakha Agarwal proposed openstack/keystone master: Added test case update registered limit with region  https://review.openstack.org/61000511:13
*** dave-mccowan has joined #openstack-keystone11:38
cmurphyrdopiera: thanks, commented11:43
cmurphyrdopiera: i'm not sure of a better way to solve the problem without a more significant refactor11:43
cmurphykmalloc: http://lists.openstack.org/pipermail/openstack-dev/2018-October/135696.html11:44
*** aojea has joined #openstack-keystone11:49
rdopieracmurphy: thank you!11:52
*** aojea has quit IRC12:22
*** hoonetorg has joined #openstack-keystone12:24
gagehugoo/12:39
*** aojea has joined #openstack-keystone13:14
*** markvoelker has quit IRC13:15
*** munimeha1 has joined #openstack-keystone13:22
*** lbragstad has joined #openstack-keystone13:23
*** ChanServ sets mode: +o lbragstad13:23
lbragstadkmalloc yeah - that's the most daunting refactor i've seen on this project yet13:29
*** munimeha1 has quit IRC13:38
*** dansmith is now known as SteelyDan13:41
*** felipemonteiro has joined #openstack-keystone13:46
*** aojea has quit IRC13:46
*** munimeha1 has joined #openstack-keystone13:57
*** spilla has joined #openstack-keystone14:00
openstackgerritLance Bragstad proposed openstack/oslo.policy master: Add guidelines for naming policies  https://review.openstack.org/60621414:14
*** lbragstad is now known as elbragstad14:25
*** munimeha1 has quit IRC14:32
openstackgerritLance Bragstad proposed openstack/oslo.policy master: Add guidelines for naming policies  https://review.openstack.org/60621414:37
*** aojea has joined #openstack-keystone14:37
*** markvoelker has joined #openstack-keystone14:41
*** bnemec is now known as beekneemech14:44
*** felipemonteiro has quit IRC14:56
*** josecastroleon has quit IRC15:00
*** jmlowe has quit IRC15:03
*** aojea has quit IRC15:10
*** awestin1 has joined #openstack-keystone15:10
*** jmlowe has joined #openstack-keystone15:18
kmalloccmurphy: ahah. Because I made it always work :P15:18
kmallocThat's kind of hilarious15:19
kmallocIt works for keystone but not Nova.15:19
*** gyee has joined #openstack-keystone15:19
kmallocLbragstad cmurphy, pydev stuff only worked under eventlet15:21
kmallocAfaik15:21
openstackgerritLance Bragstad proposed openstack/keystone master: Implement scaffolding for upgrade checks  https://review.openstack.org/60878515:21
kmallocIt's been dead for multiple releases aiui15:21
elbragstadok - not sure if we actually deprecated that formally unless people were able to put two and two together :(15:22
kmallocThe bit that stands it up wasn't used in our code base..15:22
kmallocI did a code search on all things I removed in that patch.15:23
kmallocI can re-add the dead function :P15:23
kmallocMakes no difference to me.15:23
kmalloc;)15:23
kmallocI'll just need to find another few lines to delete to get back up to -12999 lines ;)15:25
*** spilla has quit IRC15:42
kmallocelbragstad: I'll respin that last patch shortly15:45
kmallocAnd..... I have a fix for the collection key bit.15:45
gagehugokmalloc the "__UNUSED__"?15:46
kmallocYeah15:47
gagehugook cool15:47
knikollakmalloc: are you going to do it as a follow-up?15:47
kmallocYeah.15:47
elbragstadsounds good15:47
knikollasounds good. i'm reviewing the stack now.15:48
elbragstadi should be able to revisit those patches in bit... i'm currently buried in tempest clients again15:48
*** markvoelker has quit IRC15:51
*** markvoelker has joined #openstack-keystone15:52
openstackgerritMichael Johnson proposed openstack/keystonemiddleware master: Fix audit target service selection  https://review.openstack.org/61009916:11
*** aojea has joined #openstack-keystone16:11
johnsom^^^ fixes the audit bug I mentioned yesterday16:11
*** aojea has quit IRC16:34
elbragstadjohnsom oh - nice, thanks!16:34
*** irclogbot_3 has joined #openstack-keystone16:35
*** irclogbot_3 has quit IRC16:42
*** rdopiera has quit IRC16:54
openstackgerritChuck Short proposed openstack/oslo.policy master: Change python3.5 job to python3.7 job on Stein+  https://review.openstack.org/61012217:18
openstackgerritMorgan Fainberg proposed openstack/keystone master: Convert /v3/users to flask native dispatching  https://review.openstack.org/60907117:34
openstackgerritMorgan Fainberg proposed openstack/keystone master: Convert projects API to Flask  https://review.openstack.org/60345117:34
openstackgerritMorgan Fainberg proposed openstack/keystone master: Remove skip for test_locked_out_user_sends_notification  https://review.openstack.org/60915917:34
openstackgerritMorgan Fainberg proposed openstack/keystone master: Convert S3 and EC2 auth to flask native dispatching  https://review.openstack.org/60950017:34
openstackgerritMorgan Fainberg proposed openstack/keystone master: Replace JSON Body middleware with flask-native func  https://review.openstack.org/60953517:34
openstackgerritMorgan Fainberg proposed openstack/keystone master: Cleanup keystone.server.flask.application  https://review.openstack.org/60954817:34
openstackgerritMorgan Fainberg proposed openstack/keystone master: Register exceptions with a Flask Error Handler  https://review.openstack.org/60979617:34
openstackgerritMorgan Fainberg proposed openstack/keystone master: Make Request Logging a little better  https://review.openstack.org/60980417:34
openstackgerritMorgan Fainberg proposed openstack/keystone master: Internally defined middleware don't use stevedore  https://review.openstack.org/60980517:34
openstackgerritMorgan Fainberg proposed openstack/keystone master: Convert Normalizing filter to flask native Middleware  https://review.openstack.org/60981517:34
openstackgerritMorgan Fainberg proposed openstack/keystone master: Move AuthContextMiddleware  https://review.openstack.org/60983617:34
openstackgerritMorgan Fainberg proposed openstack/keystone master: Flask comment/docstring cleanup  https://review.openstack.org/60983717:34
openstackgerritMorgan Fainberg proposed openstack/keystone master: Cleanup test_wsgi  https://review.openstack.org/60983817:34
openstackgerritMorgan Fainberg proposed openstack/keystone master: Remove pre-flask legacy code  https://review.openstack.org/60983917:34
openstackgerritMorgan Fainberg proposed openstack/keystone master: Make collection_key and member_key raise if unset  https://review.openstack.org/61012917:34
kmalloccrap. it rebased everything....17:34
kmallocwell then. that kicked things out of gate :(17:34
kmallocsorry17:34
kmallocgagehugo, elbragstad, knikolla, cmurphy: mind re-kicking those things through?17:35
openstackgerritMorgan Fainberg proposed openstack/keystone master: Remove pre-flask legacy code  https://review.openstack.org/60983917:36
*** aojea has joined #openstack-keystone17:36
openstackgerritMorgan Fainberg proposed openstack/keystone master: Remove paste-ini  https://review.openstack.org/60984117:39
gagehugooh boy17:39
kmallocit was just a rebase via git review =/17:40
clarkbkmalloc: that should never happen without it tell you fwiw17:40
clarkbunless you are running 5 year old git review17:40
kmallocclarkb: current git review17:40
kmallocclarkb: it's the first time it's happened in ages17:40
clarkbkmalloc: the behavior should be that it will attempt a rebase and if it doesn't conflict reset back to original head and push that17:40
clarkbif it does conflict it errors out and asks you to rebase manually17:41
kmallocclarkb: well, i can only comment on what just happened :P17:41
kmalloci did a git cherry-pick of a patch onto the tree, git review and it rebased the whole stack17:41
clarkbah see17:41
clarkbcherry pick did it now git review :)17:41
clarkbcherry pick always creates a new commit17:41
kmalloci've never had cherry-pick rebase the entire stack17:41
kmalloccherry-pick was the last patch in the stack17:42
clarkbit "rebases" every commit cherry picked17:42
clarkbhrm17:42
kmallocright, a single patch was cherry picked from a different branch17:42
* kmalloc shrugs17:42
kmallocit isn't a big deal17:42
kmallocreally, i've not had any issues with git review and this happening once in 5 years is nbd17:42
kmalloci can only assume i've done something wrong, but it's my normal workflow :P17:43
kmallocso *shrug*17:43
clarkbya I thought we'd mostly figured out the warts. I'm still inclined to think cherry pick did something unexpected there17:43
kmallocnow if only i could git review -WIP and have it automatically workflow -1 ;)17:43
kmalloc>.>17:43
kmalloc<.<17:43
gagehugo¯\_(ツ)_/¯17:45
*** spilla has joined #openstack-keystone17:47
kmallocgagehugo: please let me know if you have questions re: final flask patches.17:51
kmalloci'm here and we're in the home stretch17:51
gagehugokmalloc will do, I just looked through users and projects this morning17:54
*** aojea has quit IRC17:59
kmallocooh i have more cleanup to do in the final patch ... wheeeeee18:04
kmallocgagehuge, elbragstad: the "collection_key" and "member_key" fixes are not 100% baked =/18:14
kmallocbecause RBACEnforcer leans on them.18:14
kmallocugh.18:14
gagehugohmm18:17
kmallocthink i have it solved now.18:19
kmallocincoming revisions18:19
* gagehugo braces for impact18:20
openstackgerritMorgan Fainberg proposed openstack/keystone master: Make collection_key and member_key raise if unset  https://review.openstack.org/61012918:22
openstackgerritMorgan Fainberg proposed openstack/keystone master: Remove pre-flask legacy code  https://review.openstack.org/60983918:22
kmallocgagehugo: there we go18:22
openstackgerritMorgan Fainberg proposed openstack/keystone master: Remove paste-ini  https://review.openstack.org/60984118:25
aningelbragstad: did you change your nick name :)?18:27
elbragstadaning it's casual nick friday :)18:27
aningelbragstad: yesterday we talked about the unique password count ...18:28
aningelbragstad: I believe there is a bug in identity sql driver18:28
elbragstaddid you happen to see my last few pings yesterday?18:29
aningyes I did18:29
aningThis command: "openstack user password set --password <> --original-password" works as expected.18:30
aningBut this command: "openstack user set --password <> <username>" doesn't work properly18:31
aningUnderneath, the first command is a POST call, which eventually call change_password() in sql.py18:32
aningWhile the second is a PATCH call, which is a user update call to user_update() in sql.py.18:32
aningupdate_user() in sql.py18:33
aningand I can see update_user() never calls _validate_password_history().18:34
kmallocaning: correct18:34
kmallocupdate_user is meant to be administrative18:34
kmallocand is exempt from password history checking18:35
kmallocit is exempt from a number of PCIDSS things18:35
kmallocthat is by design.18:35
aningunderstood. But admin can change another user's password to its previously used passwords?18:35
kmallocyes18:36
kmallocit is assumed short of the user telling the admin what the password is, it would be accidental18:36
kmallocit is common that admin password setting doesn't check history18:37
aningok18:37
kmallocthis is also why we have implemented "must change password on first use" functionality18:37
kmallocso if an admin sets a password, even a previously used one, the user must still change it18:37
aningI'm wondering a user can use the second command to change its own password too ...18:38
aningLet me try ...18:38
kmallocunless explicitly allowed to call update_user no18:38
kmallocusers are not able to call update_user on self without admin/domain admin/whatever roles18:38
kmalloc(this falls into oslo.policy settings, but by default we don't enable self update of the user object)18:39
kmallocthere are things such as exempting the user from password lockouts, etc that are the reasoning behind that18:39
aningIs oslo.policy settings can be changed by configuration files? I'd like to the self update setttings for users. ..18:41
kmallocthere is a policy.json you can use to customize18:42
kmallocby default we don't ship one anymore (meaning you get the default values)18:42
kmallocotherwise you're looking in keystone.common.policies to see what the default rules are18:42
aninggot it. Thanks!18:45
elbragstadsorry - just got off a call18:45
elbragstadaning clear as mud now?18:45
aningYeah, sort of ... need a bit more digest.18:46
kmallocheck yeah18:47
*** kmalloc is now known as needscoffee18:48
needscoffeemmmm18:48
needscoffeeyeah18:48
needscoffeeit's this time of day18:48
aningneedscoffee: memory leaking :)18:49
needscoffeeyhahahaha18:49
*** aojea has joined #openstack-keystone18:50
elbragstadaning fwiw - i was reproducing everything yesterday with a self-service password endpoint18:55
elbragstadso - openstack user password set and not openstack user set18:56
elbragstad`openstack user password set`18:56
aningelbragstad: there is a self_service column is password table, is that the same thing as what you mean?18:58
aningin password table18:58
elbragstadyeah - that's for keystone to keep track of if the password was set by a user or an administrator18:59
elbragstadit's all part of the PCI-DSS logic18:59
elbragstadbecause administrators need to be able to do things that users shouldn't be able to in certain PCI-DSS deployments18:59
elbragstaddepending on the requirements you're trying to fill19:00
aningif the password is set by self, sefl_service will be "t"19:00
aningif it is set by admin, the self_service will be "f", a wild guess ...19:00
elbragstadhttp://paste.openstack.org/raw/731979/19:01
elbragstadit's a tinyint19:01
elbragstadso 0 or 119:01
elbragstadi think19:01
elbragstadacting as boolean values19:01
elbragstad1 meaning the password was self-serviced19:01
elbragstad0 meaning it was setup by an administrator19:01
aningok19:02
*** pooja-jadhav has joined #openstack-keystone19:03
needscoffee++19:03
needscoffeethat sounds right19:03
*** pooja_jadhav has quit IRC19:05
*** pooja_jadhav has joined #openstack-keystone19:10
*** jmlowe has quit IRC19:12
*** pooja-jadhav has quit IRC19:13
*** aojea has quit IRC19:23
* elbragstad hands our earmuffs19:27
openstackgerritLance Bragstad proposed openstack/keystone master: Make policy file support in fixture optional  https://review.openstack.org/59527919:27
openstackgerritLance Bragstad proposed openstack/keystone master: Move loadapp to a generic place  https://review.openstack.org/59537119:27
openstackgerritLance Bragstad proposed openstack/keystone master: Add test case for expanding implied roles in system tokens  https://review.openstack.org/59635619:27
openstackgerritLance Bragstad proposed openstack/keystone master: Expand implied roles in system-scoped tokens  https://review.openstack.org/59635719:27
openstackgerritLance Bragstad proposed openstack/keystone master: Loosen the assertion for logging scope type warnings  https://review.openstack.org/59718619:27
openstackgerritLance Bragstad proposed openstack/keystone master: Implement scope_type checking for credentials  https://review.openstack.org/59454719:27
openstackgerritLance Bragstad proposed openstack/keystone master: Pass context objects to policy enforcement  https://review.openstack.org/60553919:27
openstackgerritLance Bragstad proposed openstack/keystone master: Implement system reader role in domains API  https://review.openstack.org/60548519:27
openstackgerritLance Bragstad proposed openstack/keystone master: Implement system member role in domains API  https://review.openstack.org/60584919:27
openstackgerritLance Bragstad proposed openstack/keystone master: Implement system admin role in domains API  https://review.openstack.org/60585019:27
openstackgerritLance Bragstad proposed openstack/keystone master: Allow domain users to access the GET domain API  https://review.openstack.org/60585119:27
openstackgerritLance Bragstad proposed openstack/keystone master: Allow project users to retrieve domains  https://review.openstack.org/60587119:27
openstackgerritLance Bragstad proposed openstack/keystone master: Remove domain policies from policy.v3cloudsample.json  https://review.openstack.org/60587619:27
elbragstadrebased those ^ to fix merge conflicts and added a dependency to a tempest patch for implementing system scope19:38
openstackgerritLance Bragstad proposed openstack/keystone master: Implement scaffolding for upgrade checks  https://review.openstack.org/60878519:41
gagehugoelbragstad: It looks like your ps for project users to retrieve domains covers this: https://review.openstack.org/#/c/605560/19:54
gagehugoright?19:54
elbragstadit should, yes19:55
gagehugook good, I'll abandon that then19:55
elbragstadwe'll want to make sure your test case is covered in my patch though19:55
gagehugoit looks like it with: https://review.openstack.org/#/c/605871/3/keystone/tests/unit/protection/v3/test_domains.py19:56
gagehugoas that tests all three default roles19:57
elbragstadcool20:01
needscoffeeelbragstad: most of those patches ^ look good20:05
needscoffeei'm looking through them, but most should be ready to land.20:05
needscoffeeelbragstad: a few conflict with the final patches to flask.20:06
openstackgerritLance Bragstad proposed openstack/keystone master: Use auth_context in issue_token exclusively  https://review.openstack.org/58263520:07
elbragstadneedscoffee yeah - i needed to resolve a couple of them but it wasn't bad20:08
gagehugoelbragstad: that looks better, it seemed like we relied on having auth_context20:09
needscoffeeelbragstad: so last three things on my plate for the near term: 1) AuthContext/KSM fixes (should be small/isolating some details in ksm), 2) oslo.cache dict config grossness, 3) OSC (keystone) CLI -> SDK20:13
needscoffeeoh and 4) official deprecation of ksc20:13
needscoffee(basically freeze ksc, all new stuff goes into SDK)20:14
needscoffeei'd like to do #4 as of this realease20:14
needscoffeeregardless of anything else20:14
needscoffeejust lock down the repo to "security fixes only" and push all new stuff to SDK.20:15
needscoffeeand backfill SDK as needed to meed parity20:15
needscoffeemeet*20:15
elbragstadsweet20:15
needscoffeelimits is already going that way20:15
needscoffeeonce SDK is at parity, KSC will be frozen (no security fixes).20:16
openstackgerritLance Bragstad proposed openstack/keystone master: Use auth_context in issue_token exclusively  https://review.openstack.org/58263520:16
needscoffeeor 90% parity or some marker20:16
needscoffeewe can evaluate that freeze at S2 or so (the "nothing but security fixes to KSC")20:18
mordredneedscoffee: I can't keep up with all of the different people you are20:20
needscoffeemordred: because i change names in IRC/elsewhere so often20:20
*** needscoffee is now known as kmalloc20:20
mordredneedscoffee: it's the real life changes that get me20:21
kmallocLOL20:21
kmallocoh cause my name has changed SO much in the entire time you've known me ;)20:21
mordredyup. I just gave up trying to follow it20:21
mordredkmalloc: btw - the discovery patch for sdk has landed - so sdk is now fully-discovery driven and config settings are only overrides20:22
kmallocNICE20:23
openstackgerritLance Bragstad proposed openstack/keystone master: Remove obsolete credential policies  https://review.openstack.org/59718720:29
elbragstadbah... users isn't on flask native yet20:50
* elbragstad sets https://bugs.launchpad.net/keystone/+bug/1748027 back on the shelf20:50
openstackLaunchpad bug 1748027 in OpenStack Identity (keystone) "The v3 users API should account for different scopes" [High,Triaged] - Assigned to sonu (sonu-bhumca11)20:50
elbragstadcmurphy should we make system-scope an official bug tag?20:51
elbragstadi saw your updates to the policy bugs20:51
*** spilla has quit IRC20:55
*** dave-mccowan has quit IRC20:57
openstackgerritMichael Johnson proposed openstack/keystonemiddleware master: Fix audit target service selection  https://review.openstack.org/61009921:16
kmallocelbragstad: yes21:24
kmallocelbragstad: we should21:25
*** jistr has quit IRC21:55
*** jistr has joined #openstack-keystone21:56
*** jistr has quit IRC22:05
*** jistr has joined #openstack-keystone22:06
*** aojea has joined #openstack-keystone22:07
*** aojea has quit IRC22:11
openstackgerritLance Bragstad proposed openstack/keystone master: WIP: Implement scope_type checking for project API  https://review.openstack.org/61017822:18
*** pcaruana has quit IRC22:20
openstackgerritMerged openstack/keystone master: Convert /v3/users to flask native dispatching  https://review.openstack.org/60907122:44
openstackgerritMerged openstack/keystone master: Convert projects API to Flask  https://review.openstack.org/60345122:44
*** elbragstad has quit IRC22:56
*** elbragstad has joined #openstack-keystone23:15
*** ChanServ sets mode: +o elbragstad23:15
*** elbragstad has quit IRC23:15
*** jmlowe has joined #openstack-keystone23:18
*** gyee has quit IRC23:52
« Thursday, 2018-10-11 Index Saturday, 2018-10-13 »

Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!