| *** dave-mccowan has quit IRC | 00:08 | |
| *** dave-mccowan has joined #openstack-keystone | 00:15 | |
| *** threestrands has joined #openstack-keystone | 00:18 | |
| *** tosky has quit IRC | 00:27 | |
| openstackgerrit | Merged openstack/python-keystoneclient master: Fix keystoneclient-devstack-functional job https://review.openstack.org/620553 | 00:56 |
|---|---|---|
| *** dave-mccowan has quit IRC | 01:31 | |
| *** dave-mccowan has joined #openstack-keystone | 01:50 | |
| *** gyee has quit IRC | 01:52 | |
| *** dklyle has joined #openstack-keystone | 01:59 | |
| *** dklyle has quit IRC | 02:05 | |
| openstackgerrit | wangxiyuan proposed openstack/keystone-specs master: Add domain level limit support https://review.openstack.org/599491 | 02:23 |
| *** Dinesh_Bhor has joined #openstack-keystone | 02:27 | |
| *** dave-mccowan has quit IRC | 02:46 | |
| *** dave-mccowan has joined #openstack-keystone | 02:56 | |
| *** dklyle has joined #openstack-keystone | 03:11 | |
| *** dklyle has quit IRC | 03:17 | |
| *** dave-mccowan has quit IRC | 03:33 | |
| *** dave-mccowan has joined #openstack-keystone | 03:35 | |
| *** dave-mccowan has quit IRC | 04:30 | |
| *** markvoelker has quit IRC | 04:32 | |
| *** markvoelker has joined #openstack-keystone | 05:02 | |
| *** Nel1x has quit IRC | 05:14 | |
| *** threestrands has quit IRC | 05:20 | |
| *** pcaruana has quit IRC | 05:35 | |
| *** imacdonn has quit IRC | 05:39 | |
| *** imacdonn has joined #openstack-keystone | 05:39 | |
| openstackgerrit | Filippo Inzaghi proposed openstack/python-keystoneclient master: Add Python 3.6 classifier to setup.cfg https://review.openstack.org/621080 | 06:57 |
| *** pcaruana has joined #openstack-keystone | 07:22 | |
| *** rcernin has quit IRC | 08:06 | |
| *** awalende has joined #openstack-keystone | 08:08 | |
| *** awalende_ has joined #openstack-keystone | 08:08 | |
| *** awalende_ has quit IRC | 08:10 | |
| *** awalende has quit IRC | 08:12 | |
| *** amoralej|off is now known as amoralej | 08:24 | |
| *** xek has joined #openstack-keystone | 08:38 | |
| *** tosky has joined #openstack-keystone | 08:42 | |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Add domain_id column for limit https://review.openstack.org/620202 | 08:54 |
| openstackgerrit | wangxiyuan proposed openstack/keystone master: Add domain_id column for limit https://review.openstack.org/620202 | 09:00 |
| *** shrasool has joined #openstack-keystone | 09:26 | |
| *** takamatsu has quit IRC | 09:41 | |
| openstackgerrit | Merged openstack/keystone master: Move to password validation schema https://review.openstack.org/614294 | 09:43 |
| *** Dinesh_Bhor has quit IRC | 10:09 | |
| *** pcaruana has quit IRC | 10:44 | |
| *** pcaruana has joined #openstack-keystone | 10:50 | |
| *** raildo has joined #openstack-keystone | 11:32 | |
| *** pcaruana has quit IRC | 12:11 | |
| *** shrasool has quit IRC | 12:37 | |
| *** Nel1x has joined #openstack-keystone | 12:46 | |
| *** xek has quit IRC | 12:46 | |
| *** xek has joined #openstack-keystone | 12:47 | |
| *** nehaalhat has quit IRC | 13:02 | |
| *** dave-mccowan has joined #openstack-keystone | 13:19 | |
| *** jackivanov has quit IRC | 13:26 | |
| *** annp has quit IRC | 13:29 | |
| *** shrasool has joined #openstack-keystone | 13:38 | |
| *** shrasool has quit IRC | 13:41 | |
| *** mchlumsky has joined #openstack-keystone | 13:44 | |
| *** takamatsu has joined #openstack-keystone | 13:55 | |
| *** shrasool has joined #openstack-keystone | 13:55 | |
| *** jdennis has quit IRC | 14:02 | |
| *** amoralej is now known as amoralej|lunch | 14:04 | |
| *** jdennis has joined #openstack-keystone | 14:06 | |
| *** etp has quit IRC | 14:18 | |
| *** etp has joined #openstack-keystone | 14:22 | |
| lbragstad | jdennis get it figured out? | 14:36 |
| *** lbragstad is now known as elbragstad | 14:36 | |
| knikolla | o/ | 14:39 |
| *** alexchadin has quit IRC | 14:42 | |
| elbragstad | good morning/afternoon/evening | 14:44 |
| elbragstad | er... good day? | 14:44 |
| cmurphy | good times | 14:45 |
| elbragstad | good UGT | 14:45 |
| *** takamatsu has quit IRC | 14:48 | |
| openstackgerrit | Lance Bragstad proposed openstack/oslo.policy master: Add domain scope support for scope types https://review.openstack.org/611443 | 14:53 |
| elbragstad | jaosorior bnemec ^ | 14:53 |
| elbragstad | rev'd that to pick up the new oslo.context version (which is passing for me locally) | 14:53 |
| jaosorior | elbragstad: excellent! | 14:54 |
| jaosorior | elbragstad: great summit summary! (just read it) | 14:55 |
| jdennis | elbragstad: yes, working on a updated patch now ... | 15:03 |
| *** takamatsu has joined #openstack-keystone | 15:29 | |
| *** bnemec is now known as beekneemech | 15:34 | |
| beekneemech | elbragstad: Just remember it's always 5 o'clock somewhere. :-) | 15:35 |
| *** amoralej|lunch is now known as amoralej | 15:39 | |
| *** dansmith is now known as SteelyDan | 15:43 | |
| *** shrasool has quit IRC | 15:45 | |
| *** takamatsu has quit IRC | 15:53 | |
| elbragstad | jaosorior glad you found it useful :) | 15:57 |
| elbragstad | beekneemech inoright? | 15:57 |
| elbragstad | cmurphy good question on https://review.openstack.org/#/c/620157/3 | 16:09 |
| elbragstad | curious to hear what your opinion is about the member role (i'm a little conflicted on it) | 16:10 |
| cmurphy | elbragstad: one sec, in a meeting | 16:10 |
| cmurphy | elbragstad: but that makes zero sense to me | 16:10 |
| elbragstad | no worries - just ping when you wanna talk about it | 16:10 |
| cmurphy | elbragstad: so imo create update and delete are all equally dangerous actions, create and update are basically the same action, so it makes no sense to only allow admins to create but anyone can edit | 16:18 |
| cmurphy | it's like if you have a root user be able to create a file but then anyone could edit the file | 16:18 |
| cmurphy | anyone could completely destroy the file by emptying it or adding garbage to it | 16:19 |
| cmurphy | so you would never do that, you'd have the same protections for create and modify | 16:19 |
| *** mchlumsky has quit IRC | 16:21 | |
| elbragstad | yeah - that's fair | 16:22 |
| elbragstad | i can see that argument | 16:23 |
| cmurphy | elbragstad: what's the other side of the argument? | 16:23 |
| elbragstad | i guess the only other perspective i can see for having member be something in between admin and reader is.. | 16:23 |
| gagehugo | o/ | 16:24 |
| elbragstad | alleviating operations from administrators | 16:24 |
| elbragstad | (not assuming bad actors) | 16:24 |
| elbragstad | so - reader = get, list; member = get, list, update; admin = get, list, update, create, delete | 16:25 |
| cmurphy | in my mind member isn't a half step, it's a member of a project/domain with full control of things of resources that belong to that project/domain | 16:25 |
| cmurphy | i can't see member being useful for any system-scope action | 16:25 |
| elbragstad | that's fair | 16:25 |
| *** pcaruana has joined #openstack-keystone | 16:26 | |
| elbragstad | so - with service providers that makes sense | 16:26 |
| *** gyee has joined #openstack-keystone | 16:27 | |
| * cmurphy -> afk for ~1 hour | 16:30 | |
| *** xek has quit IRC | 16:36 | |
| elbragstad | cmurphy for when you get back: think there is a good use case for member within keystone? i'm struggling to find any | 16:38 |
| * elbragstad has a lot of patches to respin | 16:41 | |
| elbragstad | but that should make protection testing a bit easier since reader and member are effectively the same thing | 16:41 |
| elbragstad | so - all member patches should really just be testing patches to make sure system members can only do what system reader can | 16:49 |
| *** pcaruana has quit IRC | 17:04 | |
| *** ayoung has quit IRC | 17:12 | |
| nsmeds | back with more wonderful questions. When I run command `openstack role add admin --user nsmeds --user-domain cloud_admin` it errors with `Must specify either system, domain, or project`. | 17:16 |
| nsmeds | I thought roles were global and not restricted to domains/projects yet? | 17:17 |
| cmurphy | elbragstad: i can't think of one | 17:20 |
| openstackgerrit | John Dennis proposed openstack/oslo.policy master: Fully log RBAC enforcement data https://review.openstack.org/619260 | 17:48 |
| * kmalloc catches up with backscroll | 17:48 | |
| kmalloc | nsmeds: roles have always been restricted to projects/domains until recently. Now we also support system scope (future looking to fix the is-admin hell we wrote ourselves into) | 17:50 |
| elbragstad | cmurphy ack | 17:50 |
| elbragstad | i'll just start reworking the patches to downgrade member to reader | 17:51 |
| elbragstad | but yeah, i wasn't too sure what to do with that since we never really came up with a definitive conclusion, glad you said something | 17:51 |
| *** openstackgerrit has quit IRC | 17:51 | |
| *** amoralej is now known as amoralej|off | 17:53 | |
| *** openstackgerrit has joined #openstack-keystone | 18:28 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Update mapping policies for system reader https://review.openstack.org/619612 | 18:28 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Add mapping tests for system member role https://review.openstack.org/619613 | 18:28 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Update mapping policies for system admin https://review.openstack.org/619614 | 18:28 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Add tests for domain users interacting with mappings https://review.openstack.org/619615 | 18:28 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Add tests for project users interacting with mappings https://review.openstack.org/619616 | 18:28 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Remove mapping policies from policy.v3cloudsample.json https://review.openstack.org/619617 | 18:28 |
| openstackgerrit | Monty Taylor proposed openstack/keystoneauth master: WIP Fix version discovery for rackspace public cloud https://review.openstack.org/621257 | 18:40 |
| kmalloc | mordred: seriously?! ^ | 18:45 |
| kmalloc | mordred: *sigh* | 18:45 |
| cmurphy | o.0 | 18:46 |
| kmalloc | cmurphy: yay having custom code to handle rax deployment in KSA. | 18:47 |
| cmurphy | :( | 18:47 |
| cmurphy | can we not | 18:47 |
| kmalloc | i kindof want to say no, but i get that it probably is something we need. | 18:47 |
| kmalloc | because.... reasons. | 18:48 |
| kmalloc | because it's in the discovery doc it is not easy to push up/down elsewhere | 18:49 |
| kmalloc | it's WIP patch, but ugh. | 18:49 |
| cmurphy | rax should fail refstack for something like this | 18:49 |
| kmalloc | accordcing to shrews, there is work on alternatives. | 18:50 |
| kmalloc | but bandaiding in other places doesn't make it better imo | 18:50 |
| mordred | kmalloc: I'm coming up with a better patch | 18:52 |
| mordred | that handles it without a >10 | 18:52 |
| kmalloc | mordred: i still don't like that we need to special case the discovery doc | 18:52 |
| mordred | kmalloc: the full story is - the discovery document is inaccessible there | 18:52 |
| mordred | so we have to fall back to inferring from the url - which we also have to do for things like slightly older neutron that didn't have one | 18:53 |
| kmalloc | and they have absurd things in their urls. | 18:53 |
| mordred | well - yeah - they still put project ids in their url ... BUT - it gets better | 18:53 |
| mordred | at rackspace, project ids are integers | 18:53 |
| mordred | so when we test things we pop from the url to see if they are versions ... | 18:53 |
| mordred | the project_id parses as a valid, albeit very large, version | 18:53 |
| kmalloc | which technically isn't a violation of anything.............. project ids as ints that is | 18:54 |
| mordred | kmalloc: oh - you know what- | 18:54 |
| mordred | just testing if the url segment starts with v before testing if it parses might do the trick | 18:54 |
| mordred | and be less magic | 18:54 |
| kmalloc | that would be ideal | 18:54 |
| * mordred does that - much easier than the thing he was writing | 18:54 | |
| kmalloc | because that shows we might have an issue with an all-int project-id | 18:54 |
| kmalloc | in the general case | 18:54 |
| kmalloc | sans disc. document | 18:54 |
| mordred | yeah | 18:54 |
| kmalloc | and we *could* have an all int id | 18:55 |
| kmalloc | I'm much much happier with phrasing this as a "hey... so .. all int project ids cause issues with url-based version discovery" | 18:55 |
| kmalloc | vs. "rax is weird" | 18:55 |
| kmalloc | because rax *is* sometimes weird, but this highlights a different bug in KSA's fallback behavior | 18:55 |
| kmalloc | i also think refstack should require the discovery doc (forward looking) | 18:56 |
| kmalloc | meaning, rax can't get away with making it not available. | 18:56 |
| kmalloc | and in that view, it's not really targeting rax, just saying "uh, we require discovery documents... it's part of the API" | 18:56 |
| kmalloc | and our tools need it | 18:56 |
| cmurphy | how could rax be using ints for project ids? we use uuids, that's not configurable http://git.openstack.org/cgit/openstack/keystone/tree/keystone/api/projects.py#n135 | 18:57 |
| kmalloc | cmurphy: historical long long long ago | 18:57 |
| kmalloc | rax used to run not-really-keystone | 18:57 |
| cmurphy | it sounds like they're still running not-really-keystone | 18:57 |
| * kmalloc doesn't pass judgement | 18:57 | |
| mordred | kmalloc: I also think refstack should require discovery doc | 18:57 |
| cmurphy | ++ | 18:58 |
| *** shrasool has joined #openstack-keystone | 18:58 | |
| kmalloc | mordred: i *thought* we forced auth to be validated as about the only thing in keystone required via refstack, if we missed the discovery doc as part of that | 18:58 |
| kmalloc | *facepalm* | 18:58 |
| elbragstad | rax uses a private identity system | 18:58 |
| * elbragstad used to be on that team | 18:58 | |
| openstackgerrit | Monty Taylor proposed openstack/keystoneauth master: Fix version discovery for clouds with int project_ids https://review.openstack.org/621257 | 18:58 |
| kmalloc | right. | 18:58 |
| elbragstad | it predates keystone and was supposed to be the reference implementation for keystone | 18:59 |
| mordred | kmalloc: well - we need a discovery doc test for each service | 18:59 |
| kmalloc | i mean, oath uses a custom identity system, but they integrated nicely with keystone | 18:59 |
| kmalloc | mordred: lets get a bug open on that as well. | 18:59 |
| mordred | ok. I also can verify that that fix fixes the issue we saw in infra land | 19:00 |
| kmalloc | cool. | 19:00 |
| mordred | is keystone on launchpad or storyboard? | 19:00 |
| kmalloc | and we need a minimal unit test so we don't regress | 19:00 |
| kmalloc | lp | 19:00 |
| mordred | yeah | 19:00 |
| elbragstad | launchpad | 19:00 |
| kmalloc | mordred: i'm working on ipsilon setup to demo things for infra today. i am pretty close to having a workable system we can start building config for (on the topic of LP vs SB) | 19:01 |
| kmalloc | mordred: https://bugs.launchpad.net/keystoneauth/ | 19:03 |
| openstackgerrit | Monty Taylor proposed openstack/keystoneauth master: Fix version discovery for clouds with int project_ids https://review.openstack.org/621257 | 19:09 |
| mordred | kmalloc, elbragstad, cmurphy: now with test and bug | 19:09 |
| kmalloc | yay | 19:10 |
| elbragstad | cmurphy https://www.openstack.org/marketplace/public-clouds/rackspace/rackspace-public-cloud is the latest run that I can find | 19:11 |
| elbragstad | but it doesn't really go into much detail - so looks like mileage varies based on interpretation? | 19:11 |
| kmalloc | yeah | 19:11 |
| kmalloc | and it's not just keystone | 19:11 |
| kmalloc | it's *all services that have a discovery doc* should be required to show it via refstack | 19:11 |
| mordred | ++ | 19:12 |
| kmalloc | then longer term, all services covered by refstack need to have a discovery doc | 19:12 |
| mordred | all services should have a discovery doc. all of those discovery docs should be accessible without authentication | 19:12 |
| kmalloc | yes | 19:12 |
| mordred | is what I'd REALLY like to see | 19:12 |
| *** ayoung has joined #openstack-keystone | 19:16 | |
| *** shrasool has quit IRC | 19:16 | |
| mordred | kmalloc: https://review.openstack.org/621272 is a nodepool patch blocking the openstacksdk release that exposes the keystoneauth bug | 19:19 |
| mordred | I gave the keystone team kudos in it for being helpful | 19:20 |
| kmalloc | Yay :) | 19:20 |
| *** shrasool has joined #openstack-keystone | 19:22 | |
| ayoung | elbragstad, can I convince you to drop the -1 on https://review.openstack.org/#/c/605169/ and instead push it on through? I think changing the ID generation scheme for all providers is a bigger step than we want to do here, and that is really what you are asking for | 19:27 |
| elbragstad | let me wrap up a series here and i'll take a look | 19:27 |
| ayoung | In order to not call the generator from the SQL providers, we'd have to call it externally and pass in the ID. Not a bad idea, but to do it right, we should use that approach consistantly across providers. | 19:28 |
| ayoung | I'll add that comment to the review | 19:28 |
| elbragstad | iirc - my thing with that patch was the backends should know about what's above them and shouldn't call up | 19:30 |
| elbragstad | they should be given the information they need to do what they need to do | 19:30 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Update service provider policies for system reader https://review.openstack.org/620156 | 19:32 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Add service provider tests for system member role https://review.openstack.org/620157 | 19:32 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Update service provider policies for system admin https://review.openstack.org/620158 | 19:32 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Add tests for domain users interacting with sps https://review.openstack.org/620159 | 19:32 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Add tests for project users interacting with sps https://review.openstack.org/620160 | 19:32 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Remove service provider policies from v3cloudsample.json https://review.openstack.org/620161 | 19:32 |
| ayoung | elbragstad, while that is the general approach we've taken, the UUID generator could be thought of as a hard coded provider, and this swaps it out for a configurable one as a first step. But there is nothingt implicitly wrong for one provider calling another, excpet that it is likely to duplicate business logic between providers | 19:33 |
| ayoung | in this case, there is on the one SQL provider for shadow users. When we go towards kmalloc 's principal mechanism, we'll probably extract this code to a higher level | 19:34 |
| elbragstad | well - we commonly call across provides, the approach in that patch is calling from a backend *up* to a provider | 19:34 |
| ayoung | So, this is probably not the end state. | 19:34 |
| ayoung | Right. There is really nothing wrong with that, as providers are just abstractions above drivers. Driver to driver would be bad. | 19:36 |
| ayoung | looking at the shadow user abstraction, most of the logic should be up in the manager for it as well | 19:36 |
| elbragstad | true - but it's not, and that interface is a plugin point | 19:38 |
| elbragstad | so someone rolling their own backend (however unlikely it is) is going to miss this | 19:38 |
| ayoung | elbragstad, what do you think should be done, then? | 19:39 |
| elbragstad | https://github.com/openstack/keystone/blob/master/setup.cfg#L130 | 19:39 |
| *** shrasool has quit IRC | 19:39 | |
| kmalloc | that backend should go away imop | 19:40 |
| ayoung | elbragstad, my change only changes the implementation on OUR version, not the contract. | 19:40 |
| kmalloc | that "pluggable" point that is | 19:40 |
| elbragstad | can we generate the public id at https://review.openstack.org/#/c/605169/8/keystone/identity/shadow_backends/sql.py@39 and pass it into the driver? | 19:40 |
| kmalloc | in fact... i think a chunk of keystone should be *less* pluggable | 19:40 |
| ayoung | elbragstad, of coursxe we could, but it would change the contract | 19:41 |
| elbragstad | yeah.. and it would prevent the backend from having a dependency on a higher layer | 19:41 |
| kmalloc | ayoung: the contract we adhere to is the public API/rest api | 19:41 |
| kmalloc | anything internal to keystone is not considered a contract | 19:41 |
| kmalloc | we tried it and reverted tracking the backend interface as a contract | 19:42 |
| ayoung | kmalloc, please don't confuse the issue with facts. I was merely responding to the contract implicit in " so someone rolling their own backend (however unlikely it is) is going to miss this" | 19:42 |
| kmalloc | we try not to break people too badly in general | 19:42 |
| elbragstad | we still track backend interfaces, we just don't version them like we used to | 19:42 |
| kmalloc | elbragstad: we track them only with abcmeta | 19:42 |
| elbragstad | because we still expose them as plugin points | 19:42 |
| kmalloc | at best | 19:42 |
| ayoung | so, by that logic elbragstad , no we can't | 19:42 |
| kmalloc | elbragstad: the plugin points are, in my opinion, not a contract | 19:43 |
| ayoung | if we pass in the id from external, we've changed the contract. I'd argue that instead of doing that, we do away with the plugin point altogether | 19:43 |
| kmalloc | in fact, i'd argue it absolutely is not a contract | 19:43 |
| kmalloc | because we don't track the interface of those plugins | 19:43 |
| elbragstad | it's an interface | 19:43 |
| kmalloc | merging those together/eliminating them / adding to them / splitting them | 19:44 |
| elbragstad | we provide interfaces so that we can establish boundaries and responsibilities | 19:44 |
| kmalloc | it's not restricted | 19:44 |
| kmalloc | it is not a contract | 19:44 |
| elbragstad | if we need to evolve the interface, we can | 19:44 |
| ayoung | But a driver absolutely can call up to a different provider. It is why the provider interface exists: to avoid direct links to other implementations. Like we have currently | 19:44 |
| kmalloc | it is a minor convinence of split of concerns... and overly split | 19:44 |
| elbragstad | but we need to let people know what we're changing and why | 19:44 |
| kmalloc | imo, we need to drop a lot of those backends, and we just need to issue a release note indicating the merging | 19:45 |
| kmalloc | example, the id mapping should be merged in | 19:45 |
| ayoung | So, please let this one go forward as is, and we can reengineer the shadow_users into the principal abstraction | 19:45 |
| kmalloc | and shadow users should be eliminated. | 19:45 |
| kmalloc | (as a plug point) | 19:45 |
| ayoung | this the whole manager/driver interface was a Termieism so we could support Key/Value pairs first and everything else later | 19:46 |
| elbragstad | https://bugs.launchpad.net/keystone/+bug/1563101 | 19:46 |
| openstack | Launchpad bug 1563101 in OpenStack Identity (keystone) "Remove backend dependency on core" [Medium,Fix released] - Assigned to Ron De Rose (ronald-de-rose) | 19:46 |
| kmalloc | and i want to reverse course on a lot of the split backends | 19:47 |
| kmalloc | part of being a full featured IDP is being more directly opinionated | 19:47 |
| ayoung | kmalloc, yeah. It will make the code simpler to understand and maintain. | 19:47 |
| kmalloc | the pluggable points should be things like: new federated auth form, or something custom a company wrote, allow loading in a plugin for that | 19:48 |
| kmalloc | vault vs SQL for credentials/totp/etc | 19:48 |
| kmalloc | so an HSM could be used | 19:49 |
| kmalloc | and a number of other things would be strictly API driven. | 19:49 |
| kmalloc | but i realize it's a long road to get there | 19:52 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Update mapping policies for system admin https://review.openstack.org/619614 | 20:03 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Add tests for domain users interacting with mappings https://review.openstack.org/619615 | 20:03 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Add tests for project users interacting with mappings https://review.openstack.org/619616 | 20:03 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Remove mapping policies from policy.v3cloudsample.json https://review.openstack.org/619617 | 20:03 |
| *** jistr has quit IRC | 20:11 | |
| *** jistr has joined #openstack-keystone | 20:13 | |
| *** xek has joined #openstack-keystone | 20:19 | |
| *** openstackgerrit has quit IRC | 20:50 | |
| *** itlinux has joined #openstack-keystone | 20:51 | |
| *** takamatsu has joined #openstack-keystone | 20:53 | |
| *** openstackgerrit has joined #openstack-keystone | 20:55 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Update idp policies for system reader https://review.openstack.org/619371 | 20:55 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Add idp tests for system member role https://review.openstack.org/619372 | 20:55 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Update idp policies for system admin https://review.openstack.org/619373 | 20:55 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Add tests for domain users interacting with idps https://review.openstack.org/619374 | 20:55 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Add tests for project users interacting with idps https://review.openstack.org/619375 | 20:55 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Remove idp policies from policy.v3cloudsample.json https://review.openstack.org/619376 | 20:55 |
| *** itlinux_ has joined #openstack-keystone | 20:59 | |
| *** itlinux has quit IRC | 20:59 | |
| *** raildo has quit IRC | 21:05 | |
| nsmeds | does anyone see anything incorrectly setup here? https://gist.github.com/nikosmeds/3738f24853c85d27548645a75807b973 | 21:41 |
| nsmeds | getting policy.json changes to work has been a major PITA for a few days - there's something i'm missing, and I just can't see what that is | 21:42 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Add region protection tests for system readers https://review.openstack.org/619085 | 21:50 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Add region tests for system member role https://review.openstack.org/619086 | 21:50 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Update region policies to use system admin https://review.openstack.org/619241 | 21:50 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Add tests for domain users interacting with regions https://review.openstack.org/619242 | 21:50 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Add tests for project users interacting with regions https://review.openstack.org/619243 | 21:50 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Remove region policies from policy.v3cloudsample.json https://review.openstack.org/619244 | 21:50 |
| *** itlinux_ has quit IRC | 22:13 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Update endpoint policies for system reader https://review.openstack.org/619329 | 22:14 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Add endpoint tests for system member role https://review.openstack.org/619330 | 22:14 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Update endpoint policies for system admin https://review.openstack.org/619331 | 22:14 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Add tests for domain users interacting with endpoints https://review.openstack.org/619332 | 22:14 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Add tests for project users interacting with endpoints https://review.openstack.org/619281 | 22:14 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Remove endpoint policies from policy.v3cloudsample.json https://review.openstack.org/619333 | 22:14 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Update service policies for system reader https://review.openstack.org/619277 | 22:36 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Add service tests for system member role https://review.openstack.org/619278 | 22:36 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Update service policies for system admin https://review.openstack.org/619279 | 22:36 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Add tests for domain users interacting with services https://review.openstack.org/619280 | 22:36 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Add tests for project users interacting with services https://review.openstack.org/620623 | 22:36 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Remove service policies from policy.v3cloudsample.json https://review.openstack.org/619282 | 22:36 |
| *** xek has quit IRC | 22:37 | |
| *** Nel1x has quit IRC | 23:01 | |
| *** itlinux has joined #openstack-keystone | 23:07 | |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Add registered limit protection tests https://review.openstack.org/621014 | 23:37 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Add registered limit tests for system member role https://review.openstack.org/621015 | 23:37 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Update registered limit policies for system admin https://review.openstack.org/621016 | 23:37 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Add tests for domain users interacting with registered limits https://review.openstack.org/621017 | 23:37 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Add tests for project users interacting with registered limits https://review.openstack.org/621018 | 23:37 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Remove registered limit policies from policy.v3cloudsample.json https://review.openstack.org/621019 | 23:37 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Add limit protection tests https://review.openstack.org/621020 | 23:37 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Add limit tests for system member role https://review.openstack.org/621021 | 23:37 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Update limit policies for system admin https://review.openstack.org/621022 | 23:37 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Add tests for domain users interacting with limits https://review.openstack.org/621023 | 23:37 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Add tests for project users interacting with limits https://review.openstack.org/621024 | 23:37 |
| openstackgerrit | Lance Bragstad proposed openstack/keystone master: Remove limit policies from policy.v3cloudsample.json https://review.openstack.org/621025 | 23:37 |
| *** tosky has quit IRC | 23:42 | |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!