| *** gagehugo has joined #openstack-keystone | 00:01 | |
| *** whoami-rajat has quit IRC | 00:08 | |
| *** Emine has quit IRC | 00:23 | |
| *** lbragsta_ has joined #openstack-keystone | 00:50 | |
| *** ChanServ sets mode: +o lbragsta_ | 00:50 | |
| *** lbragsta_ is now known as lbragstad__ | 00:52 | |
| *** erus has quit IRC | 01:17 | |
| *** erus has joined #openstack-keystone | 01:18 | |
| *** dims has quit IRC | 01:40 | |
| *** dims has joined #openstack-keystone | 02:11 | |
| *** Dinesh_Bhor has joined #openstack-keystone | 02:15 | |
| *** dims has quit IRC | 02:25 | |
| *** dims has joined #openstack-keystone | 02:33 | |
| *** lbragstad__ has quit IRC | 02:52 | |
| *** gyee has quit IRC | 03:00 | |
| *** vishakha has joined #openstack-keystone | 03:23 | |
| *** erus has quit IRC | 03:23 | |
| *** erus has joined #openstack-keystone | 03:25 | |
| openstackgerrit | Vishakha Agarwal proposed openstack/keystone master: Correcting tests with project_id https://review.openstack.org/634394 | 03:26 |
|---|---|---|
| *** itlinux has joined #openstack-keystone | 03:42 | |
| *** itlinux has quit IRC | 04:41 | |
| *** itlinux has joined #openstack-keystone | 04:53 | |
| *** shyamb has joined #openstack-keystone | 05:24 | |
| *** shyamb has quit IRC | 05:29 | |
| *** shyamb has joined #openstack-keystone | 05:31 | |
| *** tkajinam_ has joined #openstack-keystone | 05:41 | |
| *** tkajinam has quit IRC | 05:43 | |
| *** tkajinam_ is now known as tkajinam | 06:34 | |
| *** markvoelker has joined #openstack-keystone | 06:38 | |
| *** markvoelker has quit IRC | 06:43 | |
| openstackgerrit | Artem Vasilyev proposed openstack/keystone master: Added request_id and global_request_id to basic notifications https://review.openstack.org/634663 | 06:51 |
| *** whoami-rajat has joined #openstack-keystone | 06:53 | |
| *** shyamb has quit IRC | 06:54 | |
| *** tkajinam_ has joined #openstack-keystone | 07:03 | |
| openstackgerrit | Artem Vasilyev proposed openstack/keystone master: Seperated CADF notifications tests for request_id https://review.openstack.org/635101 | 07:04 |
| *** shyamb has joined #openstack-keystone | 07:04 | |
| *** tkajinam has quit IRC | 07:05 | |
| *** jmccrory has quit IRC | 07:06 | |
| *** jmccrory has joined #openstack-keystone | 07:06 | |
| *** pcaruana has joined #openstack-keystone | 07:29 | |
| *** markvoelker has joined #openstack-keystone | 07:39 | |
| *** Emine has joined #openstack-keystone | 07:49 | |
| *** awalende has joined #openstack-keystone | 08:11 | |
| *** Emine has quit IRC | 08:12 | |
| *** markvoelker has quit IRC | 08:12 | |
| *** shyamb has quit IRC | 08:14 | |
| *** tkajinam_ has quit IRC | 08:15 | |
| *** yan0s has joined #openstack-keystone | 08:27 | |
| *** erus has quit IRC | 08:49 | |
| *** erus has joined #openstack-keystone | 08:50 | |
| *** erus has quit IRC | 08:58 | |
| *** erus has joined #openstack-keystone | 09:03 | |
| *** xek has joined #openstack-keystone | 09:09 | |
| *** erus has quit IRC | 09:09 | |
| *** markvoelker has joined #openstack-keystone | 09:09 | |
| *** shyamb has joined #openstack-keystone | 09:18 | |
| *** mgheorghe has joined #openstack-keystone | 09:26 | |
| *** markvoelker has quit IRC | 09:43 | |
| *** erus has joined #openstack-keystone | 09:47 | |
| mgheorghe | hi everyone. I have a question about keystone v3 policy. I have a queens deployement in HA that is using keystonev3 API. I need to give some users the ability to create users and projects within their domain. The problem is that if I give them 'admin' role on thier respective domain, that user can also list/edit/delete neutron networks and glance images cloudwise (i belive this happens because neutron/glance policies are not domain aware and | 09:52 |
| mgheorghe | just follow the 'role:admin' rule, whether it is a domain or project admin). To overcome this a created a new role 'domain-admin', and modified keystone policy.json to include this role. What i did was add "admin_required": "role:admin or role:domain-admin". But there seems to be a problem with this approach in the CLI and horizon. The CLI only works for the domain-admin user to list users/projects/etc. only by specifying the domain ID | 09:52 |
| mgheorghe | (domain name does not work) using '--domain' flag like : 'openstack user list --domain my_domain_id'. Otherwise, the user gets a 'You are not authorized to perform the requested action: identity:list_users'. This happens because, without the '--domain' flag, the rule "admin_and_matching_domain_id": "rule:admin_required and domain_id:%(domain_id)s" never applies. The expected behaviour would be that if no domain flag is provided, the domain | 09:52 |
| mgheorghe | that the user belongs to should be used, except that it is not used. Is this a bug or the intended behaviour? Also, this only works when the rc file does not export OS_PROJECT_DOMAIN_NAME and OS_PROEJECT_NAME. Otherwise, we get a warning in keystone logs that the requested operation identity:list_users requires a system scope token (from what i can gather, a system scope token = domain scope token). | 09:52 |
| mgheorghe | Also this applies to Horizon as well, where i cannot specify the '--domain' flag anymore. So here, the new role becomes useless. In fact, what i have observed is that horizon always sends 'is_admin_project:True', whether it is an admin project/domain or not. So any user that has the 'admin' role on any project in any domain, instantly becomes a 'cloud_admin' because it falls in the cloud_admin rule with 'role:admin' and 'is_admin_project:True | 09:52 |
| mgheorghe | ' when using Horizon. This could be easily fixed by removing the 'is_admin_project:True' from keystone policy. | 09:52 |
| *** takamatsu_ has joined #openstack-keystone | 09:57 | |
| *** takamatsu has quit IRC | 09:57 | |
| *** takamatsu_ has quit IRC | 10:00 | |
| *** takamatsu_ has joined #openstack-keystone | 10:03 | |
| *** Emine has joined #openstack-keystone | 10:14 | |
| *** mgheorghe has quit IRC | 10:17 | |
| *** Emine has quit IRC | 10:18 | |
| *** Emine has joined #openstack-keystone | 10:21 | |
| *** shyamb has quit IRC | 10:31 | |
| *** markvoelker has joined #openstack-keystone | 10:40 | |
| *** shyamb has joined #openstack-keystone | 10:46 | |
| openstackgerrit | Vishakha Agarwal proposed openstack/keystone master: Add openstack_groups to assertion https://review.openstack.org/588211 | 10:49 |
| *** Emine has quit IRC | 10:58 | |
| *** shyamb has quit IRC | 11:02 | |
| *** mgheorghe has joined #openstack-keystone | 11:10 | |
| *** markvoelker has quit IRC | 11:13 | |
| *** shyamb has joined #openstack-keystone | 11:42 | |
| *** takamatsu_ has quit IRC | 11:48 | |
| *** takamatsu_ has joined #openstack-keystone | 11:52 | |
| *** Emine has joined #openstack-keystone | 12:06 | |
| *** raildo has joined #openstack-keystone | 12:09 | |
| *** markvoelker has joined #openstack-keystone | 12:09 | |
| *** shyamb has quit IRC | 12:23 | |
| *** Dinesh_Bhor has quit IRC | 12:24 | |
| *** takamatsu_ has quit IRC | 12:24 | |
| *** takamatsu has joined #openstack-keystone | 12:24 | |
| *** shyamb has joined #openstack-keystone | 12:25 | |
| *** shyamb has quit IRC | 12:31 | |
| *** markvoelker has quit IRC | 12:42 | |
| *** markvoelker has joined #openstack-keystone | 13:39 | |
| *** mvkr has quit IRC | 13:48 | |
| *** markvoelker has quit IRC | 14:13 | |
| *** mvkr has joined #openstack-keystone | 14:19 | |
| *** mvkr has quit IRC | 14:37 | |
| *** mvkr has joined #openstack-keystone | 14:37 | |
| *** mchlumsky has joined #openstack-keystone | 14:45 | |
| *** markvoelker has joined #openstack-keystone | 15:10 | |
| *** awalende has quit IRC | 15:23 | |
| *** awalende has joined #openstack-keystone | 15:24 | |
| *** awalende has quit IRC | 15:28 | |
| *** vishakha has quit IRC | 15:35 | |
| *** markvoelker has quit IRC | 15:43 | |
| kmalloc | o/ morning all | 15:54 |
| gagehugo | o/ | 15:55 |
| *** awalende has joined #openstack-keystone | 15:56 | |
| kmalloc | gagehugo: hows it goin? | 15:57 |
| gagehugo | kmalloc: it's been alright | 15:58 |
| gagehugo | hows the snow? | 15:58 |
| *** raildo has quit IRC | 15:58 | |
| kmalloc | crazy. it's pretty insanely cold for seattle and we have a ton of ice on the ground now (unheard of). plus more snow on the way. | 15:58 |
| gagehugo | it's been 60 here and rainy every day | 15:59 |
| kmalloc | currently ~24F, ~60% humidity | 15:59 |
| gagehugo | oh wow | 15:59 |
| kmalloc | and clear skys. | 15:59 |
| kmalloc | was down as low as 21F around 3am at my house | 16:00 |
| *** awalende has quit IRC | 16:00 | |
| gagehugo | It got -9F last week for a couple days | 16:00 |
| kmalloc | (Brie bought me one of those awesome home weather stations, so I get to see real numbers at my house) | 16:00 |
| gagehugo | not as bad as around Chicago though | 16:00 |
| kmalloc | yeah chicago was brutal i hear | 16:00 |
| gagehugo | nice | 16:00 |
| kmalloc | our poor hummingbirds (yes we have winter humming birds) are not happy little critters atm. | 16:01 |
| kmalloc | we had to get another external/window mounted feeder so it wont freeze | 16:01 |
| kmalloc | landlord left a feeder out year-round so a couple don't migrate. | 16:01 |
| gagehugo | it doesn't normally get that cold there does it? | 16:02 |
| kmalloc | nah, like a week a year below freezing (in aggregate) and 1-2 days of snow, with it washing away by the next day | 16:02 |
| kmalloc | usually no colder than upper 30s | 16:02 |
| gagehugo | ah, gotcha | 16:04 |
| gagehugo | lol tomorrow high 55 low 12 | 16:05 |
| kmalloc | we were going to plant some new fruit trees, but it is delayed until the ice melts. | 16:05 |
| *** raildo has joined #openstack-keystone | 16:05 | |
| kmalloc | ground is too hard for them to take root. | 16:05 |
| gagehugo | yeah, digging frozen ground isn't great | 16:06 |
| kmalloc | hopefully we will have warmer weather next week., this week is supposed to snow more. | 16:07 |
| gagehugo | I wouldn't mind more snow here, but I think it's all going to be rain | 16:08 |
| *** raildo has quit IRC | 16:11 | |
| lbragstad | hola | 16:14 |
| gagehugo | lbragstad: o/ | 16:15 |
| *** raildo has joined #openstack-keystone | 16:18 | |
| *** xek has quit IRC | 16:26 | |
| *** xek has joined #openstack-keystone | 16:26 | |
| *** gyee has joined #openstack-keystone | 16:32 | |
| *** markvoelker has joined #openstack-keystone | 16:40 | |
| *** raildo has quit IRC | 16:46 | |
| *** raildo has joined #openstack-keystone | 16:53 | |
| knikolla | o/ | 17:07 |
| *** markvoelker has quit IRC | 17:13 | |
| *** mgheorghe has quit IRC | 17:16 | |
| *** pcaruana has quit IRC | 17:19 | |
| *** mvkr has quit IRC | 17:22 | |
| -openstackstatus- NOTICE: Any changes failed around 16:30 UTC today with a review comment from Zuul like "ERROR Unable to find playbook" can be safely rechecked; this was an unanticipated side effect of our work to move base job definitions between configuration repositories. | 17:27 | |
| *** mvkr has joined #openstack-keystone | 17:51 | |
| *** jmlowe has joined #openstack-keystone | 17:53 | |
| *** yan0s has quit IRC | 17:58 | |
| *** erus has quit IRC | 18:00 | |
| *** erus has joined #openstack-keystone | 18:01 | |
| *** xek_ has joined #openstack-keystone | 18:02 | |
| *** xek has quit IRC | 18:04 | |
| *** markvoelker has joined #openstack-keystone | 18:10 | |
| *** erus has quit IRC | 18:23 | |
| *** jmlowe has quit IRC | 18:35 | |
| *** erus has joined #openstack-keystone | 18:37 | |
| *** markvoelker has quit IRC | 18:43 | |
| *** jmlowe has joined #openstack-keystone | 18:50 | |
| *** markvoelker has joined #openstack-keystone | 19:40 | |
| *** Emine has quit IRC | 20:10 | |
| *** markvoelker has quit IRC | 20:12 | |
| *** jmlowe has quit IRC | 20:13 | |
| *** Ebukha has joined #openstack-keystone | 20:50 | |
| *** xek__ has joined #openstack-keystone | 20:50 | |
| *** xek_ has quit IRC | 20:52 | |
| *** raildo has quit IRC | 20:56 | |
| *** jmlowe has joined #openstack-keystone | 21:06 | |
| *** markvoelker has joined #openstack-keystone | 21:09 | |
| *** erus has quit IRC | 21:15 | |
| *** xek__ has quit IRC | 21:17 | |
| *** erus has joined #openstack-keystone | 21:18 | |
| *** markvoelker has quit IRC | 21:42 | |
| *** Ebukha has quit IRC | 21:49 | |
| *** erus has quit IRC | 21:53 | |
| *** erus has joined #openstack-keystone | 21:59 | |
| openstackgerrit | Merged openstack/keystone master: Implement system reader role for users https://review.openstack.org/605485 | 22:29 |
| openstackgerrit | Merged openstack/keystone master: Implement system member role user test coverage https://review.openstack.org/623317 | 22:29 |
| *** erus has quit IRC | 22:37 | |
| *** erus has joined #openstack-keystone | 22:39 | |
| *** markvoelker has joined #openstack-keystone | 22:40 | |
| *** erus has quit IRC | 22:46 | |
| *** erus1 has joined #openstack-keystone | 22:48 | |
| *** mchlumsky has quit IRC | 22:50 | |
| openstackgerrit | Merged openstack/keystone master: Implement system admin role in users API https://review.openstack.org/623318 | 22:50 |
| *** erus has joined #openstack-keystone | 22:51 | |
| *** tkajinam has joined #openstack-keystone | 22:53 | |
| *** erus has quit IRC | 22:58 | |
| *** erus has joined #openstack-keystone | 23:06 | |
| *** erus has quit IRC | 23:13 | |
| *** markvoelker has quit IRC | 23:13 | |
| *** erus has joined #openstack-keystone | 23:21 | |
| *** awalende has joined #openstack-keystone | 23:25 | |
| *** erus has quit IRC | 23:27 | |
| *** awalende has quit IRC | 23:29 | |
| *** erus has joined #openstack-keystone | 23:36 | |
| *** erus has quit IRC | 23:43 | |
| *** itlinux has quit IRC | 23:48 | |
| *** imacdonn has quit IRC | 23:49 | |
| *** imacdonn has joined #openstack-keystone | 23:49 | |
| *** erus has joined #openstack-keystone | 23:51 | |
| *** erus has quit IRC | 23:55 | |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!