| openstackgerrit | Merged openstack/python-searchlightclient: Support token based auth options for osc https://review.openstack.org/274480 | 00:03 |
|---|---|---|
| *** TravT has quit IRC | 00:51 | |
| *** TravT has joined #openstack-searchlight | 00:53 | |
| *** RickA-HP_ has quit IRC | 04:50 | |
| *** openstackgerrit has quit IRC | 09:17 | |
| *** openstackgerrit has joined #openstack-searchlight | 09:18 | |
| *** TravT_ has joined #openstack-searchlight | 11:09 | |
| *** TravT has quit IRC | 11:11 | |
| *** pkarikh has quit IRC | 11:12 | |
| *** pkarikh has joined #openstack-searchlight | 11:20 | |
| *** krotscheck has joined #openstack-searchlight | 13:01 | |
| openstackgerrit | Brian Rosmaita proposed openstack/searchlight: Update home page URL in setup.cfg https://review.openstack.org/276741 | 13:59 |
| *** sigmavirus24_awa is now known as sigmavirus24 | 15:10 | |
| *** RickA-HP_ has joined #openstack-searchlight | 15:11 | |
| *** nikhil_k is now known as nikhil | 15:17 | |
| *** sjmc7 has joined #openstack-searchlight | 15:23 | |
| *** david-lyle has joined #openstack-searchlight | 15:47 | |
| openstackgerrit | Steve McLellan proposed openstack/searchlight: Add plugin options to generated config https://review.openstack.org/265469 | 15:52 |
| openstackgerrit | Merged openstack/searchlight: Update home page URL in setup.cfg https://review.openstack.org/276741 | 16:02 |
| *** david-lyle has quit IRC | 16:23 | |
| sjmc7 | TravT_: i’m looking at https://review.openstack.org/#/c/265396/4/etc/api-paste.ini; the only header i think we use is x-auth-token? | 16:23 |
| TravT_ | smc7: ok, let me see | 16:24 |
| *** TravT_ is now known as TravT | 16:24 | |
| sjmc7 | not urgent, trying to clear the review list | 16:24 |
| TravT | we don't use X-OpenStack-Request-ID | 16:24 |
| TravT | ? | 16:24 |
| TravT | is that not used by OSLO or something? | 16:25 |
| TravT | for tracing origin of calls | 16:25 |
| sjmc7 | i don’t think we pass it in? ah, i guess horizon or something might | 16:25 |
| sjmc7 | ok, let’s leave that | 16:25 |
| sjmc7 | the rest i don’t think so? they look like keystone headers | 16:26 |
| TravT | the other ones don't ring a bell | 16:26 |
| TravT | guess i need to google each one | 16:26 |
| sjmc7 | ok, no worries right now | 16:27 |
| TravT | would be nice to clear it through | 16:27 |
| sjmc7 | i’ll go through them in a bit and make an executive decision | 16:27 |
| TravT | looks like X-Subject-Token is keystone only? | 16:28 |
| TravT | Tokens have IDs, which the Identity API returns in the X-Subject-Token response header. | 16:28 |
| TravT | http://developer.openstack.org/api-ref-identity-v3.html | 16:28 |
| *** david-lyle has joined #openstack-searchlight | 16:29 | |
| sjmc7 | yeah, i think identity-status, user-id, tenant-id, roles are all keystoney ones | 16:29 |
| TravT | nothing keystone middleware uses? | 16:30 |
| sjmc7 | perhaps the root of my problem is i’m misunderstanding what CORS does :) | 16:30 |
| sjmc7 | i thought these controlled the headers between SL and the client? | 16:31 |
| TravT | yeah, they control what is allowed. | 16:31 |
| TravT | i don' t know if it rejects if those headers are there and not allowed | 16:32 |
| TravT | or if it strips them | 16:32 |
| TravT | or what, though | 16:32 |
| sjmc7 | so KS middleware’s not going to be affected? n/m, i’ll fire it up and have a play around | 16:32 |
| TravT | krotscheck: are you around? | 16:35 |
| krotscheck | TravT: Yeah, waht's up? | 16:35 |
| TravT | maybe you can enlighten us a bit on how the cors middleware works | 16:35 |
| TravT | see above^ | 16:35 |
| * krotscheck is reading | 16:37 | |
| krotscheck | Ok, so the CORS middleware either adds headers or not, based on the headers it receives from the client. | 16:37 |
| krotscheck | The headers it adds are ones that indicate which properties the client (browser) is allowed to read. | 16:37 |
| krotscheck | It never interrupts the request. | 16:37 |
| krotscheck | There's a preflight contract that requires - of the browser - that a request is terminated if the OPTIONS request doesn't permit the things it wants to do. | 16:38 |
| krotscheck | So, really, CORS is a two step process. | 16:38 |
| krotscheck | 1- Hey am I allowed to do this. | 16:38 |
| krotscheck | 2- I'm gonna do it. | 16:38 |
| krotscheck | The first is the OPTIONS request, where a browser just tells the API, "Hey I am coming from this domain, with these headers, can I do that". | 16:39 |
| krotscheck | And if true, additional ehaders are added to the response indicating: "Yep, you're allowed to". | 16:39 |
| krotscheck | If the client is _not_ allowed, nothing is added to the response. | 16:39 |
| krotscheck | (Mostly to conceal who is _actually_ allowed to talk to the domain) | 16:39 |
| krotscheck | The second then is the actual GET/PUT/POST request. | 16:40 |
| krotscheck | All the same rules apply there - headers are added or not based on what the client requests. | 16:40 |
| krotscheck | The only notable exception is that the response includes the access-control-expose-headers header. | 16:40 |
| krotscheck | And that tells the browser which headers (in addition to the body) it's allowed to read. | 16:41 |
| krotscheck | That was verbose. | 16:41 |
| krotscheck | Anyway | 16:41 |
| sjmc7 | :) no, that’s helpful, thanks | 16:41 |
| krotscheck | The middleware is just an intermediary passthrough. | 16:41 |
| krotscheck | Only in one case does it change the response, and that is if an OPTIONS request is sent to the underlying API and comes back as unhandled. | 16:41 |
| TravT | so, with the cors middleware, i don't see latent_* config options specifically described | 16:42 |
| TravT | http://docs.openstack.org/developer/oslo.middleware/cors.html#configuration-for-pastedeploy | 16:42 |
| krotscheck | (In that chase it switches it from a 4xx to a 200) | 16:42 |
| TravT | what is the latent_ prefix | 16:42 |
| sjmc7 | so in our case, i think we send and receive very few headers; i think x-auth-token (incoming) and x-openstack-request-id possibly in either direction | 16:42 |
| krotscheck | It's described (a bit vaguely, I admit) in the paragraph before that section. | 16:43 |
| krotscheck | Basically, the "latent" prefix is there so that a piece of software can hardcode certain headres that are required for successful operation, which an operator might not be aware of. | 16:43 |
| krotscheck | It circumvents the "Oh and I need magic configuration properties that aren't documented" | 16:44 |
| krotscheck | problem. | 16:44 |
| sjmc7 | ok, i think that answer my question | 16:44 |
| TravT | yeah, okay. well, i guess sjmc7 is just wanting to limit that patch to headers we know we need... | 16:45 |
| TravT | sjmc7, you could use that handy website you were using the other day | 16:45 |
| sjmc7 | yep, just did | 16:46 |
| TravT | okay, well if you want to post that into a review, krotscheck can probably do an inline edit and we can push this on through | 16:47 |
| TravT | i see you just did. :) | 16:47 |
| krotscheck | Can do can do :) | 16:47 |
| *** bpokorny has joined #openstack-searchlight | 16:51 | |
| sjmc7 | thanks for the explanation, krotscheck , things are much clearer now | 16:54 |
| krotscheck | sjmc7: no prob | 17:01 |
| krotscheck | One dangerous thing about CORS that people don't realize is that a passing OPTIONS request, followed by a malformed GET/POST/ETC, will still cause the latter request to execute. | 17:01 |
| krotscheck | That's why having the middleware be well tested is critical. | 17:01 |
| krotscheck | We've got a pretty elaborate suite for it over in oslo.middleware, so if you run into a problem just ping me and I'll add a test. | 17:02 |
| sjmc7 | will do, thanks | 17:06 |
| *** david-lyle has quit IRC | 17:14 | |
| *** david-lyle has joined #openstack-searchlight | 17:21 | |
| *** david-lyle has quit IRC | 17:25 | |
| openstackgerrit | Steve McLellan proposed openstack/searchlight: Add plugin options to generated config https://review.openstack.org/265469 | 17:27 |
| *** sigmavirus24 is now known as sigmavirus24_awa | 17:39 | |
| *** nikhil_k has joined #openstack-searchlight | 18:11 | |
| openstackgerrit | Steve McLellan proposed openstack/searchlight: Separate documents by role https://review.openstack.org/257516 | 18:13 |
| *** nikhil has quit IRC | 18:14 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 19:14 | |
| *** sjmc7 has quit IRC | 19:19 | |
| *** krotscheck is now known as krotscheck_dcm | 19:39 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 19:52 | |
| *** sjmc7 has joined #openstack-searchlight | 19:54 | |
| *** david-lyle has joined #openstack-searchlight | 20:39 | |
| *** RickA-HP_ has quit IRC | 20:48 | |
| *** david-lyle has quit IRC | 20:55 | |
| *** david-lyle_ has joined #openstack-searchlight | 20:55 | |
| *** david-lyle_ is now known as david-lyle | 21:00 | |
| *** briancli1e is now known as briancline | 23:28 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!