[Yahoo-eng-team] [Bug 1465444] Re: Fernet key rotation removing keys early

2015-07-30 Thread Dolph Mathews
** Also affects: keystone/kilo Importance: Undecided Status: New ** Changed in: keystone/kilo Status: New => In Progress ** Changed in: keystone/kilo Importance: Undecided => High ** Changed in: keystone/kilo Assignee: (unassigned) => Dolph Mathews (dolph)

[Yahoo-eng-team] [Bug 1479943] Re: XmlBodyMiddleware stubs break existing configs

2015-07-30 Thread Dolph Mathews
stable/kilo https://review.openstack.org/#/c/205351/ ** Changed in: keystone Importance: Undecided => Medium ** Changed in: keystone Status: New => Triaged ** Also affects: keystone/kilo Importance: Undecided Status: New ** Changed in: keystone/kilo Status: New => Tri

[Yahoo-eng-team] [Bug 1479981] Re: Openstackclient return wrong quota information

2015-07-30 Thread Dolph Mathews
*** This bug is a duplicate of bug 1420104 *** https://bugs.launchpad.net/bugs/1420104 ** No longer affects: keystone ** This bug has been marked a duplicate of bug 1420104 quota set failed -- You received this bug notification because you are a member of Yahoo! Engineering Team, which i

[Yahoo-eng-team] [Bug 1420104] Re: quota set failed

2015-07-30 Thread Dolph Mathews
** Changed in: keystone Status: Incomplete => Invalid -- You received this bug notification because you are a member of Yahoo! Engineering Team, which is subscribed to OpenStack Compute (nova). https://bugs.launchpad.net/bugs/1420104 Title: quota set failed Status in Keystone: Invali

[Yahoo-eng-team] [Bug 1480270] Re: Can't get endpoints with v2 in command line

2015-07-31 Thread Dolph Mathews
Although this is absolutely working as originally designed, it's effectively broken. This bug report may also be a dupe? Anyway, I think we (unfortunately) need to make a best guess to collapse multiple interface-specific, completely independent v3 endpoints into v2 endpoints (where at least a pub

[Yahoo-eng-team] [Bug 1480787] Re: Pagination not working in Kilo

2015-08-03 Thread Dolph Mathews
*** This bug is a duplicate of bug 1451402 *** https://bugs.launchpad.net/bugs/1451402 Pagination has not been implemented. To do so, it must be entirely controlled by the server (not the API client) due to the requirement to support multiple backends (SQL vs LDAP, for example). The page & per

[Yahoo-eng-team] [Bug 1451402] Re: v3 - pagination in GET services does not work

2015-08-03 Thread Dolph Mathews
As mentioned in comment #2, the page and per_page parameters should be removed from http://developer.openstack.org/api-ref-identity-v3.html as they are not, and have never been, supported by keystone. ** Also affects: openstack-api-site Importance: Undecided Status: New -- You received

[Yahoo-eng-team] [Bug 1481152] Re: Pagination not working in Kilo

2015-08-04 Thread Dolph Mathews
*** This bug is a duplicate of bug 1451402 *** https://bugs.launchpad.net/bugs/1451402 ** This bug has been marked a duplicate of bug 1451402 v3 - pagination in GET services does not work -- You received this bug notification because you are a member of Yahoo! Engineering Team, which is s

[Yahoo-eng-team] [Bug 1459790] Re: With fernet tokens, validate token loses the ms on 'expires' value

2015-08-07 Thread Dolph Mathews
** Tags added: kilo-backport-potential ** Also affects: keystone/kilo Importance: Undecided Status: New -- You received this bug notification because you are a member of Yahoo! Engineering Team, which is subscribed to Keystone. https://bugs.launchpad.net/bugs/1459790 Title: With fer

[Yahoo-eng-team] [Bug 1482773] [NEW] H405 violations: multi line docstring summary not separated with an empty line

2015-08-07 Thread Dolph Mathews
Public bug reported: Keystone's tox.ini contains an "ignore" entry for H405. All violations of H405 should be fixed so that H405 can be removed from the ignore list. ** Affects: keystone Importance: Low Assignee: Dolph Mathews (dolph) Status: In Progress ** Ta

[Yahoo-eng-team] [Bug 1475762] Re: v3 Fernet tokens with references outside the default domain can be validated on v2

2015-08-12 Thread Dolph Mathews
** Also affects: keystone/kilo Importance: Undecided Status: New ** Changed in: keystone/kilo Importance: Undecided => Medium -- You received this bug notification because you are a member of Yahoo! Engineering Team, which is subscribed to Keystone. https://bugs.launchpad.net/bugs/1

[Yahoo-eng-team] [Bug 1435693] Re: A number of places where we LOG messages fail to use the _L{X} formatting

2015-08-13 Thread Dolph Mathews
Closing because all the cited violations have been fixed. Henry: when you have a bug fix that consists of multiple patches, use Partial-Bug on all but the last patch in the sequence. On the last patch, use Closes-Bug so that the bug will be automatically closed when that patch merges. ** Changed

[Yahoo-eng-team] [Bug 1471967] Re: Fernet unit tests do not test persistence logic

2015-08-13 Thread Dolph Mathews
** Also affects: keystone/kilo Importance: Undecided Status: New ** Changed in: keystone/kilo Importance: Undecided => Low -- You received this bug notification because you are a member of Yahoo! Engineering Team, which is subscribed to Keystone. https://bugs.launchpad.net/bugs/1471

[Yahoo-eng-team] [Bug 1452418] Re: Fernet tokens read from disk on every request

2015-08-13 Thread Dolph Mathews
** Also affects: keystone/kilo Importance: Undecided Status: New ** Changed in: keystone/kilo Importance: Undecided => Low -- You received this bug notification because you are a member of Yahoo! Engineering Team, which is subscribed to Keystone. https://bugs.launchpad.net/bugs/1452

[Yahoo-eng-team] [Bug 1484086] Re: ec2tokens authentication is failing during Heat tests

2015-08-14 Thread Dolph Mathews
It wasn't a backwards incompatible change so much as resolving an apparent regression. v2 clients are not domain aware as there are no domain references in v2, so the potential for namespace collisions (bug 1475762) would be severe. ** Changed in: keystone Status: New => Incomplete ** Also

[Yahoo-eng-team] [Bug 1484366] Re: No way to specify password strength in keystone.

2015-08-14 Thread Dolph Mathews
The complexities of re-inventing a first class identity provider in keystone are not in our best interests. Use a real identity provider (via either LDAP or federation) that supports these features if you need them, not the SQL backend. ** Changed in: keystone Status: Triaged => Won't Fix

[Yahoo-eng-team] [Bug 1484451] Re: Project cannot be enabled after it was disabled

2015-08-14 Thread Dolph Mathews
Cool, that's expected behavior then. ** Changed in: keystone Status: Incomplete => Invalid -- You received this bug notification because you are a member of Yahoo! Engineering Team, which is subscribed to Keystone. https://bugs.launchpad.net/bugs/1484451 Title: Project cannot be enable

[Yahoo-eng-team] [Bug 1435693] Re: A number of places where we LOG messages fail to use the _L{X} formatting

2015-08-17 Thread Dolph Mathews
I thought this was backportable since it's only adding translation strings to stable/kilo (not modifying things that may have already been translated). ** Changed in: keystone/kilo Status: In Progress => Invalid -- You received this bug notification because you are a member of Yahoo! Engi

[Yahoo-eng-team] [Bug 1485712] Re: Can't set parent_id of project for hierarchical multi-tenancy

2015-08-17 Thread Dolph Mathews
This is truly by design. But by disallowing it today, we've given ourselves the option to allow it in the future (we can't do the opposite: take an API feature away). The consequences of a mutable hierarchy are complicated and affect the rest of OpenStack (think quotas, for example), and the risk o

[Yahoo-eng-team] [Bug 1461299] Re: Failure on list users when using ldap domain configuration from database

2015-08-18 Thread Dolph Mathews
** Tags removed: kilo-backport-potential ** Also affects: keystone/kilo Importance: Undecided Status: New ** Changed in: keystone Importance: Undecided => Medium ** Changed in: keystone/kilo Importance: Undecided => Medium -- You received this bug notification because you are a

[Yahoo-eng-team] [Bug 1487728] Re: ldap and ldappool modules are no listed in requirements file

2015-08-22 Thread Dolph Mathews
LDAP dependencies are optional and are defined here: https://github.com/openstack/keystone/blob/master/setup.cfg#L25-L27 This takes advantage of setuptools extras: https://pythonhosted.org/setuptools/setuptools.html#declaring-extras- optional-features-with-their-own-dependencies Use the fol

[Yahoo-eng-team] [Bug 1487671] Re: ldap and ldappool packages are not mentioned in requirements.txt

2015-08-22 Thread Dolph Mathews
See my comment on a related bug: https://bugs.launchpad.net/keystone/+bug/1487728/comments/2 ** Changed in: keystone Status: Incomplete => Invalid -- You received this bug notification because you are a member of Yahoo! Engineering Team, which is subscribed to Keystone. https://bugs.launc

[Yahoo-eng-team] [Bug 1483382] Re: Able to request a V2 token for user and project in a non-default domain

2015-08-24 Thread Dolph Mathews
Fixed by https://review.openstack.org/#/c/208069/ ** Changed in: keystone Importance: Undecided => High ** Changed in: keystone Status: New => Fix Committed ** Changed in: keystone Assignee: (unassigned) => Dolph Mathews (dolph) ** Also affects: keystone/kilo I

[Yahoo-eng-team] [Bug 1488208] [NEW] Revoking a role assignment revokes unscoped tokens too

2015-08-24 Thread Dolph Mathews
). The test failure in https://review.openstack.org/#/c/216236/ illustrates this issue: http://logs.openstack.org/36/216236/1/check/gate-keystone- python27/3f44af1/ ** Affects: keystone Importance: Medium Assignee: Dolph Mathews (dolph) Status: In Progress -- You received

[Yahoo-eng-team] [Bug 1488347] Re: Can't specify identity endpoint for token validation among several keystone servers in keystonemiddleware

2015-08-25 Thread Dolph Mathews
A related conversation is occurring on the mailing list [1]. It sounds like this is a regression with the introduction of auth plugins to keystonemiddleware (Jamie, correct me if I'm wrong), so you might want to try using an older version of keystonemiddleware as a workaround. [1]: http://lists.op

[Yahoo-eng-team] [Bug 1292591] Re: Database models differs from migrations.

2015-08-26 Thread Dolph Mathews
I'm assuming this was fixed by the last patch. In the future, please use Closes-Bug on the final patch in your patch sequence -- not just Partial-Bug on all of them (which leaves the bug open). ** Changed in: keystone Status: In Progress => Fix Committed ** Changed in: keystone Milesto

[Yahoo-eng-team] [Bug 1434034] Re: Disabling users & groups may not invalidate previously-issued tokens

2015-09-01 Thread Dolph Mathews
Based on today's keystone meeting and the above comments, I've reduced the priority of this to Medium across the board and marked this as Won't Fix in Keystone. Although this is working as intended, we acknowledge that that intended behavior is poorly documented, and it seems an OSSN is the best r

[Yahoo-eng-team] [Bug 1479962] Re: Use extras for deployment-specific package requirements

2015-09-03 Thread Dolph Mathews
devstack: - https://review.openstack.org/#/c/208584/ - https://review.openstack.org/#/c/208153/ ** Tags added: ldap ** Changed in: keystone Importance: Undecided => Low ** Also affects: devstack Importance: Undecided Status: New ** Changed in: devstack Status: New => In Pro

[Yahoo-eng-team] [Bug 1491817] Re: Revoking large token fails with "Request-URI Too Long (HTTP 414)"

2015-09-03 Thread Dolph Mathews
According to Morgan, we're 40 days from dropping support for eventlet completely, so adding a new configuration option wouldn't provide much benefit. In addition, the length of PKI tokens is a widely known issue that has gone largely unaddressed (besides the introduction of PKIZ as a compressed al

[Yahoo-eng-team] [Bug 1490497] Re: pep8-incompliant filenames missing in gate console logs

2015-09-08 Thread Dolph Mathews
Leaving this as Incomplete unless someone can reproduce. ** Also affects: hacking Importance: Undecided Status: New ** Changed in: hacking Status: New => Incomplete ** Changed in: keystone Status: New => Incomplete -- You received this bug notification because you are a

[Yahoo-eng-team] [Bug 1492951] Re: Juno keystone installation fail to import oslo_i18n

2015-09-08 Thread Dolph Mathews
Moved this to oslo.i18n, but it sounds like openstack/requirements for stable/juno just need to be fixed to reflect the reality (that oslo.utils 1.4.0 requires oslo.i18n>=1.3.0). ** Project changed: keystone => oslo.i18n -- You received this bug notification because you are a member of Yahoo! En

[Yahoo-eng-team] [Bug 1491926] Re: Remove padding from Fernet tokens

2015-09-08 Thread Dolph Mathews
** Also affects: keystone/kilo Importance: Undecided Status: New ** Tags removed: kilo-backport-potential ** Changed in: keystone/kilo Importance: Undecided => Medium -- You received this bug notification because you are a member of Yahoo! Engineering Team, which is subscribed to K

[Yahoo-eng-team] [Bug 1485553] Re: Does not report appropriate error if user ID is invaild

2015-09-09 Thread Dolph Mathews
It sounds like the user experience issue here was fixed for both stable/kilo and master, then. I'm sure further refactoring could be done, but that doesn't need to be tracked in a bug. ** Changed in: keystone Status: Triaged => Invalid -- You received this bug notification because you are

[Yahoo-eng-team] [Bug 1488208] Re: Revoking a role assignment revokes unscoped tokens too

2015-09-11 Thread Dolph Mathews
** Also affects: keystone/kilo Importance: Undecided Status: New ** Changed in: keystone/kilo Importance: Undecided => Medium ** Tags removed: kilo-backport-potential -- You received this bug notification because you are a member of Yahoo! Engineering Team, which is subscribed to K

[Yahoo-eng-team] [Bug 1484237] Re: token revocations not always respected when using fernet tokens

2015-09-11 Thread Dolph Mathews
** Also affects: keystone/kilo Importance: Undecided Status: New ** Tags removed: kilo-backport-potential -- You received this bug notification because you are a member of Yahoo! Engineering Team, which is subscribed to Keystone. https://bugs.launchpad.net/bugs/1484237 Title: token

[Yahoo-eng-team] [Bug 1471289] Re: Fernet tokens and Federated Identities result in token scope failures

2015-09-15 Thread Dolph Mathews
** Also affects: keystone/kilo Importance: Undecided Status: New ** Changed in: keystone/kilo Importance: Undecided => High -- You received this bug notification because you are a member of Yahoo! Engineering Team, which is subscribed to Keystone. https://bugs.launchpad.net/bugs/147

[Yahoo-eng-team] [Bug 1496220] Re: error in setup command: Invalid environment marker: (python_version=='2.7' # MPL)

2015-09-16 Thread Dolph Mathews
This is neither a bug in keystone nor there a fix In Progress in keystone. ** Project changed: keystone => pbr ** Changed in: pbr Status: In Progress => New -- You received this bug notification because you are a member of Yahoo! Engineering Team, which is subscribed to Keystone. https:/

[Yahoo-eng-team] [Bug 1496222] Re: Requirements update breaks keystone install on 3'rd party CI systems

2015-09-21 Thread Dolph Mathews
** Also affects: pbr Importance: Undecided Status: New -- You received this bug notification because you are a member of Yahoo! Engineering Team, which is subscribed to Keystone. https://bugs.launchpad.net/bugs/1496222 Title: Requirements update breaks keystone install on 3'rd party

[Yahoo-eng-team] [Bug 1553149] Re: Instance in ERROR state due to ConnectFailure with keystone

2016-03-08 Thread Dolph Mathews
Apache will refuse connections that it cannot assign to threads once MaxClients is exhausted, and if you're only running 10 threads, then I'm also guessing that your MaxClients is set to be less than the number of concurrent connections you're throwing at it. I'm closing this because this is just

[Yahoo-eng-team] [Bug 1516946] Re: keystone WSGI fail: ArgsAlreadyParsedError: arguments already parsed: cannot register CLI option

2016-03-08 Thread Dolph Mathews
I've run into this myself. This is the result of using outdated WSGI startup scripts. As part of your upgrade process, you must switch to the ones from the release you're trying to deploy. This is because keystone has refactored some responsibilities out of those WSGI scripts, so your scripts are

[Yahoo-eng-team] [Bug 1547031] Re: Can't distinguish users through openid login

2016-03-09 Thread Dolph Mathews
Your mapping is unconditionally resulting in this behavior. See the mapping documentation: http://docs.openstack.org/developer/keystone/mapping_combinations.html ** Changed in: keystone Status: New => Invalid -- You received this bug notification because you are a member of Yahoo! Engi

[Yahoo-eng-team] [Bug 1541656] Re: OAuth Identity token gives Forbidden

2016-03-09 Thread Dolph Mathews
This seems like a missing use case in openstackclient? If you give it an existing token, why is it trying to rescope it? What is it trying to rescope the token to? ** Also affects: python-openstackclient Importance: Undecided Status: New ** Changed in: keystone Status: New => Inc

[Yahoo-eng-team] [Bug 1536300] Re: Catalog response is inconsistent for domain scoped token

2016-03-09 Thread Dolph Mathews
The example catalog for a domain scoped token looks correct to me: those are endpoints that do not presume tenancy in the URL. ** Changed in: keystone Status: New => Invalid -- You received this bug notification because you are a member of Yahoo! Engineering Team, which is subscribed to O

[Yahoo-eng-team] [Bug 1576315] [NEW] Critically fail on startup if fernet_setup has not been run

2016-04-28 Thread Dolph Mathews
Public bug reported: As a result of the Fernet work session at the Newton design summit in Austin: Prior to making Fernet the default token provider, keystone should fail on startup if fernet_setup has not been run when fernet is also the configured token provider. Today, keystone will instead re

[Yahoo-eng-team] [Bug 1403136] Re: Create tenants, users, and roles in OpenStack Installation Guide for Ubuntu 14.04  - juno

2014-12-18 Thread Dolph Mathews
I think I understand why the manual specifies that the deployer should "create the _member_" role using "keystone role-create --name _member_" (to support the explicit assignment in the following step), but I'd recommend removing that instruction as a starting point to addressing this issue. I'm no

[Yahoo-eng-team] [Bug 1407090] Re: Unable to start keystone service on Docker container

2015-01-13 Thread Dolph Mathews
*** This bug is a duplicate of bug 1406536 *** https://bugs.launchpad.net/bugs/1406536 ** This bug has been marked a duplicate of bug 1406536 unrecognized service on Keystone install -- You received this bug notification because you are a member of Yahoo! Engineering Team, which is subscr

[Yahoo-eng-team] [Bug 1399768] Re: migration of endpoint_filter fails due to foreign key constraint

2015-02-13 Thread Dolph Mathews
** Also affects: keystone/juno Importance: Undecided Status: New ** Changed in: keystone/juno Importance: Undecided => High ** Changed in: keystone/juno Assignee: (unassigned) => Steve Martinelli (stevemar) ** Changed in: keystone/juno Status: New => In Progress -- You

[Yahoo-eng-team] [Bug 1420788] Re: Logging blocks on race condition under eventlet

2015-02-19 Thread Dolph Mathews
master patch https://review.openstack.org/#/c/154915/ ** Also affects: keystone/juno Importance: Undecided Status: New ** Changed in: keystone/juno Assignee: (unassigned) => Alexander Makarov (amakarov) ** Changed in: keystone/juno Status: New => In Progress -- You receiv

[Yahoo-eng-team] [Bug 1411478] Re: Any attribute that is equal to 'TRUE' or 'FALSE' is treated as boolean by LDAP drivers

2015-03-02 Thread Dolph Mathews
Before we backport this to stable/juno, are there any legitimate use cases where people would be depending on the old behavior? Just want to ensure there's no risk to backporting. ** Also affects: keystone/juno Importance: Undecided Status: New ** Changed in: keystone/juno Status

[Yahoo-eng-team] [Bug 1384112] Re: endpoint, service, region can not be updated when using kvs driver

2015-03-02 Thread Dolph Mathews
** Also affects: keystone/juno Importance: Undecided Status: New ** Changed in: keystone/juno Assignee: (unassigned) => wanghong (w-wanghong) ** Changed in: keystone/juno Status: New => In Progress ** Changed in: keystone/juno Importance: Undecided => Low -- You receiv

[Yahoo-eng-team] [Bug 1427485] [NEW] Fernet tokens contain a version identifier that is not integrity verified

2015-03-02 Thread Dolph Mathews
"F00" / "F01") can be dropped, as long as Keystone can still validate the tokens it's issuing. ** Affects: keystone Importance: Medium Assignee: Dolph Mathews (dolph) Status: New ** Tags: fernet ** Tags added: fernet ** Summary changed: - Fernet token

[Yahoo-eng-team] [Bug 1428321] [NEW] Crosslink keystone documentation sites

2015-03-04 Thread Dolph Mathews
Public bug reported: Keystone has three formal documentation sites (that I'm aware of): http://docs.openstack.org/developer/keystone/ http://docs.openstack.org/developer/keystonemiddleware/ http://docs.openstack.org/developer/python-keystoneclient/ But none of these are cross-linked with e

[Yahoo-eng-team] [Bug 1428708] [NEW] Fernet token expiration is redundant with key rotation

2015-03-05 Thread Dolph Mathews
ty considerations, rather than the cost of performance. ** Affects: keystone Importance: Wishlist Assignee: Dolph Mathews (dolph) Status: New ** Tags: fernet -- You received this bug notification because you are a member of Yahoo! Engineering Team, which is

[Yahoo-eng-team] [Bug 1428717] [NEW] Fernet tokens have redundant creation timestamps

2015-03-05 Thread Dolph Mathews
requires some bitwise operations, but this library demonstrates how easy the timestamp is to extract without having the Fernet encryption key: https://pypi.python.org/pypi/keyless_fernet ** Affects: keystone Importance: Medium Assignee: Dolph Mathews (dolph) Status: New ** Tags

[Yahoo-eng-team] [Bug 1428949] [NEW] Fernet tokens do not support domain scopes

2015-03-05 Thread Dolph Mathews
support doesn't really exist yet, and the current behavior will only work if the hierarchical multitenancy effort successfully migrates domains to be projects. ** Affects: keystone Importance: High Assignee: Dolph Mathews (dolph) Status: Triaged ** Tags: fernet -- You rec

[Yahoo-eng-team] [Bug 1428708] Re: Fernet token expiration is redundant with key rotation

2015-03-11 Thread Dolph Mathews
** Changed in: keystone Status: In Progress => Invalid -- You received this bug notification because you are a member of Yahoo! Engineering Team, which is subscribed to Keystone. https://bugs.launchpad.net/bugs/1428708 Title: Fernet token expiration is redundant with key rotation Statu

[Yahoo-eng-team] [Bug 1433372] Re: Fernet tokens with base64 padding are not URL-safe

2015-03-17 Thread Dolph Mathews
As it turns out, the output of base64.urlsafe_b64encode() is not actually URL-safe if the result includes padding. The padding character is '=' which must be percent-encoded. The result is that "valid" tokens are being made URL-friendly by some defensive code in keystonemiddleware, and are thus ma

[Yahoo-eng-team] [Bug 1402757] Re: Log message for token_flush is wrong

2015-03-18 Thread Dolph Mathews
A fix landed for this without citing this bug: https://github.com/openstack/keystone/commit/a077a875dd50974b66895f7d1ac39097d208e33a ** Changed in: keystone Status: Triaged => Invalid -- You received this bug notification because you are a member of Yahoo! Engineering Team, which is subsc

[Yahoo-eng-team] [Bug 1433595] Re: Keystone writes "Access denied" for DB-Connection to its configured logfile

2015-03-18 Thread Dolph Mathews
** Project changed: keystone => keystone (Ubuntu) -- You received this bug notification because you are a member of Yahoo! Engineering Team, which is subscribed to Keystone. https://bugs.launchpad.net/bugs/1433595 Title: Keystone writes "Access denied" for DB-Connection to its configured log

[Yahoo-eng-team] [Bug 1431015] Re: v3/users or groups calls not working without domain_id

2015-03-18 Thread Dolph Mathews
The assertion being made by OP is that the domain which owns the scoped project should become the domain upon which the action is performed, but I would consider that behavior to be a privilege escalation vulnerability. The user is presenting explicit domain-level authorization on a domain-level re

[Yahoo-eng-team] [Bug 1426184] Re: CONF.member_role_name isn't used for lookups

2015-03-18 Thread Dolph Mathews
The _member_ role is a handicap for the v2 API to provide an explicit means of expressing default tenancy. The existing behavior satisfies that behavior just fine. There's really no reason you should be creating the "_member_" role manually as a deployer. Use another role name instead, such as "Me

[Yahoo-eng-team] [Bug 1441083] Re: pkg_resources.DistributionNotFound: The 'argparse' distribution was not found and is required by oslo.config, python-keystoneclient, pysaml2

2015-04-07 Thread Dolph Mathews
Removed this from keystone since argparse does not appear as an explicit dep of keystone in any requirements file. ** Changed in: keystone Status: New => Invalid ** Changed in: python-openstackclient Assignee: (unassigned) => Dolph Mathews (dolph) ** Also affects:

[Yahoo-eng-team] [Bug 1441083] Re: pkg_resources.DistributionNotFound: The 'argparse' distribution was not found and is required by oslo.config, python-keystoneclient, pysaml2

2015-04-07 Thread Dolph Mathews
The same applies to openstackclient. ** Also affects: oslo.config Importance: Undecided Status: New ** Changed in: oslo.config Assignee: (unassigned) => Dolph Mathews (dolph) -- You received this bug notification because you are a member of Yahoo! Engineering Team, which

[Yahoo-eng-team] [Bug 1441083] Re: pkg_resources.DistributionNotFound: The 'argparse' distribution was not found and is required by oslo.config, python-keystoneclient, pysaml2

2015-04-07 Thread Dolph Mathews
** Also affects: pysaml2 Importance: Undecided Status: New -- You received this bug notification because you are a member of Yahoo! Engineering Team, which is subscribed to Keystone. https://bugs.launchpad.net/bugs/1441083 Title: pkg_resources.DistributionNotFound: The 'argparse' dis

[Yahoo-eng-team] [Bug 1441083] Re: pkg_resources.DistributionNotFound: The 'argparse' distribution was not found and is required by oslo.config, python-keystoneclient, pysaml2

2015-04-08 Thread Dolph Mathews
Abandoning this as invalid since pip 6.1.1 handles argparse correctly now. ** Changed in: oslo.config Status: In Progress => Invalid ** Changed in: python-keystoneclient Status: In Progress => Invalid ** Changed in: pysaml2 Status: New => Invalid -- You received this bug n

[Yahoo-eng-team] [Bug 1443598] Re: backend_argument containing a password leaked in logs

2015-04-13 Thread Dolph Mathews
https://review.openstack.org/#/c/173034/ ** Changed in: keystone Importance: Undecided => High ** Tags added: juno-backport-potential ** Tags added: icehouse-backport-potential kilo-backport-potential ** Also affects: keystone/icehouse Importance: Undecided Status: New ** Also aff

[Yahoo-eng-team] [Bug 1442663] Re: Kilo domain config rest feature does not uniformly reload domain configurations

2015-04-13 Thread Dolph Mathews
Closing based on feedback in comment #2 ** Tags removed: keystone specific ** Changed in: keystone Status: New => Invalid -- You received this bug notification because you are a member of Yahoo! Engineering Team, which is subscribed to Keystone. https://bugs.launchpad.net/bugs/1442663 T

[Yahoo-eng-team] [Bug 1444469] Re: keystone should clean up expired tokens

2015-04-15 Thread Dolph Mathews
Docs: http://docs.openstack.org/admin-guide-cloud/content/flushing-expired- tokens-from-token-database-table.html In addition, Fernet tokens, introduced in Kilo, do not need to be persisted to the database, and will leave your token table completely empty: http://docs.openstack.org/developer

[Yahoo-eng-team] [Bug 1444310] Re: keystone token response contains InternalURL for non admin user

2015-04-15 Thread Dolph Mathews
The internal URL is not intended to be obscured from users, but rather is intended to provide a public API interface on a faster / more efficient network interface (depending on the deployment). If users can reach the internal endpoint (such as for glance), then they can likely save bandwidth charg

[Yahoo-eng-team] [Bug 1445096] Re: Bad link in API version details response

2015-04-16 Thread Dolph Mathews
In master of keystone, the version response looks like this: { "version": {, "status": "stable", "updated": "2014-04-17T00:00:00Z", "media-types": [ { "base": "application/json", "type": "application/vnd.openstack.identity-v2.

[Yahoo-eng-team] [Bug 1445104] [NEW] Identity API docs contain advertise support for XML

2015-04-16 Thread Dolph Mathews
Public bug reported: The following API documentation pages contain sample XML responses, even though Keystone deprecated XML support several releases ago, and removed support altogether in Kilo: http://developer.openstack.org/api-ref-identity-v2.html http://developer.openstack.org/api-ref-ide

[Yahoo-eng-team] [Bug 1445104] Re: Identity API docs contain advertise support for XML

2015-04-16 Thread Dolph Mathews
** Project changed: keystone => openstack-api-site ** Summary changed: - Identity API docs contain advertise support for XML + Identity API docs advertise support for XML -- You received this bug notification because you are a member of Yahoo! Engineering Team, which is subscribed to Keystone.

[Yahoo-eng-team] [Bug 1439928] Re: can create the same type and name of a service with v3 API

2015-04-20 Thread Dolph Mathews
I don't see any reason for this to be a "Medium" bug - there's absolutely no negative impact described here. In fact, the documented behavior is as-designed. To quote myself from the code review above: The most obvious conflicting use case I can think of is having two services of the same type i

[Yahoo-eng-team] [Bug 1443765] Re: Delete endpoint_group should remove project_endpoint_group at first

2015-04-24 Thread Dolph Mathews
Does this affect juno? ** Tags added: kilo-backport-potential ** Also affects: keystone/kilo Importance: Undecided Status: New ** Changed in: keystone/kilo Importance: Undecided => Medium -- You received this bug notification because you are a member of Yahoo! Engineering Team, wh

[Yahoo-eng-team] [Bug 1448286] [NEW] unicode query string raises UnicodeEncodeError

2015-04-24 Thread Dolph Mathews
Public bug reported: The logging in keystone.common.wsgi is unable to handle unicode query strings. The simplest example would be: $ curl http://localhost:35357/?Ϡ This will fail with a backtrace similar to: 2015-04-24 19:57:45.860 22255 TRACE keystone.common.wsgi File ".../keystone/keys

[Yahoo-eng-team] [Bug 1448376] Re: Keystone Middleware Installation

2015-04-25 Thread Dolph Mathews
Marked as incomplete for keystonemiddleware because this looks like an issue between devstack and pip. ** Project changed: keystone => keystonemiddleware ** Also affects: devstack Importance: Undecided Status: New ** Summary changed: - Keystone Middleware Installation + Can't find pa

[Yahoo-eng-team] [Bug 1299039] Re: Token Scoping

2015-05-05 Thread Dolph Mathews
Implemented as part of: https://blueprints.launchpad.net/keystone/+spec/rescoping ** Changed in: keystone Milestone: None => 2015.1.0 ** Changed in: keystone Status: Triaged => Fix Released ** Changed in: keystone Assignee: Priti Desai (priti-desai) => Adam Young (ayoung) --

[Yahoo-eng-team] [Bug 1452418] [NEW] Fernet tokens read from disk on every request

2015-05-06 Thread Dolph Mathews
Public bug reported: The fernet keys are stored (by default) in /etc/keystone/fernet-keys/ in individual key files. All keys are read from disk on every request, so you end up with log spam like: keystone.token.providers.fernet.utils [-] Loaded 2 encryption keys from: /etc/keystone/fernet-keys/

[Yahoo-eng-team] [Bug 1453769] Re: Domain name update breaks IDP configuration

2015-05-11 Thread Dolph Mathews
I completely agree, the current design directly results in the fragility you described (I pushed for naming domain-specific configuration files using their immutable, system-defined domain IDs instead, but lost that argument... I think on the basis of deployer experience? I'll let Henry Nash commen

[Yahoo-eng-team] [Bug 1452298] Re: Fails to filter domains by id

2015-05-11 Thread Dolph Mathews
Ready for the punt return? :) Because ?id=default is not a query parameter documented or supported in any collection API, the client is not actually making a valid API request. And because 'id' is also a documented API convention, I'd suggest that to provide the expected user experience, the clien

[Yahoo-eng-team] [Bug 1452345] Re: keystone-all should not attempt to run if keystone is in httpd

2015-05-12 Thread Dolph Mathews
That's crazy. Don't try to start the eventlet server if you're already running it in Apache on the same port. More generally, don't try to run any two things on the same port, as the error message already indicates. ** Changed in: keystone Status: Incomplete => Won't Fix -- You received t

[Yahoo-eng-team] [Bug 1454041] Re: misunderstanding caused by uuid token and pki token in install guide

2015-05-13 Thread Dolph Mathews
Keystone switched to UUID by default in Juno due to longstanding issues with PKI that will likely never be resolved. At least in the stable/juno or stable/kilo install guides, there is no token setup to do beyond scheduling a cron job to run keystone-manage token_flush. Setting the keystone token

[Yahoo-eng-team] [Bug 1455034] Re: Deleting nonexistent end-point gives incorrect error message

2015-05-14 Thread Dolph Mathews
** Project changed: keystone => python-openstackclient ** Summary changed: - Deleting nonexistent end-point gives incorrect error message + Deleting nonexistent endpoint gives incorrect error message ** Tags removed: error-messge ** Tags added: error-message user-experience -- You received thi

[Yahoo-eng-team] [Bug 1456797] [NEW] Old revocation events must be purged

2015-05-19 Thread Dolph Mathews
Public bug reported: Similar to token_flush, we need an operation to purge old revocation events from the database, else they'll eventually consume excessive disk space. The operation should be very similar in implementation and usage to token_flush. Filing this as Medium priority because it does

[Yahoo-eng-team] [Bug 1456441] Re: keystone wsgi does not read files in /etc/keystone/*

2015-05-22 Thread Dolph Mathews
This is a critical Red Hat packaging issue that has been verified by multiple users. I've verified the solution in comment #10 works. ** Changed in: glance Status: Incomplete => Invalid ** Changed in: keystone Status: Incomplete => Invalid ** Changed in: nova Status: Incomp

[Yahoo-eng-team] [Bug 1458968] Re: stable/juno unit tests blocked: ContextualVersionConflict: (oslo.i18n 1.3.1 (/home/jenkins/workspace/periodic-glance-python27-juno/.tox/py27/lib/python2.7/site-packa

2015-05-27 Thread Dolph Mathews
https://review.openstack.org/#/c/173123/ has merged. ** Changed in: glance Status: New => Invalid ** Changed in: keystonemiddleware Status: New => Invalid -- You received this bug notification because you are a member of Yahoo! Engineering Team, which is subscribed to Glance. http

[Yahoo-eng-team] [Bug 1453953] Re: keystoneclient cannot log non-ascii data

2015-05-27 Thread Dolph Mathews
>From Ken Chen in https://bugs.launchpad.net/python- keystoneclient/+bug/1457279 -- In keystoneclient/session.py file, _http_log_request method, we have below codes: if data: string_parts.append("-d '%s'" % data) logger.debug(' '.join(string_parts)) However, if d

[Yahoo-eng-team] [Bug 1455344] Re: the deprecated compute_port option need to be removed

2015-05-27 Thread Dolph Mathews
Why was this marked invalid? ** Changed in: keystone Importance: Undecided => Low ** Changed in: keystone Status: Invalid => Fix Committed -- You received this bug notification because you are a member of Yahoo! Engineering Team, which is subscribed to Keystone. https://bugs.launchpad

[Yahoo-eng-team] [Bug 1459828] Re: keystone-all crashes when ca_certs is not defined in conf

2015-06-01 Thread Dolph Mathews
If this can be reproduced against 2014.1 icehouse, I would consider it to be a critical issue for our core use case (default SSL configuration w/ apache httpd). ** Changed in: keystone Importance: Undecided => Critical ** Also affects: keystone/icehouse Importance: Undecided Status:

[Yahoo-eng-team] [Bug 1455397] Re: vms which donot winth a project will become garbage data, mybe waste resources

2015-06-02 Thread Dolph Mathews
*** This bug is a duplicate of bug 967832 *** https://bugs.launchpad.net/bugs/967832 ** This bug has been marked a duplicate of bug 967832 Resources owned by a project/tenant are not cleaned up after that project is deleted from keystone -- You received this bug notification because you

[Yahoo-eng-team] [Bug 1461251] Re: Stop using deprecated oslo_utils.timeutils.isotime

2015-06-03 Thread Dolph Mathews
Added oslo to this bug for unacceptably impacting at least keystone and heat, by not providing a viable alternative capable of maintaining backward compatibility with existing public APIs. Keystone's solution is to stop using oslo.timeutils in this instance, and instead move the deprecated timeuti

[Yahoo-eng-team] [Bug 1461847] Re: Stacking controller fails due to error: 'wsgiref' is not in global-requirements.txt 2014.2.3

2015-06-04 Thread Dolph Mathews
** Project changed: nova-project => nova -- You received this bug notification because you are a member of Yahoo! Engineering Team, which is subscribed to OpenStack Compute (nova). https://bugs.launchpad.net/bugs/1461847 Title: Stacking controller fails due to error: 'wsgiref' is not in global

[Yahoo-eng-team] [Bug 1461095] Re: Token is not revoked when removing a user from project in Horizon

2015-06-05 Thread Dolph Mathews
token_cache_time is part of keystonemiddleware.auth_token's configuration. It defaults to 5 minutes if you haven't set it in your deployment: https://github.com/openstack/keystonemiddleware/blob/57d389da8aaef3f955d7f0b086803d98b6531a2e/keystonemiddleware/auth_token/__init__.py#L278-L283 It sounds

[Yahoo-eng-team] [Bug 928060] Re: link error messages in the API to formal documentation when that's set up and stable

2015-06-08 Thread Dolph Mathews
Closing because there's a similar OpenStack-wide discussion to accomplish the same thing. ** Changed in: keystone Status: Confirmed => Invalid -- You received this bug notification because you are a member of Yahoo! Engineering Team, which is subscribed to Keystone. https://bugs.launchpad

[Yahoo-eng-team] [Bug 1464652] Re: loss of privileges of current admin user

2015-06-12 Thread Dolph Mathews
This is by design on the keystone side. As a consequence of a reducing a user's current authorization, relevant tokens are revoked and the user must subsequently re-authenticate. If horizon stored an unscoped token along with the active scoped token, it could re-authenticate for another scoped tok

[Yahoo-eng-team] [Bug 1357652] Re: Keystone fails to start: "CRITICAL log logging_excepthook No module named utils"

2014-09-21 Thread Dolph Mathews
** Changed in: python-keystoneclient Status: Fix Committed => Fix Released -- You received this bug notification because you are a member of Yahoo! Engineering Team, which is subscribed to Keystone. https://bugs.launchpad.net/bugs/1357652 Title: Keystone fails to start: "CRITICAL log lo

[Yahoo-eng-team] [Bug 1328067] Re: Token with "placeholder" ID issued

2014-09-21 Thread Dolph Mathews
** Changed in: python-keystoneclient Status: Fix Committed => Fix Released -- You received this bug notification because you are a member of Yahoo! Engineering Team, which is subscribed to Keystone. https://bugs.launchpad.net/bugs/1328067 Title: Token with "placeholder" ID issued Statu

[Yahoo-eng-team] [Bug 1004114] Re: Password logging

2014-09-21 Thread Dolph Mathews
** Changed in: python-keystoneclient Status: Fix Committed => Fix Released -- You received this bug notification because you are a member of Yahoo! Engineering Team, which is subscribed to Keystone. https://bugs.launchpad.net/bugs/1004114 Title: Password logging Status in OpenStack Das

[Yahoo-eng-team] [Bug 1362245] Re: Update Endpoint Filter APIs

2014-09-22 Thread Dolph Mathews
** Changed in: keystone Status: In Progress => Won't Fix ** Changed in: openstack-api-site Status: In Progress => Invalid -- You received this bug notification because you are a member of Yahoo! Engineering Team, which is subscribed to Keystone. https://bugs.launchpad.net/bugs/1362

[Yahoo-eng-team] [Bug 1328067] Re: Token with "placeholder" ID issued

2014-09-25 Thread Dolph Mathews
** Changed in: keystonemiddleware Status: Fix Committed => Fix Released -- You received this bug notification because you are a member of Yahoo! Engineering Team, which is subscribed to Keystone. https://bugs.launchpad.net/bugs/1328067 Title: Token with "placeholder" ID issued Status i

<    1   2   3   4   5   6   7   >