Re: [Openstack] keystone user-role-list error

2012-09-29 Thread heckj
Hey Asher, That's a bug in keystoneclient - the method for doing the role listing is making a bad assumption that you're authenticating with a username and password, not handing in a token, and is getting wrapped around the axle trying to figure out what tenant you are. If you create an admin

Re: [Openstack] Enabling logging in keystone.

2012-10-01 Thread heckj
. From: heckj he...@mac.com Date: Monday, October 1, 2012 5:23 PM To: Ahmed Al-Mehdi ah...@coraid.com Cc: openstack@lists.launchpad.net openstack@lists.launchpad.net Subject: Re: [Openstack] Enabling logging in keystone. Ahmed - The header that's supposed to have the token within

Re: [Openstack] Enabling logging in keystone.

2012-10-02 Thread heckj
, Ahmed. From: openstack-bounces+ahmed=coraid@lists.launchpad.net [openstack-bounces+ahmed=coraid@lists.launchpad.net] On Behalf Of Ahmed Al-Mehdi [ah...@coraid.com] Sent: Tuesday, October 02, 2012 10:30 AM To: heckj Cc: openstack

Re: [Openstack] Enabling logging in keystone.

2012-10-02 Thread heckj
into keystone accurately and most probably not equivalent to manual steps mentioned in Deploy and Install OpenStack - Red Hat Ubuntu. I will look into the script. Regards, Ahmed. From: Dolph Mathews [dolph.math...@gmail.com] Sent: Tuesday, October 02, 2012 2:19 PM To: Ahmed Al-Mehdi Cc: heckj

Re: [Openstack] [SWIFT] Proxies Sizing for 90.000 / 200.000 RPM

2012-10-24 Thread heckj
John brought the concern over auth_token middleware up to me directly - I don't know of anyone that's driven the keystone middleware to these rates and determined where the bottlenecks are other than folks deploying swift and driving high performance numbers. The concern that John detailed

Re: [Openstack] Retrieve Endpoints

2012-10-25 Thread heckj
Hi Pradeep, I'm not sure what the context is for these values, so it's a little hard to assert a clear answer. For most openstack projects, (all but keystone), there's generally a single API endpoints, and the keystone service catalog is configured on deployment to point to those. The service

Re: [Openstack] keystone folsom-backport timetable?

2012-10-25 Thread heckj
Hey Ken, Anyone can propose a backport at any time - I pestered Mark and he was kind enough to refer me to: * http://wiki.openstack.org/StableBranch#Proposing_Fixes and notes from the summit session around just this * https://etherpad.openstack.org/process-stable-branch I took a few minutes

[Openstack] [keystone] Re: Domain Name Spaces

2012-10-26 Thread heckj
Bringing conversation for domains in Keystone to the broader mailing lists. On Oct 26, 2012, at 5:18 AM, Dolph Mathews dolph.math...@gmail.com wrote: I think this discussion would be great for both mailing lists. -Dolph On Fri, Oct 26, 2012 at 5:18 AM, Henry Nash henry.n...@mac.com

Re: [Openstack] Finding version of keystone service

2012-10-26 Thread heckj
Ahmed, Are you trying to find out the version of Keystone installed, or of the CLI client? (they're different and somewhat unrelated) -joe On Oct 26, 2012, at 2:20 PM, Ahmed Al-Mehdi ah...@coraid.com wrote: Hello, The option --version (or any variation of it) does not seem to work for

Re: [Openstack] Finding version of keystone service

2012-10-26 Thread heckj
auth-user-name] [--password auth-password] [--tenant_name tenant-name] [--auth_url auth-url] [--region_name region-name] subcommand ... keystone: error: too few arguments root@bodega:~# --Ahmed. From: heckj he...@mac.com Date: Friday

Re: [Openstack] Nova middleware for enabling CORS?

2012-10-30 Thread heckj
Keystone doesn't (yet) support CORS - there's an open blueprint for it, but no work has been applied there as yet -joe On Oct 30, 2012, at 10:57 AM, Renier Morales reni...@us.ibm.com wrote: On Oct 30, 2012, at 1:08 PM, David Kranz wrote: On 10/30/2012 12:43 PM, Renier Morales wrote:

Re: [Openstack] sample_data.sh script to configure keystone

2012-10-30 Thread heckj
Ahmed, We'd welcome an update to the script - some have talked about variations they have that use YAML, etc. As long as it's simple, and can be used from devstack to do a holistic test and verification, we'll happily take patches to the script in Keystone. Please suggest them using the

Re: [Openstack] [openstack-dev] Fwd: [keystone] Tokens representing authorization to projects/tenants in the Keystone V3 API

2012-11-13 Thread heckj
makes much difference. THe more I think about it, the real benefit comes from limiting the endpoints. On Oct 20, 2012, at 21:07, Adam Young ayo...@redhat.com mailto:ayo...@redhat.com wrote: On 10/20/2012 01:50 PM, heckj wrote: I sent this to the openstack-dev list, and thought

Re: [Openstack] [openstack-dev] Fwd: [keystone] Tokens representing authorization to projects/tenants in the Keystone V3 API

2012-11-13 Thread heckj
On Nov 13, 2012, at 11:01 AM, Jorge Williams jorge.willi...@rackspace.com wrote: On Nov 13, 2012, at 11:35 AM, heckj wrote: So maintaining a token scoped to just the user, and a mechanism to scope it to a tenant sound like all goodness. We can absolutely keep the API such that it can

Re: [Openstack] [openstack-dev] Fwd: [keystone] Tokens representing authorization to projects/tenants in the Keystone V3 API

2012-11-13 Thread heckj
+joe.savak=rackspace@lists.launchpad.net [mailto:openstack-bounces+joe.savak=rackspace@lists.launchpad.net] On Behalf Of heckj Sent: Tuesday, November 13, 2012 1:34 PM To: OpenStack Development Mailing List Cc: openstack@lists.launchpad.net (openstack@lists.launchpad.net) Subject: Re

Re: [Openstack] [openstack-dev] Fwd: [keystone] Tokens representing authorization to projects/tenants in the Keystone V3 API

2012-11-14 Thread heckj
to be extensible and flexible to allow for the all sorts of use cases that are likely to occur. Thanks, joe -Original Message- From: heckj [mailto:he...@mac.com] Sent: Tuesday, November 13, 2012 3:59 PM To: Joe Savak Cc: OpenStack Development Mailing List; openstack

Re: [Openstack] [Keystone] LDAP Backend for Catalog

2012-12-03 Thread heckj
I haven't heard any demand for it - - joe On Dec 3, 2012, at 11:13 AM, Adam Young ayo...@redhat.com wrote: Right now, only the Identity submodule has an LDAP backend. This is user, tenants, and roles. Is there any requirement for the Catalog to have an LDAP back end? Endpoints and

Re: [Openstack] Do we have any schema for keystone v3.0 request/responses

2012-12-05 Thread heckj
Hey Ali, We don't have an XSD for the V3 API sets - we've been holding off finalizing that up as we are making small implementation changes as we're getting it into practice and learning what ideas worked, and which didn't. Jorge (Rackspace) has something and offered to do more, but hasn't

Re: [Openstack] [DevStack] Does a Swift/Keystone only install require AMQP?

2013-02-19 Thread heckj
It doesn't - the AMQP is needed for the Nova/Glance/Cinder/Ceilometer integration and that internal RPC mechanism that they use. -joe On Feb 19, 2013, at 4:53 PM, Everett Toews everett.to...@rackspace.com wrote: Hi All, When I was doing a Swift/Keystone only install with DevStack I used the

Re: [Openstack] what is the difference between 2013.1 and grizzly?

2013-03-26 Thread heckj
2013.1 is the release, grizzly-1 is a release candidate -joe On Mar 26, 2013, at 8:12 PM, Liu Wenmao marvel...@gmail.com wrote: I notice that openstack components have two different develop code names, for example, openstack grizzly has 2013.1 and grizzly, so what is the difference between

Re: [Openstack] Keystone Identity based notifications

2013-04-17 Thread heckj
There was a fellow Panok, I think, that asked me about it in the dev lounge, sounded like he was perhaps interested in driving that forward. I also sat in on Mark McLoughlin's talk about normalizing our the RPC API code that's used across several of the projects, and caught a bit from others

Re: [Openstack] API version in Grizzly

2013-05-09 Thread heckj
That's not entirely the case - the API structure has changed rather significantly (mostly made more consistent and unified), so API calls to V2 may or may not match entirely with API calls to V3. We did go to the trouble of writing a very thorough spec, and then checking and updating it as we