Re: [Openstack] debug glance with pydev in eclipse

2016-01-18 Thread Adam Young
On 01/18/2016 08:08 AM, 郝启臣 wrote: hello,guys,I want to debug the glance code with pydev in eclipse,but i don't know how to do,can anybody help me? ps:I debug horizon successfully in eclipse,the entrance of the dubug is manage.py,so where is the entry of the glance code. ___

Re: [Openstack] [Keystone] Dynamic RBAC policy please?

2016-02-22 Thread Adam Young
on X role allows user to perform all actions on compute instance with ID 1234). We are aware of the work proposed by Adam Young from RedHat (_https://review.openstack.org/#/c/279379/_) and think he is absolutely on the right track. We are even keen to help with the development work related to thi

Re: [Openstack] [keystone] Keystone service creation (HTTP 500)

2016-02-24 Thread Adam Young
On 02/24/2016 04:29 PM, Alexandr Porunov wrote: Also there is a strange thing. This command: su -s /bin/sh -c "keystone-manage db_sync" keystone shows: No handlers could be found for logger "oslo_config.cfg" That is just a warning, and can be silenced by setting verboes = false in the keyston

Re: [Openstack] Keystone With Active Directory

2016-03-01 Thread Adam Young
On 02/29/2016 10:07 AM, alexander.di...@stfc.ac.uk wrote: Hi all, I am in the process of setting up a Liberty deployment, with multi-domain keystone connected to Active Directory. I am just wondering if anybody is using Security Groups in Active Directory to map roles to projects? If so h

Re: [Openstack] Error when installing RDO

2016-03-03 Thread Adam Young
On 03/03/2016 09:57 PM, Wilson Kwok wrote: Hello all, I am teaching RDO with 10 students, when they start to installing RDO, half student can't finish installation, after re-run the RDO can finish. I was tested in VMware Workstation 11.0 with this problem, I was thinking may be VMware Workst

Re: [Openstack] Fine-grained control of designate domain policy

2016-03-09 Thread Adam Young
On 03/08/2016 10:48 PM, Andrew Bogott wrote: Due to the weird public/private hybrid nature of my cloud, I'm frequently needing to abuse policy.conf files in unexpected ways. Today's challenge is the designate policy. Right now we're running a custom solution that maintains all public dns entri

Re: [Openstack] Fine-grained control of designate domain policy

2016-03-09 Thread Adam Young
On 03/09/2016 10:17 AM, Andrew Bogott wrote: Thanks for the quick response, Adam! Responses inline... On 3/9/16 8:16 AM, Adam Young wrote: On 03/08/2016 10:48 PM, Andrew Bogott wrote: Due to the weird public/private hybrid nature of my cloud, I'm frequently needing to abuse policy.conf

Re: [Openstack] password in clear text

2016-03-23 Thread Adam Young
On 03/23/2016 11:46 AM, Tim Bell wrote: We use Kerberos and X.509 in Keystone V3 for the end users. It works very nicely (although the python client-* CLIs often do not support it so you have to use the openstack OSC CLI) I'm personally in favor of moving toward a Federated approach using Ke

Re: [Openstack] OpenStack OSAD and Horizon policy updates

2016-03-23 Thread Adam Young
On 03/23/2016 05:42 PM, Brad Pokorny wrote: There's currently no built in automation for Horizon to pull the policy file, so you'll have to update it yourself on the Horizon instances. This is essentially true of all the policy files. Managing them is left to the discretion of the install/manag

Re: [Openstack] [Keystone] Keystone Middleware Deprecate in-process token cache

2016-04-19 Thread Adam Young
On 04/19/2016 01:55 AM, Kuo Hugo wrote: Hi Keystone Team, We aware this deprecation information in keystone middleware. I got couple of questions. https://github.com/openstack/keystonemiddleware/blob/6e58f8620ae60eb4f26984258d15a9823345c310/releasenotes/notes/deprecate-caching-tokens-in-proce

Re: [Openstack] Federated Identity And Identity Provider Specific WebSSO

2016-05-11 Thread Adam Young
On 05/11/2016 11:08 AM, schmitt wrote: Hi, I'm implementing the feature of "Identity Provider Specific WebSSO" on RHEL7+RHOSP8, according to the document: http://docs.openstack.org/developer/keystone/configure_federation.html. In the part of "Configure Apache to use a federation capable auth

Re: [Openstack] keystone: change from fernet tokens to uuid

2016-05-20 Thread Adam Young
On 05/20/2016 06:14 AM, magicb...@hotmail.com wrote: Hi I've deployed FUEL 8.0 (liberty) on my lab and noticed that FUEL works with fernet tokens. Because I have an old app which only works with UUID, I have changed /etc/keyston/keyston.conf from: [token] provider = keystone.token.p

Re: [Openstack] keystone: change from fernet tokens to uuid

2016-05-20 Thread Adam Young
On 20/05/16 17:16, Adam Young wrote: On 05/20/2016 06:14 AM, magicb...@hotmail.com wrote: Hi I've deployed FUEL 8.0 (liberty) on my lab and noticed that FUEL works with fernet tokens. Because I have an old app which only works with UUID, I have changed /etc/keyston/keyston

Re: [Openstack] Devstack Auth Error in Neutron

2016-06-21 Thread Adam Young
On 06/17/2016 08:03 AM, Mohan Kumar wrote: Karun, Please check q-svc (neutron) service is running or not ! Error complaining that keystone url is not reachable to authenticate , IP 192.168.202.130 should be reachable and keystone service should be active . Maybe you can rerun devstack if

Re: [Openstack] python-keystoneclient (2.3.1-2) make wrong URI call for keystone api V3

2016-06-27 Thread Adam Young
On 06/24/2016 03:16 AM, Soputhi Sea wrote: Hi, I'm using Mitaka release (the very latest public release one from Jun-02), and i'm having issue with List Project in Horizon. In my case i have multiple projects created and when i login to Horizon the drop down list of project (on the top left

Re: [Openstack] how to change the admin password

2016-06-27 Thread Adam Young
On 06/27/2016 10:37 AM, Venkatesh Kotipalli wrote: Hi All, i want to change the admin password for openstack mitaka by using CLI. i installed on centos7 when i am tried to change the password in admin-openrc, after changing the password i am unable to login with the password i changed, as i

Re: [Openstack] [Keystone] Why not OAuth 2.0 provider?

2016-06-28 Thread Adam Young
On 06/28/2016 03:18 AM, 林自均 wrote: Hi Steve, Thanks for your explanation! I have some further questions: You said that OS-OAUTH doesn't make Keystone a proper OAuth provider, so what is missing? Can name some of the missing parts? Another thing, a backlog started by you proposed to unify del

Re: [Openstack] -[keystone] help configure keystone for token ssl x509 authorization

2016-07-27 Thread Adam Young
On 07/04/2016 11:14 AM, schmitt wrote: Hi, I am learning to configure keystone for tokenless ssl x509 authorization, according to the document: http://docs.openstack.org/developer/keystone/configure_tokenless_x509.html. when making self-signed certificate with command openssl, I don't know

Re: [Openstack] [OpenStack] [Keystone] How to use two keystone servers?

2016-10-19 Thread Adam Young
On 09/23/2016 11:03 AM, Alexandr Porunov wrote: Hello, I have next nodes: swift_proxy1 - 192.168.0.11 swift_proxy2 - 192.168.0.12 keystone1 - 192.168.0.21 keystone2 - 192.168.0.22 I wonder to know if it is possible to use two keystone servers if we use "uuid" or "fernet" tokens. Yes, you wa

Re: [Openstack] Cinder policy.json

2017-05-16 Thread Adam Young
On 05/09/2017 06:39 AM, ch...@foxmail.com wrote: Hello: I want every one can access a volume I created in cinder as admin, so I changed /etc/cinder/policy.json as bellow, but it won't work. Why? And how to do it? Thanks! policy.json So, debugging policy is a pain. What operation specifi

<    1   2