Re: [openstack-dev] [keystone] Diagnostic APIs for Keystone

2015-11-25 Thread Adam Young
On 11/24/2015 10:50 AM, Henry Nash wrote: Some good ideas here, Adam. I would think that some of the real “diagnostic APIs” might only be available via keystone-manage, rather than an exposed API. I'd like to get away from the assumption that you have physical access to the machines to do o

Re: [openstack-dev] [keystone] Diagnostic APIs for Keystone

2015-11-24 Thread Henry Nash
Some good ideas here, Adam. I would think that some of the real “diagnostic APIs” might only be available via keystone-manage, rather than an exposed API. Henry > On 24 Nov 2015, at 03:07, Adam Young wrote: > > Figuring out what is or is not going to work when a user tries to perform an > ope

Re: [openstack-dev] [keystone] Diagnostic APIs for Keystone

2015-11-24 Thread Jay Pipes
On 11/23/2015 10:07 PM, Adam Young wrote: What kind of diagnostic tooling do we need? I know the basics: If I have a known good user in LDAP, can they . This is the first thing, and it can be done by asking for an unscoped token. Certainly if you have a known good user in LDAP, they can . B

[openstack-dev] [keystone] Diagnostic APIs for Keystone

2015-11-23 Thread Adam Young
Figuring out what is or is not going to work when a user tries to perform an operation in OpenStack can be frustrating. I've had a few people ask me for help specifically for configuring LDAP. With Federation , things will get better. I mean Worse. What kind of diagnostic tooling do we need