openstack team mailing list archive

[Adam Young <ayoung@xxxxxxxxxx>]

On 02/09/2012 03:27 AM, Ryan Lane wrote:
> On Thu, Feb 9, 2012 at 3:29 AM, Adam Young<ayoung@xxxxxxxxxx>  wrote:
> > I've made some strides in the KSL  LDAP  implementation.  I've set up a
> > github  clone with the code pushed:
> >
> >
> > https://github.com/admiyo/keystone/tree/ldap
> >
> > The code is ugly,  as I'm in "Just get it working" mode.  Cleanup will
> > happend prior to any attempt to merge with the Redux branch.  I've attempted
> > to keep the same set of unit tests running as are used for the SQL backend.
> >   The one delta is  Metadata, as I am not sure how (or even if) we want to
> > reflect that in LDAP.  I've made those three unit tests no-ops for LDAP.
> >
> > There are still more API calls to implement, (Tenant_Modify for example) and
> > then I'll test out against a live Open LDAP  instance.
> >
> > The one change I've made from the old config is that fields like URL  no
> > longer have ldap_  in front of them,  so the config will look something like
> >
> > [ldap]
> > url = ldap://localhost
> > user = cn=Admin
> > password = password
> > backend_entities = ['Tenant', 'User', 'UserRoleAssociation', 'Role']
> > suffix ='cn=example,cn=com'
> >
> >
> >
> > Feedback requested.
> Looking through the code, it appears that using ldaps:// may work for
> LDAPS support, but is LDAP w/ TLS going to be supported as well? Have
> you tested LDAPS support?
>
> - Ryan
Not yet.  Thus far,  I've only tested doing a simple bind to the 
OpenLDAP server.  I'm not sure about the rules of using TLS or other 
Cryptographic approaches with Eventlet:  I suspect that to do something 
like TLS would require a thread pool.  I'm mostly focused on getting 
parity between the Keystone current and Redux code bases.  Something 
more than that would probably be post E4 time frame.