openstack team mailing list archive

[Adam Young <ayoung@xxxxxxxxxx>]

Role is grouped in the collection under the Tenant, with the userid in 
the members attribute for that role.



On 09/24/2012 03:18 AM, ?? wrote:
> Openstack services need user account with 'admin' role. But I could 
> not figure out how FreeIPA propagate 'role' into Keystone.
>
> That's why I'm asking the question in mailing list.
>
>
> On Sep 24, 2012, at 11:30 AM, spring wrote:
>
> > Thanks qiujian!
> > By using this configuration, can we log in through dashboard? If I 
> > want to implement that, is there any other configuration I have to do?
> >
> > 2012/9/24 ?? <qiujian@xxxxxxxxxxx <mailto:qiujian@xxxxxxxxxxx>>
> >
> >     BTW, here is my configuration:
> >
> >     [ldap]
> >     url = ldap://10.64.11.199
> >     tree_dn = cn=accounts,dc=mydomain,dc=com
> >     user_tree_dn = cn=users,cn=accounts,dc=mydomain,dc=com
> >     user_objectclass = person
> >     user_name_attribute = uid
> >     user_id_attribute = uid
> >     tenant_tree_dn = cn=groups,cn=accounts,dc=mydomain,dc=com
> >     tenant_objectclass = posixgroup
> >     tenant_id_attribute = cn
> >     tenant_name_attribute = cn
> >     tenant_member_attribute = member
> >     role_tree_dn = cn=groups,cn=accounts,dc=mydomain,dc=com
> >     role_objectclass = posixgroup
> >     role_id_attribute = cn
> >     role_name_attribute = cn
> >     role_member_attribute = member
> >     user = uid=sudo,cn=sysaccounts,cn=etc,dc=mydomain,dc=com
> >     password = mysudopassword
> >     suffix = cn=mydomain,cn=com
> >
> >
> >     [identity]
> >     driver = keystone.identity.backends.ldap.Identity
> >
> >     It seems that keystone LDAP requires role nodes the children of
> >     tenant nodes. But FreeIPA has a flat structure.
> >
> >     --
> >     ??
> >     ??????????? - ?????
> >     ??:1381129925
> >     ??:qiujian@xxxxxxxxxxx <mailto:qiujian@xxxxxxxxxxx>
> >
> >     On Sep 22, 2012, at 12:27 PM, ?? wrote:
> >
> > >     Hi,
> > >
> > >     I was working on using LDAP of FreeIP as backend of Keystone.
> > >
> > >     User and tenants information can be fetched from LDAP. However,
> > >     I could not figure out how to assign roles to users in specific
> > >     tenants. I'm wondering whether someone can help?
> > >
> > >     I noticed that Mr. Adam Young had post a blog about this topic:
> > >
> > >     http://adam.younglogic.com/2012/09/ldaps-against-a-freeipa-server/
> > >
> > >     However, it did not show how to import roles in LDAP. I'm
> > >     wondering whether there is any progress about this?
> > >
> > >     Many thanks.
> > >
> > >     keystone in use was the latest master branch on github on Sep
> > >     21, 2012.
> > >
> > >
> > >     Jian Qiu
> > >     _______________________________________________
> > >     Mailing list: https://launchpad.net/~openstack
> > >     <https://launchpad.net/%7Eopenstack>
> > >     Post to     : openstack@xxxxxxxxxxxxxxxxxxx
> > >     <mailto:openstack@xxxxxxxxxxxxxxxxxxx>
> > >     Unsubscribe : https://launchpad.net/~openstack
> > >     <https://launchpad.net/%7Eopenstack>
> > >     More help   : https://help.launchpad.net/ListHelp
> >
> >
> >     _______________________________________________
> >     Mailing list: https://launchpad.net/~openstack
> >     <https://launchpad.net/%7Eopenstack>
> >     Post to     : openstack@xxxxxxxxxxxxxxxxxxx
> >     <mailto:openstack@xxxxxxxxxxxxxxxxxxx>
> >     Unsubscribe : https://launchpad.net/~openstack
> >     <https://launchpad.net/%7Eopenstack>
> >     More help   : https://help.launchpad.net/ListHelp
> >
> >
> >
> >
> > --
> > Huang Shuquan (???)
> > Software Institute of Nanjing University Nanjing, P.R.China
> > Mobile: 86 137 7086 4433
>
>
>
> _______________________________________________
> Mailing list: https://launchpad.net/~openstack
> Post to     : openstack@xxxxxxxxxxxxxxxxxxx
> Unsubscribe : https://launchpad.net/~openstack
> More help   : https://help.launchpad.net/ListHelp