This is what came out of my logs. I've bolded what looks
relevant to me:
LDAP init: url=ldap://typhon.acm.jhu.edu
2013-03-04 16:06:01 DEBUG [keystone.common.ldap.core] LDAP
bind: dn=cn=admin,ou=OpenStack,dc=acm,dc=jhu,dc=edu
2013-03-04 16:06:01 DEBUG [keystone.common.ldap.core] LDAP
search: dn=ou=Users,ou=OpenStack,dc=acm,dc=jhu,dc=edu, *scope=1*,
query=(objectClass=inetOrgPerson)
Unless I'm reading that very wrong, my scope search request is
being ignored. Time to dive into the code, I suppose.
Steve
On 03/04/2013 10:15 AM, Dolph Mathews wrote:
I'd suggest enabling debug=True in keystone.conf and comparing
the LDAP queries being issued (shown in logs) against what
you're expecting.
I believe that [ldap] query_scope=sub does in fact expand
queries to apply to subtrees, beyond just a single level (as the
default value is query_scope=one).
-Dolph
On Sun, Mar 3, 2013 at 12:05 PM, Steven Presser
<spresse1@xxxxxxx <mailto:spresse1@xxxxxxx>> wrote:
Hey all,
I have some questions about using the LDAP backend for
keystone. I'm in what seems to be an odd situation. I have
an organization-wide DLAP directory that already exists.
All of our users will have access to OpenStack, so we want
to tie directly into this directory. However, we can't have
service accounts mixed in with the regular users, at least
not in any way that might result in you being able to log in
to a service account. For neatness, the directory admin
would prefer that all the OpenStack stuff be off in its own
OU (and has allocated us one so we can do that).
In that OU, I've set up the recommended schema from
http://docs.openstack.org/trunk/openstack-compute/admin/content/configuring-keystone-for-ldap-backend.html
(changing it to my domain, obviously). I then aliased all
our users in to ou=Users. The relevant part of my
keystone.conf currently looks like:
[ldap]
url = ldap://[host]
user = cn=admin,ou=OpenStack,dc=acm,dc=jhu,dc=edu
password = [password]
suffix = dc=acm,dc=jhu,dc=edu
use_dumb_member = False
allow_subtree_delete = False
query_scope = sub
As near as I can tell, this should correspond to this query:
$ ldapsearch -x -D
cn=admin,ou=OpenStack,dc=acm,dc=jhu,dc=edu -w [password] -b
dc=acm,dc=jhu,dc=edu '(objectclass=inetOrgPerson)' -s sub
Which returns my aliased users correctly. (that is, it
returns "dn: uid=[uid],ou=People,dc=acm,dc=jhu,dc=edu" for
each user).
I really can't figure out whats going on here. Logically,
this should work, but (obviously) doesn't. Anyone have some
advice for me? My suspicion is that query_scope=sub isn't
doing what I expect. (Returning search results from within
a subtree)
Oh, finally, I have DEREF always enabled in ldap.conf.
Thanks,
Steve
_______________________________________________
Mailing list: https://launchpad.net/~openstack
<https://launchpad.net/%7Eopenstack>
Post to : openstack@xxxxxxxxxxxxxxxxxxx
<mailto:openstack@xxxxxxxxxxxxxxxxxxx>
Unsubscribe : https://launchpad.net/~openstack
<https://launchpad.net/%7Eopenstack>
More help : https://help.launchpad.net/ListHelp
_______________________________________________
Mailing list:https://launchpad.net/~openstack <https://launchpad.net/%7Eopenstack>
Post to :openstack@xxxxxxxxxxxxxxxxxxx <mailto:openstack@xxxxxxxxxxxxxxxxxxx>
Unsubscribe :https://launchpad.net/~openstack <https://launchpad.net/%7Eopenstack>
More help :https://help.launchpad.net/ListHelp
