yahoo-eng-team team mailing list archive

[Nisha Yadav <ynisha11@xxxxxxxxx>]

** Changed in: keystone/newton
       Status: New => Fix Released

-- 
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to OpenStack Identity (keystone).
https://bugs.launchpad.net/bugs/1638603

Title:
  Identity LDAP does not support AD nested groups

Status in OpenStack Identity (keystone):
  Fix Released
Status in OpenStack Identity (keystone) newton series:
  Fix Released

Bug description:
  Active Directory has a very specific mechanism to
  handle nested groups.  LDAP queries need to look like this:

  "(&(objectClass=group)(member=member:1.2.840.113556.1.4.1941:=CN=nwalnut,OU=Users,DC=EXAMPLE,DC=COM))"

  If a deployment is using nested groups, three queries need to be
  modified to support it:

  list users in a group
  list groups for a user
  check if a user is in a group

  Since all three are necessary, a single configuration value ensures
  that the change is synchronized across all three calls.

To manage notifications about this bug go to:
https://bugs.launchpad.net/keystone/+bug/1638603/+subscriptions