yahoo-eng-team team mailing list archive

[Launchpad Bug Tracker <1915318@xxxxxxxxxxxxxxxxxx>]

You have been subscribed to a public bug:

Windows AD, functional level Windows Server 2012 R2

Focal + Ussuri

keystone-ldap-31

Using ldap-config-flags of:

```
ldap-config-flags: "{
          user_tree_dn: 'DC=example,DC=org',
          query_scope: sub,
          user_objectclass: person,
          user_id_attribute: cn,
          user_filter: '{|(memberOf=CN=OpenStackAdmins,OU=OpenStack,OU=Groups,DC=example,DC=org)(memberOf=CN=OpenStackUsers,OU=OpenStack,OU=Groups,DC=example,DC=org)}',
          user_name_attribute: sAMAccountName,
          user_mail_attribute: mail,
          user_pass_attribute: '',
          user_description_attribute: displayName,
          user_enabled_attribute: userAccountControl,
          user_enabled_mask: 2,
          user_enabled_invert: false,
          user_enabled_default: 512,
          group_tree_dn: 'OU=OpenStack,OU=Groups,DC=example,DC=org',
          group_objectclass: group,
          group_id_attribute: cn,
          group_name_attribute: sAMAccountName,
          group_member_attribute: member,
          }"
```

The user list cannot be retrieved, but the group list can.  Horizon
shows an error of "Unable to retrieve user list"

Running `openstack user list --domain example.org` shows "Internal
Server Error (HTTP 500)"

In this scenario.  There are 2 sets of users that customer wants to have
access to this openstack environment.

There are no logs in /var/log/keystone/keystone.log when this error
occurs

The DN's for those 2 different User trees are:

OU=AdminUsers,DC=example,DC=com   and OU=Users,DC=example,DC=com

As can be seen, both OU's are off of the root domain, and don't share a
common tree, other than the root.

When the user_dn_tree is changed to `OU=AdminUsers,DC=example,DC=com`
then users in that User tree can log in, and show up in the user list,
but the users from OU=Users,DC=example,DC=com do not.  and Vice-Versa

** Affects: keystone
     Importance: Undecided
         Status: New


** Tags: cpe-onsite
-- 
User list cannot be retrieved when pointing user_tree_dn at top level of the root domain
https://bugs.launchpad.net/bugs/1915318
You received this bug notification because you are a member of Yahoo! Engineering Team, which is subscribed to OpenStack Identity (keystone).