<font size=2 face="sans-serif">I need to go read Henry's document.
I can't comment on that yet. In principle, I am OK with having a
separate json config file for doing the LDAP configuration. I agree
that we will be adding enough content here that its probably best to move
it out of keystone.conf. We do however need to look at the config
options apache provides for this as we will benefit from its experience.
For the chain of domains work I'm pretty sure I can get you some
stakeholders and use cases. We definitely have folks interested
in getting multiple keystones to work together. Starting
the planning/design of this work has the best chance of being successful/providing
value if we get the stakeholders and concrete use cases first and then
go from there.</font>
<br>
<br><font size=2 face="sans-serif">Thanks,</font>
<br>
<br><font size=2 face="sans-serif">Brad</font>
<br><font size=2 face="sans-serif"><br>
Brad Topol, Ph.D.<br>
IBM Distinguished Engineer<br>
OpenStack<br>
(919) 543-0646<br>
Internet: btopol@us.ibm.com<br>
Assistant: Cindy Willman (919) 268-5296</font>
<br>
<br>
<br>
<br><font size=1 color=#5f5f5f face="sans-serif">From:
</font><font size=1 face="sans-serif">Adam Young <ayoung@redhat.com></font>
<br><font size=1 color=#5f5f5f face="sans-serif">To:
</font><font size=1 face="sans-serif">openstack-dev@lists.openstack.org</font>
<br><font size=1 color=#5f5f5f face="sans-serif">Date:
</font><font size=1 face="sans-serif">04/26/2013 05:25 PM</font>
<br><font size=1 color=#5f5f5f face="sans-serif">Subject:
</font><font size=1 face="sans-serif">Re: [openstack-dev]
[keystone] Suggested LDAP DIT for domains</font>
<br>
<hr noshade>
<br>
<br>
<br><tt><font size=2>OK, so Henry's document, while sound, it actually
specifies a schema. <br>
It is what a sane person would do, but LDAP drives away sanity. We
know <br>
that for most people, wae can't dictate what the schema would look like.<br>
So, if there is a need for "manging multiple domains from a single
<br>
Backend" we will try to migrate over to useing Henry's design. It
was <br>
what I wanted in the first place.<br>
<br>
If there is a customer out there that wants to use LDAP with a schema <br>
that matches Henry's design, we still have to account for the fact that
<br>
not everything under a single root can be considered a domain. There
<br>
may be no root entity, or there might be things under their root entity
<br>
that is not a domain, but that still implements orgUnit.<br>
<br>
Make that one reason in support of the external JSON config for domains.<br>
<br>
Lets look at the requirement that a single Keystone front multiple
LDAP <br>
servers. These are not going to be dynamically definied. It is going
to <br>
be a small, fixed number of LDAP servers, with one being added or
<br>
removed on average of every couple of years. We need a place to <br>
configure these.<br>
<br>
That is two reasons in support of an external JSON config file<br>
<br>
Now, lets take the case where two organizations have one cloud, but they
<br>
want to maintain their user data completely separately. Different LDAP
<br>
server, different Token database, and maybe even an overlapping but <br>
different set of endpoints. These two Keystone servers need a way
to <br>
talk to each other. Each gets registered as an "external"
domain in the <br>
JSON file.<br>
<br>
Hence: </font></tt><a href="https://etherpad.openstack.org/chain-of-domains"><tt><font size=2>https://etherpad.openstack.org/chain-of-domains</font></tt></a><tt><font size=2><br>
<br>
<br>
Its clean. It is straightforward, and it allows the backends to <br>
interoperate. If we decide to cut some aspect of scope, it still
<br>
supports the other use cases.<br>
<br>
We probably want to discuss it in context with<br>
<br>
</font></tt><a href="https://blueprints.launchpad.net/keystone/+spec/json-for-ldap"><tt><font size=2>https://blueprints.launchpad.net/keystone/+spec/json-for-ldap</font></tt></a><tt><font size=2><br>
<br>
</font></tt><a href="https://blueprints.launchpad.net/keystone/+spec/multiple-datastores"><tt><font size=2>https://blueprints.launchpad.net/keystone/+spec/multiple-datastores</font></tt></a><tt><font size=2><br>
<br>
_______________________________________________<br>
OpenStack-dev mailing list<br>
OpenStack-dev@lists.openstack.org<br>
</font></tt><a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev"><tt><font size=2>http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</font></tt></a><tt><font size=2><br>
<br>
</font></tt>
<br>