<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto"><div dir="ltr"><br></div><div class="gmail_extra"><span style="-webkit-text-size-adjust: auto; background-color: rgba(255, 255, 255, 0);"><br></span><div class="gmail_quote"><blockquote class="gmail_quote" style="margin: 0px 0px 0px 0.8ex; border-left-width: 1px; border-left-color: rgb(204, 204, 204); border-left-style: solid; padding-left: 1ex; "><div dir="ltr"><span style="-webkit-text-size-adjust: auto; background-color: rgba(255, 255, 255, 0);">I have installed openstack-keystone-2013.2-0.11.b3.el6.noarch rpm and I added a active directory user "test123" with role admin and tenant admin successfully. In Keystone.conf identity is pointed to ldap and assignment is pointed to SQL. I sourced keystonerc file with the correct credentials for user test123 and then trying to run a keystone commands.</span><div><span style="-webkit-text-size-adjust: auto; background-color: rgba(255, 255, 255, 0);"><br></span></div><div><span style="-webkit-text-size-adjust: auto; background-color: rgba(255, 255, 255, 0);">However when I run keystone get-token if gives me the following error:</span></div><div><span style="-webkit-text-size-adjust: auto; background-color: rgba(255, 255, 255, 0);">Authorization Failed: An unexpected error prevented the server from fulfilling your request. {'info': '000020D6: SvcErr: DSID-031007DB, problem 5012 (DIR_ERROR), data 0\n', 'desc': 'Operations error'} (HTTP 500)<br></span></div><div><span style="-webkit-text-size-adjust: auto; background-color: rgba(255, 255, 255, 0);"><br></span></div><div><span style="-webkit-text-size-adjust: auto; background-color: rgba(255, 255, 255, 0);">I am not sure why keystone is still looking at the Active Directory for authorization? </span></div></div><div class="HOEnZb"><div class="h5"></div></div></blockquote></div></div><br></body></html>