<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">On 11/15/2013 07:39 PM, Avi L wrote:<br>
</div>
<blockquote
cite="mid:CAMBOUKw-+rbyJYTApHGSPBRiD+9Dv4Pe6nbgAtsBxyM0b9yMSA@mail.gmail.com"
type="cite">
<blockquote class="gmail_quote" style="margin:0px 0px 0px
0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div bgcolor="#FFFFFF" text="#000000">
<div class="im">
<blockquote type="cite">
<div dir="ltr">
<div>However when I run keystone user-list if gives me
the following error:</div>
<div>Authorization Failed: An unexpected error prevented
the server from fulfilling your request. {'info':
'000020D6: SvcErr: DSID-031007DB, problem 5012
(DIR_ERROR), data 0\n', 'desc': 'Operations error'}
(HTTP 500)<br>
</div>
</div>
</blockquote>
<br>
</div>
This error looks AD specific. I have not seen it from other
LDAP providers.<br>
<br>
When you do a user list, you have to authenticate to AD, which
is done via A Simple Bind. This is probably not what you want
long term (External Auth will let you use Kerberos, for
example) but to start troubleshooting, make sure you can do an
ldap query against the LDAP as the Admin user. If that
works, you should be able to do a keystone token-get with that
same information</div>
</blockquote>
<div><br>
<br>
</div>
<div>I can do a user list against AD using the ADMIN token , which
is binding as the AD user specified in the keystone.conf file.
Using the ADMIN token I am also giving that user a role of admin
and a tenant of admin . These are supposedly being stored in the
SQL database. Now if I change my credentials to the AD user
sourcing a keystone rc file and run the token-get or user-list
command I get this error.<br>
</div>
<div><br>
</div>
</blockquote>
ADMIN Token does no authentication against the back end. It is a
bootstrap method for setting up Keystone, nothing else. It should
be disabled as soon as you can authenticate via AD.<br>
<br>
I don't think you have successfully authenticated against AD.<br>
</body>
</html>