<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">On 02/10/2014 03:27 PM, Fischer, Matt
wrote:<br>
</div>
<blockquote cite="mid:CF1E8456.1ADA%25matt.fischer@twcable.com"
type="cite">
<meta http-equiv="Content-Type" content="text/html;
charset=ISO-8859-1">
<div><br>
</div>
<div>If we use LDAP to provide Assignment and Identity for
Keystone, what things is keystone still managing locally? The
reason I'm asking is that we're setting up Openstack in a couple
data centers and would like to centrally manage
users/tenants/roles without replicating keystone databases (if
that's possible). It looks like Tokens, Catalogs, and Policy are
the remaining services. I don't think we'd ever want to
replicate Tokens, and the data in Catalogs might differ across
DCs anyway, but "Policy" is what I'm not sure about. Is Policy
the same as Assignment? <br>
</div>
</blockquote>
No, policy is the flat file that has the rules for RBAC.<br>
<br>
Assignment is what you want to replicate: the assignment of roles
to users and groups within projects or domains.<br>
<br>
<blockquote cite="mid:CF1E8456.1ADA%25matt.fischer@twcable.com"
type="cite">
<div><br>
</div>
<div>Finally, has anyone else set this up and if so do you have
any caveats/must-dos? I think I have all the connection to LDAP
stuff figured out but have not tried with multiple keystone
instances.</div>
</blockquote>
LDAP can support assignment, but you lose multiple domain support.
It might be your simplest replication strategy, though.<br>
<br>
<blockquote cite="mid:CF1E8456.1ADA%25matt.fischer@twcable.com"
type="cite">
<br>
<hr>
<font color="Gray" face="Arial" size="1">This E-mail and any of
its attachments may contain Time Warner Cable proprietary
information, which is privileged, confidential, or subject to
copyright belonging to Time Warner Cable. This E-mail is
intended solely for the use of the individual or entity to which
it is addressed. If you are not the intended recipient of this
E-mail, you are hereby notified that any dissemination,
distribution, copying, or action taken in relation to the
contents of and attachments to this E-mail is strictly
prohibited and may be unlawful. If you have received this E-mail
in error, please notify the sender immediately and permanently
delete the original and any copy of this E-mail and any
printout.<br>
</font>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
OpenStack-operators mailing list
<a class="moz-txt-link-abbreviated" href="mailto:OpenStack-operators@lists.openstack.org">OpenStack-operators@lists.openstack.org</a>
<a class="moz-txt-link-freetext" href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-operators">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-operators</a>
</pre>
</blockquote>
<br>
</body>
</html>