<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
On 05/22/2012 07:07 AM, Kuo Hugo wrote:
<blockquote
cite="mid:CA++_uhvLxk7OEnuZwPT8kbLgPwBraboZu6wVT63DOZrdi62+-w@mail.gmail.com"
type="cite">
<div>Hi Folks , </div>
<div><br>
</div>
<div>I have try with keystone backend by LDAP and Windows AD. </div>
<div><br>
</div>
<div>It looks fine . Just want to clarify one point. </div>
<div><br>
</div>
<div>For my test result , LDAP driver could only validate users in
the particular container (OU,CN etc.) and does not include the
subtree users.</div>
<div><br>
</div>
<div>[ldap]</div>
<div>
<div>tree_dn = dc=taiwan,dc=com</div>
<div>user_tree_dn = ou=foo,dc=taiwan,dc=com</div>
</div>
<div><br>
</div>
<div><br>
</div>
<div>For example ....</div>
<div> User1 : cn=jeremy,ou=foo,dc=taiwan,dc=com</div>
<div><br>
</div>
<div> User2 :
cn=jordan,ou=bar,ou=foo,dc=taiwan,dc=com</div>
<div> </div>
<div>User1 could be validated , and get the token generated by
keystone.</div>
<div>User2 could not be validated </div>
<div><br>
</div>
<div><br>
</div>
<div>Is there any way to validate both User1 and User2 in current
design ?</div>
</blockquote>
<br>
No, there is not. Queries are not done against subtrees. <br>
<br>
If this is important to you, please file a ticket:<br>
<a class="moz-txt-link-freetext" href="https://bugs.launchpad.net/keystone/+filebug">https://bugs.launchpad.net/keystone/+filebug</a><br>
<br>
<br>
<br>
<blockquote
cite="mid:CA++_uhvLxk7OEnuZwPT8kbLgPwBraboZu6wVT63DOZrdi62+-w@mail.gmail.com"
type="cite">
<div><br>
</div>
<div><br>
</div>
-- <br>
<div>+Hugo Kuo+</div>
<div><a moz-do-not-send="true" href="mailto:tonytkdk@gmail.com"
target="_blank">tonytkdk@gmail.com<br>
</a></div>
<div><a moz-do-not-send="true" href="mailto:tonytkdk@gmail.com"
target="_blank">+</a>886 935004793</div>
<br>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
Mailing list: <a class="moz-txt-link-freetext" href="https://launchpad.net/~openstack">https://launchpad.net/~openstack</a>
Post to : <a class="moz-txt-link-abbreviated" href="mailto:openstack@lists.launchpad.net">openstack@lists.launchpad.net</a>
Unsubscribe : <a class="moz-txt-link-freetext" href="https://launchpad.net/~openstack">https://launchpad.net/~openstack</a>
More help : <a class="moz-txt-link-freetext" href="https://help.launchpad.net/ListHelp">https://help.launchpad.net/ListHelp</a>
</pre>
</blockquote>
<br>
</body>
</html>