<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">BTW, here is my configuration:<div><br></div><div><div>[ldap]</div><div>url = <a href="ldap://10.64.11.199">ldap://10.64.11.199</a></div><div>tree_dn = cn=accounts,dc=mydomain,dc=com</div><div>user_tree_dn = cn=users,cn=accounts,dc=mydomain,dc=com</div><div>user_objectclass = person</div><div>user_name_attribute = uid</div><div>user_id_attribute = uid</div><div>tenant_tree_dn = cn=groups,cn=accounts,dc=mydomain,dc=com</div><div>tenant_objectclass = posixgroup</div><div>tenant_id_attribute = cn</div><div>tenant_name_attribute = cn</div><div>tenant_member_attribute = member</div><div>role_tree_dn = cn=groups,cn=accounts,dc=mydomain,dc=com</div><div>role_objectclass = posixgroup</div><div>role_id_attribute = cn</div><div>role_name_attribute = cn</div><div>role_member_attribute = member</div><div>user = uid=sudo,cn=sysaccounts,cn=etc,dc=mydomain,dc=com</div><div>password = mysudopassword</div><div>suffix = cn=mydomain,cn=com</div><div><br></div><div><br></div><div>[identity]</div><div>driver = keystone.identity.backends.ldap.Identity</div></div><div><br></div><div>It seems that keystone LDAP requires role nodes the children of tenant nodes. But FreeIPA has a flat structure.</div><div><br><div apple-content-edited="true">
<div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">--</div><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">邱剑<br>美团网技术部系统运维组 - 系统工程师<br>手机：1381129925<br>邮件：<a href="mailto:qiujian@meituan.com">qiujian@meituan.com</a></div>
</div>
<br><div><div>On Sep 22, 2012, at 12:27 PM, 邱剑 wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">Hi, <div><br><div>I was working on using LDAP of FreeIP as backend of Keystone.</div><div><br></div><div>User and tenants information can be fetched from LDAP. However, I could not figure out how to assign roles to users in specific tenants. I'm wondering whether someone can help?</div><div><br></div><div>I noticed that Mr. Adam Young had post a blog about this topic:</div><div><br></div><div><a href="http://adam.younglogic.com/2012/09/ldaps-against-a-freeipa-server/">http://adam.younglogic.com/2012/09/ldaps-against-a-freeipa-server/</a></div><div><br></div><div>However, it did not show how to import roles in LDAP. I'm wondering whether there is any progress about this?</div><div><br></div><div><div>Many thanks.</div></div><div><br></div><div><div><div>keystone in use was the latest master branch on github on Sep 21, 2012.</div></div><div><br></div></div><div><br></div><div>Jian Qiu</div></div>
</div>_______________________________________________<br>Mailing list: <a href="https://launchpad.net/~openstack">https://launchpad.net/~openstack</a><br>Post to : <a href="mailto:openstack@lists.launchpad.net">openstack@lists.launchpad.net</a><br>Unsubscribe : <a href="https://launchpad.net/~openstack">https://launchpad.net/~openstack</a><br>More help : <a href="https://help.launchpad.net/ListHelp">https://help.launchpad.net/ListHelp</a><br></blockquote></div><br></div></body></html>