<font size=2 face="sans-serif">Hi Marcelo,</font>
<br>
<br><font size=2 face="sans-serif">In the latest version of devstack there
is an option that will install and configure LDAP and show it working with
domains configured to map to a businessCategory attribute. This
mapping approach was a stopgap measure and was not ideal. At the
summit we will be discussing what should be the best approach to map domains
to LDAP directories. But for now to see things working please use
devstack and try the options below:</font>
<br>
<br><font size=2 face="sans-serif">From </font><a href=http://devstack.org/stack.sh.html:><font size=2 face="sans-serif">http://devstack.org/stack.sh.html:</font></a>
<br>
<br>
<table>
<tr>
<td><font size=5><b>Keystone</b></font>
<td><tt><font size=3><br>
</font></tt>
<tr>
<td>
<td>
<tr>
<td>
<td>
<tr>
<td>
<td>
<tr>
<td><font size=3>Keystone can now optionally install OpenLDAP by adding
ldap to the list of enabled services in the localrc file (e.g. ENABLED_SERVICES=key,ldap).
If OpenLDAP has already been installed but you need to clear out the Keystone
contents of LDAP set KEYSTONE_CLEAR_LDAP to yes (e.g. KEYSTONE_CLEAR_LDAP=yes
) in the localrc file. To enable the Keystone Identity Driver (keystone.identity.backends.ldap.Identity)
set KEYSTONE_IDENTITY_BACKEND to ldap (e.g. KEYSTONE_IDENTITY_BACKEND=ldap)
in the localrc file.</font>
<td><tt><font size=3><br>
<br>
</font></tt></table>
<br>
<br>
<br><font size=2 face="sans-serif">Thanks,</font>
<br>
<br><font size=2 face="sans-serif">Brad</font>
<br><font size=2 face="sans-serif"><br>
Brad Topol, Ph.D.<br>
IBM Distinguished Engineer<br>
OpenStack<br>
(919) 543-0646<br>
Internet: btopol@us.ibm.com<br>
Assistant: Cindy Willman (919) 268-5296</font>
<br>
<br>
<br>
<br><font size=1 color=#5f5f5f face="sans-serif">From:
</font><font size=1 face="sans-serif">Marcelo Mariano Miziara
<marcelo.miziara@serpro.gov.br></font>
<br><font size=1 color=#5f5f5f face="sans-serif">To:
</font><font size=1 face="sans-serif">openstack@lists.launchpad.net</font>
<br><font size=1 color=#5f5f5f face="sans-serif">Date:
</font><font size=1 face="sans-serif">04/04/2013 09:07 AM</font>
<br><font size=1 color=#5f5f5f face="sans-serif">Subject:
</font><font size=1 face="sans-serif">[Openstack]
New schema for LDAP + Keystone Grizzly?</font>
<br><font size=1 color=#5f5f5f face="sans-serif">Sent by:
</font><font size=1 face="sans-serif">openstack-bounces+btopol=us.ibm.com@lists.launchpad.net</font>
<br>
<hr noshade>
<br>
<br>
<br><font size=3>Hello to all!<br>
<br>
Before the release of version grizzly 3, the suggested schema in the openstack
documentation (</font><a href="http://docs.openstack.org/trunk/openstack-compute/admin/content/configuring-keystone-for-ldap-backend.html"><font size=3>http://docs.openstack.org/trunk/openstack-compute/admin/content/configuring-keystone-for-ldap-backend.html</font></a><font size=3>)
worked fine. This is the suggested schema:</font>
<br><tt><font size=3>dn: cn=openstack,cn=org<br>
dc: openstack<br>
objectClass: dcObject<br>
objectClass: organizationalUnit<br>
ou: openstack<br>
<br>
dn: ou=Groups,cn=openstack,cn=org<br>
objectClass: top<br>
objectClass: organizationalUnit<br>
ou: groups<br>
<br>
dn: ou=Users,cn=openstack,cn=org<br>
objectClass: top<br>
objectClass: organizationalUnit<br>
ou: users<br>
<br>
dn: ou=Roles,cn=openstack,cn=org<br>
objectClass: top<br>
objectClass: organizationalUnit<br>
ou: roles</font></tt>
<br><font size=3>But after the release of the version grizzly 3 I think
that's not enough anymore, mainly because of the "domain" concept.<br>
<br>
I'm kind of lost trying to make LDAP work with keystone now...does anyone
succeed in this? <br>
<br>
I created a new dn, something like:</font>
<br><tt><font size=3>dn: ou=Domains,cn=openstack,cn=org<br>
objectClass: top<br>
objectClass: organizationalUnit<br>
ou: Domains</font></tt>
<br><font size=3>But when I run the "keystone-manage db_sync"
the "default" domain isn't created in the LDAP...When I manually
create the domain in there, I have a problem with authentication...<br>
<br>
I think I must be doing something wrong, does anyone have a light?<br>
<br>
Thanks in advance,<br>
Marcelo M. Miziara <br>
marcelo.miziara@serpro.gov.br </font>
<br><font size=3>-<br>
<br>
<br>
"Esta mensagem do SERVIÇO FEDERAL DE PROCESSAMENTO DE DADOS (SERPRO),
empresa pública federal regida pelo disposto na Lei Federal nº 5.615,
é enviada exclusivamente a seu destinatário e pode conter informações
confidenciais, protegidas por sigilo profissional. Sua utilização desautorizada
é ilegal e sujeita o infrator às penas da lei. Se você a recebeu indevidamente,
queira, por gentileza, reenviá-la ao emitente, esclarecendo o equívoco."<br>
<br>
"This message from SERVIÇO FEDERAL DE PROCESSAMENTO DE DADOS (SERPRO)
-- a government company established under Brazilian law (5.615/70) -- is
directed exclusively to its addressee and may contain confidential data,
protected under professional secrecy rules. Its unauthorized use is illegal
and may subject the transgressor to the law's penalties. If you're not
the addressee, please send it back, elucidating the failure."</font><tt><font size=2>_______________________________________________<br>
Mailing list: </font></tt><a href=https://launchpad.net/~openstack><tt><font size=2>https://launchpad.net/~openstack</font></tt></a><tt><font size=2><br>
Post to : openstack@lists.launchpad.net<br>
Unsubscribe : </font></tt><a href=https://launchpad.net/~openstack><tt><font size=2>https://launchpad.net/~openstack</font></tt></a><tt><font size=2><br>
More help : </font></tt><a href=https://help.launchpad.net/ListHelp><tt><font size=2>https://help.launchpad.net/ListHelp</font></tt></a><tt><font size=2><br>
</font></tt>
<br>