<div dir="ltr">Hello,<div><br></div><div> We had similar requests with wanting AD integration for authentication but not for authorization.</div><div><br></div><div>We ended up with our own driver:</div><div><a href="https://bitbucket.org/mgale/openstack-havana/overview">https://bitbucket.org/mgale/openstack-havana/overview</a><br>
</div><div><br></div><div>Installation instructions are available here:</div><div><a href="https://bitbucket.org/mgale/openstack-havana/src/78f825a63de664bc786923c76ffedda220e7cd80/installing.txt?at=master">https://bitbucket.org/mgale/openstack-havana/src/78f825a63de664bc786923c76ffedda220e7cd80/installing.txt?at=master</a><br>
</div><div><br></div><div>We also created a small utility to create users based on OU's in Keystone and assign them to specific tenants:</div><div><a href="https://bitbucket.org/mgale/openstack-havana/src/">https://bitbucket.org/mgale/openstack-havana/src/</a> under the utils dir.<br>
</div><div><br></div><div><br></div><div>Michael</div></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Fri, May 2, 2014 at 7:52 AM, Jasper Capel <span dir="ltr"><<a href="mailto:Jasper.Capel@spilgames.com" target="_blank">Jasper.Capel@spilgames.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">No, we didn’t do anything with custom drivers. We implemented the pipeline solution referred to in this document:<br>
<br>
<a href="http://docs.openstack.org/developer/keystone/external-auth.html" target="_blank">http://docs.openstack.org/developer/keystone/external-auth.html</a><br>
<br>
Jasper<br>
<div class=""><br>
On 02 May 2014, at 15:00, Michael Hearn <<a href="mailto:mrhearn@gmail.com">mrhearn@gmail.com</a>> wrote:<br>
<br>
> Jasper<br>
> Are you alluding to the hybrid drivers as discussed & avail via <a href="http://www.mattfischer.com/blog/?tag=openstack-2" target="_blank">http://www.mattfischer.com/blog/?tag=openstack-2</a><br>
><br>
> ~Mike.<br>
><br>
> On Thu, May 1, 2014 at 11:17 PM, Lillie Ross-CDSR11 <<a href="mailto:Ross.Lillie@motorolasolutions.com">Ross.Lillie@motorolasolutions.com</a>> wrote:<br>
> I’ve been playing with using LDAP authentication (identity) and SQL authorization (assignment) within Keystone in the current devstack release running in a single VM.<br>
><br>
> The problem with this setup, as I understand it, is the need to have LDAP entries for each service user (i.e. nova, glance, etc.). In our environment, this isn’t possible as our corporate LDAP directory is solely for employee records. While I could work around this issue by running each service under a known LDAP employee record - this seems rather a kludge to me.<br>
><br>
> My question is, and admittedly I’m not well versed in directory federation, is this an issue that could be resolved once directory federation is stable in the next Openstack release? Where, for instance, all of the openstack service accounts could remain in a separate directory service controlled solely by the cloud owner/admin, while user’s could then be authenticated via the corporate employee LDAP database?<br>
><br>
> We’d love to use LDAP to authenticate cloud user’s, but with the need to also authenticate openstack services against the same LDAP backend makes the use of LDAP unviable in our environment.<br>
><br>
> This has probably been discussed previously, but any insight would be helpful.<br>
><br>
> Thanks and regards,<br>
> Ross<br>
> --<br>
> Ross Lillie<br>
> Distinguished Member of Technical Staff<br>
> Motorola Solutions, Inc.<br>
><br>
> <a href="http://motorolasolutions.com" target="_blank">motorolasolutions.com</a><br>
> O: <a href="tel:%2B1.847.576.0012" value="+18475760012">+1.847.576.0012</a><br>
> M: <a href="tel:%2B1.847.980.2241" value="+18479802241">+1.847.980.2241</a><br>
> E: <a href="mailto:ross.lillie@motorolasolutions.com">ross.lillie@motorolasolutions.com</a><br>
><br>
><br>
</div>> <MSI-Email-Identity-sm.png><br>
<div class="HOEnZb"><div class="h5">><br>
><br>
> _______________________________________________<br>
> Mailing list: <a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack</a><br>
> Post to : <a href="mailto:openstack@lists.openstack.org">openstack@lists.openstack.org</a><br>
> Unsubscribe : <a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack</a><br>
><br>
><br>
> _______________________________________________<br>
> Mailing list: <a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack</a><br>
> Post to : <a href="mailto:openstack@lists.openstack.org">openstack@lists.openstack.org</a><br>
> Unsubscribe : <a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack</a><br>
<br>
<br>
_______________________________________________<br>
Mailing list: <a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack</a><br>
Post to : <a href="mailto:openstack@lists.openstack.org">openstack@lists.openstack.org</a><br>
Unsubscribe : <a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack</a><br>
</div></div></blockquote></div><br><br clear="all"><div><br></div>-- <br><div dir="ltr"><span style="font-size:16px"><h2 style="font-family:Verdana,Arial,Helvetica,sans-serif;font-weight:bold;font-size:16px"><span style="font-family:verdana,sans-serif;color:rgb(24,24,24);font-size:14px;font-weight:normal;line-height:18px">“We, the unwilling, led by the unknowing, are doing the impossible for the ungrateful. We have done so much, for so long, with so little, we are now qualified to do anything with nothing.”</span><br>
</h2><div><p><font face="verdana, sans-serif"><span style="color:rgb(24,24,24);font-size:14px;line-height:18px">― </span><a href="https://www.goodreads.com/author/show/4666841.Konstantin_Josef_Jire_ek" style="color:rgb(102,102,0);text-decoration:none;font-size:14px;line-height:18px" target="_blank">Konstantin Josef Jireček</a></font><br>
</p></div></span></div>
</div>