On 05/30/2013 05:58 PM, Dave Neary wrote: > Hi Adam, > > Can you have a look at this post on rdo-list and see if you can figure > out what's going wrong, please? > > Thanks! > Dave. > > > > -------- Original Message -------- > Subject: [Rdo-list] RDO with Red Hat IDM > Date: Thu, 30 May 2013 17:13:59 -0400 > From: Michael Solberg <msolberg(a)redhat.com&gt; > To: rdo-list(a)redhat.com > > Hi list. > > I've spent a day or two now trying to use Red Hat IDM as a backing store > for Keystone in RDO and I'm about to pull my hair out. > > I started with Adam Young's blog post here: > http://adam.younglogic.com/2012/02/freeipa-keystone-ldap/ > > Then I watched his Summit video here: > http://www.openstack.org/summit/portland-2013/session-videos/presentation... > > > Then I tried to follow this document: > http://docs.openstack.org/trunk/openstack-compute/admin/content/configuri... > > > I definitely ran into the domain_id problem described here: > https://lists.launchpad.net/openstack/msg23387.html > > I also ran into the issue around the RFC 4519 schema not allowing a > "enabled" attribute. I think I've mitigated this by setting the > "attribute_ignore" settings in keystone.conf. > > I've tried tackling the architecture from a few different directions and > I've gotten to the point where I can create roles, create tenants, and > list users in my IDM domain, but not assign roles to users. I think > this is because I'm trying to separate out the tenants and roles from > the users in the directory tree. I don't mind keystone creating objects > in it's own tree, but I don't want it updating user accounts from IDM. So, you have put projects into their own subtree? Can the LDAP user from Keystone modify that tree?

I would think you would want to make user that has ACLs set up permitting them to make modifications to that tree, but not to add users. Configure Keystone to use that user to talk to LDAP.

On 05/31/2013 09:51 AM, Michael Solberg wrote: > On 05/30/2013 08:04 PM, Adam Young wrote: >> On 05/30/2013 05:58 PM, Dave Neary wrote: >>> Hi Adam, >>> >>> Can you have a look at this post on rdo-list and see if you can figure >>> out what's going wrong, please? >>> >>> Thanks! >>> Dave. >>> >>> >>> >>> -------- Original Message -------- >>> Subject: [Rdo-list] RDO with Red Hat IDM >>> Date: Thu, 30 May 2013 17:13:59 -0400 >>> From: Michael Solberg <msolberg(a)redhat.com&gt; >>> To: rdo-list(a)redhat.com >>> >>> Hi list. >>> >>> I've spent a day or two now trying to use Red Hat IDM as a backing >>> store >>> for Keystone in RDO and I'm about to pull my hair out. >>> >>> I started with Adam Young's blog post here: >>> http://adam.younglogic.com/2012/02/freeipa-keystone-ldap/ >>> >>> Then I watched his Summit video here: >>> http://www.openstack.org/summit/portland-2013/session-videos/presentation... >>> >>> >>> >>> >>> Then I tried to follow this document: >>> http://docs.openstack.org/trunk/openstack-compute/admin/content/configuri... >>> >>> >>> >>> >>> I definitely ran into the domain_id problem described here: >>> https://lists.launchpad.net/openstack/msg23387.html >>> >>> I also ran into the issue around the RFC 4519 schema not allowing a >>> "enabled" attribute. I think I've mitigated this by setting the >>> "attribute_ignore" settings in keystone.conf. >>> >>> I've tried tackling the architecture from a few different directions >>> and >>> I've gotten to the point where I can create roles, create tenants, and >>> list users in my IDM domain, but not assign roles to users. I think >>> this is because I'm trying to separate out the tenants and roles from >>> the users in the directory tree. I don't mind keystone creating >>> objects >>> in it's own tree, but I don't want it updating user accounts from IDM. >> >> So, you have put projects into their own subtree? Can the LDAP user >> from Keystone modify that tree? > > Yes - for right now, I'm just using the cn=Directory Manager account. I > figured I'd work on the ACLs once I got the mappings correct. All of my > issues so far have been around Keystone trying to create or read objects > in the tree that don't conform to the standard directory types that we > ship in IDM (groupOfNames, posixaccount, etc). That's why I was curious > if someone had a working configuration that I could look at. It looks > like we've documented using AD upstream, but not IDM. I figured it out. Is there a good place for me to document this? Thanks. Michael. _______________________________________________ Rdo-list mailing list Rdo-list(a)redhat.com https://www.redhat.com/mailman/listinfo/rdo-list

On 06/13/2013 04:20 PM, Dave Neary wrote: > Hi, > > Yes! Please create a page in the wiki and link to it from > http://openstack.redhat.com/Troubleshooting please. It could probably use some editing, but it's a start: http://openstack.redhat.com/KeystoneIDMIntegration It'd be nice to go into how to set up SSL and PKI for the various services. Michael. _______________________________________________ Rdo-list mailing list Rdo-list(a)redhat.com https://www.redhat.com/mailman/listinfo/rdo-list

On 06/14/2013 02:40 PM, Dave Neary wrote: > Hi Michael, > > How is IDM integration different from FreeIPA integrations? I don't have a lot of experience with FreeIPA, but I'd imagine that they're very similar - perhaps identical, depending on how far IdM lags upstream.

Michael. > On 06/13/2013 10:57 PM, Michael Solberg wrote: >> On 06/13/2013 04:20 PM, Dave Neary wrote: >>> Hi, >>> >>> Yes! Please create a page in the wiki and link to it from >>> http://openstack.redhat.com/Troubleshooting please. >> >> It could probably use some editing, but it's a start: >> >> http://openstack.redhat.com/KeystoneIDMIntegration >> >> It'd be nice to go into how to set up SSL and PKI for the various >> services. >> >> Michael. >> >> _______________________________________________ >> Rdo-list mailing list >> Rdo-list(a)redhat.com >> https://www.redhat.com/mailman/listinfo/rdo-list >