Chapter 4. Using domain-specific LDAP backends with director

Red Hat OpenStack Platform director can configure keystone to use one or more LDAP backends. This approach results in the creation of a separate LDAP backend for each keystone domain.

4.1. Setting the configuration options

For deployments using Red Hat OpenStack Platform director, you need to set the KeystoneLDAPDomainEnable flag to true in your heat templates; as a result, this will configure the domain_specific_drivers_enabled option in keystone (within the identity configuration group).

Note

The default directory for domain configuration files is set to /etc/keystone/domains/. You can override this by setting the required path using the keystone::domain_config_directory hiera key and adding it as an ExtraConfig parameter within an environment file.

You must also add a specification of the LDAP backend configuration. This is done using the KeystoneLDAPBackendConfigs parameter in tripleo-heat-templates. You can then specify your required LDAP options. For more information on the available options, see the Configuration Reference Guide.

4.2. Configure the director deployment

Important

There is currently a known issue with a heat template: the keystone_domain_confg tag is missing from keystone.yaml. For the workaround and further information, see https://bugzilla.redhat.com/show_bug.cgi?id=1519057.

  1. Create a copy of the keystone_domain_specific_ldap_backend.yaml environment file: 

    $ cp /usr/share/openstack-tripleo-heat-templates/environments/services/keystone_domain_specific_ldap_backend.yaml /home/stack/templates/

  2. Edit the /home/stack/templates/keystone_domain_specific_ldap_backend.yaml environment file and set the values to suit your deployment. For example, these entries create a LDAP configuration for a keystone domain named testdomain: 

        parameter_defaults:
      KeystoneLDAPDomainEnable: true
      KeystoneLDAPBackendConfigs:
        testdomain:
          url: ldaps://192.0.2.250
          user: cn=openstack,ou=Users,dc=director,dc=example,dc=com
          password: RedactedComplexPassword
          suffix: dc=director,dc=example,dc=com
          user_tree_dn: ou=Users,dc=director,dc=example,dc=com
          user_filter: "(memberOf=cn=OSuser,ou=Groups,dc=director,dc=example,dc=com)"
          user_objectclass: person
          user_id_attribute: cn
          user_allow_create: false
          user_allow_update: false
          user_allow_delete: false

  3. You can also configure the environment file to specify multiple domains. For example: 

        KeystoneLDAPBackendConfigs:
      domain1:
        url: ldaps://domain1.example.com
        user: cn=openstack,ou=Users,dc=director,dc=example,dc=com
        password: RedactedComplexPassword
        ...
      domain2:
        url: ldaps://domain2.example.com
        user: cn=openstack,ou=Users,dc=director,dc=example,dc=com
        password: RedactedComplexPassword
        ...

    This will result in two domains named domain1 and domain2; each will have a different LDAP domain with its own configuration.