Chapter 4. Using domain-specific LDAP backends with director
Red Hat OpenStack Platform director can configure keystone to use one or more LDAP backends. This approach results in the creation of a separate LDAP backend for each keystone domain.
4.1. Setting the configuration options
For deployments using Red Hat OpenStack Platform director, you need to set the KeystoneLDAPDomainEnable
flag to true
in your heat templates; as a result, this will configure the domain_specific_drivers_enabled
option in keystone (within the identity
configuration group).
The default directory for domain configuration files is set to /etc/keystone/domains/
. You can override this by setting the required path using the keystone::domain_config_directory
hiera key and adding it as an ExtraConfig
parameter within an environment file.
You must also add a specification of the LDAP backend configuration. This is done using the KeystoneLDAPBackendConfigs
parameter in tripleo-heat-templates
, where you can then specify your required LDAP options.
4.2. Configure the director deployment
Create a copy of the
keystone_domain_specific_ldap_backend.yaml
environment file:$ cp /usr/share/openstack-tripleo-heat-templates/environments/services/keystone_domain_specific_ldap_backend.yaml /home/stack/templates/
Edit the
/home/stack/templates/keystone_domain_specific_ldap_backend.yaml
environment file and set the values to suit your deployment. For example, these entries create a LDAP configuration for a keystone domain namedtestdomain
:parameter_defaults: KeystoneLDAPDomainEnable: true KeystoneLDAPBackendConfigs: testdomain: url: ldaps://192.0.2.250 user: cn=openstack,ou=Users,dc=director,dc=example,dc=com password: RedactedComplexPassword suffix: dc=director,dc=example,dc=com user_tree_dn: ou=Users,dc=director,dc=example,dc=com user_filter: "(memberOf=cn=OSuser,ou=Groups,dc=director,dc=example,dc=com)" user_objectclass: person user_id_attribute: cn
You can also configure the environment file to specify multiple domains. For example:
KeystoneLDAPBackendConfigs: domain1: url: ldaps://domain1.example.com user: cn=openstack,ou=Users,dc=director,dc=example,dc=com password: RedactedComplexPassword ... domain2: url: ldaps://domain2.example.com user: cn=openstack,ou=Users,dc=director,dc=example,dc=com password: RedactedComplexPassword ...
This will result in two domains named
domain1
anddomain2
; each will have a different LDAP domain with its own configuration.