HowtoIntegrateKeystonewithAD - Revision history

Ryan Lane: Text replace - "NOTOC" to ""

2013-02-17T23:29:26Z

Text replace - "__NOTOC__" to ""

Ryan Lane: Text replace - "<>" to "TOC"

2013-02-17T23:22:07Z

Text replace - "<<TableOfContents()>>" to "__TOC__"

Jose at 12:38, 1 November 2012

2012-11-01T12:38:16Z

Jose at 09:01, 9 October 2012

2012-10-09T09:01:25Z

at 00:00, 1 January 1970

1970-01-01T00:00:00Z

New page

__NOTOC__
= How to integrate Keystone with Active Directory =

<SOME TEXT>

== Structure (3 different trees for each identity type) ==

Windows 2008 schema (includes services for unix)
Users (OU=Users)
[[AdminUser]]
@id
@name
@mail
[[DemoUser]]
@id
@name
@mail
Tenants(OU=Tenants)
[[DemoTenant]]
@id
@name
@description
member([[AdminUser]],[[DemoUser]])
[[AdminRole]]
roleOccupant([[AdminUser]])
[[MemberRole]]
roleOccupant([[DemoUser]])
Roles(OU=Roles)
[[AdminRole]]
@id
@name
[[MemberRole]]
@id
@name

== Changes on organizationalRole to have groupOfNames as a possible superior ==

In ADSI Edit go to schema
Open CN=Organizational-Role
In attribute editor edit possSuperiors
Add groupOfNames in the values and click OK

@@ Line 1: / Line 1: @@
-__NOTOC__
 <!-- ## page was renamed from [[HowtointegrateKeystonewithad]] -->
 Table of contents: __TOC__

@@ Line 1: / Line 1: @@
 __NOTOC__
 <!-- ## page was renamed from [[HowtointegrateKeystonewithad]] -->
-Table of contents: <<[[TableOfContents]]()>>
+Table of contents: __TOC__
 = How to Integrate Keystone with Active Directory =

@@ Line 68: / Line 68: @@
    ...
    [ldap]
-   url                     = ldap://dc.example.com
+   url                      = ldap://dc.example.com
-   user                    = CN=ldap,OU=Users,DC=example,DC=com
+   user                     = CN=ldap,OU=Users,DC=example,DC=com
-   password                = verybadpass
+   password                 = verybadpass
-   suffix                  = DC=example,DC=com
+   suffix                   = DC=example,DC=com
-   use_dumb_member         = True
+   use_dumb_member          = True
-   dumb_member             = CN=ldap,OU=Users,DC=example,DC=com
+   dumb_member              = CN=ldap,OU=Users,DC=example,DC=com
-   user_tree_dn            = OU=Users,DC=example,DC=com
+   user_tree_dn             = OU=Users,DC=example,DC=com
-   user_objectclass        = person
+   user_objectclass         = person
-   user_filter             =
+   user_filter              =
-   user_id_attribute       = cn
+   user_id_attribute        = cn
-   user_name_attribute     = cn
+   user_name_attribute      = cn
-   user_mail_attribute     = mail
+   user_mail_attribute      = mail
-   user_attribute_ignore   = password,tenant_id,enabled,tenants
+  user_pass_attribute      =
-   user_allow_create       = False
+  user_enabled_attribute   = userAccountControl
-   user_allow_update       = False
+  user_enabled_mask        = 2
-   user_allow_delete       = False
+  user_enabled_default     = 512
-   tenant_tree_dn          = OU=Tenants,DC=example,DC=com
+   tenant_tree_dn           = OU=Tenants,DC=example,DC=com
-   tenant_filter           =
+   tenant_filter            =
-   tenant_objectclass      = groupOfNames
+   tenant_objectclass       = groupOfNames
-   tenant_id_attribute     = cn
+   tenant_id_attribute      = cn
-   tenant_member_attribute = member
+   tenant_member_attribute  = member
-   tenant_name_attribute   = ou
+   tenant_name_attribute    = ou
-   tenant_desc_attribute   = description
+   tenant_desc_attribute    = description
-   tenant_attribute_ignore = enabled
+   tenant_enabled_attribute = extensionName
-   tenant_allow_create     = True
+   tenant_attribute_ignore  =
-   tenant_allow_update     = True
+   tenant_allow_create      = True
-   tenant_allow_delete     = True
+   tenant_allow_update      = True
-   role_tree_dn            = OU=Roles,DC=example,DC=com
+   role_tree_dn             = OU=Roles,DC=example,DC=com
-   role_filter             =
+   role_filter              =
-   role_objectclass        = organizationalRole
+   role_objectclass         = organizationalRole
-   role_id_attribute       = cn
+   role_id_attribute        = cn
-   role_name_attribute     = ou
+   role_name_attribute      = ou
-   role_member_attribute   = roleOccupant
+   role_member_attribute    = roleOccupant
-   role_attribute_ignore   =
+   role_attribute_ignore    =
-   role_allow_create       = True
+   role_allow_create        = True
-   role_allow_update       = True
+   role_allow_update        = True
-   role_allow_delete       = True
+   role_allow_delete        = True
    ...
    [identity]

@@ Line 1: / Line 1: @@
 __NOTOC__
-= How to integrate Keystone with Active Directory =
+<!-- ## page was renamed from [[HowtointegrateKeystonewithad]] -->
-<SOME TEXT>
+= How to Integrate Keystone with Active Directory =
-== Structure (3 different trees for each identity type) ==
+== Sample information stored on Active Directory ==
 Windows 2008 schema (includes services for unix)
 Users (OU=Users)
-[[AdminUser]]
+  AdminUser
-@id
+    @id
-@name
+    @name
-@mail
+    @mail
-[[DemoUser]]
+  DemoUser
-@id
+    @id
-@name
+    @name
-@mail
+    @mail
 Tenants(OU=Tenants)
-[[DemoTenant]]
+Tenants (OU=Tenants)
-@id
+  DemoTenant
-@name
+    @id
-@description
+    @name
-member([[AdminUser]],[[DemoUser]])
+    @description
-[[AdminRole]]
+    member(AdminUser,DemoUser)
-roleOccupant([[AdminUser]])
+      AdminRole
-[[MemberRole]]
+        roleOccupant(AdminUser)
-roleOccupant([[DemoUser]])
+      MemberRole
-Roles(OU=Roles)
+        roleOccupant(DemoUser)
-[[AdminRole]]
-@id
+Roles (OU=Roles)
-@name
+  AdminRole
-[[MemberRole]]
+    @id
-@id
+    @name
 @name
-== Changes on organizationalRole to have groupOfNames as a possible superior ==
+  tenant_tree_dn          = OU=Tenants,DC=example,DC=com
-In ADSI Edit go to schema
+  role_tree_dn            = OU=Roles,DC=example,DC=com
-Open CN=Organizational-Role
+  role_filter             =
-In attribute editor edit possSuperiors
+  role_objectclass        = organizationalRole
-Add groupOfNames in the values and click OK
+  role_id_attribute       = cn