<html> <head> <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"> <meta name="Generator" content="Microsoft Word 14 (filtered medium)"> <style></style> </head> <body text="#000000" bgcolor="#FFFFFF"> This is a discussion I'm party to between the Hyper-V Dev and CERN regarding Keystone LDAP usage to access their Active Directory structure. <div class="moz-forward-container"> Thought some of you might be interested. -------- Original Message -------- <table class="moz-email-headers-table" cellpadding="0" cellspacing="0" border="0"> <tbody> <tr> <th align="RIGHT" nowrap="nowrap" valign="BASELINE">Subject: </th> <td>RE: LDAP/AD</td> </tr> <tr> <th align="RIGHT" nowrap="nowrap" valign="BASELINE">Date: </th> <td>Tue, 11 Sep 2012 20:59:56 +0000</td> </tr> <tr> <th align="RIGHT" nowrap="nowrap" valign="BASELINE">From: </th> <td>Peter Pouliot <a class="moz-txt-link-rfc2396E" href="mailto:ppouliot@microsoft.com"><ppouliot@microsoft.com></a></td> </tr> <tr> <th align="RIGHT" nowrap="nowrap" valign="BASELINE">To: </th> <td>Tim Bell <a class="moz-txt-link-rfc2396E" href="mailto:Tim.Bell@cern.ch"><Tim.Bell@cern.ch></a>, "Adam Young (<a class="moz-txt-link-abbreviated" href="mailto:ayoung@redhat.com">ayoung@redhat.com</a>)" <a class="moz-txt-link-rfc2396E" href="mailto:ayoung@redhat.com"><ayoung@redhat.com></a></td> </tr> <tr> <th align="RIGHT" nowrap="nowrap" valign="BASELINE">CC: </th> <td>John Dickinson <a class="moz-txt-link-rfc2396E" href="mailto:me@not.mn"><me@not.mn></a>, Joseph Heck <a class="moz-txt-link-rfc2396E" href="mailto:heckj@mac.com"><heckj@mac.com></a>, Jose Castro Leon <a class="moz-txt-link-rfc2396E" href="mailto:jose.castro.leon@cern.ch"><jose.castro.leon@cern.ch></a></td> </tr> </tbody> </table> <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"> <meta name="Generator" content="Microsoft Word 14 (filtered medium)"> <style></style> <div class="WordSection1"> Tim,<o:p></o:p> Thanks for the information. I’m in agreement on LDAP and wasn’t suggesting Native AD support. However being able to utilize the existing information is key.<o:p></o:p> <o:p> </o:p> P<o:p></o:p> <o:p> </o:p> <o:p> </o:p> <div> <div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in"> From: Tim Bell [<a class="moz-txt-link-freetext" href="mailto:Tim.Bell@cern.ch">mailto:Tim.Bell@cern.ch</a>] Sent: Tuesday, September 11, 2012 3:15 PM To: Peter Pouliot; Adam Young (<a class="moz-txt-link-abbreviated" href="mailto:ayoung@redhat.com">ayoung@redhat.com</a>) Cc: John Dickinson; Joseph Heck; Jose Castro Leon Subject: RE: LDAP/AD <o:p></o:p> </div> </div> <o:p> </o:p> <o:p> </o:p> Peter,<o:p></o:p> <o:p> </o:p> From CERN’s first quick analysis in the past week or so, AD integration can be done within the framework of a flexible OpenLDAP driver. We may need some configuration flags, some mapping from roles to group members and some recommendations for AD administrators to index certain parts of the tree (we have groups with 1,000s of members and 48,000 users in our AD).<o:p></o:p> <o:p> </o:p> Given the good AD/LDAP built in compatibility, we can make things generic if we find the right schema options. I do not think we’ve the critical mass currently for AD-only support. I’d much rather have a good LDAP support and a recommendation on how to provide an AD view which is performant and compatible for both OpenLDAP and AD backends.<o:p></o:p> <o:p> </o:p> A few beers, a white board, the key guys and we can sort this out … <o:p></o:p> <o:p> </o:p> Tim<o:p></o:p> <o:p> </o:p> <o:p> </o:p> <div style="border:none;border-left:solid blue 1.5pt;padding:0in 0in 0in 4.0pt"> <div> <div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in"> From: Peter Pouliot <a moz-do-not-send="true" href="mailto:[mailto:ppouliot@microsoft.com]">[mailto:ppouliot@microsoft.com]</a> Sent: 11 September 2012 21:03 To: Tim Bell; Adam Young (<a moz-do-not-send="true" href="mailto:ayoung@redhat.com">ayoung@redhat.com</a>) Cc: John Dickinson; Joseph Heck Subject: RE: Hyper-V Meeting Minutes<o:p></o:p> </div> </div> <o:p> </o:p> Tim,<o:p></o:p> <o:p> </o:p> I agree on not having fragmentation.<o:p></o:p> <o:p> </o:p> John had approached me a while back around some AD discussion and I know I had some a conversation with Joe somewhere along the lines at the April summit.<o:p></o:p> <o:p> </o:p> John and Joe,<o:p></o:p> I figured this is a great point to bring you both in. I know each of you also have showed some interest in advancing the Active Directory integration.<o:p></o:p> <o:p> </o:p> It’s probably a great time to try to organize our efforts .<o:p></o:p> <o:p> </o:p> What do you both think about Tim’s suggestion of a Bof Slot on the Topic in SD?<o:p></o:p> <o:p> </o:p> pp<o:p></o:p> <o:p> </o:p> <o:p> </o:p> <o:p> </o:p> <div> <div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in"> From: Tim Bell <a moz-do-not-send="true" href="mailto:[mailto:Tim.Bell@cern.ch]">[mailto:Tim.Bell@cern.ch]</a> Sent: Tuesday, September 11, 2012 2:17 PM To: Peter Pouliot; Adam Young (<a moz-do-not-send="true" href="mailto:ayoung@redhat.com">ayoung@redhat.com</a>) Subject: RE: Hyper-V Meeting Minutes<o:p></o:p> </div> </div> <o:p> </o:p> <o:p> </o:p> I’ve already got the CERN troops voting for the Hyper-V and Redhat talks J<o:p></o:p> <o:p> </o:p> I’ll certainly give some prominence to the work with Microsoft and Redhat in the CERN user story too, so your votes are welcome…<o:p></o:p> <o:p> </o:p> In any case, we should get a BoF slot for OpenLDAP/AD integration .. it does not need a massive investment but we should avoid fragmentation….<o:p></o:p> <o:p> </o:p> We’re also trying to do some PKI testing too …. Another hot topic for us….<o:p></o:p> <o:p> </o:p> Ti<o:p></o:p> <o:p> </o:p> <div style="border:none;border-left:solid blue 1.5pt;padding:0in 0in 0in 4.0pt"> <div> <div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in"> From: Peter Pouliot <a moz-do-not-send="true" href="mailto:[mailto:ppouliot@microsoft.com]">[mailto:ppouliot@microsoft.com]</a> Sent: 11 September 2012 19:57 To: Tim Bell; Adam Young (<a moz-do-not-send="true" href="mailto:ayoung@redhat.com">ayoung@redhat.com</a>) Subject: RE: Hyper-V Meeting Minutes<o:p></o:p> </div> </div> <o:p> </o:p> Tim,<o:p></o:p> Awesome! We’d love to make sure everyone interested meets up at the summit.<o:p></o:p> <o:p> </o:p> I’m looking forward to seeing what you have done already.<o:p></o:p> Adam and I have been talking about this for a while. (We actually work close by to each other in Cambridge MA).<o:p></o:p> <o:p> </o:p> I’ve been trying to get more free cycles to help w/ the testing and potentially help with integration to use other AD object properties.<o:p></o:p> <o:p> </o:p> We should definitely sync up together and get a good understanding of your needs at CERN. I should be able to guide some of the momentum towards the work internally if the external interest is there.<o:p></o:p> <o:p> </o:p> PS. Votes for Hyper-V Presentations help the cause.<o:p></o:p> <o:p> </o:p> J<o:p></o:p> <o:p> </o:p> p<o:p></o:p> <o:p> </o:p> <div> <div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in"> From: Tim Bell <a moz-do-not-send="true" href="mailto:[mailto:Tim.Bell@cern.ch]">[mailto:Tim.Bell@cern.ch]</a> Sent: Tuesday, September 11, 2012 1:32 PM To: Peter Pouliot; Adam Young (<a moz-do-not-send="true" href="mailto:ayoung@redhat.com">ayoung@redhat.com</a>) Subject: FW: Hyper-V Meeting Minutes<o:p></o:p> </div> </div> <o:p> </o:p> <o:p> </o:p> Peter/Adam,<o:p></o:p> <o:p> </o:p> Pleased to see that the AD integration work is of interest. I’ve asked Jose to brief you further on the thoughts and options.<o:p></o:p> <o:p> </o:p> For the summit, Jose, Belmiro and I will be there. I’ve got some management board related meetings but I’d be delighted to get together with you both and discuss further integration work of common interest.<o:p></o:p> <o:p> </o:p> Tim<o:p></o:p> <o:p> </o:p> <div> <div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in"> From: Peter Pouliot <a moz-do-not-send="true" href="mailto:[mailto:ppouliot@microsoft.com]">[mailto:ppouliot@microsoft.com]</a> Sent: 11 September 2012 17:56 To: <a moz-do-not-send="true" href="mailto:openstack-dev@lists.openstack.org">openstack-dev@lists.openstack.org</a> Subject: [openstack-dev] Hyper-V Meeting Minutes<o:p></o:p> </div> </div> <o:p> </o:p> Meeting ended Tue Sep 11 15:47:37 2012 UTC. Information about MeetBot at <a moz-do-not-send="true" href="http://wiki.debian.org/MeetBot">http://wiki.debian.org/MeetBot</a> . (v 0.1.4)<o:p></o:p> Minutes: <a moz-do-not-send="true" href="http://eavesdrop.openstack.org/meetings/hyper_v/2012/hyper_v.2012-09-11-15.00.html">http://eavesdrop.openstack.org/meetings/hyper_v/2012/hyper_v.2012-09-11-15.00.html</a><o:p></o:p> Minutes (text): <a moz-do-not-send="true" href="http://eavesdrop.openstack.org/meetings/hyper_v/2012/hyper_v.2012-09-11-15.00.txt">http://eavesdrop.openstack.org/meetings/hyper_v/2012/hyper_v.2012-09-11-15.00.txt</a><o:p></o:p> Log: <a moz-do-not-send="true" href="http://eavesdrop.openstack.org/meetings/hyper_v/2012/hyper_v.2012-09-11-15.00.log.html">http://eavesdrop.openstack.org/meetings/hyper_v/2012/hyper_v.2012-09-11-15.00.log.html</a><o:p></o:p> <o:p> </o:p> <o:p> </o:p> Peter J. Pouliot, CISSP<o:p></o:p> Senior SDET, OpenStack<o:p></o:p> <o:p> </o:p> Microsoft <o:p></o:p> New England Research & Development Center<o:p></o:p> One Memorial Drive,Cambridge, MA 02142<o:p></o:p> <a moz-do-not-send="true" href="mailto:PPOULIOT@microsoft.com">PPOULIOT@microsoft.com</a> | Tel: +1(857) 453 6436<o:p></o:p> <o:p> </o:p> </div> </div> </div> </div> </body> </html>