<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"> <head> <meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> <meta name="Generator" content="Microsoft Word 12 (filtered medium)"> <style>  </style> </head> <body lang="EN-US" link="blue" vlink="purple"> <div class="Section1"> You are best off working directly with the upstream project, at http://www.openstack.org<o:p></o:p> They have a good wiki page on how to contribute here: http://wiki.openstack.org/HowToContribute<o:p></o:p> <o:p> </o:p> After dealing with contributor agreements and Launchpad accounts, this probably needs a Blueprint (feature) to be created/approved.<o:p></o:p> <o:p> </o:p> <div> Regards,<o:p></o:p> John Haller<o:p></o:p> </div> <o:p> </o:p> <div style="border:none;border-left:solid blue 1.5pt;padding:0in 0in 0in 4.0pt"> <div> <div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in"> From: rhos-list-bounces@redhat.com [mailto:rhos-list-bounces@redhat.com] On Behalf Of Jose Castro Leon Sent: Wednesday, September 12, 2012 10:03 AM To: rhos-list@redhat.com Cc: Peter Pouliot (ppouliot@microsoft.com); joe.heck@nebula.com Subject: [rhos-list] Openstack LDAP/AD integration at CERN<o:p></o:p> </div> </div> <o:p> </o:p> Hi,<o:p></o:p> During last days, I had a look on the LDAP module to try to make it work with AD, in order to see if there is any missing part that we could contribute.<o:p></o:p> Here at CERN the identity management is heavily based on Active Directory and we are interested in having that feature in Openstack.<o:p></o:p> With the help of some of my colleagues, I was able to configure the LDAP module in order to make it work with Active Directory.<o:p></o:p> <o:p> </o:p> I saw that there is much more configuration available on Folsom on the LDAP module, that helps a bit but there is some more configuration hardcoded.<o:p></o:p> We had prepared some patches in order to expose the configuration to keystone.conf while maintaining compatibility with openLDAP<o:p></o:p> <o:p> </o:p> We would like to know how to proceed in order to contribute to the community.<o:p></o:p> <o:p> </o:p> Active Directory<o:p></o:p> <![if !supportLists]>· <![endif]>Schema is Windows 2008 (Active Directory + Services for Unix)<o:p></o:p> <![if !supportLists]>· <![endif]>Small change on roleOccupant class (let it have a groupOfNames superior)<o:p></o:p> <o:p> </o:p> List of Patches<o:p></o:p> <o:p> </o:p> <![if !supportLists]>1. <![endif]>Move ‘dumb_member ‘ account to be a configuration parameter<o:p></o:p> <![if !supportLists]>2. <![endif]>Create configuration attributes for user mapping (name, mail)<o:p></o:p> <![if !supportLists]>3. <![endif]>Create configuration attributes for tenant mapping (name, description)<o:p></o:p> <![if !supportLists]>4. <![endif]>Create attribute ignore configuration to specify the attributes that are not mapped with LDAP (user,tenant,role)<o:p></o:p> <![if !supportLists]>5. <![endif]>Bugfix on get_users(self, tenant_id, role_id=None)<o:p></o:p> If a user is a member of a tenant and also in a role it appears twice when called<o:p></o:p> <o:p> </o:p> As an additional patch, we can put a filter in all user queries to reduce the amount of data that is returned when the list of users is retrieved.<o:p></o:p> We have more than 40000 accounts at CERN, and we need something to don’t make dashboard and keystone unusable due to the amount of users on<o:p></o:p> the system.<o:p></o:p> <o:p> </o:p> Kind regards,<o:p></o:p> <o:p> </o:p> Jose Castro Leon<o:p></o:p> CERN IT-OIS-IN tel: +41.22.76.74272<o:p></o:p> mob: +41.76.48.79222<o:p></o:p> fax: +41.22.76.67955<o:p></o:p> Office: 31-R-021 CH-1211 Geneve 23<o:p></o:p> email: <a href="mailto:jose.castro.leon@cern.ch">jose.castro.leon@cern.ch</a><o:p></o:p> <o:p> </o:p> </div> </div> </body> </html>