Document the LDAP Identity Driver

Configuring the LDAP Identity Provider
===========================================================

Keystone can Use a Directory server to provide the Identity service. An example Schema
for openstack would look like this::

  dn: cn=openstack,cn=org
  dc: openstack
  objectClass: dcObject
  objectClass: organizationalUnit
  ou: openstack

  dn: ou=Groups,cn=openstack,cn=org
  objectClass: top
  objectClass: organizationalUnit
  ou: groups

  dn: ou=Users,cn=openstack,cn=org
  objectClass: top
  objectClass: organizationalUnit
  ou: users

  dn: ou=Roles,cn=openstack,cn=org
  objectClass: top
  objectClass: organizationalUnit
  ou: users

The corresponding entries in the configuration file are::

  [ldap]
  url = ldap://localhost
  suffix = dc=openstack,dc=org
  user = dc=Manager,dc=openstack,dc=org
  password = badpassword

A couple of questions:

Does the [ldap] section go into the keystone.conf file?

What are the basic requirements on the LDAP side?

There are many variations on LDAP, so I tried to keep the documentation as Neutral as possible. Assuming a development setup for OpenLDAP has worked in the past, but should probably not be documented in the application itself, but rather on the Keystone or Openstack sites.

Yes, the [ldap] section goes in the keystone.conf file. I have updated to specify that.

On the LDAP side, the user would need to ldapadd a schema as described by the first comment in the ticket. I is pretty straight forward, and should be understandable by anyone comfortable with LDAP.

Reviewed: https://review.openstack.org/5237
Committed: http://github.com/openstack/keystone/commit/5b3e05bbabd5366461630327e4498fe582ff8ab7
Submitter: Jenkins
Branch: master

commit 5b3e05bbabd5366461630327e4498fe582ff8ab7
Author: Adam Young <email address hidden>
Date: Wed Mar 7 16:04:32 2012 -0500

    added LDAP section to architecture and architecture

    https://bugs.launchpad.net/keystone/+bug/949521

    Bug 949521

    Change-Id: I2e37c0d946e3d97a2c4bc4bf4a50bd94466f70c2

LDAP setup document started here

http://www.debuntu.org/ldap-server-and-linux-ldap-clients