Wikimedia Cloud Services team/EnhancementProposals/Neutron SDN/ldap
Open Questions
- "service_role": "role:service", exists in /etc/keystone/policy.json but we don't define a service role?
---
Do we use keystone groups for anything?
Glance admin role?
General service user roles and assignments?
What's our domain? multiple domains?
What roles do we have and where are they assigned?
- The possibility of having multiple domains came with version 3 of the Keystone API.
What version of keystone api? (v2 or v3)
- keystone has the concept of groups?
"Keystone added a new abstraction, called a Domain, that could provide the ability to isolate the visibility of a set of Projects and Users (and User Groups) to a specific organization."
As of the Juno release, Keystone supports multiple Identity backends for the V3 Identity API.
As of Liberty, roles are not domain scoped, but this could change in the future.
- getting keystone cli util to work
- Authorization Failed: The resource could not be found. (HTTP 404) (Request-ID: req-a170d956-c868-48e0-98da-26d368b03798)
Keystone
https://docs.openstack.org/admin-guide/identity-integrate-with-ldap.html
http://www.thegeekstuff.com/2015/02/openldap-add-users-groups
http://www.lichteblau.com/ldapvi/
http://www.lichteblau.com/ldapvi/manual/
https://www.chriscantwell.co.uk/2009/11/using-ldapvi-to-quickly-modify-ldap-directories/
root@labtestcontrol2001:~# openstack role list
+----------------------------------+--------------+
| ID | Name |
+----------------------------------+--------------+
| 7db0d1d2a27f4e7f8afc45bdf19aaf59 | observer |
| 8284c7e1155a464c818cf1eacf008c23 | user |
| 8e86568d85984eda8ff44532f99e9304 | admin |
| cb17fb40e2ef4cdd99956cd771b1799a | projectadmin |
| eb3fb807ab684f3d9fa77eed65bc0817 | glanceadmin |
+----------------------------------+--------------+
LDAP vs Keystone: identify and assignemnt
https://docs.openstack.org/developer/keystone/configuration.html#read-only-ldap
https://www.mattfischer.com/blog/?p=545
openstack role assignment list -- bastion vs non?
https://adam.younglogic.com/2013/10/read-only-ldap-in-keystone/
ldap assignment (we don't use this)
http://sergslipushenko.github.io/html_doc/keystone_integrate_assignment_backend_ldap.html
LDAP OU
1 ou=people,dc=wikimedia,dc=org
2 ou=netgroup,dc=wikimedia,dc=org
3 ou=sudoers,dc=wikimedia,dc=org
4 ou=hosts,dc=wikimedia,dc=org
5 ou=profile,dc=wikimedia,dc=org
9 ou=groups,dc=wikimedia,dc=org
43 ou=projects,dc=wikimedia,dc=org
172 ou=roles,dc=wikimedia,dc=org
496 ou=servicegroups,dc=wikimedia,dc=org
497 ou=people,ou=servicegroups,dc=wikimedia,dc=org
LDAP (via wikitech) Creation
neutronone
+8391 uid=neutronone,ou=people,dc=wikimedia,dc=org
+uid: neutronone
+sn: Neutronone
+cn: Neutronone
+userPassword: {SHA}xT+zGZAmaKGFkoAWtJLlcA8dnYA=
+objectClass: inetOrgPerson
+objectClass: person
+objectClass: ldapPublicKey
+objectClass: posixAccount
+objectClass: shadowAccount
+uidNumber: 14005
+gidNumber: 500
+homeDirectory: /home/neutronone
+loginShell: /bin/bash
+mail: cpettet+neutronone@wikimedia.org
-------
root@labtestcontrol2001:~# openstack user create --domain default --password-prompt neutronone
User Password:
Repeat User Password:
Conflict occurred attempting to store user - Duplicate name, neutronone. (HTTP 409) (Request-ID: req-c9d0fca0-07ca-4057-9e9d-043a721b6d44)
root@labtestcontrol2001:~# openstack role add --project service --user neutronone admin
No project with a name or ID of 'service' exists.
root@labtestcontrol2001:~# openstack role add --project admin --user neutronone admin
root@labtestcontrol2001:~#
root@labtestcontrol2001:~# openstack service create --name neutron \
> --description "OpenStack Networking" network
+-------------+----------------------------------+
| Field | Value |
+-------------+----------------------------------+
| description | OpenStack Networking |
| enabled | True |
| id | 21777ec0152245919cea3bfd17781d98 |
| name | neutron |
| type | network |
+-------------+----------------------------------+
openstack endpoint create --region codfw \
network public <nowiki>http://labtestnet2001.codfw.wmnet:9696</nowiki>
openstack endpoint create --region codfw \
network internal <nowiki>http://labtestnet2001.codfw.wmnet:9696</nowiki>
openstack endpoint create --region codfw \
network admin <nowiki>http://labtestnet2001.codfw.wmnet:9696</nowiki>
openstack endpoint list | grep network