TLS support for LDAP back end

[Adam Young]

There are two different ways to secure LDAP traffic: LDAPS and TLS. LDAPS is currently supported. However, Active Directory is going to require TLS support.

We need some way to specify the certificate. In nss_ldap syntax, this is one of:

tls_cacertfile /etc/ssl/ca.cert
tls_cacertdir /etc/openldap/cacerts

Additionally, you need a directive to state whether you intent to use SSL or START_TLS. Have an 'ldaps' URI is not enough, because that wouldn't leave you with a way to specify that you wish to connect to unencrypted port 389 and issue a START_TLS command. nss_ldap does one of:

ssl on
ssl start_tls

You need a way to specify whether the cert is required and should be validated:

tls_reqcert never | demand | allow

Have a look at the TLS functions of python-ldap:

http://www.python-ldap.org/doc/html/ldap.html#tls-options

[Adam Young (ayoung)]

LDAPS seems to work out of the box, provided the CA cert is set up properly.

I got it to work by doing this:

http://adam.younglogic.com/2012/09/ldaps-against-a-freeipa-server/

And changing the URL in the keystone.conf file to ldaps://

[Brad Topol (btopol)]

Adam with regards to "You need a way to specify whether the cert is required and should be validated:" Are these values that can just be pulled keystone.conf ?

[Adam Young (ayoung)]

Brad, yes, I think it should be out of the conf file. One value should specify if we are expecting TLS. If we are, we should always require and validate a cert. Backing off that rule can be an additional change, but I would prefer if we defaulted to the stronger crypto methd.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/25327

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/25327
Committed: http://github.com/openstack/keystone/commit/e4ec12e8118b92cbad9e2f287f111b6be8bb2705
Submitter: Jenkins
Branch: master

commit e4ec12e8118b92cbad9e2f287f111b6be8bb2705
Author: Brad Topol <email address hidden>
Date: Mon Mar 25 15:23:15 2013 -0500

    Add TLS Support for LDAP

    Fixes Bug1040115

    added several test cases, also provides a full ldap
    regression suite. Also added supplemental (simple)
    verification for CACERTFILE and CACERTDIR
    added a TLS disable option when ldaps URLs are used
    and did full regression tests using ldaps URLs
    and with TLS
    addresses ayoung's comments
    addresses dolphm's and Mouad's comments
    addresses gyee's doc request and bknudson's comments

    Change-Id: I639f2853df0ce5c10ae85b06214b26430d872aca