Configurable actions on LDAP backend in users, tenants and roles

[Jose Castro Leon]

In our environment we have an enterprise identity service that uses Active Directory, and manages the complete lifecycle of an account. LDAP backend allows to create accounts and there is no way to disable this behaviour. The proposal is to have some extra parameters that allows to disable user operations so we can still rely on our enterprise identity service and use the accounts from AD as well.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/13339

[Ivan Bondarev (vanch-deactivatedaccount)]

This should be controlled by domain policies of ldap_user, isn't it?

[Jose Castro Leon (jose-castro-leon)]

You can use a read-only account on this part of the tree using LDAP permissions, and receive a nice exception in every operation that you do on user create, update and delete. This is another security measure if the LDAP permissions are not set or badly configured.

[Ivan Bondarev (vanch-deactivatedaccount)]

You can also raise nice exception on rights absence. And "one more check"... I still think it's bad. We shouldn't rely AD management on keystone.

[Jose Castro Leon (jose-castro-leon)]

As suggested by Adam Young, the implementation will allow configure actions on Tenants and Roles as well

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/13339
Committed: http://github.com/openstack/keystone/commit/8152c2cb8698ce1fc868c02f2fa4d4301afc5738
Submitter: Jenkins
Branch: master

commit 8152c2cb8698ce1fc868c02f2fa4d4301afc5738
Author: Jose Castro Leon <email address hidden>
Date: Thu Sep 20 09:15:05 2012 +0200

    Configurable actions on LDAP backend in users Active Directory (bug 1052929)

    Change-Id: I99092eb4aee3b3b1b9cf297561577f1915c0e886

[Thierry Carrez (ttx)]

Do not set to FixReleased until the fix is released in a milestone, thanks. This will be done automatically.