keystone user-update with ldap not working

[Andre Naehring]

Using ldap as backend for keystone it is possible to add users, but updating them is not possible.

First example, driver is "driver = keystone.identity.backends.sql.Identity":

oscontroller:/etc/keystone # keystone user-update --enabled=false 336ad698c2e2457bb980f5b113dba7ef
User has been updated.

This is using LDAP ( "keystone.identity.backends.ldap.Identity"):

# keystone user-update --enabled=true a31ae867e31d444e8ef517f5a1a98012
No handlers could be found for logger "keystoneclient.client"
Unable to update user: An unexpected error prevented the server from fulfilling your request. 'name' (HTTP 500)

[Jose Castro Leon (jose-castro-leon)]

There is no mapping yet to the property enabled in ldap. Maybe this is the reason that it does not work

[Joseph Heck (heckj)]

If the back-end doesn't implement the relevant feature (i.e. modifing the enabled field in this case), then the service should at least return a 501 NotImplemented or 505 NotSupported rather than a generic 500 error.

[Jose Castro Leon (jose-castro-leon)]

In the latest update, I have included the enabled field capability could you please recheck?
There is some documentation to read because not all LDAP servers handle that field with the same way (specially AD)

[Brant Knudson (blk-u)]

This is fixed with https://review.openstack.org/#/c/19813/

[Dolph Mathews (dolph)]

I believe this was fixed by the above.