When using per-domain-identity backend, user_ids could collide

[Morgan Fainberg]

When using the per-domain-identity backend usernames could end up colliding when multiple LDAP backends are used since we extract very limited information from the DN.

Example

cn=example user, dc=example1,dc=com
cn=example user, dc=example2,dc=com

Would net the same "user_id" of "example user"

This can also affect groups in the same manner.

[Morgan Fainberg (mdrnstm)]

This requires increasing the storage in the assignment backend (SQL) for the user_id followed by changing the way we calculate the user_id from DN.

[Dolph Mathews (dolph)]

Unassigning due to inactivity.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/74214

[Morgan Fainberg (mdrnstm)]

Fix to nova's Schema to not mis-match keystone's maximum user_id length: https://review.openstack.org/#/c/77450/

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/77450
Committed: https://git.openstack.org/cgit/openstack/nova/commit/?id=dbdb938fc08452ea80379652ee101b6ebe006e3f
Submitter: Jenkins
Branch: master

commit dbdb938fc08452ea80379652ee101b6ebe006e3f
Author: Morgan Fainberg <email address hidden>
Date: Sun Mar 2 13:43:47 2014 -0800

    Update user_id length to match Keystone schema in volume_usage_cache

    Update the maximum length to match the Keystone schema for maximum
    user_id length in volume_usage_cache. In the case that Keystone were
    to leverage the full varchar 64, there would potentially be data loss
    and/or collision of user_ids across records.

    This change originates from the conversation about increasing the
    length of user_ids in Keystone:

    http://lists.openstack.org/pipermail/openstack-dev/2014-February/028125.html

    Even with the length not changing, it is important to ensure there is no
    loss of data/resolution when relying on user_id to identify users uniquely.

    Closes-Bug: #1226171
    Change-Id: I05a5644a29d6e2432311c2ee5331970d5e8b0683

[Dolph Mathews (dolph)]

Moved to wishlist since we haven't merged a working per-domain-identity backend implementation yet.

[Dolph Mathews (dolph)]

Fixed in commit 1a50986e7c122afdc14d40aebb0c852b71bd99e1

https://review.openstack.org/#/c/74214/