Keystone Havana Authentication Error using samAccountName in Active Directory
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
OpenStack Identity (keystone) |
Fix Released
|
Low
|
Nathan Kinder | ||
Icehouse |
Fix Released
|
Low
|
Nathan Kinder |
Bug Description
When using Active Directory as the LDAP backend for Keystone, if I use the cn attribute for user_id_attribute and user_name_
Authorization Failed: An unexpected error prevented the server from fulfilling your request. 'name' (HTTP 500)
and the login screen in Horizon shows: An error occurred authenticating. Please try again later.
Also, the following trace is shown in the keystone.log:
2014-02-17 06:48:37.472 8207 ERROR keystone.
2014-02-17 06:48:37.472 8207 TRACE keystone.
2014-02-17 06:48:37.472 8207 TRACE keystone.
2014-02-17 06:48:37.472 8207 TRACE keystone.
2014-02-17 06:48:37.472 8207 TRACE keystone.
2014-02-17 06:48:37.472 8207 TRACE keystone.
2014-02-17 06:48:37.472 8207 TRACE keystone.
2014-02-17 06:48:37.472 8207 TRACE keystone.
2014-02-17 06:48:37.472 8207 TRACE keystone.
2014-02-17 06:48:37.472 8207 TRACE keystone.
2014-02-17 06:48:37.472 8207 TRACE keystone.
2014-02-17 06:48:37.472 8207 TRACE keystone.
2014-02-17 06:48:37.472 8207 TRACE keystone.
2014-02-17 06:48:37.472 8207 TRACE keystone.
2014-02-17 06:48:37.474 8207 INFO access [-] 192.168.1.128 - - [17/Feb/
It appears that the user_ref has no 'name' property when I try to use samAccountName. This seems to have worked in Grizzly but does not work in Havana. Below are the applicable lines from the keystone.conf:
[ldap]
query_scope = sub
url = LDAP://
user = CN=ldapuser,
password = ldapuserpassword
suffix = DC=mydomain,DC=net
use_dumb_member = True
dumb_member = CN=ldapuser,
user_tree_dn = CN=Users,
user_objectclass = organizationalP
user_id_attribute = samAccountName
user_name_attribute = samAccountName
user_mail_attribute = mail
user_enabled_
user_enabled_mask = 2
user_enabled_
user_attribute_
user_allow_create = False
user_allow_update = False
user_allow_delete = False
tenant_tree_dn = OU=Projects,
tenant_objectclass = organizationalUnit
tenant_id_attribute = ou
tenant_
tenant_
tenant_
tenant_
tenant_
tenant_allow_create = True
tenant_allow_update = True
tenant_allow_delete = True
role_tree_dn = OU=Roles,
role_objectclass = organizationalRole
role_id_attribute = cn
role_name_attribute = cn
role_member_
role_allow_create = True
role_allow_update = True
role_allow_delete = True
Again, if I change the user_id_attribute and the user_name_attribute to cn then everything works fine. Please advise. Thanks!
tags: | added: havana-backport-potential |
Changed in keystone: | |
importance: | Undecided → Low |
status: | New → Triaged |
Changed in keystone: | |
assignee: | Dolph Mathews (dolph) → Adam Young (ayoung) |
tags: | added: icehouse-backport-potential |
tags: |
added: ldap removed: active directory |
tags: | removed: icehouse-backport-potential |
Changed in keystone: | |
milestone: | none → juno-1 |
status: | Fix Committed → Fix Released |
Changed in keystone: | |
milestone: | juno-1 → 2014.2 |
I've discovered that other attributes work besides cn, including sn and gecos, but samAccountName doesn't work. This makes me think that it's got something to do with a schema definition somewhere, but I'm still digging around trying to find it. I'm running keystone havana on Ubuntu 12.04.4 LTS