Keystone ldap driver should allow for a mechanism to propogate ldap messages when needed
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
OpenStack Identity (keystone) |
New
|
Undecided
|
Unassigned |
Bug Description
The ldap driver overwrites any error messages seen during binding with User Name/Password invalid.
Need a mechanism to allow for propagating the messages further based on some configuration.
Example, ldap may be configured to lock an account on multiple auth failures, in such case the user should know his account is locked.
I did this by modifying code as follows.
"/usr/lib/
115 try:
116 self.identity_
117 context,
118 user_id=
119 password=
120 domain_
121 except AssertionError as e:
122 # authentication failed because of invalid username or password
123 msg = _('Invalid username or password')
124
125 if str(e) == "Error, Account is locked":
126 msg = _('Error, Account is locked')
vim /usr/lib/
53
54 def authenticate(self, user_id, password):
55 try:
56 user_ref = self._get_
57 except exception.
58 raise AssertionError(
59 if not user_id or not password:
60 raise AssertionError(
61 conn = None
62 try:
63 conn = self.user.
64 password)
65 if not conn:
66 raise AssertionError(
67 except ldap.UNWILLING_
68 raise AssertionError(
69 except Exception:
70 raise AssertionError(
71 finally:
72 if conn:
73 conn.unbind_s()
74 return identity.
This is pretty similar to bug #1365458. Suggest making bug #1365458 general enough to fit both cases if you need to and we can track the progress under one bug report.