Unable to retrieve LDAP domain user and group list on Horizon.

[Alexander Nagovitsyn]

I'm using openstack 7.0 with LDAP plugin " ldap-1.0-1.0.0-1.noarch.rpm"

I need add LDAP user on new project on keystone.tld domain. Project creation on this domain working fine, but when i tryed to add LDAP users on this project i see an error: "Unable to retrieve LDAP domain user/group list "

https://screencloud.net/v/xS09

I can not use a user unless add him to the project

On version 1.0.0 LDAP plugin this working fine, without critical problems.

When i use CLI, i see erorr:
openstack --os-auth-url http://172.16.0.3:5000/v3 --os-username Administrator --os-password Pass1234 --os-user-domain-name keystone.tld user list
ERROR: openstack Expecting to find domain in project - the server could not comply with the request since it is either malformed or otherwise incorrect. The client is assumed to be in error. (HTTP 400) (Request-ID: req-8f456d5d-afba-4289-957a-4eed91ee75cc)

Log message on FuelUI (get all avaliable users on project):
GET http://192.168.0.2:35357/v3/users?domain_id=19bca8582eae47b891e6b9d45fd6225b&default_project_id=ae96f8daec6c405a9e3b5d509a39db83 HTTP/1.1" 500 143 keystoneclient.session: DEBUG: RESP: keystoneclient.session: DEBUG: Request returned failure status: 500

Mirantis LDAP server 172.16.57.146 working fine.

My LDAP settings:

[ldap]
suffix=dc=keystone,dc=tld
query_scope=sub
user_id_attribute=cn
user=cn=Administrator,cn=Users,dc=keystone,dc=tld
user_objectclass=person
user_name_attribute=cn
password=Pass1234
user_allow_delete=False
user_tree_dn=dc=keystone,dc=tld
user_pass_attribute=userPassword
user_enabled_attribute=enabled
user_allow_create=False
user_allow_update=False
user_filter=
url=ldap://172.16.57.146

[Vasyl Saienko (vsaienko)]

Please provide diagnostic snapshot.

[Alexander Nagovitsyn (gluk12189)]

Here he is
https://drive.google.com/file/d/0B5xW3hFynCJlXzhuWE5Ic3VHYlk/view?usp=sharing

[Alexander Nagovitsyn (gluk12189)]

wont to add:
i using rpm from https://mirantis.jira.com/browse/MU-343

I took the old version on git hub repo

[Alexander Nagovitsyn (gluk12189)]

Empirically, I found that the cause of the problem is the installation of the base operating system on controller

[Alexander Nagovitsyn (gluk12189)]

and also MongoDB role on comtroller affects ldap plugin

[Alexander Nagovitsyn (gluk12189)]

I tried to deploy 2 nodes with cinder + base os roles on controller and cinder on compute. And got a error:
http://screencloud.net/v/97SJ
http://screencloud.net/v/EKi

[Steve Martinelli (stevemar)]

im marking keystone as invalid for now since this seems like it's fuel related, update if i'm incorrect

[Irina Povolotskaya (ipovolotskaya)]

I'm adding Ivan as Vasyl Saienko pointed at him being the plugin developer.
Ivan, please let me know if you're the right contact there.

We still do need to investigate this issue and understand how critical this is.

[Max Yatsenko (myatsenko)]

The possibility to assign "Controller"and "Operating System" roles simultaniosly (or "Compute" and "Operating System" roles) to a node - it looks like a bug. I have created a bug about it:

https://bugs.launchpad.net/fuel/+bug/1521706

[Irina Povolotskaya (ipovolotskaya)]

Max, so the issue is caused by Fuel?
I suppose, this needs to be documented in the Plugin Guide.

[Max Yatsenko (myatsenko)]

Fuel team marked https://bugs.launchpad.net/fuel/+bug/1521706 bug as invalid and
it was told it shouldn't affect ldap plugin installation.
I continue to deploy test environment to reproduce the issue .

[Max Yatsenko (myatsenko)]

The bug was not reproduce on the following configurations:

MOS 7.0

1. Openstack cluster configuration:
Hypervisor: Qemu
Network: Neutron with VLAN segmentation
Storage Backends: No, use default providers
3xController, Storate-Cinder, Operating System
2xCompute,Storage-Cinder

LDAP plugin was cloned from https://github.com/openstack/fuel-plugin-ldap,
the plugin was built by using: "fpb --build fuel-plugin-ldap/" command
and installed by "fuel plugins --install ldap-1.0-1.0.0-1.noarch.rpm" command.

2. Openstack cluster configuration:
Hypervisor: Qemu
Network: Neutron with VLAN segmentation
Storage Backends: No, use default providers
3xController,Telemetry-MongoDB
2xCompute

LDAP plugin was cloned from https://github.com/openstack/fuel-plugin-ldap,
the plugin was built by using: "fpb --build fuel-plugin-ldap/" command
and installed by "fuel plugins --install ldap-1.0-1.0.0-1.noarch.rpm" command.

[Max Yatsenko (myatsenko)]

The bug was not reproduces, due to this reason a status will be set to "Invalid".

[Max Yatsenko (myatsenko)]

Las update:
as this bug was not reproduced, a status of this bug was set to
Invalid on 2015-12-09.

On Wed, Dec 2, 2015 at 12:44 PM, Irina Povolotskaya
<email address hidden> wrote:
> Max, so the issue is caused by Fuel?
> I suppose, this needs to be documented in the Plugin Guide.
>
> --
> You received this bug notification because you are subscribed to the bug
> report.
> https://bugs.launchpad.net/bugs/1512744
>
> Title:
> Unable to retrieve LDAP domain user and group list on Horizon.
>
> Status in Fuel Plugins:
> New
> Status in OpenStack Identity (keystone):
> Invalid
>
> Bug description:
> I'm using openstack 7.0 with LDAP plugin "
> ldap-1.0-1.0.0-1.noarch.rpm"
>
> I need add LDAP user on new project on keystone.tld domain. Project
> creation on this domain working fine, but when i tryed to add LDAP
> users on this project i see an error: "Unable to retrieve LDAP domain
> user/group list "
>
> https://screencloud.net/v/xS09
>
> I can not use a user unless add him to the project
>
> On version 1.0.0 LDAP plugin this working fine, without critical
> problems.
>
> When i use CLI, i see erorr:
> openstack --os-auth-url http://172.16.0.3:5000/v3 --os-username Administrator --os-password Pass1234 --os-user-domain-name keystone.tld user list
> ERROR: openstack Expecting to find domain in project - the server could not comply with the request since it is either malformed or otherwise incorrect. The client is assumed to be in error. (HTTP 400) (Request-ID: req-8f456d5d-afba-4289-957a-4eed91ee75cc)
>
> Log message on FuelUI (get all avaliable users on project):
> GET http://192.168.0.2:35357/v3/users?domain_id=19bca8582eae47b891e6b9d45fd6225b&default_project_id=ae96f8daec6c405a9e3b5d509a39db83 HTTP/1.1" 500 143 keystoneclient.session: DEBUG: RESP: keystoneclient.session: DEBUG: Request returned failure status: 500
>
> Mirantis LDAP server 172.16.57.146 working fine.
>
> My LDAP settings:
>
> [ldap]
> suffix=dc=keystone,dc=tld
> query_scope=sub
> user_id_attribute=cn
> user=cn=Administrator,cn=Users,dc=keystone,dc=tld
> user_objectclass=person
> user_name_attribute=cn
> password=Pass1234
> user_allow_delete=False
> user_tree_dn=dc=keystone,dc=tld
> user_pass_attribute=userPassword
> user_enabled_attribute=enabled
> user_allow_create=False
> user_allow_update=False
> user_filter=
> url=ldap://172.16.57.146
>
> To manage notifications about this bug go to:
> https://bugs.launchpad.net/fuel-plugins/+bug/1512744/+subscriptions