keystone.pp missing selinux boolean authlogin_nsswitch_use_ldap

[plieb]

On selinux enabled systems, domain creation will fail unless authlogin_nsswitch_use_ldap is set to true in keystone.pp.

To reproduce:
1. Deploy an LDAP server
2. Create a domain
3. Create a domain-specific LDAP backend template per https://docs.openstack.org/developer/tripleo-docs/advanced_deployment/domain_specific_ldap_backends.html
4. Deploy the overcloud with selinux enabled
5. test domain access via keystone v3

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/469877

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/469877
Committed: https://git.openstack.org/cgit/openstack/puppet-tripleo/commit/?id=90704a6017f7c539e3c1fed038ed247763619380
Submitter: Jenkins
Branch: master

commit 90704a6017f7c539e3c1fed038ed247763619380
Author: Jacob Liberman <email address hidden>
Date: Thu Jun 1 09:33:21 2017 -0500

    Add conditional for setting authlogin_nsswitch_use_ldap selboolean

    If selinux is enabled the authlogin_nsswitch_use_ldap Boolean must
    be enabled. This setting allows LDAP communications to the confined
    LDAP/server port. This change includes a conditional for enabling this
    Boolean only when selinux is in use.

    Change-Id: If985f2434d28fcd33198929bf61f2a3a82e601fe
    Closes-Bug: #1695002

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/ocata
Review: https://review.openstack.org/470164

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/470164
Committed: https://git.openstack.org/cgit/openstack/puppet-tripleo/commit/?id=7ea37eaadc8f6daf5524c20cb6dfa7ee525c966f
Submitter: Jenkins
Branch: stable/ocata

commit 7ea37eaadc8f6daf5524c20cb6dfa7ee525c966f
Author: Jacob Liberman <email address hidden>
Date: Thu Jun 1 09:33:21 2017 -0500

    Add conditional for setting authlogin_nsswitch_use_ldap selboolean

    If selinux is enabled the authlogin_nsswitch_use_ldap Boolean must
    be enabled. This setting allows LDAP communications to the confined
    LDAP/server port. This change includes a conditional for enabling this
    Boolean only when selinux is in use.

    Change-Id: If985f2434d28fcd33198929bf61f2a3a82e601fe
    Closes-Bug: #1695002
    (cherry picked from commit 90704a6017f7c539e3c1fed038ed247763619380)

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/puppet-tripleo 7.1.0 release.

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/puppet-tripleo 6.5.0 release.