[RFE][keystone][idm/ldap backend]: is it possible to use nested group to authorize users ?

[Rohit Londhe]

Hello,

Keystone is interfaced with an LDAP backend (IDM) using a specific domain to authenticate/authorize users to access openstack APIs. We assign a role to a specific group to a specific project. In order to simplify IDM configuration, I would like to use nested group but I do not manage to configure it. I am not even sure it is possible.

In general/standard configuration keystone is looking up for groups with a direct membship for the user. When we use nested group, as the user is not a direct member it does not work.

Is there any option in keystone ldap configuration that could make keystone used "memberOf" attributes of the user (instead of the group_member_attribute) to determine the group membership.

Or Are there plans to get this added a feature in OpenStack?

[Colleen Murphy (krinkle)]

Have you tried turning on the group_ad_nesting option? I am not sure whether the AD implementation maps to the IdM implementation at all, but the idea seems similar. If that doesn't work, we could probably implement a similar option specific to IdM.

[Guang Yee (guang-yee)]

Can you please provide a specific example on what your group structure looks like in LDAP and the expected outcome?

[Launchpad Janitor (janitor)]

[Expired for OpenStack Identity (keystone) because there has been no activity for 60 days.]