keystone charm should expose chase_referrals setting

[Brad Marshall]

To assist in making LDAP more usable, the keystone charm should expose the chase_referrals configuration as a juju config setting. This is particularly useful when using Active Directory domains as an authentication source.

This setting can be either a boolean, or unset to use the systems default behaviour.

[Brad Marshall (brad-marshall)]

Note our use case for this is for use with multiple ldap domains, I believe there's work to create a subordinate charm in planning for this. I did notice we can use the ldap-config-flags option to do it, but thats only if the identity_backend is set to ldap, which is not the case for us.

[James Page (james-page)]

https://github.com/openstack/charm-keystone-ldap

[James Page (james-page)]

I'm loath to put more feature into the v2 LDAP support directly into the keystone charm as I think its a perfect use case for a domain specific identity driver - as provided by the keystone-ldap charm.

[Brad Marshall (brad-marshall)]

That's fine, at the time I wasn't sure where the LDAP keystone driver was going to be, but if we can use the ldap-config-flags on it as seems to be in the charm-keystone-ldap, that should be sufficient to us. As long as the value gets set for the domains, I'm happy.