required ldap configs not explicitly defined in config.yaml

[Alex H]

The keystone-ldap charm should explicitly specify necessary ldap configuration values which are currently being set as part of ldap-config-flags. This creates a template for proper configuration which can then be enforced by the charm, and also increases charm usability in the case of a user that might be less experienced with ldap configuration.

Certain required configs, such as user_filter, user name attribute, user id attribute, group tree dn, group name attribute, group id attribute definitely need to be explicitly set in config.yaml, though other frequently used values should be included as well, with a suggested list below:

query_scope - default to 'sub'
user_tree_dn: default to 'ou=users,dc=example,dc=com'
user_filter: default to '(memberof=cn=openstack_group,ou=groups,dc=example,dc=com)'
user_name_attributes: default to uid
user_id_attribute: default to uidNumber
user_objectclass: default to posixAccount
group_tree_dn: default to 'ou=groups,dc=example,dc=com'
group_objectclass: default to 'posixGroup'
group_id_attributes: default to 'gidNumber'
user_enabled_emulation | user_enabled_emulation_dn | user_enabled_attribute | user_enabled_flags | user_enabled_attribute_reverse (spelling on some of these unknown) should be something the charm handles consciously.

The full list of ldap config values can be found at https://docs.openstack.org/keystone/pike/admin/identity-integrate-with-ldap.html

[Corey Bryant (corey.bryant)]

Thanks Alex, this would be a nice addition to the charm.

[Hemanth Nakkina (hemanth-n)]

In addition to the above mentioned configs, it is good to have LDAP connection timeout configurations to be explicitly defined.

- connection_timeout
- pool_connection_timeout (when ldap pools are used)

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.opendev.org/748364

[Hemanth Nakkina (hemanth-n)]

Code submitted for review https://review.opendev.org/748364

The default values for the new configuration parameters are made in sync with the upstream keystone ldap config option default values.

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/748364
Committed: https://opendev.org/openstack/charm-keystone-ldap/commit/65bb510b519f677ae03cc828100f545d476be667
Submitter: Zuul
Branch: master

commit 65bb510b519f677ae03cc828100f545d476be667
Author: Hemanth Nakkina <email address hidden>
Date: Thu Aug 27 12:20:22 2020 +0530

    Explicitly define ldap configurations

    Add new options to keystone-ldap charm to explicitly specify
    necessary ldap configuration values. The default values for
    the new configuration parameters introduced in this patch are
    empty so the default upstream keystone ldap config options are
    used when undeclared.

    If the same LDAP config options are specified in
    ldap-config-flags and the respective charm config
    option, then the value from the charm config option
    will be used.

    Func-Test-Pr: https://github.com/openstack-charmers/zaza-openstack-tests/pull/458
    Change-Id: Ib269e74c7d313d9c6d09da29661dd279995dffe4
    Closes-Bug: #1832765

[Aurelien Lourot (aurelien-lourot)]

This needs some small re-working, see discussions in:
https://review.opendev.org/#/c/763541/
https://github.com/openstack-charmers/zaza-openstack-tests/pull/458