[fuel-plugin-ldap] tls settings are required for ldap plugin

[Oleksii Aleksieiev]

Corporate ldap/AD servers are usually accessible via tls/ssl only.
Also its possible that internal CA certificate maybe used for ldap tls/ssl .

Plugin should allow users to upload custom CA file.

Plugin should upload the file to keystone node and update keystone config:

[ldap]
tls_cacertfile = /etc/keystone/path.to.CA.pem

[Simon Pasquier (simon-pasquier)]

Note that there is no way to upload a file in the Fuel UI for plugins. That being said, it should be possible to copy/paste the CA key in a text field.

[Max Yatsenko (myatsenko)]

TLS support was added to MOS7.0
patch https://review.openstack.org/#/c/281711/

[Oleksii Aleksieiev (alexzzman)]

Thanks for creating a the fix.

The CA chain field is dependent on settings:ldap.use_tls.value == true. This is not correct.
in ldap setting you may have ldaps://ldap server URL but tls disabled. This means ssl protocol will be used instead of tls and CA chain still may be needed.

The variable name tls_cacertfile may be confusing at this point but it still valid use case. This two options should be independent on each other.