LDAP identity still allows setting domain via attribute

[Jamie Lennox]

At keystone/identity/backends/ldap.py:230 we allow mapping domain_id of a user based on the attribute specified in conf.ldap.user_domain_id_attribute which defaults to 'businessCategory'.

My understanding is that this is no longer required and should no longer be allowed and indeed in practice it completely overrides any domain information that is provided in the authentication body.

[Jamie Lennox (jamielennox)]

How does this also relate to user_domain_id_attribute and group_domain_id_attribute? These default to businessCategory and i now have a couple of projects set to the wrong domain (i'm still not sure how this was ever set wrong).

These are supposed to be domain scoped but if ldap is limited to the default domain (or one domain) surely these should be ignored and overwritten with the default domain?

[Dolph Mathews (dolph)]

This looks like it should be a havana release blocker

[David Stanek (dstanek)]

I can't find anything that uses user_domain_id_attribute in master. Is this still a problem?

[Dolph Mathews (dolph)]

Adam/Jamie- please correct me if I'm wrong, but my understanding is that any '*domain_id*' LDAP configuration should be unused at this point, as the LDAP driver now only supports a single domain (as we move towards https://blueprints.launchpad.net/keystone/+spec/multiple-ldap-servers ). Is that true?

Maybe the only work to do here is to un-document old configuration options such as keystone.conf [ldap] user_domain_id_attribute, and any similar domain_id attributes?

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/46207

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/47514

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/47514
Committed: http://github.com/openstack/keystone/commit/668ee718127a9983d4838b868efd44ddf661b533
Submitter: Jenkins
Branch: master

commit 668ee718127a9983d4838b868efd44ddf661b533
Author: Morgan Fainberg <email address hidden>
Date: Thu Sep 19 19:53:02 2013 -0700

    Remove ldap identity domain attribute options

    LDAP Identity backend is not domain aware, and therefore does not
    need mappings for the domain attributes for user and group.

    closes-bug: 1209440
    Change-Id: Ib7b77b90134322d04b5826b151d05535b9b8b7c7