OpenStack Identity (keystone)

Cannot create global roles in LDAP assignment backend

Bug #1285136 reported by Jose Castro Leon
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
OpenStack Identity (keystone)
In Progress
Wishlist
Marcos Lobo

Bug Description

When using the ldap assignment backend, there is no possibility to assign a role to a user without a tenant (global role)
This behavior is completely different to SQL that allows that functionality. In LDAP it just simply fails requiring a tenant_id.

Jose Castro Leon (jose-castro-leon)
Changed in keystone:
assignee: nobody → Jose Castro Leon (jose-castro-leon)
Marcos Lobo (marcos-fermin-lobo)
Changed in keystone:
assignee: Jose Castro Leon (jose-castro-leon) → Marcos Lobo (marcos-fermin-lobo)
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to keystone (master)

Fix proposed to branch: master
Review: https://review.openstack.org/76568

Changed in keystone:
status: New → In Progress
Revision history for this message
Dolph Mathews (dolph) wrote :

SQL isn't intended to allow "global" role assignments either (rather, we support domain-level role assignments that are inherited by owned projects), so I'm a little confused about the precedence for this.

Changed in keystone:
importance: Undecided → Wishlist
Revision history for this message
Adam Young (ayoung) wrote :

There are no global roles. Only domain scoped roles.

Changed in keystone:
status: In Progress → Invalid
Revision history for this message
Jose Castro Leon (jose-castro-leon) wrote :

I think that's the only way to support domain scoped roles on the LDAP assignment backend if it is enabled in a multi backend setup.

OpenStack Infra (hudson-openstack)
Changed in keystone:
status: Invalid → In Progress
Revision history for this message
Steve Martinelli (stevemar) wrote :

we'll be deprecating all LDAP backends that aren't identity

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.