LDAP Referrals were returned and ignored

[Divya K Konoor]

I am using OpenStack with a Windows Active Directory Server, such that the [LDAP] chase referrals attribute is set to True. The LDAP search flow reaches the convert_ldap_result(ldap_result) function inside https://github.com/openstack/keystone/blob/master/keystone/identity/backends/ldap/common.py and the search returns one or more referrals as well. The flow logs the below:

https://github.com/openstack/keystone/blob/master/keystone/identity/backends/ldap/common.py#L180-L182

if at_least_one_referral:
        LOG.debug('Referrals were returned and ignored. Enable referral '
'chasing in keystone.conf via [ldap] chase_referrals')

In my case, the above statement does get logged but the log statement is either incorrect or misleading. There are 2 problems here >>
1. Why does the ldap search bother to search and return referrals if they are going to be ignored anyway?
2. The above message also leads us to believe that the referrals were ignored because the value of chase referrals was False, which is clearly not the case here.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/619336

[Lance Bragstad (lbragstad)]

Unassigning myself for now in case anyone has time to pick up what's in review [0].

[0] https://review.openstack.org/#/c/619336/

[OpenStack Infra (hudson-openstack)]

Change abandoned by Lance Bragstad (<email address hidden>) on branch: master
Review: https://review.opendev.org/619336
Reason: Abandoning this since I haven't updated it in over a year. Someone is more than welcome to pick this up and carry it forward.