When enabling LDAP , the playbooks stop due to the read-only nature of the LDAP setup.
Ideally we would skip those tasks assuming the sevice user have been created inside LDAP already
TASK: [os_keystone | Ensure Admin user] ***************************************
Result from run 1 is: {'msg': 'OpenSSH_6.6.1, OpenSSL 1.0.1f 6 Jan 2014\r\ndebug1: Reading configuration data /etc/ssh/ssh_config\r\ndebug1: /etc/ssh/ssh_config line 19: Applying options for *\r\ndebug1: auto-mux: Trying existing master\r\ndebug1: mux_client_request_session: master session id: 2\r\nTraceback (most recent call last):\n File "<stdin>", line 2895, in <module>\n File "<stdin>", line 1284, in main\n File "<stdin>", line 460, in command_router\n File "<stdin>", line 720, in ensure_user\n File "<stdin>", line 660, in _get_user\n File "/usr/local/lib/python2.7/dist-packages/keystoneclient/utils.py", line 318, in inner\n return func(*args, **kwargs)\n File "/usr/local/lib/python2.7/dist-packages/keystoneclient/v3/users.py", line 108, in list\n **kwargs)\n File "/usr/local/lib/python2.7/dist-packages/keystoneclient/base.py", line 73, in func\n return f(*args, **new_kwargs)\n File "/usr/local/lib/python2.7/dist-packages/keystoneclient/base.py", line 361, in list\n self.collection_key)\n File "/usr/local/lib/python2.7/dist-packages/keystoneclient/base.py", line 113, in _list\n resp, body = self.client.get(url, **kwargs)\n File "/usr/local/lib/python2.7/dist-packages/keystoneclient/adapter.py", line 170, in get\n return self.request(url, \'GET\', **kwargs)\n File "/usr/local/lib/python2.7/dist-packages/keystoneclient/adapter.py", line 206, in request\n resp = super(LegacyJsonAdapter, self).request(*args, **kwargs)\n File "/usr/local/lib/python2.7/dist-packages/keystoneclient/adapter.py", line 95, in request\n return self.session.request(url, method, **kwargs)\n File "/usr/local/lib/python2.7/dist-packages/keystoneclient/utils.py", line 318, in inner\n return func(*args, **kwargs)\n File "/usr/local/lib/python2.7/dist-packages/keystoneclient/session.py", line 397, in request\n raise exceptions.from_response(resp, method, url)\nkeystoneclient.openstack.common.apiclient.exceptions.Unauthorized: The request you have made requires authentication. (HTTP 401) (Request-ID: req-b1e36888-0d67-4614-b4ee-c46d71fc9f0e)\n', 'failed': True, 'attempts': 1, 'parsed': False}
Probably a stupid question: When using LDAP is it always read-only or is it plausible that Keystone might be able to create users (like an Admin user)?