support Keystone with read-only LDAP identity backend

[Richard Megginson]

Many organizations have LDAP servers with users that they want to use with OpenStack via Keystone, but they don't want Keystone to have write access to the LDAP server, they just want Keystone to be able to use the authentication, user, and group information. Puppet should have a way to install Keystone to use a read-only LDAP identity backend.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/133601

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/133601
Committed: https://git.openstack.org/cgit/stackforge/puppet-keystone/commit/?id=1b8010e44fb3a6ec8554dc813314e7e254378da9
Submitter: Jenkins
Branch: master

commit 1b8010e44fb3a6ec8554dc813314e7e254378da9
Author: Rich Megginson <email address hidden>
Date: Tue Oct 28 08:12:52 2014 -0600

    handle missing project/tenant when using ldap backend

    The project/tenant is only stored with the user when using
    the sql (default) backend. This means calls like user list
    and user show will not show the default project. For getting
    the project/tenant, if it is not present in the instances
    information provided by user list --long, we don't actually
    get the project/tenant, we just check to see if the user is
    assigned to the given tenant/project. For setting the
    project/tenant, this is usually done with user create, but when
    ldap is read-only, we have to use role add to add the user to a
    default _member_ role and at the same time assign the user to a
    given project/tenant. This also adds support for using the
    openstack $obj show commands which return --format shell output,
    and return a hash of key/value pairs.

    Closes-Bug: #1391373
    Change-Id: I9a4f72f9a1de200b324aa52eb3ea90d15423c062

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/juno
Review: https://review.openstack.org/150041

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/150041
Committed: https://git.openstack.org/cgit/stackforge/puppet-keystone/commit/?id=8cc6ec605954cf46cb321d644b07d9fe43795823
Submitter: Jenkins
Branch: stable/juno

commit 8cc6ec605954cf46cb321d644b07d9fe43795823
Author: Rich Megginson <email address hidden>
Date: Tue Oct 28 08:12:52 2014 -0600

    handle missing project/tenant when using ldap backend

    The project/tenant is only stored with the user when using
    the sql (default) backend. This means calls like user list
    and user show will not show the default project. For getting
    the project/tenant, if it is not present in the instances
    information provided by user list --long, we don't actually
    get the project/tenant, we just check to see if the user is
    assigned to the given tenant/project. For setting the
    project/tenant, this is usually done with user create, but when
    ldap is read-only, we have to use role add to add the user to a
    default _member_ role and at the same time assign the user to a
    given project/tenant. This also adds support for using the
    openstack $obj show commands which return --format shell output,
    and return a hash of key/value pairs.

    Closes-Bug: #1391373
    Change-Id: I9a4f72f9a1de200b324aa52eb3ea90d15423c062
    (cherry picked from commit 1b8010e44fb3a6ec8554dc813314e7e254378da9)