keystone对接LDAP实践

0. 环境

系统环境

[root@compute-61 ldap]# cat /etc/redhat-release
CentOS Linux release 7.2.1511 (Core)

keystone版本

[root@compute-192-168-6-61 ldap]# keystone --version
1.7.2

1. 安装 OpenLDAP Server.

yum -y install openldap-servers openldap-clients

cp /usr/share/openldap-servers/DB_CONFIG.example /var/lib/ldap/DB_CONFIG

chown -R ldap:ldap /var/lib/ldap/DB_CONFIG

systemctl start slapd
systemctl enable slapd

2. 设置OpenLDAP admin password

[root@compute-61 ldap]# slappasswd -s a123456
{SSHA}fmi9B1qP6JPBHXVAg0Gcup/qQUWSzho9
[root@compute-61 ldap]#
[root@compute-61 ldap]#
[root@compute-61 ldap]# vim chrootpw.ldif

在chrootpw.ldif中加入如下内容：

# specify the password generated above for "olcRootPW" section
dn: olcDatabase={0}config,cn=config
changetype: modify
add: olcRootPW
olcRootPW: {SSHA}fmi9B1qP6JPBHXVAg0Gcup/qQUWSzho9

执行ldapadd命令:

ldapadd -Y EXTERNAL -H ldapi:/// -f chrootpw.ldif

3. 导入基础的schemas，执行如下命令

ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/cosine.ldif

ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/nis.ldif

ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/inetorgperson.ldif

4. 设置 domain name on LDAP DB.

编辑chdomain.ldif，vim chdomain.ldif

# replace to your own domain name for "dc=***,dc=***" section
# specify the password generated above for "olcRootPW" section
dn: olcDatabase={1}monitor,cn=config
changetype: modify
replace: olcAccess
olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth"
   read by dn.base="cn=manager,dc=openstack,dc=org" read by * none

dn: olcDatabase={2}hdb,cn=config
changetype: modify
replace: olcSuffix
olcSuffix: dc=openstack,dc=org

dn: olcDatabase={2}hdb,cn=config
changetype: modify
replace: olcRootDN
olcRootDN: cn=manager,dc=openstack,dc=org

dn: olcDatabase={2}hdb,cn=config
changetype: modify
add: olcRootPW
olcRootPW: {SSHA}fmi9B1qP6JPBHXVAg0Gcup/qQUWSzho9

dn: olcDatabase={2}hdb,cn=config
changetype: modify
add: olcAccess
olcAccess: {0}to attrs=userPassword,shadowLastChange by
   dn="cn=manager,dc=openstack,dc=org" write by anonymous auth by self write by * none
olcAccess: {1}to dn.base="" by * read
olcAccess: {2}to * by dn="cn=manager,dc=openstack,dc=org" write by * read

执行ldapmodify

ldapmodify -Y EXTERNAL -H ldapi:/// -f chdomain.ldif

5. 修改LDAP的默认schema

LDAP的默认schema不能直接和openstack配合使用，有些openstack的用户、角色、租户需要的属性默认schema中没有，例如：enable，description等等，需要修改；其次，需要添加存储openstack相关模型（user，tenant，group，role，domain）的dn，以便保存数据。

vim modify.ldif

dn: cn={0}core,cn=schema,cn=config
changetype: modify
add: olcAttributeTypes
olcAttributeTypes: {52}( 2.5.4.66 NAME 'enabled' DESC 'RFC2256: enabled of a group' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE )

dn: cn={0}core,cn=schema,cn=config
changetype: modify
delete: olcObjectClasses
olcObjectClasses: {7}( 2.5.6.9 NAME 'groupOfNames' DESC 'RFC2256: a group of names (DNs)' SUP top STRUCTURAL MUST ( member $ cn ) MAY ( businessCategory $ seeAlso $ owner $ ou $ o $ description ) )
-
add: olcObjectClasses
olcObjectClasses: {7}( 2.5.6.9 NAME 'groupOfNames' DESC 'RFC2256: a group of names (DNs)' SUP top STRUCTURAL MUST ( member $ cn ) MAY ( businessCategory $ seeAlso $ owner $ ou $ o $ description $ enabled) )

dn: cn={3}inetorgperson,cn=schema,cn=config
changetype: modify
delete: olcObjectClasses
olcObjectClasses: {0}( 2.16.840.1.113730.3.2.2 NAME 'inetOrgPerson' DESC 'RFC2798: Internet Organizational Person' SUP organizationalPerson STRUCTURAL MAY ( audio $ businessCategory $ carLicense $ departmentNumber $ displayName $ employeeNumber $ employeeType $ givenName $ homePhone $ homePostalAddress $ initials $ jpegPhoto $ labeledURI $ mail $ manager $ mobile $ o $ pager $ photo $ roomNumber $ secretary $ uid $ userCertificate $ x500uniqueIdentifier $ preferredLanguage $ userSMIMECertificate $ userPKCS12 ) )
-
add: olcObjectClasses
olcObjectClasses: {0}( 2.16.840.1.113730.3.2.2 NAME 'inetOrgPerson' DESC 'RFC2798: Internet Organizational Person' SUP organizationalPerson STRUCTURAL MAY ( audio $ businessCategory $ carLicense $ departmentNumber $ displayName $ employeeNumber $ employeeType $ givenName $ homePhone $ homePostalAddress $ initials $ jpegPhoto $ labeledURI $ mail $ manager $ mobile $ o $ pager $ photo $ roomNumber $ secretary $ uid $ userCertificate $ x500uniqueIdentifier $ preferredLanguage $ userSMIMECertificate $ userPKCS12 $ description $ enabled $ email ) )

将以上内容保存到对应的文件之后，执行如下命令：
ldapmodify -c -Y EXTERNAL -H ldapi:/// -f modify.ldif

6. 创建基础域

vim basedomain.ldif

dn: dc=openstack,dc=org
objectClass: top
objectClass: dcObject
objectClass: organization
dc: openstack
o: youyun

dn: ou=users,dc=openstack,dc=org
ou: users
objectClass: top
objectClass: organizationalUnit

dn: ou=projects,dc=openstack,dc=org
objectClass: top
objectClass: organizationalUnit

dn: ou=roles,dc=openstack,dc=org
objectClass: top
objectClass: organizationalUnit

dn: ou=groups,dc=openstack,dc=org
objectClass: top
objectClass: organizationalUnit

dn: ou=domains,dc=openstack,dc=org
objectClass: top
objectClass: organizationalUnit

执行
ldapadd -x -c -D"cn=manager,dc=openstack,dc=org" -w "a123456" -f basedomain.ldif

7. 修改keystone的配置文件

/etc/keystone/keystone.conf

将Identity的后端配置为ldap

[identity]
driver = keystone.identity.backends.ldap.Identity

增加ldap段的配置，只需如下配置，其他可以使用默认值

[ldap]
url = ldap://localhost
user = cn=manager,dc=openstack,dc=org
password = a123456
suffix = dc=openstack,dc=org
use_dumb_member = True
allow_subtree_delete = False

user_tree_dn = ou=users,dc=openstack,dc=org
project_tree_dn = ou=projects,dc=openstack,dc=org #有的版本没有project_tree_dn，其对应的tree_dn为tenant_tree_dn
role_tree_dn = ou=roles,dc=openstack,dc=org
group_tree_dn = ou=groups,dc=openstack,dc=org
#domain_tree_dn = ou=domains,dc=openstack,dc=org

重启keystone服务。

8. 配置keystone

创建admin 租户

keystone --os-token fac6fcc5b4b542a1bdd05013e57d7db4 --os-endpoint  tenant-create --name admin

注意：fac6fcc5b4b542a1bdd05013e57d7db4 为/etc/keystone/keystone.conf中的admin_token的值

创建admin用户并绑定租户

keystone --os-token fac6fcc5b4b542a1bdd05013e57d7db4 --os-endpoint  user-create --tenant-id 9a1d69f72c044ba29ceaa25731f1084a --name admin --pass admin

创建管理员角色(根据keystone默认的 policy.json)

keystone --os-token fac6fcc5b4b542a1bdd05013e57d7db4 --os-endpoint  role-create --name admin

赋予admin租户中的的admin用户管理员权限

keystone --os-token fac6fcc5b4b542a1bdd05013e57d7db4 --os-endpoint  user-role-add --tenant-id 9a1d69f72c044ba29ceaa25731f1084a --user-id dd71eb7771a845ea87c8ec5eb7a02f4c --role-id a516ce68a19448d7a5b2b78fcde9b726

9. 验证

keystone user-list
keystone role-list



 2016.05.03 shanghai pudong