Chapter 5. Integrating OpenStack Identity (keystone) with Active Directory

1. Create the LDAP lookup account. This account is used by Identity Service to query the AD DS LDAP service:

   PS C:\> New-ADUser -SamAccountName svc-ldap -Name "svc-ldap" -GivenName LDAP -Surname Lookups -UserPrincipalName svc-ldap@lab.local  -Enabled $false -PasswordNeverExpires $true -Path 'OU=labUsers,DC=lab,DC=local'

2. Set a password for this account, and then enable it. You will be prompted to specify a password that complies with your AD domain’s complexity requirements:

   PS C:\> Set-ADAccountPassword svc-ldap -PassThru | Enable-ADAccount

3. Create a group for RHOSP users, called grp-openstack. Only members of this group can have permissions assigned in OpenStack Identity.

   PS C:\> NEW-ADGroup -name "grp-openstack" -groupscope Global -path "OU=labUsers,DC=lab,DC=local"

4. Create the Project groups:

   PS C:\> NEW-ADGroup -name "grp-openstack-demo" -groupscope Global -path "OU=labUsers,DC=lab,DC=local"
   PS C:\> NEW-ADGroup -name "grp-openstack-admin" -groupscope Global -path "OU=labUsers,DC=lab,DC=local"

5. Add the svc-ldap user to the grp-openstack group:

   PS C:\> ADD-ADGroupMember "grp-openstack" -members "svc-ldap"

6. From an AD Domain Controller, use a Certificates MMC to export your LDAPS certificate’s public key (not the private key) as a DER-encoded x509 .cer file. Send this file to the RHOSP administrators.

7. Retrieve the NetBIOS name of your AD DS domain.

   PS C:\> Get-ADDomain | select NetBIOSName
   NetBIOSName
   -----------
   LAB

   Send this value to the RHOSP administrators.

Procedure

1. Copy the LDAPS public key to the node running OpenStack Identity and convert the .cer to .crt. This example uses a source certificate file named addc.lab.local.cer:

   # openssl x509 -inform der -in addc.lab.local.cer -out addc.lab.local.crt
   # cp addc.lab.local.crt /etc/pki/ca-trust/source/anchors

2. Optional: If you need to run diagnostic commands, such as ldapsearch, you also need to add the certificate to the RHEL certificate store:

   1. Convert the .cer to .pem. This example uses a source certificate file named addc.lab.local.cer:

      # openssl x509 -inform der -in addc.lab.local.cer -out addc.lab.local.pem

   2. Install the .pem on the Controller node. For example, in Red Hat Enterprise Linux:

      # cp addc.lab.local.pem /etc/pki/ca-trust/source/anchors/
      # update-ca-trust

Procedure

1. In the heat template for your deployment, set the KeystoneLDAPDomainEnable flag to true. This configures the domain_specific_drivers_enabled option in keystone within the identity configuration group.
2. Add a specification of the LDAP backend configuration by setting the KeystoneLDAPBackendConfigs parameter in tripleo-heat-templates, where you can then specify your required LDAP options.

3. Create a copy of the keystone_domain_specific_ldap_backend.yaml environment file:

   $ cp /usr/share/openstack-tripleo-heat-templates/environments/services/keystone_domain_specific_ldap_backend.yaml /home/stack/templates/

4. Edit the /home/stack/templates/keystone_domain_specific_ldap_backend.yaml environment file and set the values to suit your deployment. For example, this parameter create a LDAP configuration for a keystone domain named testdomain:

       parameter_defaults:
         KeystoneLDAPDomainEnable: true
         KeystoneLDAPBackendConfigs:
           testdomain:
             url: ldaps://192.0.2.250
             user: cn=openstack,ou=Users,dc=director,dc=example,dc=com
             password: RedactedComplexPassword
             suffix: dc=director,dc=example,dc=com
             user_tree_dn: ou=Users,dc=director,dc=example,dc=com
             user_filter: "(memberOf=cn=OSuser,ou=Groups,dc=director,dc=example,dc=com)"
             user_objectclass: person
             user_id_attribute: cn

   Note

   The keystone_domain_specific_ldap_backend.yaml environment file contains the following deprecated write parameters:

   • user_allow_create
   • user_allow_update
   • user_allow_delete

   The values for these parameters have no effect on the deployment, and can be safely removed.

5. Optional: Add more domains to the environment file. For example:

       KeystoneLDAPBackendConfigs:
         domain1:
           url: ldaps://domain1.example.com
           user: cn=openstack,ou=Users,dc=director,dc=example,dc=com
           password: RedactedComplexPassword
           ...
         domain2:
           url: ldaps://domain2.example.com
           user: cn=openstack,ou=Users,dc=director,dc=example,dc=com
           password: RedactedComplexPassword
           ...

   This results in two domains named domain1 and domain2; each will have a different LDAP domain with its own configuration.

1. Get the ID of the LAB domain:

   $ openstack domain show LAB
   +---------+----------------------------------+
   | Field   | Value                            |
   +---------+----------------------------------+
   | enabled | True                             |
   | id      | 6800b0496429431ab1c4efbb3fe810d4 |
   | name    | LAB                              |
   +---------+----------------------------------+

2. Get the ID of the admin user from the default domain:

   $ openstack user list --domain default | grep admin
   | 3d75388d351846c6a880e53b2508172a | admin      |

3. Get the ID of the admin role:

   $ openstack role list

   The output depends on the external service you are integrating with:

   • Active Directory Domain Service (AD DS):

     +----------------------------------+-----------------+
     | ID                               | Name            |
     +----------------------------------+-----------------+
     | 01d92614cd224a589bdf3b171afc5488 | admin           |
     | 034e4620ed3d45969dfe8992af001514 | member          |
     | 0aa377a807df4149b0a8c69b9560b106 | ResellerAdmin   |
     | 9369f2bf754443f199c6d6b96479b1fa | heat_stack_user |
     | cfea5760d9c948e7b362abc1d06e557f | reader          |
     | d5cb454559e44b47aaa8821df4e11af1 | swiftoperator   |
     | ef3d3f510a474d6c860b4098ad658a29 | service         |
     +----------------------------------+-----------------+

   • Red Hat Identity Manager (IdM):

     +----------------------------------+---------------+
     | ID                               | Name          |
     +----------------------------------+---------------+
     | 544d48aaffde48f1b3c31a52c35f01f9 | SwiftOperator |
     | 6d005d783bf0436e882c55c62457d33d | ResellerAdmin |
     | 785c70b150ee4c778fe4de088070b4cf | admin         |
     | 9fe2ff9ee4384b1894a90878d3e92bab | _member_      |
     +----------------------------------+---------------+

4. Use the domain and admin IDs to construct the command that adds the admin user to the admin role of the keystone LAB domain:

   # openstack role add --domain 6800b0496429431ab1c4efbb3fe810d4 --user 3d75388d351846c6a880e53b2508172a 785c70b150ee4c778fe4de088070b4cf

Procedure

1. Retrieve a list of user groups from the OpenStack Identity domain:

   # openstack group list --domain LAB

   The command output depends on the external user management service that you are integrating with:

   • Active Directory Domain Service (AD DS):

     +------------------------------------------------------------------+---------------------+
     | ID                                                               | Name                |
     +------------------------------------------------------------------+---------------------+
     | 185277be62ae17e498a69f98a59b66934fb1d6b7f745f14f5f68953a665b8851 | grp-openstack       |
     | a8d17f19f464c4548c18b97e4aa331820f9d3be52654aa8094e698a9182cbb88 | grp-openstack-admin |
     | d971bb3bd5e64a454cbd0cc7af4c0773e78d61b5f81321809f8323216938cae8 | grp-openstack-demo  |
     +------------------------------------------------------------------+---------------------+

   • Red Hat Identity Manager (IdM):

     +------------------------------------------------------------------+---------------------+
     | ID                                                               | Name                |
     +------------------------------------------------------------------+---------------------+
     | 185277be62ae17e498a69f98a59b66934fb1d6b7f745f14f5f68953a665b8851 | grp-openstack       |
     | a8d17f19f464c4548c18b97e4aa331820f9d3be52654aa8094e698a9182cbb88 | grp-openstack-admin |
     | d971bb3bd5e64a454cbd0cc7af4c0773e78d61b5f81321809f8323216938cae8 | grp-openstack-demo  |
     +------------------------------------------------------------------+---------------------+

2. Retrieve a list of roles:

   # openstack role list

   The command output depends on the external user management service that you are integrating with:

   • Active Directory Domain Service (AD DS):

     +----------------------------------+-----------------+
     | ID                               | Name            |
     +----------------------------------+-----------------+
     | 01d92614cd224a589bdf3b171afc5488 | admin           |
     | 034e4620ed3d45969dfe8992af001514 | member          |
     | 0aa377a807df4149b0a8c69b9560b106 | ResellerAdmin   |
     | 9369f2bf754443f199c6d6b96479b1fa | heat_stack_user |
     | cfea5760d9c948e7b362abc1d06e557f | reader          |
     | d5cb454559e44b47aaa8821df4e11af1 | swiftoperator   |
     | ef3d3f510a474d6c860b4098ad658a29 | service         |
     +----------------------------------+-----------------+

   • Red Hat Identity Manager (IdM):

     +----------------------------------+---------------+
     | ID                               | Name          |
     +----------------------------------+---------------+
     | 0969957bce5e4f678ca6cef00e1abf8a | ResellerAdmin |
     | 1fcb3c9b50aa46ee8196aaaecc2b76b7 | admin         |
     | 9fe2ff9ee4384b1894a90878d3e92bab | _member_      |
     | d3570730eb4b4780a7fed97eba197e1b | SwiftOperator |
     +----------------------------------+---------------+

3. Grant the user groups access to RHOSP projects by adding them to one or more of these roles. For example, if you want users in the grp-openstack-demo group to be general users of the demo project, you must add the group to the member or _member_ role, depending on the external service that you are integrating with:

   • Active Directory Domain Service (AD DS):

     # openstack role add --project demo --group d971bb3bd5e64a454cbd0cc7af4c0773e78d61b5f81321809f8323216938cae8  member

   • Red Hat Identity Manager (IdM):

     $ openstack role add --project demo --group d971bb3bd5e64a454cbd0cc7af4c0773e78d61b5f81321809f8323216938cae8  _member_

Procedure

1. Retrieve a list of users from the OpenStack Identity domain:

   # openstack user list --domain LAB
    +------------------------------------------------------------------+----------------+
   | ID                                                               | Name           |
   +------------------------------------------------------------------+----------------+
   | 1f24ec1f11aeb90520079c29f70afa060d22e2ce92b2eba7784c841ac418091e | user1          |
   | 12c062faddc5f8b065434d9ff6fce03eb9259537c93b411224588686e9a38bf1 | user2          |
   | afaf48031eb54c3e44e4cb0353f5b612084033ff70f63c22873d181fdae2e73c | user3          |
   | e47fc21dcf0d9716d2663766023e2d8dc15a6d9b01453854a898cabb2396826e | user4          |
   +------------------------------------------------------------------+----------------+

2. Retrieve a list of roles:

   # openstack role list

   The command output depends on the external user management service that you are integrating with:

   • Active Directory Domain Service (AD DS):

     +----------------------------------+-----------------+
     | ID                               | Name            |
     +----------------------------------+-----------------+
     | 01d92614cd224a589bdf3b171afc5488 | admin           |
     | 034e4620ed3d45969dfe8992af001514 | member          |
     | 0aa377a807df4149b0a8c69b9560b106 | ResellerAdmin   |
     | 9369f2bf754443f199c6d6b96479b1fa | heat_stack_user |
     | cfea5760d9c948e7b362abc1d06e557f | reader          |
     | d5cb454559e44b47aaa8821df4e11af1 | swiftoperator   |
     | ef3d3f510a474d6c860b4098ad658a29 | service         |
     +----------------------------------+-----------------+

   • Red Hat Identity Manager (IdM):

     +----------------------------------+---------------+
     | ID                               | Name          |
     +----------------------------------+---------------+
     | 0969957bce5e4f678ca6cef00e1abf8a | ResellerAdmin |
     | 1fcb3c9b50aa46ee8196aaaecc2b76b7 | admin         |
     | 9fe2ff9ee4384b1894a90878d3e92bab | _member_      |
     | d3570730eb4b4780a7fed97eba197e1b | SwiftOperator |
     +----------------------------------+---------------+

3. Grant users access to RHOSP projects by adding them to one or more of these roles. For example, if you want user1 to be a general user of the demo project, you add them to the member or _member_ role, depending on the external service that you are integrating with:

   • Active Directory Domain Service (AD DS):

     # openstack role add --project demo --user 1f24ec1f11aeb90520079c29f70afa060d22e2ce92b2eba7784c841ac418091e member

   • Red Hat Identity Manager (IdM):

     # openstack role add --project demo --user 1f24ec1f11aeb90520079c29f70afa060d22e2ce92b2eba7784c841ac418091e _member_

4. If you want user1 to be an administrative user of the demo project, add the user to the admin role:

   # openstack role add --project demo --user 1f24ec1f11aeb90520079c29f70afa060d22e2ce92b2eba7784c841ac418091e admin

Procedure

1. Show the list of domains:

   # openstack domain list
   +----------------------------------+---------+---------+----------------------------------------------------------------------+
   | ID                               | Name    | Enabled | Description                                                          |
   +----------------------------------+---------+---------+----------------------------------------------------------------------+
   | 6800b0496429431ab1c4efbb3fe810d4 | LAB     | True    |                                                                      |
   | default                          | Default | True    | Owns users and projects available on Identity API v2. |
   +----------------------------------+---------+---------+----------------------------------------------------------------------+

2. Show the list of users in a specific domain. This command example specifies the --domain LAB and returns users in the LAB domain that are members of the grp-openstack group:

   # openstack user list --domain LAB

   You can also append --domain Default to show the built-in keystone accounts:

   # openstack user list --domain Default

Procedure

1. Create a test user in the external user management service, and add the user to the grp-openstack group.
2. In Red Hat OpenStack Platform, add the user to the _member_ role of the demo project.
3. Log in to the dashboard with the credentials of the AD test user.
4. Click on each of the tabs to confirm that they are presented successfully without error messages.
5. Use the dashboard to build a test instance.

Procedure

1. Test the LDAP connection by using the ldapsearch command to remotely perform test queries against the Active Directory Domain Controller. A successful result indicates that network connectivity is working, and the AD DS services are up. In this example, a test query is performed against the server 192.0.2.250 on port 636:

   # ldapsearch -Z -x -H ldaps://192.0.2.250:636 -D "cn=openstack,ou=Users,dc=director,dc=example,dc=com" -W -b "ou=Users,dc=director,dc=example,dc=com" -s sub "(memberOf=cn=OSuser,ou=Groups,dc=director,dc=example,dc=com)"

   Note
   • ldapsearch is a part of the openldap-clients package. You can install this using # dnf install openldap-clients
   • This command expects to find the necessary certificate in your host operating system.

2. If you receive the error Peer's Certificate issuer is not recognized. while testing the ldapsearch command, confirm that your TLS_CACERTDIR path is correctly set. For example:

   TLS_CACERTDIR /etc/openldap/certs

3. As a temporary workaround, consider disabling certificate validation.

   Important

   This setting must not be permanently configured.

   In the /etc/openldap/ldap.conf, set the TLS_REQCERT parameter to allow:

   TLS_REQCERT allow

   If the ldapsearch query works after setting this value, you might need to review whether your certificate trusts are correctly configured.

4. Use the nc command to check that LDAPS port 636 is remotely accessible. In this example, a probe is performed against the server addc.lab.local. Press ctrl-c to exit the prompt.

   # nc -v addc.lab.local 636
   Ncat: Version 6.40 ( http://nmap.org/ncat )
   Ncat: Connected to 192.168.200.10:636.
   ^C

   Failure to establish a connection might indicate a firewall configuration issue.