Red Hat Summit Red Hat Summit지원콘솔개발자평가판 시작연락처

이 콘텐츠는 선택한 언어로 제공되지 않습니다.

Chapter 4. Using domain-specific LDAP backends with director

Red Hat OpenStack Platform director can configure keystone to use one or more LDAP backends. This approach results in the creation of a separate LDAP backend for each keystone domain.

4.1. Setting the configuration options
링크 복사

For deployments using Red Hat OpenStack Platform director, you need to set the KeystoneLDAPDomainEnable flag to true in your heat templates; as a result, this will configure the domain_specific_drivers_enabled option in keystone (within the identity configuration group).

Note

The default directory for domain configuration files is set to /etc/keystone/domains/. You can override this by setting the required path using the keystone::domain_config_directory hiera key and adding it as an ExtraConfig parameter within an environment file.

You must also add a specification of the LDAP backend configuration. This is done using the KeystoneLDAPBackendConfigs parameter in tripleo-heat-templates, where you can then specify your required LDAP options.

4.2. Configure the director deployment
링크 복사

  1. Create a copy of the keystone_domain_specific_ldap_backend.yaml environment file: 

    $ cp /usr/share/openstack-tripleo-heat-templates/environments/services/keystone_domain_specific_ldap_backend.yaml /home/stack/templates/
    Copy to Clipboard Toggle word wrap

  2. Edit the /home/stack/templates/keystone_domain_specific_ldap_backend.yaml environment file and set the values to suit your deployment. For example, these entries create a LDAP configuration for a keystone domain named testdomain: 

        parameter_defaults:
      KeystoneLDAPDomainEnable: true
      KeystoneLDAPBackendConfigs:
        testdomain:
          url: ldaps://192.0.2.250
          user: cn=openstack,ou=Users,dc=director,dc=example,dc=com
          password: RedactedComplexPassword
          suffix: dc=director,dc=example,dc=com
          user_tree_dn: ou=Users,dc=director,dc=example,dc=com
          user_filter: "(memberOf=cn=OSuser,ou=Groups,dc=director,dc=example,dc=com)"
          user_objectclass: person
          user_id_attribute: cn
    Copy to Clipboard Toggle word wrap

  3. You can also configure the environment file to specify multiple domains. For example: 

        KeystoneLDAPBackendConfigs:
      domain1:
        url: ldaps://domain1.example.com
        user: cn=openstack,ou=Users,dc=director,dc=example,dc=com
        password: RedactedComplexPassword
        ...
      domain2:
        url: ldaps://domain2.example.com
        user: cn=openstack,ou=Users,dc=director,dc=example,dc=com
        password: RedactedComplexPassword
        ...
    Copy to Clipboard Toggle word wrap

    This will result in two domains named domain1 and domain2; each will have a different LDAP domain with its own configuration.

맨 위로 이동
Red Hat logoGithubredditYoutubeTwitter

자세한 정보

평가판, 구매 및 판매

커뮤니티

Red Hat 문서 정보

Red Hat을 사용하는 고객은 신뢰할 수 있는 콘텐츠가 포함된 제품과 서비스를 통해 혁신하고 목표를 달성할 수 있습니다. 최신 업데이트를 확인하세요.

보다 포괄적 수용을 위한 오픈 소스 용어 교체

Red Hat은 코드, 문서, 웹 속성에서 문제가 있는 언어를 교체하기 위해 최선을 다하고 있습니다. 자세한 내용은 다음을 참조하세요.Red Hat 블로그.

Red Hat 소개

Red Hat은 기업이 핵심 데이터 센터에서 네트워크 에지에 이르기까지 플랫폼과 환경 전반에서 더 쉽게 작업할 수 있도록 강화된 솔루션을 제공합니다.

Theme

© 2026 Red Hat