)]}'
{"doc/source/guides/devstack-with-ldap.rst":[{"author":{"_account_id":13252,"name":"Dr. Jens Harbott","display_name":"Jens Harbott (frickler)","email":"frickler@offenerstapel.de","username":"jrosenboom"},"change_message_id":"37c433b10da38729d85e4c4ef01bfb8f7edc7b3e","unresolved":false,"context_lines":[{"line_number":21,"context_line":"To deploy an OpenLDAP server, make sure ``ldap`` is added to the list of"},{"line_number":22,"context_line":"``ENABLED_SERVICES``::"},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"    ENABLED_SERVICES+\u003d,ldap"},{"line_number":25,"context_line":""},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"Devstack will require a password to setup an LDAP administrator. This"}],"source_content_type":"text/x-rst","patch_set":3,"id":"bf659307_b9d64927","line":24,"updated":"2018-04-05 13:01:18.000000000","message":"Should make clear that this needs to go into local.conf, doesn\u0027t work if just executed in the shell.\n\nI\u0027d also prefer the more modern looking variant\n\n    enable_service ldap","commit_id":"2755fd5da5393fedf9bfe53babebf473896df77d"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"aa0c4caf8aaaf69bffd0e0eb929bdb6dec3251c1","unresolved":false,"context_lines":[{"line_number":21,"context_line":"To deploy an OpenLDAP server, make sure ``ldap`` is added to the list of"},{"line_number":22,"context_line":"``ENABLED_SERVICES``::"},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"    ENABLED_SERVICES+\u003d,ldap"},{"line_number":25,"context_line":""},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"Devstack will require a password to setup an LDAP administrator. This"}],"source_content_type":"text/x-rst","patch_set":3,"id":"bf659307_915559fd","line":24,"in_reply_to":"bf659307_b9d64927","updated":"2018-04-05 14:57:25.000000000","message":"Done","commit_id":"2755fd5da5393fedf9bfe53babebf473896df77d"},{"author":{"_account_id":13252,"name":"Dr. Jens Harbott","display_name":"Jens Harbott (frickler)","email":"frickler@offenerstapel.de","username":"jrosenboom"},"change_message_id":"37c433b10da38729d85e4c4ef01bfb8f7edc7b3e","unresolved":false,"context_lines":[{"line_number":31,"context_line":"Devstack will prompt you for a password when running ``stack.sh`` if"},{"line_number":32,"context_line":"``LDAP_PASSWORD`` is not set::"},{"line_number":33,"context_line":""},{"line_number":34,"context_line":"    LDAP_PASSWORD\u003dsuper_secret_password"},{"line_number":35,"context_line":"    ./stack.sh"},{"line_number":36,"context_line":""},{"line_number":37,"context_line":"At this point, devstack should have everything it needs to deploy OpenLDAP,"}],"source_content_type":"text/x-rst","patch_set":3,"id":"bf659307_f9fda1b1","line":34,"updated":"2018-04-05 13:01:18.000000000","message":"This doesn\u0027t work, either need to add \"export\" or (better IMO) add that line into local.conf.","commit_id":"2755fd5da5393fedf9bfe53babebf473896df77d"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"aa0c4caf8aaaf69bffd0e0eb929bdb6dec3251c1","unresolved":false,"context_lines":[{"line_number":31,"context_line":"Devstack will prompt you for a password when running ``stack.sh`` if"},{"line_number":32,"context_line":"``LDAP_PASSWORD`` is not set::"},{"line_number":33,"context_line":""},{"line_number":34,"context_line":"    LDAP_PASSWORD\u003dsuper_secret_password"},{"line_number":35,"context_line":"    ./stack.sh"},{"line_number":36,"context_line":""},{"line_number":37,"context_line":"At this point, devstack should have everything it needs to deploy OpenLDAP,"}],"source_content_type":"text/x-rst","patch_set":3,"id":"bf659307_f1793593","line":34,"in_reply_to":"bf659307_f9fda1b1","updated":"2018-04-05 14:57:25.000000000","message":"Done","commit_id":"2755fd5da5393fedf9bfe53babebf473896df77d"},{"author":{"_account_id":13252,"name":"Dr. Jens Harbott","display_name":"Jens Harbott (frickler)","email":"frickler@offenerstapel.de","username":"jrosenboom"},"change_message_id":"37c433b10da38729d85e4c4ef01bfb8f7edc7b3e","unresolved":false,"context_lines":[{"line_number":44,"context_line":"identity sources. For example, the ``default`` domain will be backed by MySQL."},{"line_number":45,"context_line":"This is usually where you\u0027ll find your administrative and services users. If"},{"line_number":46,"context_line":"you query keystone for a list of domains, you should see a domain called"},{"line_number":47,"context_line":"``Users``. This domain is setup by devstack and points to OpenLDAP."},{"line_number":48,"context_line":""},{"line_number":49,"context_line":"User Management"},{"line_number":50,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":3,"id":"bf659307_04e02c96","line":47,"updated":"2018-04-05 13:01:18.000000000","message":"Nit: s/setup/set up/","commit_id":"2755fd5da5393fedf9bfe53babebf473896df77d"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"aa0c4caf8aaaf69bffd0e0eb929bdb6dec3251c1","unresolved":false,"context_lines":[{"line_number":44,"context_line":"identity sources. For example, the ``default`` domain will be backed by MySQL."},{"line_number":45,"context_line":"This is usually where you\u0027ll find your administrative and services users. If"},{"line_number":46,"context_line":"you query keystone for a list of domains, you should see a domain called"},{"line_number":47,"context_line":"``Users``. This domain is setup by devstack and points to OpenLDAP."},{"line_number":48,"context_line":""},{"line_number":49,"context_line":"User Management"},{"line_number":50,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":3,"id":"bf659307_b173bdb1","line":47,"in_reply_to":"bf659307_04e02c96","updated":"2018-04-05 14:57:25.000000000","message":"Done","commit_id":"2755fd5da5393fedf9bfe53babebf473896df77d"},{"author":{"_account_id":13252,"name":"Dr. Jens Harbott","display_name":"Jens Harbott (frickler)","email":"frickler@offenerstapel.de","username":"jrosenboom"},"change_message_id":"37c433b10da38729d85e4c4ef01bfb8f7edc7b3e","unresolved":false,"context_lines":[{"line_number":92,"context_line":""},{"line_number":93,"context_line":"Now, we use the ``Manager`` user to create a user for Peter in LDAP::"},{"line_number":94,"context_line":""},{"line_number":95,"context_line":"    ldapadd -x -w $LDAPPASSWORD -D cn\u003dManager,dc\u003dopenstack,dc\u003dorg \\"},{"line_number":96,"context_line":"        -H ldap://localhost -c -f peter.ldif.in"},{"line_number":97,"context_line":""},{"line_number":98,"context_line":"We should be able to assign Peter roles on projects. After Peter has some level"}],"source_content_type":"text/x-rst","patch_set":3,"id":"bf659307_e4c3b837","line":95,"updated":"2018-04-05 13:01:18.000000000","message":"Nit: LDAP_PASSWORD","commit_id":"2755fd5da5393fedf9bfe53babebf473896df77d"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"aa0c4caf8aaaf69bffd0e0eb929bdb6dec3251c1","unresolved":false,"context_lines":[{"line_number":92,"context_line":""},{"line_number":93,"context_line":"Now, we use the ``Manager`` user to create a user for Peter in LDAP::"},{"line_number":94,"context_line":""},{"line_number":95,"context_line":"    ldapadd -x -w $LDAPPASSWORD -D cn\u003dManager,dc\u003dopenstack,dc\u003dorg \\"},{"line_number":96,"context_line":"        -H ldap://localhost -c -f peter.ldif.in"},{"line_number":97,"context_line":""},{"line_number":98,"context_line":"We should be able to assign Peter roles on projects. After Peter has some level"}],"source_content_type":"text/x-rst","patch_set":3,"id":"bf659307_51ad81e8","line":95,"in_reply_to":"bf659307_e4c3b837","updated":"2018-04-05 14:57:25.000000000","message":"Done","commit_id":"2755fd5da5393fedf9bfe53babebf473896df77d"},{"author":{"_account_id":13252,"name":"Dr. Jens Harbott","display_name":"Jens Harbott (frickler)","email":"frickler@offenerstapel.de","username":"jrosenboom"},"change_message_id":"37c433b10da38729d85e4c4ef01bfb8f7edc7b3e","unresolved":false,"context_lines":[{"line_number":97,"context_line":""},{"line_number":98,"context_line":"We should be able to assign Peter roles on projects. After Peter has some level"},{"line_number":99,"context_line":"of authorization, he should be able to login to Horizon by specifying the"},{"line_number":100,"context_line":"``Users`` domain and using his ``peter`` username and password."},{"line_number":101,"context_line":""},{"line_number":102,"context_line":"Deleting Users"},{"line_number":103,"context_line":"--------------"}],"source_content_type":"text/x-rst","patch_set":3,"id":"bf659307_04726c12","line":100,"updated":"2018-04-05 13:01:18.000000000","message":"Maybe also show the commands that would be neccessary for this? Seems a bit non-trivial to find the right combination of options. Like:\n\nopenstack project create tp1 --domain Users\nopenstack role add --user peter --user-domain Users --domain Users --project tp1 --project-domain Users Member","commit_id":"2755fd5da5393fedf9bfe53babebf473896df77d"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"aa0c4caf8aaaf69bffd0e0eb929bdb6dec3251c1","unresolved":false,"context_lines":[{"line_number":97,"context_line":""},{"line_number":98,"context_line":"We should be able to assign Peter roles on projects. After Peter has some level"},{"line_number":99,"context_line":"of authorization, he should be able to login to Horizon by specifying the"},{"line_number":100,"context_line":"``Users`` domain and using his ``peter`` username and password."},{"line_number":101,"context_line":""},{"line_number":102,"context_line":"Deleting Users"},{"line_number":103,"context_line":"--------------"}],"source_content_type":"text/x-rst","patch_set":3,"id":"bf659307_318d6d7b","line":100,"in_reply_to":"bf659307_04726c12","updated":"2018-04-05 14:57:25.000000000","message":"oh, good call. I can add that.","commit_id":"2755fd5da5393fedf9bfe53babebf473896df77d"},{"author":{"_account_id":13252,"name":"Dr. Jens Harbott","display_name":"Jens Harbott (frickler)","email":"frickler@offenerstapel.de","username":"jrosenboom"},"change_message_id":"37c433b10da38729d85e4c4ef01bfb8f7edc7b3e","unresolved":false,"context_lines":[{"line_number":105,"context_line":"We can use the same basic steps to remove users from LDAP, but instead of using"},{"line_number":106,"context_line":"LDIFs, we can just pass the ``dn`` of the user we want to delete::"},{"line_number":107,"context_line":""},{"line_number":108,"context_line":"    ldapdelete -x -w $LDAPPASSWORD -D cn\u003dManager,dc\u003dopenstack,dc\u003dorg H \\"},{"line_number":109,"context_line":"        -H ldap://localhost cn\u003dpeter,ou\u003dUsers,dc\u003dopenstack,dc\u003dorg"},{"line_number":110,"context_line":""},{"line_number":111,"context_line":"Group Management"}],"source_content_type":"text/x-rst","patch_set":3,"id":"bf659307_a4606037","line":108,"updated":"2018-04-05 13:01:18.000000000","message":"Nit: LDAP_PASSWORD","commit_id":"2755fd5da5393fedf9bfe53babebf473896df77d"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"aa0c4caf8aaaf69bffd0e0eb929bdb6dec3251c1","unresolved":false,"context_lines":[{"line_number":105,"context_line":"We can use the same basic steps to remove users from LDAP, but instead of using"},{"line_number":106,"context_line":"LDIFs, we can just pass the ``dn`` of the user we want to delete::"},{"line_number":107,"context_line":""},{"line_number":108,"context_line":"    ldapdelete -x -w $LDAPPASSWORD -D cn\u003dManager,dc\u003dopenstack,dc\u003dorg H \\"},{"line_number":109,"context_line":"        -H ldap://localhost cn\u003dpeter,ou\u003dUsers,dc\u003dopenstack,dc\u003dorg"},{"line_number":110,"context_line":""},{"line_number":111,"context_line":"Group Management"}],"source_content_type":"text/x-rst","patch_set":3,"id":"bf659307_71aa05d3","line":108,"in_reply_to":"bf659307_a4606037","updated":"2018-04-05 14:57:25.000000000","message":"Done","commit_id":"2755fd5da5393fedf9bfe53babebf473896df77d"},{"author":{"_account_id":13252,"name":"Dr. Jens Harbott","display_name":"Jens Harbott (frickler)","email":"frickler@offenerstapel.de","username":"jrosenboom"},"change_message_id":"37c433b10da38729d85e4c4ef01bfb8f7edc7b3e","unresolved":false,"context_lines":[{"line_number":133,"context_line":"We can create the group using the same ``ldapadd`` command as we did with"},{"line_number":134,"context_line":"users::"},{"line_number":135,"context_line":""},{"line_number":136,"context_line":"    ldapadd -x -w $LDAPPASSWORD -D cn\u003dManager,dc\u003dopenstack,dc\u003dorg \\"},{"line_number":137,"context_line":"        -H ldap://localhost -c -f guardian-group.ldif.in"},{"line_number":138,"context_line":""},{"line_number":139,"context_line":"If we check the group membership in Horizon, we\u0027ll see that only Peter is a"}],"source_content_type":"text/x-rst","patch_set":3,"id":"bf659307_845f5c71","line":136,"updated":"2018-04-05 13:01:18.000000000","message":"Nit: LDAP_PASSWORD","commit_id":"2755fd5da5393fedf9bfe53babebf473896df77d"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"aa0c4caf8aaaf69bffd0e0eb929bdb6dec3251c1","unresolved":false,"context_lines":[{"line_number":133,"context_line":"We can create the group using the same ``ldapadd`` command as we did with"},{"line_number":134,"context_line":"users::"},{"line_number":135,"context_line":""},{"line_number":136,"context_line":"    ldapadd -x -w $LDAPPASSWORD -D cn\u003dManager,dc\u003dopenstack,dc\u003dorg \\"},{"line_number":137,"context_line":"        -H ldap://localhost -c -f guardian-group.ldif.in"},{"line_number":138,"context_line":""},{"line_number":139,"context_line":"If we check the group membership in Horizon, we\u0027ll see that only Peter is a"}],"source_content_type":"text/x-rst","patch_set":3,"id":"bf659307_31b48d35","line":136,"in_reply_to":"bf659307_845f5c71","updated":"2018-04-05 14:57:25.000000000","message":"Done","commit_id":"2755fd5da5393fedf9bfe53babebf473896df77d"},{"author":{"_account_id":13252,"name":"Dr. Jens Harbott","display_name":"Jens Harbott (frickler)","email":"frickler@offenerstapel.de","username":"jrosenboom"},"change_message_id":"37c433b10da38729d85e4c4ef01bfb8f7edc7b3e","unresolved":false,"context_lines":[{"line_number":147,"context_line":""},{"line_number":148,"context_line":"Just like users, groups can be deleted using the ``dn``::"},{"line_number":149,"context_line":""},{"line_number":150,"context_line":"    ldapdelete -x -w $LDAPPASSWORD -D cn\u003dManager,dc\u003dopenstack,dc\u003dorg -H \\"},{"line_number":151,"context_line":"        ldap://localhost cn\u003dguardians,ou\u003dUserGroups,dc\u003dopenstack,dc\u003dorg"},{"line_number":152,"context_line":""},{"line_number":153,"context_line":"Note that this operation will not remove users within that group. It will only"}],"source_content_type":"text/x-rst","patch_set":3,"id":"bf659307_24545054","line":150,"updated":"2018-04-05 13:01:18.000000000","message":"Nit: LDAP_PASSWORD","commit_id":"2755fd5da5393fedf9bfe53babebf473896df77d"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"aa0c4caf8aaaf69bffd0e0eb929bdb6dec3251c1","unresolved":false,"context_lines":[{"line_number":147,"context_line":""},{"line_number":148,"context_line":"Just like users, groups can be deleted using the ``dn``::"},{"line_number":149,"context_line":""},{"line_number":150,"context_line":"    ldapdelete -x -w $LDAPPASSWORD -D cn\u003dManager,dc\u003dopenstack,dc\u003dorg -H \\"},{"line_number":151,"context_line":"        ldap://localhost cn\u003dguardians,ou\u003dUserGroups,dc\u003dopenstack,dc\u003dorg"},{"line_number":152,"context_line":""},{"line_number":153,"context_line":"Note that this operation will not remove users within that group. It will only"}],"source_content_type":"text/x-rst","patch_set":3,"id":"bf659307_f187f560","line":150,"in_reply_to":"bf659307_24545054","updated":"2018-04-05 14:57:25.000000000","message":"Done","commit_id":"2755fd5da5393fedf9bfe53babebf473896df77d"}]}