)]}'
{"doc/source/admin/identity-integrate-with-ldap.rst":[{"author":{"_account_id":16465,"name":"Kristi Nikolla","email":"knikolla@bu.edu","username":"knikolla"},"change_message_id":"65c6b4d1a8d4f732484312c576cbba5ea3bf0aa7","unresolved":false,"context_lines":[{"line_number":109,"context_line":"This setting sets OPT_DEBUG_LEVEL in the underlying python library.  This field"},{"line_number":110,"context_line":"is a bit mask (integer), and the possible flags are documented in the OpenLDAP"},{"line_number":111,"context_line":"manpages. Commonly used values include 255 and 4095, with 4095 being more"},{"line_number":112,"context_line":"verbose. We recommend consulting the documentation for your LDAP back end when"},{"line_number":113,"context_line":"using this option."},{"line_number":114,"context_line":""},{"line_number":115,"context_line":".. WARNING::"}],"source_content_type":"text/x-rst","patch_set":1,"id":"5f201791_8afc72b5","line":112,"updated":"2017-06-27 16:21:32.000000000","message":"Might want to also say that 0 disables it entirely? Given that you\u0027re referring to `enabling` it in the warning below.","commit_id":"47718194a8bb706ca59f2042946f54bd0cd73ad3"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"485e2f1655eed4f5c278a98e4ea24338ce24aedc","unresolved":false,"context_lines":[{"line_number":109,"context_line":"This setting sets OPT_DEBUG_LEVEL in the underlying python library.  This field"},{"line_number":110,"context_line":"is a bit mask (integer), and the possible flags are documented in the OpenLDAP"},{"line_number":111,"context_line":"manpages. Commonly used values include 255 and 4095, with 4095 being more"},{"line_number":112,"context_line":"verbose. We recommend consulting the documentation for your LDAP back end when"},{"line_number":113,"context_line":"using this option."},{"line_number":114,"context_line":""},{"line_number":115,"context_line":".. WARNING::"}],"source_content_type":"text/x-rst","patch_set":1,"id":"5f201791_a5588155","line":112,"in_reply_to":"5f201791_8afc72b5","updated":"2017-06-27 17:01:24.000000000","message":"Done","commit_id":"47718194a8bb706ca59f2042946f54bd0cd73ad3"},{"author":{"_account_id":16465,"name":"Kristi Nikolla","email":"knikolla@bu.edu","username":"knikolla"},"change_message_id":"65c6b4d1a8d4f732484312c576cbba5ea3bf0aa7","unresolved":false,"context_lines":[{"line_number":140,"context_line":"**Connection pooling for end user authentication**"},{"line_number":141,"context_line":""},{"line_number":142,"context_line":"LDAP user authentication is performed via an LDAP bind operation. In large"},{"line_number":143,"context_line":"deployments, user authentication can use up all available able connections in a"},{"line_number":144,"context_line":"connection pool. OpenStack Identity provides a seperate connection pool"},{"line_number":145,"context_line":"specifically for user authentication."},{"line_number":146,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"5f201791_8aea32d5","line":143,"updated":"2017-06-27 16:21:32.000000000","message":"/available able/available/","commit_id":"47718194a8bb706ca59f2042946f54bd0cd73ad3"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"485e2f1655eed4f5c278a98e4ea24338ce24aedc","unresolved":false,"context_lines":[{"line_number":140,"context_line":"**Connection pooling for end user authentication**"},{"line_number":141,"context_line":""},{"line_number":142,"context_line":"LDAP user authentication is performed via an LDAP bind operation. In large"},{"line_number":143,"context_line":"deployments, user authentication can use up all available able connections in a"},{"line_number":144,"context_line":"connection pool. OpenStack Identity provides a seperate connection pool"},{"line_number":145,"context_line":"specifically for user authentication."},{"line_number":146,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"5f201791_85534539","line":143,"in_reply_to":"5f201791_8aea32d5","updated":"2017-06-27 17:01:24.000000000","message":"Done","commit_id":"47718194a8bb706ca59f2042946f54bd0cd73ad3"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"26456a56eba7c649ca2c73707d2d975df12c3c04","unresolved":false,"context_lines":[{"line_number":106,"context_line":"   [ldap]"},{"line_number":107,"context_line":"   debug_level \u003d 4095"},{"line_number":108,"context_line":""},{"line_number":109,"context_line":"This setting sets OPT_DEBUG_LEVEL in the underlying python library.  This field"},{"line_number":110,"context_line":"is a bit mask (integer), and the possible flags are documented in the OpenLDAP"},{"line_number":111,"context_line":"manpages. Commonly used values include 255 and 4095, with 4095 being more"},{"line_number":112,"context_line":"verbose and 0 being disabled. We recommend consulting the documentation for"}],"source_content_type":"text/x-rst","patch_set":2,"id":"3f1d235d_8b7b338a","line":109,"range":{"start_line":109,"start_character":18,"end_line":109,"end_character":33},"updated":"2017-07-07 04:00:36.000000000","message":"use `` here","commit_id":"b720c6fcd4b23b8222ca3ca12cd918dd6b273193"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"812d05660d4e65e37425a85797f1acc7e3256955","unresolved":false,"context_lines":[{"line_number":106,"context_line":"   [ldap]"},{"line_number":107,"context_line":"   debug_level \u003d 4095"},{"line_number":108,"context_line":""},{"line_number":109,"context_line":"This setting sets OPT_DEBUG_LEVEL in the underlying python library.  This field"},{"line_number":110,"context_line":"is a bit mask (integer), and the possible flags are documented in the OpenLDAP"},{"line_number":111,"context_line":"manpages. Commonly used values include 255 and 4095, with 4095 being more"},{"line_number":112,"context_line":"verbose and 0 being disabled. We recommend consulting the documentation for"}],"source_content_type":"text/x-rst","patch_set":2,"id":"3f1d235d_2b9adfb7","line":109,"in_reply_to":"3f1d235d_8b7b338a","updated":"2017-07-07 04:02:41.000000000","message":"Good catch, thanks!","commit_id":"b720c6fcd4b23b8222ca3ca12cd918dd6b273193"},{"author":{"_account_id":21420,"name":"Gage Hugo","email":"gagehugo@gmail.com","username":"ghugo"},"change_message_id":"290aefe3092bd91ddda51f7b98927386e62d8025","unresolved":false,"context_lines":[{"line_number":110,"context_line":"field is a bit mask (integer), and the possible flags are documented in the"},{"line_number":111,"context_line":"OpenLDAP manpages. Commonly used values include 255 and 4095, with 4095 being"},{"line_number":112,"context_line":"more verbose and 0 being disabled. We recommend consulting the documentation"},{"line_number":113,"context_line":"for your LDAP back end when using this option."},{"line_number":114,"context_line":""},{"line_number":115,"context_line":".. WARNING::"},{"line_number":116,"context_line":"  Enabling ``debug_level`` will negatively impact performance."}],"source_content_type":"text/x-rst","patch_set":3,"id":"3f1d235d_bb1628f1","line":113,"range":{"start_line":113,"start_character":14,"end_line":113,"end_character":22},"updated":"2017-07-07 16:12:25.000000000","message":"Really small nit: Kinda weird using both \"back end\" and \"backends\"","commit_id":"83d5896976a16ba434846a19871b3ed24a6d977f"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"ccc98e1df313889ed8cdcb01462c706d41c4a91f","unresolved":false,"context_lines":[{"line_number":110,"context_line":"field is a bit mask (integer), and the possible flags are documented in the"},{"line_number":111,"context_line":"OpenLDAP manpages. Commonly used values include 255 and 4095, with 4095 being"},{"line_number":112,"context_line":"more verbose and 0 being disabled. We recommend consulting the documentation"},{"line_number":113,"context_line":"for your LDAP back end when using this option."},{"line_number":114,"context_line":""},{"line_number":115,"context_line":".. WARNING::"},{"line_number":116,"context_line":"  Enabling ``debug_level`` will negatively impact performance."}],"source_content_type":"text/x-rst","patch_set":3,"id":"3f1d235d_fe9dae57","line":113,"in_reply_to":"3f1d235d_bb1628f1","updated":"2017-07-07 16:53:50.000000000","message":"Done","commit_id":"83d5896976a16ba434846a19871b3ed24a6d977f"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"024244fda7e2c2085a0047de4db5b14ad70d4985","unresolved":false,"context_lines":[{"line_number":188,"context_line":""},{"line_number":189,"context_line":"         user_objectclass \u003d person"},{"line_number":190,"context_line":""},{"line_number":191,"context_line":"#. A read-only implementation is recommended for LDAP integration. These"},{"line_number":192,"context_line":"   permissions are applied to object types in the"},{"line_number":193,"context_line":"   ``/etc/keystone/keystone.conf`` file:"},{"line_number":194,"context_line":""},{"line_number":195,"context_line":"   .. code-block:: ini"},{"line_number":196,"context_line":""},{"line_number":197,"context_line":"      [ldap]"},{"line_number":198,"context_line":"      user_allow_create \u003d False"},{"line_number":199,"context_line":"      user_allow_update \u003d False"},{"line_number":200,"context_line":"      user_allow_delete \u003d False"},{"line_number":201,"context_line":""},{"line_number":202,"context_line":"      group_allow_create \u003d False"},{"line_number":203,"context_line":"      group_allow_update \u003d False"},{"line_number":204,"context_line":"      group_allow_delete \u003d False"},{"line_number":205,"context_line":""},{"line_number":206,"context_line":"   Restart the OpenStack Identity service."},{"line_number":207,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"df3967d1_e850e10c","side":"PARENT","line":204,"range":{"start_line":191,"start_character":0,"end_line":204,"end_character":32},"updated":"2017-08-02 13:46:55.000000000","message":"are we losing this bit?","commit_id":"bcae07ebdc1f3c87dc7d777dca7546e1bff77057"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"ec8ce240925b744489398452cd7434230af3d9e3","unresolved":false,"context_lines":[{"line_number":201,"context_line":""},{"line_number":202,"context_line":"      group_allow_create \u003d False"},{"line_number":203,"context_line":"      group_allow_update \u003d False"},{"line_number":204,"context_line":"      group_allow_delete \u003d False"},{"line_number":205,"context_line":""},{"line_number":206,"context_line":"   Restart the OpenStack Identity service."},{"line_number":207,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"df3967d1_689e3155","side":"PARENT","line":204,"in_reply_to":"df3967d1_28eca9f1","updated":"2017-08-02 13:57:08.000000000","message":"ah that\u0027s true!","commit_id":"bcae07ebdc1f3c87dc7d777dca7546e1bff77057"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"97ea4afc24ca15f058bdeab0f5dc82647f4bfaab","unresolved":false,"context_lines":[{"line_number":201,"context_line":""},{"line_number":202,"context_line":"      group_allow_create \u003d False"},{"line_number":203,"context_line":"      group_allow_update \u003d False"},{"line_number":204,"context_line":"      group_allow_delete \u003d False"},{"line_number":205,"context_line":""},{"line_number":206,"context_line":"   Restart the OpenStack Identity service."},{"line_number":207,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"df3967d1_28eca9f1","side":"PARENT","line":204,"in_reply_to":"df3967d1_e850e10c","updated":"2017-08-02 13:55:23.000000000","message":"These options don\u0027t actually exist anymore. I went to look them up but they went away when we moved to full read-only access. It was mostly here as a way for deployments to move from read-write -\u003e read-only.","commit_id":"bcae07ebdc1f3c87dc7d777dca7546e1bff77057"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"024244fda7e2c2085a0047de4db5b14ad70d4985","unresolved":false,"context_lines":[{"line_number":117,"context_line":""},{"line_number":118,"context_line":"This setting sets ``OPT_DEBUG_LEVEL`` in the underlying python library. This"},{"line_number":119,"context_line":"field is a bit mask (integer), and the possible flags are documented in the"},{"line_number":120,"context_line":"OpenLDAP manpages. Commonly used values include 255 and 4095, with 4095 being"},{"line_number":121,"context_line":"more verbose and 0 being disabled. We recommend consulting the documentation"},{"line_number":122,"context_line":"for your LDAP back end when using this option."},{"line_number":123,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"df3967d1_cd140f51","line":120,"range":{"start_line":120,"start_character":0,"end_line":120,"end_character":17},"updated":"2017-08-02 13:46:55.000000000","message":"would be nice a reference","commit_id":"d65112995b02d715ce33006249bc5fabff5181db"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"ec8ce240925b744489398452cd7434230af3d9e3","unresolved":false,"context_lines":[{"line_number":117,"context_line":""},{"line_number":118,"context_line":"This setting sets ``OPT_DEBUG_LEVEL`` in the underlying python library. This"},{"line_number":119,"context_line":"field is a bit mask (integer), and the possible flags are documented in the"},{"line_number":120,"context_line":"OpenLDAP manpages. Commonly used values include 255 and 4095, with 4095 being"},{"line_number":121,"context_line":"more verbose and 0 being disabled. We recommend consulting the documentation"},{"line_number":122,"context_line":"for your LDAP back end when using this option."},{"line_number":123,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"df3967d1_2873894f","line":120,"in_reply_to":"df3967d1_a812d907","updated":"2017-08-02 13:57:08.000000000","message":"yeah maybe w ecan remove , \"and the possible flags are documented in the OpenLDAP manpages\"","commit_id":"d65112995b02d715ce33006249bc5fabff5181db"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"97ea4afc24ca15f058bdeab0f5dc82647f4bfaab","unresolved":false,"context_lines":[{"line_number":117,"context_line":""},{"line_number":118,"context_line":"This setting sets ``OPT_DEBUG_LEVEL`` in the underlying python library. This"},{"line_number":119,"context_line":"field is a bit mask (integer), and the possible flags are documented in the"},{"line_number":120,"context_line":"OpenLDAP manpages. Commonly used values include 255 and 4095, with 4095 being"},{"line_number":121,"context_line":"more verbose and 0 being disabled. We recommend consulting the documentation"},{"line_number":122,"context_line":"for your LDAP back end when using this option."},{"line_number":123,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"df3967d1_a812d907","line":120,"in_reply_to":"df3967d1_cd140f51","updated":"2017-08-02 13:55:23.000000000","message":"Good idea - I can\u0027t seem to find a consistent link to a man page though. I wonder if we should remove this bit then? Or refactor it to say something else. As a reader - it\u0027s frustrating to go research something you just read and you can\u0027t find anything.","commit_id":"d65112995b02d715ce33006249bc5fabff5181db"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"024244fda7e2c2085a0047de4db5b14ad70d4985","unresolved":false,"context_lines":[{"line_number":150,"context_line":""},{"line_number":151,"context_line":"LDAP user authentication is performed via an LDAP bind operation. In large"},{"line_number":152,"context_line":"deployments, user authentication can use up all available connections in a"},{"line_number":153,"context_line":"connection pool. OpenStack Identity provides a seperate connection pool"},{"line_number":154,"context_line":"specifically for user authentication."},{"line_number":155,"context_line":""},{"line_number":156,"context_line":"Use ``use_auth_pool`` to enable LDAP connection pooling for end user"}],"source_content_type":"text/x-rst","patch_set":5,"id":"df3967d1_28182973","line":153,"range":{"start_line":153,"start_character":47,"end_line":153,"end_character":55},"updated":"2017-08-02 13:46:55.000000000","message":"separate","commit_id":"d65112995b02d715ce33006249bc5fabff5181db"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"97ea4afc24ca15f058bdeab0f5dc82647f4bfaab","unresolved":false,"context_lines":[{"line_number":150,"context_line":""},{"line_number":151,"context_line":"LDAP user authentication is performed via an LDAP bind operation. In large"},{"line_number":152,"context_line":"deployments, user authentication can use up all available connections in a"},{"line_number":153,"context_line":"connection pool. OpenStack Identity provides a seperate connection pool"},{"line_number":154,"context_line":"specifically for user authentication."},{"line_number":155,"context_line":""},{"line_number":156,"context_line":"Use ``use_auth_pool`` to enable LDAP connection pooling for end user"}],"source_content_type":"text/x-rst","patch_set":5,"id":"df3967d1_48036db9","line":153,"in_reply_to":"df3967d1_28182973","updated":"2017-08-02 13:55:23.000000000","message":"Done","commit_id":"d65112995b02d715ce33006249bc5fabff5181db"},{"author":{"_account_id":21420,"name":"Gage Hugo","email":"gagehugo@gmail.com","username":"ghugo"},"change_message_id":"5ed3e12b84c04c65463796be6082bc5a4184b1bd","unresolved":false,"context_lines":[{"line_number":380,"context_line":"Enabled emulation"},{"line_number":381,"context_line":"   OpenStack Identity supports emulation for integrating with LDAP servers that"},{"line_number":382,"context_line":"   do not provide an ``enabled`` attribute for users. This allows OpenStack"},{"line_number":383,"context_line":"   Identity to advertize ``enabled`` attributes when the user entity in LDAP"},{"line_number":384,"context_line":"   does not. The ``user_enabled_emulation`` option must be enabled and the"},{"line_number":385,"context_line":"   ``user_enabled_emulation_dn`` option must be a valid LDAP group. Users in"},{"line_number":386,"context_line":"   the group specified by ``user_enabled_emulation_dn`` will be marked as"}],"source_content_type":"text/x-rst","patch_set":5,"id":"1f1a1f67_04557f1d","line":383,"range":{"start_line":383,"start_character":15,"end_line":383,"end_character":24},"updated":"2017-07-13 21:13:13.000000000","message":"advertise*","commit_id":"d65112995b02d715ce33006249bc5fabff5181db"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"97ea4afc24ca15f058bdeab0f5dc82647f4bfaab","unresolved":false,"context_lines":[{"line_number":380,"context_line":"Enabled emulation"},{"line_number":381,"context_line":"   OpenStack Identity supports emulation for integrating with LDAP servers that"},{"line_number":382,"context_line":"   do not provide an ``enabled`` attribute for users. This allows OpenStack"},{"line_number":383,"context_line":"   Identity to advertize ``enabled`` attributes when the user entity in LDAP"},{"line_number":384,"context_line":"   does not. The ``user_enabled_emulation`` option must be enabled and the"},{"line_number":385,"context_line":"   ``user_enabled_emulation_dn`` option must be a valid LDAP group. Users in"},{"line_number":386,"context_line":"   the group specified by ``user_enabled_emulation_dn`` will be marked as"}],"source_content_type":"text/x-rst","patch_set":5,"id":"df3967d1_88d03521","line":383,"in_reply_to":"1f1a1f67_04557f1d","updated":"2017-08-02 13:55:23.000000000","message":"Done","commit_id":"d65112995b02d715ce33006249bc5fabff5181db"},{"author":{"_account_id":21420,"name":"Gage Hugo","email":"gagehugo@gmail.com","username":"ghugo"},"change_message_id":"5ed3e12b84c04c65463796be6082bc5a4184b1bd","unresolved":false,"context_lines":[{"line_number":408,"context_line":"   In this case, the attribute is an integer and the enabled attribute is"},{"line_number":409,"context_line":"   listed in bit 1. If the mask configured ``user_enabled_mask`` is different"},{"line_number":410,"context_line":"   from 0, it retrieves the attribute from ``user_enabled_attribute`` and"},{"line_number":411,"context_line":"   performs an add operations with the ``user_enabled_mask``. If the sum of the"},{"line_number":412,"context_line":"   operation matches the mask, then the account is disabled."},{"line_number":413,"context_line":""},{"line_number":414,"context_line":"   The value of ``user_enabled_attribute`` is also saved before applying the"}],"source_content_type":"text/x-rst","patch_set":5,"id":"1f1a1f67_a4148b4f","line":411,"range":{"start_line":411,"start_character":19,"end_line":411,"end_character":29},"updated":"2017-07-13 21:13:13.000000000","message":"operation*","commit_id":"d65112995b02d715ce33006249bc5fabff5181db"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"97ea4afc24ca15f058bdeab0f5dc82647f4bfaab","unresolved":false,"context_lines":[{"line_number":408,"context_line":"   In this case, the attribute is an integer and the enabled attribute is"},{"line_number":409,"context_line":"   listed in bit 1. If the mask configured ``user_enabled_mask`` is different"},{"line_number":410,"context_line":"   from 0, it retrieves the attribute from ``user_enabled_attribute`` and"},{"line_number":411,"context_line":"   performs an add operations with the ``user_enabled_mask``. If the sum of the"},{"line_number":412,"context_line":"   operation matches the mask, then the account is disabled."},{"line_number":413,"context_line":""},{"line_number":414,"context_line":"   The value of ``user_enabled_attribute`` is also saved before applying the"}],"source_content_type":"text/x-rst","patch_set":5,"id":"df3967d1_e8a461bb","line":411,"in_reply_to":"1f1a1f67_a4148b4f","updated":"2017-08-02 13:55:23.000000000","message":"Done","commit_id":"d65112995b02d715ce33006249bc5fabff5181db"}],"doc/source/configuration.rst":[{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"6afafaf92312dbde94523d978fb80480cc88a1b3","unresolved":false,"context_lines":[{"line_number":1544,"context_line":"  user_tree_dn \u003d ou\u003dUsers,dc\u003dopenstack,dc\u003dorg"},{"line_number":1545,"context_line":"  user_objectclass \u003d inetOrgPerson"},{"line_number":1546,"context_line":""},{"line_number":1547,"context_line":"The default object classes and attributes are intentionally simplistic. They"},{"line_number":1548,"context_line":"reflect the common standard objects according to the LDAP RFCs. However, in a"},{"line_number":1549,"context_line":"live deployment, the correct attributes can be overridden to support a"},{"line_number":1550,"context_line":"preexisting, more complex schema. For example, in the user object, the"},{"line_number":1551,"context_line":"objectClass posixAccount from RFC2307 is very common. If this is the underlying"},{"line_number":1552,"context_line":"objectclass, then the *uid* field should probably be *uidNumber* and *username*"},{"line_number":1553,"context_line":"field either *uid* or *cn*. To change these two fields, the corresponding"},{"line_number":1554,"context_line":"entries in the keystone configuration file are:"},{"line_number":1555,"context_line":""},{"line_number":1556,"context_line":".. code-block:: ini"},{"line_number":1557,"context_line":""},{"line_number":1558,"context_line":"  [ldap]"},{"line_number":1559,"context_line":"  user_id_attribute \u003d uidNumber"},{"line_number":1560,"context_line":"  user_name_attribute \u003d cn"},{"line_number":1561,"context_line":""},{"line_number":1562,"context_line":"There are some configuration options for filtering users, tenants and roles, if"},{"line_number":1563,"context_line":"the backend is providing too much output, in such case the configuration will"}],"source_content_type":"text/x-rst","patch_set":4,"id":"3f1d235d_89c074e2","side":"PARENT","line":1560,"range":{"start_line":1547,"start_character":0,"end_line":1560,"end_character":26},"updated":"2017-07-11 14:21:54.000000000","message":"I don\u0027t see this information copied over, I think losing it would be a loss","commit_id":"bcae07ebdc1f3c87dc7d777dca7546e1bff77057"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"d7874d018202d098de7aa21e82cb2c74f38de706","unresolved":false,"context_lines":[{"line_number":1557,"context_line":""},{"line_number":1558,"context_line":"  [ldap]"},{"line_number":1559,"context_line":"  user_id_attribute \u003d uidNumber"},{"line_number":1560,"context_line":"  user_name_attribute \u003d cn"},{"line_number":1561,"context_line":""},{"line_number":1562,"context_line":"There are some configuration options for filtering users, tenants and roles, if"},{"line_number":1563,"context_line":"the backend is providing too much output, in such case the configuration will"}],"source_content_type":"text/x-rst","patch_set":4,"id":"1f1a1f67_ca63131a","side":"PARENT","line":1560,"in_reply_to":"3f1d235d_89c074e2","updated":"2017-07-13 19:56:56.000000000","message":"Done","commit_id":"bcae07ebdc1f3c87dc7d777dca7546e1bff77057"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"6afafaf92312dbde94523d978fb80480cc88a1b3","unresolved":false,"context_lines":[{"line_number":1568,"context_line":"  [ldap]"},{"line_number":1569,"context_line":"  user_filter \u003d (memberof\u003dCN\u003dopenstack-users,OU\u003dworkgroups,DC\u003dopenstack,DC\u003dorg)"},{"line_number":1570,"context_line":""},{"line_number":1571,"context_line":"In case that the directory server does not have an attribute enabled of type"},{"line_number":1572,"context_line":"boolean for the user, there is several configuration parameters that can be"},{"line_number":1573,"context_line":"used to extract the value from an integer attribute like in Active Directory:"},{"line_number":1574,"context_line":""},{"line_number":1575,"context_line":".. code-block:: ini"},{"line_number":1576,"context_line":""},{"line_number":1577,"context_line":"  [ldap]"},{"line_number":1578,"context_line":"  user_enabled_attribute \u003d userAccountControl"},{"line_number":1579,"context_line":"  user_enabled_mask      \u003d 2"},{"line_number":1580,"context_line":"  user_enabled_default   \u003d 512"},{"line_number":1581,"context_line":""},{"line_number":1582,"context_line":"In this case the attribute is an integer and the enabled attribute is listed in"},{"line_number":1583,"context_line":"bit 1, so the if the mask configured *user_enabled_mask* is different from 0,"},{"line_number":1584,"context_line":"it gets the value from the field *user_enabled_attribute* and it makes an ADD"},{"line_number":1585,"context_line":"operation with the value indicated on *user_enabled_mask* and if the value"},{"line_number":1586,"context_line":"matches the mask then the account is disabled."},{"line_number":1587,"context_line":""},{"line_number":1588,"context_line":"It also saves the value without mask to the user identity in the attribute"},{"line_number":1589,"context_line":"*enabled_nomask*. This is needed in order to set it back in case that we need"},{"line_number":1590,"context_line":"to change it to enable/disable a user because it contains more information than"},{"line_number":1591,"context_line":"the status like password expiration. Last setting *user_enabled_mask* is needed"},{"line_number":1592,"context_line":"in order to create a default value on the integer attribute (512 \u003d NORMAL"},{"line_number":1593,"context_line":"ACCOUNT on AD)"},{"line_number":1594,"context_line":""},{"line_number":1595,"context_line":"In case of Active Directory the classes and attributes could not match the"},{"line_number":1596,"context_line":"specified classes in the LDAP module so you can configure them like:"}],"source_content_type":"text/x-rst","patch_set":4,"id":"3f1d235d_a4feb502","side":"PARENT","line":1593,"range":{"start_line":1571,"start_character":0,"end_line":1593,"end_character":14},"updated":"2017-07-11 14:21:54.000000000","message":"same with this, the other guide is lacking these details","commit_id":"bcae07ebdc1f3c87dc7d777dca7546e1bff77057"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"d7874d018202d098de7aa21e82cb2c74f38de706","unresolved":false,"context_lines":[{"line_number":1590,"context_line":"to change it to enable/disable a user because it contains more information than"},{"line_number":1591,"context_line":"the status like password expiration. Last setting *user_enabled_mask* is needed"},{"line_number":1592,"context_line":"in order to create a default value on the integer attribute (512 \u003d NORMAL"},{"line_number":1593,"context_line":"ACCOUNT on AD)"},{"line_number":1594,"context_line":""},{"line_number":1595,"context_line":"In case of Active Directory the classes and attributes could not match the"},{"line_number":1596,"context_line":"specified classes in the LDAP module so you can configure them like:"}],"source_content_type":"text/x-rst","patch_set":4,"id":"1f1a1f67_b50838d9","side":"PARENT","line":1593,"in_reply_to":"3f1d235d_a4feb502","updated":"2017-07-13 19:56:56.000000000","message":"Ok - I took a shot at moving this over. I had to guess in a few parts since I don\u0027t have an Active Directory to test against (it seems this example was tailored to AD).","commit_id":"bcae07ebdc1f3c87dc7d777dca7546e1bff77057"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"6afafaf92312dbde94523d978fb80480cc88a1b3","unresolved":false,"context_lines":[{"line_number":1817,"context_line":"  # Minimum value: 1"},{"line_number":1818,"context_line":"  auth_pool_connection_lifetime \u003d 60"},{"line_number":1819,"context_line":""},{"line_number":1820,"context_line":"Specifying Multiple LDAP servers"},{"line_number":1821,"context_line":"--------------------------------"},{"line_number":1822,"context_line":""},{"line_number":1823,"context_line":"Multiple LDAP server URLs can be provided to keystone to provide"},{"line_number":1824,"context_line":"high-availability support for a single LDAP backend. To specify multiple LDAP"},{"line_number":1825,"context_line":"servers, simply change the ``url`` option in the ``[ldap]`` section. The new"},{"line_number":1826,"context_line":"option should list the different servers, each separated by a comma. For"},{"line_number":1827,"context_line":"example:"},{"line_number":1828,"context_line":""},{"line_number":1829,"context_line":".. code-block:: ini"},{"line_number":1830,"context_line":""},{"line_number":1831,"context_line":"  [ldap]"},{"line_number":1832,"context_line":"  url \u003d \"ldap://localhost,ldap://backup.localhost\""},{"line_number":1833,"context_line":""},{"line_number":1834,"context_line":""},{"line_number":1835,"context_line":"Credential Encryption"}],"source_content_type":"text/x-rst","patch_set":4,"id":"3f1d235d_a49a35c2","side":"PARENT","line":1832,"range":{"start_line":1820,"start_character":0,"end_line":1832,"end_character":50},"updated":"2017-07-11 14:21:54.000000000","message":"This section seems to be missing too","commit_id":"bcae07ebdc1f3c87dc7d777dca7546e1bff77057"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"d7874d018202d098de7aa21e82cb2c74f38de706","unresolved":false,"context_lines":[{"line_number":1829,"context_line":".. code-block:: ini"},{"line_number":1830,"context_line":""},{"line_number":1831,"context_line":"  [ldap]"},{"line_number":1832,"context_line":"  url \u003d \"ldap://localhost,ldap://backup.localhost\""},{"line_number":1833,"context_line":""},{"line_number":1834,"context_line":""},{"line_number":1835,"context_line":"Credential Encryption"}],"source_content_type":"text/x-rst","patch_set":4,"id":"1f1a1f67_15adac87","side":"PARENT","line":1832,"in_reply_to":"3f1d235d_a49a35c2","updated":"2017-07-13 19:56:56.000000000","message":"Done","commit_id":"bcae07ebdc1f3c87dc7d777dca7546e1bff77057"}]}