Bug 983345

Summary:	[RFE] Splitting assignments from the Identity Backend.
Product:	Red Hat OpenStack	Reporter:	Adam Young <ayoung>
Component:	openstack-keystone	Assignee:	Adam Young <ayoung>
Status:	CLOSED ERRATA	QA Contact:	Jeremy Agee <jagee>
Severity:	high	Docs Contact:
Priority:	medium
Version:	4.0	CC:	ayoung, dpal, kbanerje, nkinder
Target Milestone:	Upstream M2	Keywords:	FutureFeature
Target Release:	4.0
Hardware:	Unspecified
OS:	Unspecified
URL:	https://blueprints.launchpad.net/keystone/+spec/split-identity
Whiteboard:
Fixed In Version:	openstack-keystone-2013.2-0.5.b2.el6ost	Doc Type:	Enhancement
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2013-12-19 23:54:08 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	986067, 988937
Bug Blocks:	975499

Description Adam Young 2013-07-11 03:16:25 UTC

Original bug report was: 

implement an LDAP backend for identity that:

* allows for mapping by a tenant to a group/search set in LDAP
* authenticates to LDAP
* manages tenants and tenant-user linkages in SQL external to LDAP

Better stated as:

Split the identity backend into an identity portion and an assignments portion.

This work is tracked by blueprint 

https://blueprints.launchpad.net/keystone/+spec/split-identity

Comment 2 Dmitri Pal 2013-07-23 20:52:50 UTC

How to test:

Configure both the SQL and LDAP values for Keystone.

Set up Keystone to use the sql asignment backend, and the LDAP identity backend

[identity]
driver = keystone.identity.backends.ldap.Identity

[assignment]
driver = keystone.identity.backends.sqlAssignment

Run the tempest test suite.

As a precondtion, make sure that there are no users or groups set up in the Sql Database, and no roles, role assignments, or projects in the LDAP database.

after running tempest,  that precondition should hold true as well.

Any users or groups created by tempest should only exist in the LDAP backend
Any role assignments etc should only exist in the sql backend.

Comment 3 Dmitri Pal 2013-07-23 20:54:00 UTC

Make sure that you have read only access to LDAP in the test above.

Comment 6 Jeremy Agee 2013-12-13 02:34:43 UTC

verified, assignments and identity function separately

Comment 8 errata-xmlrpc 2013-12-19 23:54:08 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHEA-2013-1859.html