Description of problem: Keystone juno-rc2 needs python-ldap 2.3 for ldap identity. Centos7 comes with python-ldap 2.4 Version-Release number of selected component (if applicable): - openstack-keystone.noarch 2014.2-0.6rc2.el7.centos @openstack-juno - python-ldap.x86_64 2.4.6-6.el7 @base - CentOS 7 Steps to Reproduce: 1. Configure keystone to use ldap 2. keystone user-list Actual results: 2014-10-15 18:01:42.877 7294 ERROR keystone.common.wsgi [-] 'module' object has no attribute 'LDAP_CONTROL_PAGE_OID' 2014-10-15 18:01:42.877 7294 TRACE keystone.common.wsgi Traceback (most recent call last): 2014-10-15 18:01:42.877 7294 TRACE keystone.common.wsgi File "/usr/lib/python2.7/site-packages/keystone/common/wsgi.py", line 223, in __call__ 2014-10-15 18:01:42.877 7294 TRACE keystone.common.wsgi result = method(context, **params) 2014-10-15 18:01:42.877 7294 TRACE keystone.common.wsgi File "/usr/lib/python2.7/site-packages/keystone/token/controllers.py", line 100, in authenticate 2014-10-15 18:01:42.877 7294 TRACE keystone.common.wsgi context, auth) 2014-10-15 18:01:42.877 7294 TRACE keystone.common.wsgi File "/usr/lib/python2.7/site-packages/keystone/token/controllers.py", line 287, in _authenticate_local 2014-10-15 18:01:42.877 7294 TRACE keystone.common.wsgi username, CONF.identity.default_domain_id) 2014-10-15 18:01:42.877 7294 TRACE keystone.common.wsgi File "/usr/lib/python2.7/site-packages/keystone/identity/core.py", line 202, in wrapper 2014-10-15 18:01:42.877 7294 TRACE keystone.common.wsgi return f(self, *args, **kwargs) 2014-10-15 18:01:42.877 7294 TRACE keystone.common.wsgi File "/usr/lib/python2.7/site-packages/keystone/identity/core.py", line 213, in wrapper 2014-10-15 18:01:42.877 7294 TRACE keystone.common.wsgi return f(self, *args, **kwargs) 2014-10-15 18:01:42.877 7294 TRACE keystone.common.wsgi File "/usr/lib/python2.7/site-packages/keystone/identity/core.py", line 600, in get_user_by_name 2014-10-15 18:01:42.877 7294 TRACE keystone.common.wsgi ref = driver.get_user_by_name(user_name, domain_id) 2014-10-15 18:01:42.877 7294 TRACE keystone.common.wsgi File "/usr/lib/python2.7/site-packages/keystone/identity/backends/ldap.py", line 87, in get_user_by_name 2014-10-15 18:01:42.877 7294 TRACE keystone.common.wsgi return self.user.filter_attributes(self.user.get_by_name(user_name)) 2014-10-15 18:01:42.877 7294 TRACE keystone.common.wsgi File "/usr/lib/python2.7/site-packages/keystone/common/ldap/core.py", line 1475, in get_by_name 2014-10-15 18:01:42.877 7294 TRACE keystone.common.wsgi res = self.get_all(query) 2014-10-15 18:01:42.877 7294 TRACE keystone.common.wsgi File "/usr/lib/python2.7/site-packages/keystone/common/ldap/core.py", line 1746, in get_all 2014-10-15 18:01:42.877 7294 TRACE keystone.common.wsgi return super(EnabledEmuMixIn, self).get_all(ldap_filter) 2014-10-15 18:01:42.877 7294 TRACE keystone.common.wsgi File "/usr/lib/python2.7/site-packages/keystone/common/ldap/core.py", line 1483, in get_all 2014-10-15 18:01:42.877 7294 TRACE keystone.common.wsgi for x in self._ldap_get_all(ldap_filter)] 2014-10-15 18:01:42.877 7294 TRACE keystone.common.wsgi File "/usr/lib/python2.7/site-packages/keystone/common/ldap/core.py", line 1445, in _ldap_get_all 2014-10-15 18:01:42.877 7294 TRACE keystone.common.wsgi attrs) 2014-10-15 18:01:42.877 7294 TRACE keystone.common.wsgi File "/usr/lib/python2.7/site-packages/keystone/common/ldap/core.py", line 929, in search_s 2014-10-15 18:01:42.877 7294 TRACE keystone.common.wsgi filterstr, attrlist) 2014-10-15 18:01:42.877 7294 TRACE keystone.common.wsgi File "/usr/lib/python2.7/site-packages/keystone/common/ldap/core.py", line 964, in _paged_search_s 2014-10-15 18:01:42.877 7294 TRACE keystone.common.wsgi controlType=ldap.LDAP_CONTROL_PAGE_OID, 2014-10-15 18:01:42.877 7294 TRACE keystone.common.wsgi AttributeError: 'module' object has no attribute 'LDAP_CONTROL_PAGE_OID' Expected results: List of users. Additional info: I tried with python-ldap 2.3 and works.
What does your Keystone LDAP configuration look like? Also, what version of the 'openldap' package do you have installed? This is working for me on a fresh install using a domain specific LDAP backend for identity (assignment in SQL): [rhosuser@rhos ~]$ rpm -q openstack-keystone python-ldap openldap openstack-keystone-2014.2-0.6rc2.el7.centos.noarch python-ldap-2.4.6-6.el7.x86_64 openldap-2.4.39-3.el7.x86_64 [rhosuser@rhos ~(keystone_cloud_admin)]$ openstack user list --domain ipa +------------------------------------------------------------------+----------+ | ID | Name | +------------------------------------------------------------------+----------+ | 08c8bb1b1b8efa7abea9a8eb73784c59e6fbd7283e864d341aaea7d45b42814e | admin | | 1f94e7038ecd141dfe1656aa56d89779a27dd8b7a6aca4863860a1d58ac168ab | keystone | +------------------------------------------------------------------+----------+
Ok, so this is indeed a problem. Keystone needs some changes to allow it to work with the new way that paging works in python-ldap 2.4.
An upstream bug was filed on this issue here: https://bugs.launchpad.net/keystone/+bug/1381768
A fix has been proposed for this upstream (in master): https://review.openstack.org/128782 There should not be a problem with backporting this to Juno once it's accepted for master.
Great! Thanks.
http://pkgs.fedoraproject.org/cgit/openstack-keystone.git/commit/?id=7bf72c1557651328f1dc6c2bd41c748bbc2650ab
This never happened to me with the default LDAP configurations I've been using. How do I recreate this bug? Did it ever happen in a version that was delivered to QE?
(In reply to Udi from comment #7) > This never happened to me with the default LDAP configurations I've been > using. How do I recreate this bug? Did it ever happen in a version that was > delivered to QE? Yes, it should exist in versions that QE have tested. You need to enable paging by setting 'page_size' to a value greater than '0' in the '[ldap]' section of keystone.conf and do an operation like 'keystone user-list' against an LDAP identity backend. To reproduce, this would need to be done on a system using python-ldap 2.4.x.