openstack/deb-keystone
Code Issues Proposed changes

deprecate LDAP config options for 'tenants'

Browse Source 
This deprecates all config options using the term 'tenant' in favor of
new options using the term 'project'.

Change-Id: I7eb6819de33f4d94a8bae75286bb02436152c64b
Closes-Bug: 1283841
This commit is contained in:
Dolph Mathews 2014-06-24 10:28:01 -05:00
parent db0519dfa0
commit 58fb797815
8 changed files with 120 additions and 88 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

58
doc/source/configuration.rst
View File

@ -1332,8 +1332,8 @@ The corresponding entries in the Keystone configuration file are::
user_tree_dn = ou=Users,dc=openstack,dc=org user_tree_dn = ou=Users,dc=openstack,dc=org
user_objectclass = inetOrgPerson user_objectclass = inetOrgPerson
tenant_tree_dn = ou=Projects,dc=openstack,dc=org project_tree_dn = ou=Projects,dc=openstack,dc=org
tenant_objectclass = groupOfNames project_objectclass = groupOfNames
role_tree_dn = ou=Roles,dc=openstack,dc=org role_tree_dn = ou=Roles,dc=openstack,dc=org
role_objectclass = organizationalRole role_objectclass = organizationalRole
@ -1362,9 +1362,9 @@ is::
user_allow_update = False user_allow_update = False
user_allow_delete = False user_allow_delete = False
tenant_allow_create = True project_allow_create = True
tenant_allow_update = True project_allow_update = True
tenant_allow_delete = True project_allow_delete = True
role_allow_create = True role_allow_create = True
role_allow_update = True role_allow_update = True
@ -1376,7 +1376,7 @@ will look like::
[ldap] [ldap]
user_filter = (memberof=CN=openstack-users,OU=workgroups,DC=openstack,DC=org) user_filter = (memberof=CN=openstack-users,OU=workgroups,DC=openstack,DC=org)
tenant_filter = project_filter =
role_filter = role_filter =
In case that the directory server does not have an attribute enabled of type In case that the directory server does not have an attribute enabled of type
@ -1404,36 +1404,36 @@ In case of Active Directory the classes and attributes could not match the
specified classes in the LDAP module so you can configure them like:: specified classes in the LDAP module so you can configure them like::
[ldap] [ldap]
user_objectclass = person user_objectclass = person
user_id_attribute = cn user_id_attribute = cn
user_name_attribute = cn user_name_attribute = cn
user_mail_attribute = mail user_mail_attribute = mail
user_enabled_attribute = userAccountControl user_enabled_attribute = userAccountControl
user_enabled_mask = 2 user_enabled_mask = 2
user_enabled_default = 512 user_enabled_default = 512
user_attribute_ignore = tenant_id,tenants user_attribute_ignore = tenant_id,tenants
tenant_objectclass = groupOfNames project_objectclass = groupOfNames
tenant_id_attribute = cn project_id_attribute = cn
tenant_member_attribute = member project_member_attribute = member
tenant_name_attribute = ou project_name_attribute = ou
tenant_desc_attribute = description project_desc_attribute = description
tenant_enabled_attribute = extensionName project_enabled_attribute = extensionName
tenant_attribute_ignore = project_attribute_ignore =
role_objectclass = organizationalRole role_objectclass = organizationalRole
role_id_attribute = cn role_id_attribute = cn
role_name_attribute = ou role_name_attribute = ou
role_member_attribute = roleOccupant role_member_attribute = roleOccupant
role_attribute_ignore = role_attribute_ignore =
Enabled Emulation Enabled Emulation
----------------- -----------------
Some directory servers do not provide any enabled attribute. For these Some directory servers do not provide any enabled attribute. For these
servers, the ``user_enabled_emulation`` and ``tenant_enabled_emulation`` servers, the ``user_enabled_emulation`` and ``project_enabled_emulation``
attributes have been created. They are enabled by setting their respective attributes have been created. They are enabled by setting their respective
flags to True. Then the attributes ``user_enabled_emulation_dn`` and flags to True. Then the attributes ``user_enabled_emulation_dn`` and
``tenant_enabled_emulation_dn`` may be set to specify how the enabled users ``project_enabled_emulation_dn`` may be set to specify how the enabled users
and projects (tenants) are selected. These attributes work by using a and projects (tenants) are selected. These attributes work by using a
``groupOfNames`` and adding whichever users or projects (tenants) that ``groupOfNames`` and adding whichever users or projects (tenants) that
you want enabled to the respective group. For example, this will you want enabled to the respective group. For example, this will
@ -1444,7 +1444,7 @@ mark any user who is a member of ``enabled_users`` as enabled::
user_enabled_emulation_dn = cn=enabled_users,cn=groups,dc=openstack,dc=org user_enabled_emulation_dn = cn=enabled_users,cn=groups,dc=openstack,dc=org
The default values for user and project (tenant) enabled emulation DN is The default values for user and project (tenant) enabled emulation DN is
``cn=enabled_users,$user_tree_dn`` and ``cn=enabled_tenants,$tenant_tree_dn`` ``cn=enabled_users,$user_tree_dn`` and ``cn=enabled_tenants,$project_tree_dn``
respectively. respectively.
Secure Connection Secure Connection

34
etc/keystone.conf.sample
View File

@ -948,60 +948,60 @@
#user_additional_attribute_mapping= #user_additional_attribute_mapping=
# Search base for projects (string value) # Search base for projects (string value)
#tenant_tree_dn=<None> #project_tree_dn=<None>
# LDAP search filter for projects. (string value) # LDAP search filter for projects. (string value)
#tenant_filter=<None> #project_filter=<None>
# LDAP objectclass for projects. (string value) # LDAP objectclass for projects. (string value)
#tenant_objectclass=groupOfNames #project_objectclass=groupOfNames
# LDAP attribute mapped to project id. (string value) # LDAP attribute mapped to project id. (string value)
#tenant_id_attribute=cn #project_id_attribute=cn
# LDAP attribute mapped to project membership for user. # LDAP attribute mapped to project membership for user.
# (string value) # (string value)
#tenant_member_attribute=member #project_member_attribute=member
# LDAP attribute mapped to project name. (string value) # LDAP attribute mapped to project name. (string value)
#tenant_name_attribute=ou #project_name_attribute=ou
# LDAP attribute mapped to project description. (string value) # LDAP attribute mapped to project description. (string value)
#tenant_desc_attribute=description #project_desc_attribute=description
# LDAP attribute mapped to project enabled. (string value) # LDAP attribute mapped to project enabled. (string value)
#tenant_enabled_attribute=enabled #project_enabled_attribute=enabled
# LDAP attribute mapped to project domain_id. (string value) # LDAP attribute mapped to project domain_id. (string value)
#tenant_domain_id_attribute=businessCategory #project_domain_id_attribute=businessCategory
# List of attributes stripped off the project on update. (list # List of attributes stripped off the project on update. (list
# value) # value)
#tenant_attribute_ignore= #project_attribute_ignore=
# Allow project creation in LDAP backend. (boolean value) # Allow project creation in LDAP backend. (boolean value)
#tenant_allow_create=true #project_allow_create=true
# Allow project update in LDAP backend. (boolean value) # Allow project update in LDAP backend. (boolean value)
#tenant_allow_update=true #project_allow_update=true
# Allow project deletion in LDAP backend. (boolean value) # Allow project deletion in LDAP backend. (boolean value)
#tenant_allow_delete=true #project_allow_delete=true
# If true, Keystone uses an alternative method to determine if # If true, Keystone uses an alternative method to determine if
# a project is enabled or not by checking if they are a member # a project is enabled or not by checking if they are a member
# of the "tenant_enabled_emulation_dn" group. (boolean value) # of the "project_enabled_emulation_dn" group. (boolean value)
#tenant_enabled_emulation=false #project_enabled_emulation=false
# DN of the group entry to hold enabled projects when using # DN of the group entry to hold enabled projects when using
# enabled emulation. (string value) # enabled emulation. (string value)
#tenant_enabled_emulation_dn=<None> #project_enabled_emulation_dn=<None>
# Additional attribute mappings for projects. Attribute # Additional attribute mappings for projects. Attribute
# mapping format is <ldap_attr>:<user_attr>, where ldap_attr # mapping format is <ldap_attr>:<user_attr>, where ldap_attr
# is the attribute in the LDAP entry and user_attr is the # is the attribute in the LDAP entry and user_attr is the
# Identity API attribute. (list value) # Identity API attribute. (list value)
#tenant_additional_attribute_mapping= #project_additional_attribute_mapping=
# Search base for roles. (string value) # Search base for roles. (string value)
#role_tree_dn=<None> #role_tree_dn=<None>

4
keystone/assignment/backends/ldap.py
View File

@ -409,7 +409,7 @@ class ProjectApi(common_ldap.EnabledEmuMixIn, common_ldap.BaseLdap):
DEFAULT_MEMBER_ATTRIBUTE = 'member' DEFAULT_MEMBER_ATTRIBUTE = 'member'
NotFound = exception.ProjectNotFound NotFound = exception.ProjectNotFound
notfound_arg = 'project_id' # NOTE(yorik-sar): while options_name = tenant notfound_arg = 'project_id' # NOTE(yorik-sar): while options_name = tenant
options_name = 'tenant' options_name = 'project'
attribute_options_names = {'name': 'name', attribute_options_names = {'name': 'name',
'description': 'desc', 'description': 'desc',
'enabled': 'enabled', 'enabled': 'enabled',
@ -419,7 +419,7 @@ class ProjectApi(common_ldap.EnabledEmuMixIn, common_ldap.BaseLdap):
def __init__(self, conf): def __init__(self, conf):
super(ProjectApi, self).__init__(conf) super(ProjectApi, self).__init__(conf)
self.member_attribute = (getattr(conf.ldap, 'tenant_member_attribute') self.member_attribute = (getattr(conf.ldap, 'project_member_attribute')
or self.DEFAULT_MEMBER_ATTRIBUTE) or self.DEFAULT_MEMBER_ATTRIBUTE)
def create(self, values): def create(self, values):

66
keystone/common/config.py
View File

@ -527,44 +527,76 @@ FILE_OPTIONS = {
'ldap_attr is the attribute in the LDAP entry and ' 'ldap_attr is the attribute in the LDAP entry and '
'user_attr is the Identity API attribute.'), 'user_attr is the Identity API attribute.'),
cfg.StrOpt('tenant_tree_dn', default=None, cfg.StrOpt('project_tree_dn', default=None,
deprecated_opts=[cfg.DeprecatedOpt(
'tenant_tree_dn', group='ldap')],
help='Search base for projects'), help='Search base for projects'),
cfg.StrOpt('tenant_filter', default=None, cfg.StrOpt('project_filter', default=None,
deprecated_opts=[cfg.DeprecatedOpt(
'tenant_filter', group='ldap')],
help='LDAP search filter for projects.'), help='LDAP search filter for projects.'),
cfg.StrOpt('tenant_objectclass', default='groupOfNames', cfg.StrOpt('project_objectclass', default='groupOfNames',
deprecated_opts=[cfg.DeprecatedOpt(
'tenant_objectclass', group='ldap')],
help='LDAP objectclass for projects.'), help='LDAP objectclass for projects.'),
cfg.StrOpt('tenant_id_attribute', default='cn', cfg.StrOpt('project_id_attribute', default='cn',
deprecated_opts=[cfg.DeprecatedOpt(
'tenant_id_attribute', group='ldap')],
help='LDAP attribute mapped to project id.'), help='LDAP attribute mapped to project id.'),
cfg.StrOpt('tenant_member_attribute', default='member', cfg.StrOpt('project_member_attribute', default='member',
deprecated_opts=[cfg.DeprecatedOpt(
'tenant_member_attribute', group='ldap')],
help='LDAP attribute mapped to project membership for ' help='LDAP attribute mapped to project membership for '
'user.'), 'user.'),
cfg.StrOpt('tenant_name_attribute', default='ou', cfg.StrOpt('project_name_attribute', default='ou',
deprecated_opts=[cfg.DeprecatedOpt(
'tenant_name_attribute', group='ldap')],
help='LDAP attribute mapped to project name.'), help='LDAP attribute mapped to project name.'),
cfg.StrOpt('tenant_desc_attribute', default='description', cfg.StrOpt('project_desc_attribute', default='description',
deprecated_opts=[cfg.DeprecatedOpt(
'tenant_desc_attribute', group='ldap')],
help='LDAP attribute mapped to project description.'), help='LDAP attribute mapped to project description.'),
cfg.StrOpt('tenant_enabled_attribute', default='enabled', cfg.StrOpt('project_enabled_attribute', default='enabled',
deprecated_opts=[cfg.DeprecatedOpt(
'tenant_enabled_attribute', group='ldap')],
help='LDAP attribute mapped to project enabled.'), help='LDAP attribute mapped to project enabled.'),
cfg.StrOpt('tenant_domain_id_attribute', cfg.StrOpt('project_domain_id_attribute',
deprecated_opts=[cfg.DeprecatedOpt(
'tenant_domain_id_attribute', group='ldap')],
default='businessCategory', default='businessCategory',
help='LDAP attribute mapped to project domain_id.'), help='LDAP attribute mapped to project domain_id.'),
cfg.ListOpt('tenant_attribute_ignore', default=[], cfg.ListOpt('project_attribute_ignore', default=[],
deprecated_opts=[cfg.DeprecatedOpt(
'tenant_attribute_ignore', group='ldap')],
help='List of attributes stripped off the project on ' help='List of attributes stripped off the project on '
'update.'), 'update.'),
cfg.BoolOpt('tenant_allow_create', default=True, cfg.BoolOpt('project_allow_create', default=True,
deprecated_opts=[cfg.DeprecatedOpt(
'tenant_allow_create', group='ldap')],
help='Allow project creation in LDAP backend.'), help='Allow project creation in LDAP backend.'),
cfg.BoolOpt('tenant_allow_update', default=True, cfg.BoolOpt('project_allow_update', default=True,
deprecated_opts=[cfg.DeprecatedOpt(
'tenant_allow_update', group='ldap')],
help='Allow project update in LDAP backend.'), help='Allow project update in LDAP backend.'),
cfg.BoolOpt('tenant_allow_delete', default=True, cfg.BoolOpt('project_allow_delete', default=True,
deprecated_opts=[cfg.DeprecatedOpt(
'tenant_allow_delete', group='ldap')],
help='Allow project deletion in LDAP backend.'), help='Allow project deletion in LDAP backend.'),
cfg.BoolOpt('tenant_enabled_emulation', default=False, cfg.BoolOpt('project_enabled_emulation', default=False,
deprecated_opts=[cfg.DeprecatedOpt(
'tenant_enabled_emulation', group='ldap')],
help='If true, Keystone uses an alternative method to ' help='If true, Keystone uses an alternative method to '
'determine if a project is enabled or not by ' 'determine if a project is enabled or not by '
'checking if they are a member of the ' 'checking if they are a member of the '
'"tenant_enabled_emulation_dn" group.'), '"project_enabled_emulation_dn" group.'),
cfg.StrOpt('tenant_enabled_emulation_dn', default=None, cfg.StrOpt('project_enabled_emulation_dn', default=None,
deprecated_opts=[cfg.DeprecatedOpt(
'tenant_enabled_emulation_dn', group='ldap')],
help='DN of the group entry to hold enabled projects when ' help='DN of the group entry to hold enabled projects when '
'using enabled emulation.'), 'using enabled emulation.'),
cfg.ListOpt('tenant_additional_attribute_mapping', cfg.ListOpt('project_additional_attribute_mapping',
deprecated_opts=[cfg.DeprecatedOpt(
'tenant_additional_attribute_mapping', group='ldap')],
default=[], default=[],
help='Additional attribute mappings for projects. ' help='Additional attribute mappings for projects. '
'Attribute mapping format is ' 'Attribute mapping format is '

4
keystone/tests/config_files/backend_liveldap.conf
View File

@ -5,9 +5,9 @@ password = test
suffix = dc=openstack,dc=org suffix = dc=openstack,dc=org
group_tree_dn = ou=UserGroups,dc=openstack,dc=org group_tree_dn = ou=UserGroups,dc=openstack,dc=org
role_tree_dn = ou=Roles,dc=openstack,dc=org role_tree_dn = ou=Roles,dc=openstack,dc=org
tenant_tree_dn = ou=Projects,dc=openstack,dc=org project_tree_dn = ou=Projects,dc=openstack,dc=org
user_tree_dn = ou=Users,dc=openstack,dc=org user_tree_dn = ou=Users,dc=openstack,dc=org
tenant_enabled_emulation = True project_enabled_emulation = True
user_enabled_emulation = True user_enabled_emulation = True
user_mail_attribute = mail user_mail_attribute = mail
use_dumb_member = True use_dumb_member = True

4
keystone/tests/config_files/backend_tls_liveldap.conf
View File

@ -5,9 +5,9 @@ password = test
suffix = dc=openstack,dc=org suffix = dc=openstack,dc=org
group_tree_dn = ou=UserGroups,dc=openstack,dc=org group_tree_dn = ou=UserGroups,dc=openstack,dc=org
role_tree_dn = ou=Roles,dc=openstack,dc=org role_tree_dn = ou=Roles,dc=openstack,dc=org
tenant_tree_dn = ou=Projects,dc=openstack,dc=org project_tree_dn = ou=Projects,dc=openstack,dc=org
user_tree_dn = ou=Users,dc=openstack,dc=org user_tree_dn = ou=Users,dc=openstack,dc=org
tenant_enabled_emulation = True project_enabled_emulation = True
user_enabled_emulation = True user_enabled_emulation = True
user_mail_attribute = mail user_mail_attribute = mail
use_dumb_member = True use_dumb_member = True

36
keystone/tests/test_backend_ldap.py
View File

@ -800,8 +800,8 @@ class LDAPIdentity(BaseLDAPIdentity, tests.TestCase):
def test_configurable_forbidden_project_actions(self): def test_configurable_forbidden_project_actions(self):
self.config_fixture.config( self.config_fixture.config(
group='ldap', tenant_allow_create=False, tenant_allow_update=False, group='ldap', project_allow_create=False,
tenant_allow_delete=False) project_allow_update=False, project_allow_delete=False)
self.load_backends() self.load_backends()
tenant = {'id': u'fäké1', 'name': u'fäké1'} tenant = {'id': u'fäké1', 'name': u'fäké1'}
@ -860,9 +860,9 @@ class LDAPIdentity(BaseLDAPIdentity, tests.TestCase):
self.assertDictEqual(tenant_ref, self.tenant_bar) self.assertDictEqual(tenant_ref, self.tenant_bar)
self.config_fixture.config(group='ldap', self.config_fixture.config(group='ldap',
tenant_filter='(CN=DOES_NOT_MATCH)') project_filter='(CN=DOES_NOT_MATCH)')
self.load_backends() self.load_backends()
# NOTE(morganfainberg): CONF.ldap.tenant_filter will not be # NOTE(morganfainberg): CONF.ldap.project_filter will not be
# dynamically changed at runtime. This invalidate is a work-around for # dynamically changed at runtime. This invalidate is a work-around for
# the expectation that it is safe to change config values in tests that # the expectation that it is safe to change config values in tests that
# could affect what the drivers would return up to the manager. This # could affect what the drivers would return up to the manager. This
@ -908,15 +908,15 @@ class LDAPIdentity(BaseLDAPIdentity, tests.TestCase):
def test_project_attribute_mapping(self): def test_project_attribute_mapping(self):
self.config_fixture.config( self.config_fixture.config(
group='ldap', tenant_name_attribute='ou', group='ldap', project_name_attribute='ou',
tenant_desc_attribute='description', project_desc_attribute='description',
tenant_enabled_attribute='enabled') project_enabled_attribute='enabled')
self.clear_database() self.clear_database()
self.load_backends() self.load_backends()
self.load_fixtures(default_fixtures) self.load_fixtures(default_fixtures)
# NOTE(morganfainberg): CONF.ldap.tenant_name_attribute, # NOTE(morganfainberg): CONF.ldap.project_name_attribute,
# CONF.ldap.tenant_desc_attribute, and # CONF.ldap.project_desc_attribute, and
# CONF.ldap.tenant_enabled_attribute will not be # CONF.ldap.project_enabled_attribute will not be
# dynamically changed at runtime. This invalidate is a work-around for # dynamically changed at runtime. This invalidate is a work-around for
# the expectation that it is safe to change config values in tests that # the expectation that it is safe to change config values in tests that
# could affect what the drivers would return up to the manager. This # could affect what the drivers would return up to the manager. This
@ -933,12 +933,12 @@ class LDAPIdentity(BaseLDAPIdentity, tests.TestCase):
self.assertEqual(self.tenant_baz['enabled'], tenant_ref['enabled']) self.assertEqual(self.tenant_baz['enabled'], tenant_ref['enabled'])
self.config_fixture.config(group='ldap', self.config_fixture.config(group='ldap',
tenant_name_attribute='description', project_name_attribute='description',
tenant_desc_attribute='ou') project_desc_attribute='ou')
self.load_backends() self.load_backends()
# NOTE(morganfainberg): CONF.ldap.tenant_name_attribute, # NOTE(morganfainberg): CONF.ldap.project_name_attribute,
# CONF.ldap.tenant_desc_attribute, and # CONF.ldap.project_desc_attribute, and
# CONF.ldap.tenant_enabled_attribute will not be # CONF.ldap.project_enabled_attribute will not be
# dynamically changed at runtime. This invalidate is a work-around for # dynamically changed at runtime. This invalidate is a work-around for
# the expectation that it is safe to change config values in tests that # the expectation that it is safe to change config values in tests that
# could affect what the drivers would return up to the manager. This # could affect what the drivers would return up to the manager. This
@ -955,11 +955,11 @@ class LDAPIdentity(BaseLDAPIdentity, tests.TestCase):
def test_project_attribute_ignore(self): def test_project_attribute_ignore(self):
self.config_fixture.config( self.config_fixture.config(
group='ldap', group='ldap',
tenant_attribute_ignore=['name', 'description', 'enabled']) project_attribute_ignore=['name', 'description', 'enabled'])
self.clear_database() self.clear_database()
self.load_backends() self.load_backends()
self.load_fixtures(default_fixtures) self.load_fixtures(default_fixtures)
# NOTE(morganfainberg): CONF.ldap.tenant_attribute_ignore will not be # NOTE(morganfainberg): CONF.ldap.project_attribute_ignore will not be
# dynamically changed at runtime. This invalidate is a work-around for # dynamically changed at runtime. This invalidate is a work-around for
# the expectation that it is safe to change configs values in tests # the expectation that it is safe to change configs values in tests
# that could affect what the drivers would return up to the manager. # that could affect what the drivers would return up to the manager.
@ -1551,7 +1551,7 @@ class LDAPIdentityEnabledEmulation(LDAPIdentity):
super(LDAPIdentityEnabledEmulation, self).config_overrides() super(LDAPIdentityEnabledEmulation, self).config_overrides()
self.config_fixture.config(group='ldap', self.config_fixture.config(group='ldap',
user_enabled_emulation=True, user_enabled_emulation=True,
tenant_enabled_emulation=True) project_enabled_emulation=True)
def test_project_crud(self): def test_project_crud(self):
# NOTE(topol): LDAPIdentityEnabledEmulation will create an # NOTE(topol): LDAPIdentityEnabledEmulation will create an

2
keystone/tests/test_ldap_livetest.py
View File

@ -68,7 +68,7 @@ class LiveLDAPIdentity(test_backend_ldap.LDAPIdentity):
create_object(CONF.ldap.role_tree_dn, create_object(CONF.ldap.role_tree_dn,
{'objectclass': 'organizationalUnit', {'objectclass': 'organizationalUnit',
'ou': 'Roles'}) 'ou': 'Roles'})
create_object(CONF.ldap.tenant_tree_dn, create_object(CONF.ldap.project_tree_dn,
{'objectclass': 'organizationalUnit', {'objectclass': 'organizationalUnit',
'ou': 'Projects'}) 'ou': 'Projects'})
create_object(CONF.ldap.group_tree_dn, create_object(CONF.ldap.group_tree_dn,