8bf222ac5d
If LDAP returns a UUID as an octet string the LDAP driver will fail to convert it to something meaningful. The error usually looks something like: ID attribute objectGUID not found in LDAP object Microsoft AD's `objectGUID` parameter is stored and transmitted as an octet string [0]. If you attempt to use the `objectGUID` to generate user or group IDs, you'll get an HTTP 404 because keystone can't decode it properly. This is unfortunate because `objectGUID` are a fixed length, UUID format, and ideal for generating IDs in keystone. As opposed to using the object's CN, which is variable length, and can generate hashes that are larger than keystone's database table limit for user IDs. [0] https://docs.microsoft.com/en-us/windows/win32/ad/reading-an-objectampaposs-objectguid-and-creating-a-string-representation-of-the-guid Change-Id: Id80b17bdff015e10340e636102576b7435bd564f Closes-Bug: 1889936
6 lines
160 B
YAML
6 lines
160 B
YAML
---
|
|
fixes:
|
|
- |
|
|
[`bug 1889936 <https://bugs.launchpad.net/keystone/+bug/1889936>`_]
|
|
Properly decode octet strings, or byte arrays, returned from LDAP.
|