Implement multi-domain LDAP configuration for Keystone

This patch changes the keystone_ldap configuration to allow multiple
LDAP identity back-end configurations to be implemented.

Example implementation in user_variables.yml:

keystone_ldap:
  Users:
    url: "ldap://10.10.10.10"
    user: "root"
    password: "secrete"
    ...
  Admins:
    url: "ldap://20.20.20.20"
    user: "root"
    password: "secrete"
    ...

This will place two configuration files into /etc/keystone/domains/,
both of which will be configured to use the LDAP driver.

 - keystone.Users.conf
 - keystone.Admins.conf

Each first level key entry is a domain name. Each entry below that
are key-value pairs for the 'ldap' section in the configuration
file.

Note that the reason why only LDAP is catered for is due to the fact
that LDAP is the only supported driver in OpenStack for
Domain-specific configuration files.

Also the reason that only the identity back-end is catered for is that
the LDAP driver for the role, resource and assignment back-ends have
been deprecated and are scheduled for removal in Mitaka.

UpgradeImpact:

- keystone_ldap's first key tier is now the domain name.
  An existing keystone_ldap configuration entry can be converted by
  renaming the 'ldap' key to the domain name 'Default'.
  **Note** that the domain name entry is case-sensitive.

- keystone_ldap_identity_driver has been removed, as the driver
  for ldap is now simply 'ldap' and there are no other back-end
  options for Keystone at this time.

Change-Id: Ifa4c42f7dbcc40a256a3156f74f0150384f9ab87

defaults/main.yml

@@ -165,22 +165,26 @@ keystone_ssl_self_signed_subject: "/C=US/ST=Texas/L=San Antonio/O=IT/CN={{ inter
 # If set this will enable dog pile cache for keystone.
 # keystone_cache_backend_argument: url:127.0.0.1:11211
 
-## LDAP section
+## LDAP Section
-# Define keystone ldap information here.
+# Define Keystone LDAP domain configuration here.
+# This may be used to add configuration for a LDAP identity back-end.
 # See the http://docs.openstack.org/admin-guide-cloud/keystone_integrate_with_ldap.html
-# for more information on available options. The sections here are defined as key: value pairs. Each
+#
-# top level key bellow ``keystone_ldap`` is a section.
+# Each top-level entry is a domain name. Each entry below that are key: value pairs for
+# the ldap section in the domain-specific configuraiton file.
+#
 # (EXAMPLE LAYOUT)
 # keystone_ldap:
-#   ldap:
+#   Users:
 #     url: "ldap://127.0.0.1"
 #     user: "root"
 #     password: "secrete"
 #     ...
 
-keystone_ldap_identity_driver: ldap
+keystone_ldap: {}
 keystone_ldap_domain_config_dir: /etc/keystone/domains
 
+
 # If you want to regenerate the keystone users SSH keys, on each run, set this var to True
 # Otherwise keys will be generated on the first run and not regenerated each run.
 keystone_recreate_keys: False

tasks/keystone_ldap_setup.yml

@@ -0,0 +1,41 @@
+---
+# Copyright 2015, Rackspace US, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+
+- name: Create Keystone LDAP domains
+  keystone:
+    command: ensure_domain
+    domain_name: "{{ item.key }}"
+    token: "{{ keystone_auth_admin_token }}"
+    endpoint: "{{ keystone_service_adminurl }}"
+    insecure: "{{ keystone_service_adminuri_insecure }}"
+  with_dict: keystone_ldap
+  run_once: true
+  tags:
+    - keystone-ldap-domain-create
+
+- name: Create Keystone LDAP domain configs
+  template:
+    src: keystone.domain.conf.j2
+    dest: "{{ keystone_ldap_domain_config_dir }}/keystone.{{ item.key }}.conf"
+    owner: "{{ keystone_system_user_name }}"
+    group: "{{ keystone_system_group_name }}"
+    mode: "0644"
+  with_dict: keystone_ldap
+  notify:
+    - Restart Apache
+  tags:
+    - keystone-ldap-domain-config
+

tasks/keystone_post_install.yml

@@ -27,10 +27,6 @@
       dest: "/etc/keystone/keystone.conf"
       config_overrides: "{{ keystone_keystone_conf_overrides }}"
       config_type: "ini"
-    - src: "keystone.Default.conf.j2"
-      dest: "{{ keystone_ldap_domain_config_dir }}/keystone.Default.conf"
-      config_overrides: "{{ keystone_keystone_default_conf_overrides }}"
-      config_type: "ini"
     - src: "keystone-paste.ini.j2"
       dest: "/etc/keystone/keystone-paste.ini"
       config_overrides: "{{ keystone_keystone_paste_ini_overrides }}"

tasks/main.yml

@@ -47,6 +47,11 @@
   when: >
     inventory_hostname == groups['keystone_all'][0]
 
+- include: keystone_ldap_setup.yml
+  tags:
+    - keystone-config
+    - keystone-ldap
+
 - include: keystone_federation_sp_idp_setup.yml
   when: >
     keystone_sp is defined and

templates/keystone.Default.conf.j2

@@ -1,12 +0,0 @@
-# LDAP configuration options
-{% if keystone_ldap is defined %}
-[identity]
-driver = {{ keystone_ldap_identity_driver }}
-
-{% for section in keystone_ldap|dictsort %}
-[{{ section.0 }}]
-{% for key, value in section.1.items() %}
-{{ key }} = {{ value }}
-{% endfor %}
-{% endfor %}
-{% endif %}

templates/keystone.conf.j2

@@ -64,8 +64,10 @@ max_active_keys = {{ keystone_fernet_tokens_max_active_keys }}
 
 
 [identity]
-driver = {{ keystone_identity_driver }}
+{% if keystone_ldap.Default is not defined %}
-{% if keystone_ldap is defined and keystone_ldap.ldap %}
+driver = sql
+{% endif %}
+{% if keystone_ldap | length > 0 %}
 domain_config_dir = {{ keystone_ldap_domain_config_dir }}
 domain_specific_drivers_enabled = True
 {% endif %}

templates/keystone.domain.conf.j2

@@ -0,0 +1,9 @@
+# {{ ansible_managed }}
+
+[identity]
+driver = ldap
+
+[ldap]
+{% for key, value in item.value | dictsort %}
+{{ key }} = {{ value }}
+{% endfor %}