c2a1ceb created the issue

how can i integrate active directory in openstack using keystone ?

As per my analysis with Openstack and AD integration there are two ways of integrating as suggested on this question about Swift and I haven't managed to successfully integrate AD with my OpenStack installation.

The suggestions for Swift are:

1. If your existing system is using LDAP or Active Directory, consider using the OpenStack Identity service backing on to this - it integrates well with swift.

2. If you have a 'special' system that has its own API, you can write a small module to put in the swift pipeline to handle the authorization decisions. You can find an example of how to develop a module in the OpenStack Operations Guide "Customize" chapter ()

I was trying for first option for last 4 days because there two type of attributes for tenant specially used for the integration with as keystone back end which are as follows:

a) AD tenant object creation with Class Organizationunit and change the Keystone .conf as per this setup: When we try to login via Horizon it says "Unable to authenticate using available projects." and this shows Authentication is happening and authorization is not happening using tenant,role,user integration. Also its not allowing to bind any with any serivce as the authorization is not completing as it is not able to authenticate using existing projects . Attached file with keystone log for this setup will give more clarity of information.

b) AD tenant object creation with Class groupOfNames and change the keystone.conf as per this setup. When we use this setup via Horizon it says " Unable to retrieve authorized projects." and it stops . Attached file with keystone log for this setup will give more clarity of information.

where as from both the setup, from the command line we can just list user,tenant, roles objects using ADMIN token … and this active directory is successfully happening.

Attachments

• AD and Keystone config Config.xlsx (10.9 KiB)
• Keystone log using Tenant object us with Organizationunit as class.txt (14.8 KiB)
• Keystone loging using Tenant object with groupOfNames as class.txt (15.0 KiB)