@@ -12,14 +12,14 @@ Introduction
1212LDAP support in keystone is read-only. You can use it to back an entire
1313OpenStack deployment to a single LDAP server, or you can use it to back
1414separate LDAP servers to specific keystone domains. Users within those domains
15- will can authenticate against keystone, assume role assignments, and interact
16- with other OpenStack services.
15+ can authenticate against keystone, assume role assignments, and interact with
16+ other OpenStack services.
1717
1818Configuration
1919=============
2020
2121To deploy an OpenLDAP server, make sure ``ldap `` is added to the list of
22- ``ENABLED_SERVICES ``::
22+ ``ENABLED_SERVICES `` in the `` local.conf `` file ::
2323
2424 enable_service ldap
2525
@@ -35,9 +35,9 @@ Devstack will prompt you for a password when running ``stack.sh`` if
3535
3636At this point, devstack should have everything it needs to deploy OpenLDAP,
3737bootstrap it with a minimal set of users, and configure it to back to a domain
38- in keystone::
38+ in keystone. You can do this by running the `` stack.sh `` script ::
3939
40- ./stack.sh
40+ $ ./stack.sh
4141
4242Once ``stack.sh `` completes, you should have a running keystone deployment with
4343a basic set of users. It is important to note that not all users will live
@@ -63,7 +63,7 @@ Listing Users
6363To list all users in LDAP directly, you can use ``ldapsearch `` with the LDAP
6464user bootstrapped by devstack::
6565
66- ldapsearch -x -w LDAP_PASSWORD -D cn=Manager,dc=openstack,dc=org \
66+ $ ldapsearch -x -w LDAP_PASSWORD -D cn=Manager,dc=openstack,dc=org \
6767 -H ldap://localhost -b dc=openstack,dc=org
6868
6969As you can see, devstack creates an OpenStack domain called ``openstack.org ``
@@ -93,7 +93,7 @@ example LDIF that can be used to create a new LDAP user, let's call it
9393
9494Now, we use the ``Manager `` user to create a user for Peter in LDAP::
9595
96- ldapadd -x -w LDAP_PASSWORD -D cn=Manager,dc=openstack,dc=org \
96+ $ ldapadd -x -w LDAP_PASSWORD -D cn=Manager,dc=openstack,dc=org \
9797 -H ldap://localhost -c -f peter.ldif.in
9898
9999We should be able to assign Peter roles on projects. After Peter has some level
@@ -125,7 +125,7 @@ Deleting Users
125125We can use the same basic steps to remove users from LDAP, but instead of using
126126LDIFs, we can just pass the ``dn `` of the user we want to delete::
127127
128- ldapdelete -x -w LDAP_PASSWORD -D cn=Manager,dc=openstack,dc=org \
128+ $ ldapdelete -x -w LDAP_PASSWORD -D cn=Manager,dc=openstack,dc=org \
129129 -H ldap://localhost cn=peter,ou=Users,dc=openstack,dc=org
130130
131131Group Management
@@ -153,7 +153,7 @@ Let's define a specific group with the following LDIF::
153153We can create the group using the same ``ldapadd `` command as we did with
154154users::
155155
156- ldapadd -x -w LDAP_PASSWORD -D cn=Manager,dc=openstack,dc=org \
156+ $ ldapadd -x -w LDAP_PASSWORD -D cn=Manager,dc=openstack,dc=org \
157157 -H ldap://localhost -c -f guardian-group.ldif.in
158158
159159If we check the group membership in Horizon, we'll see that only Peter is a
@@ -167,7 +167,7 @@ Deleting Groups
167167
168168Just like users, groups can be deleted using the ``dn ``::
169169
170- ldapdelete -x -w LDAP_PASSWORD -D cn=Manager,dc=openstack,dc=org \
170+ $ ldapdelete -x -w LDAP_PASSWORD -D cn=Manager,dc=openstack,dc=org \
171171 -H ldap://localhost cn=guardians,ou=UserGroups,dc=openstack,dc=org
172172
173173Note that this operation will not remove users within that group. It will only
0 commit comments