Re: [openstack-dev] Using AD for keystone authentication only

2013-11-15 Thread Adam Young
On 11/14/2013 07:37 PM, Avi L wrote: I have installed openstack-keystone-2013.2-0.11.b3.el6.noarch rpm and I added a active directory user test123 with role admin and tenant admin successfully. However when I run keystone user-list if gives me the following error: Authorization Failed: An

Re: [openstack-dev] Using AD for keystone authentication only

2013-11-15 Thread Avi L
Hi, On Fri, Nov 15, 2013 at 2:58 PM, Adam Young ayo...@redhat.com wrote: On 11/14/2013 07:37 PM, Avi L wrote: I have installed openstack-keystone-2013.2-0.11.b3.el6.noarch rpm and I added a active directory user test123 with role admin and tenant admin successfully. However when I run

Re: [openstack-dev] Using AD for keystone authentication only

2013-11-14 Thread Dolph Mathews
You can assign roles to users in keystoneclient ($ keystone help user-role-add) -- the assignment would be persisted in SQL. openstackclient supports assignments to groups as well if you switch to --identity-api-version=3 On Wed, Nov 13, 2013 at 3:08 PM, Avi L aviost...@gmail.com wrote: Oh ok

Re: [openstack-dev] Using AD for keystone authentication only

2013-11-14 Thread Avi L
I have installed openstack-keystone-2013.2-0.11.b3.el6.noarch rpm and I added a active directory user test123 with role admin and tenant admin successfully. However when I run keystone user-list if gives me the following error: Authorization Failed: An unexpected error prevented the server from

Re: [openstack-dev] Using AD for keystone authentication only

2013-11-14 Thread Avi L
Just to clarify I am running keystone user-list with keystonerc file sourced and containing the correct credentials for test123, On Thu, Nov 14, 2013 at 4:37 PM, Avi L aviost...@gmail.com wrote: I have installed openstack-keystone-2013.2-0.11.b3.el6.noarch rpm and I added a active directory

Re: [openstack-dev] Using AD for keystone authentication only

2013-11-13 Thread Dolph Mathews
Yes, that's the preferred approach in Havana: Users and Groups via LDAP, and everything else via SQL. On Wednesday, November 13, 2013, Avi L wrote: Hi, I understand that the LDAP provider in keystone can be used for authenticating a user (i.e validate username and password) , and it also

Re: [openstack-dev] Using AD for keystone authentication only

2013-11-13 Thread Avi L
Oh ok so in this case how does the Active Directory user gets a id , and how do you map the user to a role? Is there any example you can point me to? On Wed, Nov 13, 2013 at 11:24 AM, Dolph Mathews dolph.math...@gmail.comwrote: Yes, that's the preferred approach in Havana: Users and Groups via