Hello,
I'm in a bit of a pickle.
We had an OpenStack Havana install that ended up dead due to database
issues. It was installed by a co-worker that left.
Brand new install using Icehouse, and everything was going pretty good.
Imported all of the snapshots and volumes.
Final part was to tie it back to the Active Directory server. This will
not work.
Total time spent is many hours. The error I get back is always Invalid
Username/Password.
I've turned on additional debug notifications by modifying the python
script for LDAP. I've got debugging turned on in keystone.conf.
the sAMAccount/cn thing is well known, I've tried it all ways. I'm pretty
sure I get past this as I see that when I key in my short name -- the
keystone.log has the full name in it. It makes first request to go from
short name (sAMAccount) to long (cn) then proceeds to use that I believe.
I'm using the same queries and such from the older Havana keystone.conf.
I've even tried running the old config straight up (modifying a few
settings of course.)
Is there any known issues with the 0.9.0 keystone and Active Directory?
Could it be an issue with encryption?
Python is 2.6, python-ldap is centos distributed 2.3.10-1.el6.
I've tried both ldaps and ldap. I've confirmed using the old partially
working Havana deployment that switching down to ldap authenticates fine.
Note, we can still actually use the older Havana install and use the LDAP
authentication with Active Directory.
I suppose I should beg. Can anyone shed insight into my failure?
Thanks in advance. - Ethan
-----------------
2014-11-14 01:57:09.517 13033 DEBUG keystone.common.ldap.core [-] LDAP
bind: dn=CN=AD Bind,OU=Service Accounts,OU=User
Accounts,DC=int,DC=domain,DC=com simple_bind_s
/usr/lib/python2.6/site-packages/keystone/common/ldap/core.py:771
2014-11-14 01:57:09.524 13033 DEBUG keystone.common.ldap.core [-] LDAP
search: dn=ou=User Accounts,dc=int,dc=aopslab,dc=com, scope=2,
query=(&(cn=Neutron
Service)(memberof:1.2.840.113556.1.4.1941:=CN=Cloud,OU=Security
Groups,OU=User Accounts,DC=int,DC=domain,DC=com)(objectClass=person)),
attrs=['', 'userAccountControl', 'sAMAccountName', 'mail'] search_s
/usr/lib/python2.6/site-packages/keystone/common/ldap/core.py:807
2014-11-14 01:57:09.527 13033 DEBUG keystone.common.ldap.core [-] LDAP
unbind unbind_s
/usr/lib/python2.6/site-packages/keystone/common/ldap/core.py:777
2014-11-14 01:57:09.528 13033 DEBUG keystone.common.ldap.core [-] LDAP
init: url=ldap://phatActiveDirectoryserver.domain.com:389 __init__
/usr/lib/python2.6/site-packages/keystone/common/ldap/core.py:701
2014-11-14 01:57:09.529 13033 DEBUG keystone.common.ldap.core [-] LDAP
init: use_tls=False
2014-11-14 01:52:01.324 13033 DEBUG keystone.common.ldap.core [-] LDAP
bind: dn=CN=AD Bind,OU=Service Accounts,OU=User
Accounts,DC=int,DC=domain,DC=com simple_bind_s
/usr/lib/python2.6/site-packages/keystone/common/ldap/core.py:771
2014-11-14 01:52:01.329 13033 DEBUG keystone.common.ldap.core [-] LDAP
search: dn=ou=User Accounts,dc=int,dc=domain,dc=com, scope=2,
query=(&(cn=Neutron Service)(objectclass=person)), attrs=None search_s
/usr/lib/python2.6/site-packages/keystone/common/ldap/core.py:807
2014-11-14 01:52:01.335 13033 DEBUG keystone.notifications [-] CADF Event:
{'typeURI': 'http://schemas.dmtf.org/cloud/audit/1.0/event', 'initiator':
{'typeURI': 'service/security/account/user', 'host': {'agent':
'python-neutronclient', 'address': '10.10.10.10'}, 'id':
'openstack:1784b835-787a-4ece-a531-0a6f4111111', 'name': u'Neutron
Service'}, 'target': {'typeURI': 'service/security/account/user', 'id':
'openstack:6944c582-5574-42e2-af8b-a11111111111'}, 'observer': {'typeURI':
'service/security', 'id':
'openstack:fb5afc49-a5e5-4dc0-9867-7c8a1111111'}, 'eventType':
'activity', 'eventTime': '2014-11-14T01:52:01.335185+0000', 'action':
'authenticate', 'outcome': 'failure', 'id':
'openstack:ac8208e7-df94-4706-a1d1-5551111111'} _send_audit_notification
/usr/lib/python2.6/site-packages/keystone/notifications.py:289
2014-11-14 01:52:01.337 13033 WARNING keystone.common.wsgi [-]
Authorization failed. Invalid user / password from 10.10.10.10
--------------------------
_______________________________________________
Mailing list: http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack
Post to : openstack@lists.openstack.org
Unsubscribe : http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack
