OpenStack Cloud Computing Cookbook

In order to operate OpenStack Identity service with an external authentication source, it is necessary that one have an external authentication service available. In the OpenStack Cloud Computing Cookbook, we used OpenLDAP. As installing and configuring OpenLDAP is beyond the scope of the book, that information is provided here.

Getting ready

We will be performing an installation and configuration of OpenLDAP on it’s own Ubuntu 14.04 server.

How to do it…

We will break this into two steps: installing OpenLDAP, and configuring it for use with OpenStack.

Installing OpenLDAP

Once you are logged in, to your Ubuntu 14.04 node, run the following commands to install OpenLDAP:
We set the Ubuntu installer to non-interactive, as we will be providing the configuration values for OpenLDAP prior to installation:

export DEBIAN_FRONTEND=noninteractive

Next we provide an admin password so OpenLDAP will install:

echo -e " \
slapd slapd/internal/generated_adminpw password openstack
slapd slapd/password2 password openstack
slapd slapd/internal/adminpw password openstack
slapd slapd/password1 password openstack
" | sudo debconf-set-selections

Finally, we install OpenLDAP via slapd package:

sudo apt-get install -y slapd ldap-utils

Configuring

OpenStack has a few requirements regarding which attribute types are used for user information. To accomodate this in our OpenLDAP we need to add these values to the new-attributes schema file:

sudo echo "
 attributetype ( 1.2.840.113556.1.4.8 NAME 'userAccountControl'
 SYNTAX '1.3.6.1.4.1.1466.115.121.1.27' )

objectclass ( 1.2.840.113556.1.5.9 NAME 'user'
 DESC 'a user'
 SUP inetOrgPerson STRUCTURAL
 MUST ( cn )
 MAY ( userPassword $ memberOf $ userAccountControl ) )

" >> /etc/ldap/schema/new-attributes.schema

Finally, restart OpenLDAP:

sudo service slapd restart

How it works…

What we have done here is install OpenLDAP on Ubuntu 14.04. Additionally we created an LDAP schema, configuring the userAccountControl property, and configuring a ‘user’ object to provide login authorization.