keystone-ldap-prototype.yaml

heat_template_version: 2013-05-23

description: >
  This template will provision two keystone servers and two ldap servers.
  This will demonstrate how to configure multi-region keystone.

parameters:
  ldap_domain:
    description: blah
    type: string
    default: "test.com"
    constraints:
      - allowed_pattern: "[a-zA-z]*.[a-zA-Z]*"
  keystone_sha:
    description: sha from which to clone keystone.
    type: string
    default: "7c2bee76936461043671adc6d100f20775c4212f"

resources:
  ldap_admin_pass:
    type: "OS::Heat::RandomString"
  maria_admin_pass:
    type: "OS::Heat::RandomString"
  ldap:
    type: "Rackspace::Cloud::Server"
    properties:
      flavor: 1 GB Performance
      image: Ubuntu 14.04 LTS (Trusty Tahr)
      key_name: shep
      user_data:
        str_replace:
          template: |
            #!/bin/bash
            apt-get install -y debconf-utils
            debconf-set-selections <<< 'slapd slapd/password1 password %ldap_admin_pass%'
            debconf-set-selections <<< 'slapd slapd/password2 password %ldap_admin_pass%'
            debconf-set-selections <<< 'slapd slapd/domain string %ldap_domain%'
            debconf-set-selections <<< 'slapd slapd/backend select HDB'
            debconf-set-selections <<< 'slapd slapd/purge_database boolean false'
            debconf-set-selections <<< 'slapd slapd/move_old_database boolean true'
            debconf-set-selections <<< 'slapd slapd/allow_ldap_v2 boolean false'

            # Install openldap
            apt-get install -y slapd ldap-utils

            # Create tmp dir for ldif files
            tmp_ldap_dir=$(mktemp -d -t ldap.$$.XXXXXXXXXX)

            # Create slappasswd
            export SLAPPASS=$(slappasswd -s %ldap_admin_pass%)

            # Build out LDAP_BASE_DN from ldap_domain
            export LDAP_BASE_DN=$(echo %ldap_domain% | awk -F '.' '{print "dc=" $1 ",dc=" $2}')
            export LDAP_BASE_DC=$(echo %ldap_domain% | awk -F '.' '{print $1}')
            export LDAP_MANAGER_DN="cn=Manager,${LDAP_BASE_DN}"

            # drop a manager.ldif
            tee ${tmp_ldap_dir}/manager.ldif <<EOF
            dn: olcDatabase={1}hdb,cn=config
            changetype: modify
            replace: olcSuffix
            olcSuffix: $LDAP_BASE_DN
            -
            replace: olcRootDN
            olcRootDN: ${LDAP_MANAGER_DN}
            -
            replace: olcRootPW
            olcRootPW: ${SLAPPASS}
            -
            replace: olcDbIndex
            olcDbIndex: objectClass eq
            olcDbIndex: default pres,eq
            olcDbIndex: cn,sn,givenName
            EOF
            # upload manager.ldif
            ldapmodify -Y EXTERNAL -H ldapi:/// -f ${tmp_ldap_dir}/manager.ldif

            # configure logging
            mkdir /var/log/slapd
            chmod 755 /var/log/slapd
            chown openldap:openldap /var/log/slapd
            tee ${tmp_ldap_dir}/logging.ldif <<EOF
            dn: cn=config
            changetype: modify
            replace: olcLogFile
            olcLogFile: /var/log/slapd/slapd.log
            -
            replace: olcLogLevel
            olcLogLevel: conns filter config acl stats shell
            EOF
            # upload manager.ldif
            ldapmodify -Y EXTERNAL -H ldapi:/// -f ${tmp_ldap_dir}/logging.ldif
            service slapd restart

            # drop a keystone.ldif
            tee ${tmp_ldap_dir}/keystone.ldif <<EOF
            #dn: ${LDAP_BASE_DN}
            #objectClass: dcObject
            #objectClass: organizationalUnit
            #dc: ${LDAP_BASE_DC}
            #ou: ${LDAP_BASE_DC}

            # NOTE(galstrom): Do not confuse with 'groups' in keystone
            dn: ou=Groups,${LDAP_BASE_DN}
            objectClass: organizationalUnit
            ou: UserGroups

            dn: ou=Users,${LDAP_BASE_DN}
            objectClass: organizationalUnit
            ou: Users

            dn: ou=Roles,${LDAP_BASE_DN}
            objectClass: organizationalUnit
            ou: Roles

            dn: ou=Projects,${LDAP_BASE_DN}
            objectClass: organizationalUnit
            ou: Projects

            dn: cn=9fe2ff9ee4384b1894a90878d3e92bab,ou=Roles,${LDAP_BASE_DN}
            objectClass: organizationalRole
            ou: _member_
            cn: 9fe2ff9ee4384b1894a90878d3e92bab

            # BEGIN EXAMPLE USERS HERE #
            dn: uid=admin,ou=Users,${LDAP_BASE_DN}
            objectClass: person
            objectClass: inetOrgPerson
            cn: Admin
            uid: admin
            sn: User
            userPassword: secrete

            dn: uid=jsmith,ou=Users,${LDAP_BASE_DN}
            objectClass: person
            objectClass: inetOrgPerson
            cn: James Smith
            uid: jsmith
            sn: Smith
            userPassword: password

            dn: uid=rjohnson,ou=Users,${LDAP_BASE_DN}
            objectClass: person
            objectClass: inetOrgPerson
            cn: Robert Johnson
            uid: rjohnson
            sn: Johnson
            userPassword: password

            dn: uid=jwilliams,ou=Users,${LDAP_BASE_DN}
            objectClass: person
            objectClass: inetOrgPerson
            cn: John Williams
            uid: jwilliams
            sn: Williams
            userPassword: password

            dn: uid=mbrown,ou=Users,${LDAP_BASE_DN}
            objectClass: person
            objectClass: inetOrgPerson
            cn: Michael Brown
            uid: mbrown
            sn: Brown
            userPassword: password

            dn: uid=wjones,ou=Users,${LDAP_BASE_DN}
            objectClass: person
            objectClass: inetOrgPerson
            cn: William Jones
            uid: wjones
            sn: Jones
            userPassword: password

            dn: uid=dmiller,ou=Users,${LDAP_BASE_DN}
            objectClass: person
            objectClass: inetOrgPerson
            cn: David Miller
            uid: dmiller
            sn: Miller
            userPassword: password

            dn: uid=rdavis,ou=Users,${LDAP_BASE_DN}
            objectClass: person
            objectClass: inetOrgPerson
            cn: Richard Davis
            uid: rdavis
            sn: Davis
            userPassword: password

            dn: uid=cwilson,ou=Users,${LDAP_BASE_DN}
            objectClass: person
            objectClass: inetOrgPerson
            cn: Charles Wilson
            uid: cwilson
            sn: Wilson
            userPassword: password

            dn: uid=jmartinez,ou=Users,${LDAP_BASE_DN}
            objectClass: person
            objectClass: inetOrgPerson
            cn: Joseph Martinez
            uid: jmartinez
            sn: Martinez
            userPassword: password

            dn: uid=tanderson,ou=Users,${LDAP_BASE_DN}
            objectClass: person
            objectClass: inetOrgPerson
            cn: Thomas Anderson
            uid: tanderson
            sn: Anderson
            userPassword: password

            dn: uid=ctaylor,ou=Users,${LDAP_BASE_DN}
            objectClass: person
            objectClass: inetOrgPerson
            cn: Christopher Taylor
            uid: ctaylor
            sn: Taylor
            userPassword: password

            dn: uid=dthomas,ou=Users,${LDAP_BASE_DN}
            objectClass: person
            objectClass: inetOrgPerson
            cn: Daniel Thomas
            uid: dthomas
            sn: Thomas
            userPassword: password

            dn: uid=phernandez,ou=Users,${LDAP_BASE_DN}
            objectClass: person
            objectClass: inetOrgPerson
            cn: Paul Hernandez
            uid: phernandez
            sn: Hernandez
            userPassword: password

            dn: uid=mmoore,ou=Users,${LDAP_BASE_DN}
            objectClass: person
            objectClass: inetOrgPerson
            cn: Mark Moore
            uid: mmoore
            sn: Moore
            userPassword: password

            dn: uid=dmartin,ou=Users,${LDAP_BASE_DN}
            objectClass: person
            objectClass: inetOrgPerson
            cn: Donald Martin
            uid: dmartin
            sn: Martin
            userPassword: password

            dn: uid=gjackson,ou=Users,${LDAP_BASE_DN}
            objectClass: person
            objectClass: inetOrgPerson
            cn: George Jackson
            uid: gjackson
            sn: Jackson
            userPassword: password

            dn: uid=kthompson,ou=Users,${LDAP_BASE_DN}
            objectClass: person
            objectClass: inetOrgPerson
            cn: Kenneth Thompson
            uid: kthompson
            sn: Thompson
            userPassword: password

            dn: uid=swhite,ou=Users,${LDAP_BASE_DN}
            objectClass: person
            objectClass: inetOrgPerson
            cn: Steven White
            uid: swhite
            sn: White
            userPassword: password
            # END EXAMPLE USERS HERE #

            # BEGIN EXAMPLE GROUPS HERE #
            dn: cn=engineering,ou=Groups,${LDAP_BASE_DN}
            cn: Engineering Group
            objectClass: groupOfNames
            member: uid=jsmith,ou=Users,${LDAP_BASE_DN}
            member: uid=rjohnson,ou=Users,${LDAP_BASE_DN}
            member: uid=jwilliams,ou=Users,${LDAP_BASE_DN}
            member: uid=mbrown,ou=Users,${LDAP_BASE_DN}
            member: uid=wjones,ou=Users,${LDAP_BASE_DN}

            dn: cn=developmet,ou=Groups,${LDAP_BASE_DN}
            cn: Development Group
            objectClass: groupOfNames
            member: uid=dmiller,ou=Users,${LDAP_BASE_DN}
            member: uid=rdavis,ou=Users,${LDAP_BASE_DN}
            member: uid=cwilson,ou=Users,${LDAP_BASE_DN}
            member: uid=jmartinez,ou=Users,${LDAP_BASE_DN}
            member: uid=tanderson,ou=Users,${LDAP_BASE_DN}

            dn: cn=sales,ou=Groups,${LDAP_BASE_DN}
            cn: Salses Group
            objectClass: groupOfNames
            member: uid=ctaylor,ou=Users,${LDAP_BASE_DN}
            member: uid=dthomas,ou=Users,${LDAP_BASE_DN}
            member: uid=phernandez,ou=Users,${LDAP_BASE_DN}
            member: uid=mmoore,ou=Users,${LDAP_BASE_DN}
            member: uid=dmartin,ou=Users,${LDAP_BASE_DN}

            dn: cn=marketing,ou=Groups,${LDAP_BASE_DN}
            cn: Marketing Group
            objectClass: groupOfNames
            member: uid=gjackson,ou=Users,${LDAP_BASE_DN}
            member: uid=kthompson,ou=Users,${LDAP_BASE_DN}
            member: uid=swhite,ou=Users,${LDAP_BASE_DN}
            # END EXAMPLE GROUPS HERE #
            EOF

            # upload keystone.ldif
            ldapadd -x -w %ldap_admin_pass% -D $LDAP_MANAGER_DN -H ldap://localhost -c -f ${tmp_ldap_dir}/keystone.ldif
          params:
            "%ldap_admin_pass%": { get_attr: [ldap_admin_pass, value] }
            "%ldap_domain%": { get_param: ldap_domain }
  keystone:
    type: "Rackspace::Cloud::Server"
    properties:
      flavor: 1 GB Performance
      image: Ubuntu 14.04 LTS (Trusty Tahr)
      key_name: shep
      user_data:
        str_replace:
          template: |
            #!/bin/bash
            apt-get install -y debconf-utils screen git libxml2-dev libxslt1-dev zlib1g-dev libldap2-dev libsasl2-dev libssl-dev

            # Install MariaDB
            debconf-set-selections <<< 'mariadb-server-5.5 mysql-server/root_password password %maria_admin_passwd%'
            debconf-set-selections <<< 'mariadb-server-5.5 mysql-server/root_password_again password %maria_admin_passwd%'
            debconf-set-selections <<< 'mariadb-server-5.5 mariadb-server/oneway_migration boolean true'
            apt-get install -y mariadb-server-5.5 libmysqlclient-dev
            mysql -u root -p%maria_admin_passwd% -e "GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'%' IDENTIFIED BY 'keystonepass'"
            mysql -u root -p%maria_admin_passwd% -e "create database keystone"

            # Checkout keystone
            cd /opt
            git clone https:/openstack/keystone
            pushd /opt/keystone
            git checkout %keystone_sha%

            # Install all python dependencies
            pip install -r requirements.txt
            cat test-requirements.txt | grep ldap | xargs pip install
            pip install tempita decorator sqlparse MySQL-python

            # Configure keystone.conf
            pushd etc/
            tee keystone.conf <<EOF
            [DEFAULT]
            admin_token=ADMIN
            admin_port=35357
            public_port=5000
            member_role_id=9fe2ff9ee4384b1894a90878d3e92bab
            member_role_name=_member_

            [assignment]
            driver=keystone.assignment.backends.sql.Assignment

            [auth]
            #
            # Options defined in keystone
            #

            # Default auth methods. (list value)
            #methods=external,password,token

            # The password auth plugin module. (string value)
            #password=keystone.auth.plugins.password.Password

            # The token auth plugin module. (string value)
            #token=keystone.auth.plugins.token.Token

            # The external (REMOTE_USER) auth plugin module. (string
            # value)
            #external=keystone.auth.plugins.external.DefaultDomain

            [catalog]
            #driver=keystone.catalog.backends.sql.Catalog

            [credential]
            #driver=keystone.credential.backends.sql.Credential

            [database]
            connection=mysql://keystone:keystonepass@0.0.0.0/keystone

            [ec2]
            #driver=keystone.contrib.ec2.backends.kvs.Ec2

            [endpoint_filter]
            #driver=keystone.contrib.endpoint_filter.backends.sql.EndpointFilter

            [federation]
            #driver=keystone.contrib.federation.backends.sql.Federation

            [identity]
            driver=keystone.identity.backends.ldap.Identity

            [ldap]
            debug_level=4095
            url=ldap://%ldap_url%
            user=cn=Manager,dc=test,dc=com
            password=%ldap_admin_pass%
            suffix=dc=test,dc=com
            #use_dumb_member=true
            use_dumb_member=False

            # User attributes
            user_tree_dn=ou=Users,dc=test,dc=com
            user_objectClass=inetOrgPerson
            user_id_attribute=uid
            user_name_attribute=uid
            user_pass_attribute=userPassword
            #user_attribute_ignore=enabled,email,tenants,default_project_id
            # Make it read-only
            user_allow_create=False
            user_allow_update=False
            user_allow_delete=False

            # tenant attributes
            #tenant_tree_dn=ou=Projects,dc=test,dc=com
            #tenant_desc_attribute=description
            #tenant_attribute_ignore=enabled
            # Make it read-only
            tenant_allow_create=False
            tenant_allow_update=False
            tenant_allow_delete=False

            # role attributes
            # Make it read-only
            role_allow_create=False
            role_allow_update=False
            role_allow_delete=False

            [oauth1]
            #driver=keystone.contrib.oauth1.backends.sql.OAuth1

            [policy]
            driver=keystone.policy.backends.sql.Policy

            [token]
            provider=keystone.token.providers.uuid.Provider
            EOF
            popd

            # sync the keystone database
            bin/keystone-manage db_sync
            screen -d -m bin/keystone-all
            # sleep for 1/3 of a shep
            sleep 10s
            popd

            # Bootstrap the admin user
            OPTS="--os-endpoint http://0.0.0.0:35357/v2.0 --os-token ADMIN"
            keystone $OPTS tenant-create --name admin
            keystone $OPTS role-create --name admin
            keystone $OPTS user-role-add --user admin --tenant admin --role admin

            # Configure keystone endpoint
            MYIP=$(ifconfig $(route -n | grep '^0.0.0.0' | awk '{print $8}') | { IFS=' :';read r; read r r a r; echo $a; } )
            OPTS="--os-endpoint http://0.0.0.0:35357/v2.0 --os-token ADMIN"
            keystone $OPTS service-create --name keystone --type identity
            keystone $OPTS endpoint-create --region RegionOne --service keystone \
              --publicurl http://$MYIP:5000/v2.0 \
              --adminurl http://$MYIP:35357/v2.0 \
              --internalurl http://$MYIP:5000/v2.0
          params:
           "%keystone_sha%": { get_param: keystone_sha }
           "%maria_admin_passwd%": { get_attr: [maria_admin_pass, value ]}
           "%ldap_admin_pass%": { get_attr: [ldap_admin_pass, value] }
           "%ldap_url%": { get_attr: [ldap, privateIPv4] }
outputs:
  ldap_admin_pass:
    value: { get_attr: [ldap_admin_pass, value] }
  maria_admin_pass:
    value: { get_attr: [maria_admin_pass, value ] }