Typo
[mirror/dsa-puppet.git] / 3rdparty / modules / keystone / examples / ldap_full.pp
1 # A full example from a real deployment that allows Keystone to modify
2 # everything except users, uses enabled_emulation, and ldaps
3
4 # Ensure this matches what is in LDAP or keystone will try to recreate
5 # the admin user
6 class { '::keystone::roles::admin':
7   email    => 'test@example.com',
8   password => 'ChangeMe',
9 }
10
11 # You can test this connection with ldapsearch first to ensure it works.
12 # LDAP configurations are *highly* dependent on your setup and this file
13 # will need to be tweaked. This sample talks to ldap.example.com, here is
14 # an example of ldapsearch that will search users on this box:
15 # ldapsearch -v -x -H 'ldap://example.com:389' -D \
16 # "uid=bind,cn=users,cn=accounts,dc=example,dc=com" -w SecretPass \
17 # -b cn=users,cn=accounts,dc=example,dc=com
18 class { '::keystone:ldap':
19   url                          => 'ldap://ldap.example.com:389',
20   user                         => 'uid=bind,cn=users,cn=accounts,dc=example,dc=com',
21   password                     => 'SecretPass',
22   suffix                       => 'dc=example,dc=com',
23   query_scope                  => 'sub',
24   user_tree_dn                 => 'cn=users,cn=accounts,dc=example,dc=com',
25   user_id_attribute            => 'uid',
26   user_name_attribute          => 'uid',
27   user_mail_attribute          => 'mail',
28   user_allow_create            => 'False',
29   user_allow_update            => 'False',
30   user_allow_delete            => 'False',
31   user_enabled_emulation       => 'True',
32   user_enabled_emulation_dn    => 'cn=openstack-enabled,cn=groups,cn=accounts,dc=example,dc=com',
33   group_tree_dn                => 'ou=groups,ou=openstack,dc=example,dc=com',
34   group_objectclass            => 'organizationalRole',
35   group_id_attribute           => 'cn',
36   group_name_attribute         => 'cn',
37   group_member_attribute       => 'RoleOccupant',
38   group_desc_attribute         => 'description',
39   group_allow_create           => 'True',
40   group_allow_update           => 'True',
41   group_allow_delete           => 'True',
42   project_tree_dn              => 'ou=projects,ou=openstack,dc=example,dc=com',
43   project_objectclass          => 'organizationalUnit',
44   project_id_attribute         => 'ou',
45   project_member_attribute     => 'member',
46   project_name_attribute       => 'ou',
47   project_desc_attribute       => 'description',
48   project_allow_create         => 'True',
49   project_allow_update         => 'True',
50   project_allow_delete         => 'True',
51   project_enabled_emulation    => 'True',
52   project_enabled_emulation_dn => 'cn=enabled,ou=openstack,dc=example,dc=com',
53   role_tree_dn                 => 'ou=roles,ou=openstack,dc=example,dc=com',
54   role_objectclass             => 'organizationalRole',
55   role_id_attribute            => 'cn',
56   role_name_attribute          => 'cn',
57   role_member_attribute        => 'roleOccupant',
58   role_allow_create            => 'True',
59   role_allow_update            => 'True',
60   role_allow_delete            => 'True',
61   identity_driver              => 'keystone.identity.backends.ldap.Identity',
62   assignment_driver            => 'keystone.assignment.backends.ldap.Assignment',
63   use_tls                      => 'True',
64   tls_cacertfile               => '/etc/ssl/certs/ca-certificates.crt',
65   tls_req_cert                 => 'demand',
66   use_pool                     => 'True',
67   use_auth_pool                => 'True',
68   pool_size                    => 5,
69   auth_pool_size               => 5,
70   pool_retry_max               => 3,
71   pool_connection_timeout      => 120,
72 }