{"push_id":815231099,"size":1,"distinct_size":1,"ref":"refs/heads/keystone-openldap","head":"497ce21817f2ed93b03b61514b8b4192d7528725","before":"6815eba6bc3dd83995379ed984f2ae452663379c","commits":[{"sha":"497ce21817f2ed93b03b61514b8b4192d7528725","author":{"email":"191741518368ce1b5ddd9d6507011e05ee287a64@us.ibm.com","name":"MaheshIBM"},"message":"Add option to use openldap as an identity backend\n\nKeystone supports using ldap as an identity backend for storing users and groups.\nThis commit makes changes to install openldap and modify the keystone and haproxy\nconfiguration to support this change.\nOpenldap is installed in master master replication on two nodes using haproxy for load\nbalancing. LDAP driver does not support multiple domains, due to this, keystone is\nconfigured to use domain specific drivers. Users in default domain are stored in LDAP,\nwhile users belonging to other domains are stored in sql backend. Heat needs this feature\nas the heat stack users are created in a separate domain called the heat-domain.\n\nMain reason for the change is to support compliance requirements for user passwords by\nthe way of using password policies in openldap that support following things.\n  - Syntax check for password strength.\n  - Account locking on multiple tries with wrong password.\n  - Password encryption.\n  - Expire a password after a certain duration.\n  - Disallow password change before a certain duration.\n\nCertain users like service users(nova, glance, cinder etc) can be selectively exempted\nby applying a password policy that has no rules.","distinct":true,"url":"https://api.github.com/repos/MaheshIBM/ursula/commits/497ce21817f2ed93b03b61514b8b4192d7528725"}]}