Integrating OpenStack with Active Directory
•Download as PPTX, PDF•
4 likes•2,555 views
This document discusses integrating OpenStack with Active Directory at Go Daddy. It covers configuring Keystone and Nova to authenticate against Active Directory using LDAP. It also discusses integrating DNS and deploying the integration using Puppet. Additional topics include handling domain controller proxying, implementing access control using metadata, and integrating Linux VMs with Active Directory.
Report
Share
Integrating OpenStack with Active Directory
- 1. Integrating OpenStack with Active Directory (Because AD != LDAP) Craig Jellick Mike Dorman cjellick@godaddy.com mdorman@godaddy.com Go Daddy OpenStack Cloud Platform Group
- 2. Agenda ● OpenStack at Go Daddy ● Keystone Integration with AD ● Nova Integration with AD ● DNS Integration ● Deployment with Puppet ● Domain Controller Proxying ● PBIS Integration
- 3. OpenStack at Go Daddy ● Internal Pilot launched in February ● Still small, but growing: o Made available to over 1000 T/C users o >200 users have created VMs o ~300 Active VMs o Windows VMs Coming Soon™* ● Production pilot Coming Soon™* *Not actual trademarked
- 4. Our OpenStack ● Havana 2013.2.3 ● Anvil + Stackforge’s openstack-puppet ● Neutron: ML2 driver with OVS agent ● CentOS 6 on hosts and VMs ● KVM hypervisor ● No object or block storage
- 6. Integration Requirements ● Large existing AD infrastructure o Some legacy pain points o Read-only* o Must authenticate real and service account users against AD
- 7. Keystone Integration strategy ● LDAP Identity backend; Database Assignment backend ● 1:1 user-to-project mapping for the pilot o Group-based projects to follow o Allow some users to assign service account users to projects for API access in the short term
- 8. LDAP Identity backend Robust, with a few AD quirks: ● Bug #1233365: LDAP backend fails when connecting to Active Directory root DN. ● Bug #1254849: Wrong LDAP attribute used in user response bodies ● Horizon performance issues
- 9. Quick Look at our configuration https://gist.github.com/cjellick/e5409d9557a25e36e926
- 10. [identity] driver=keystone.identity.backends.ldap.Identity [assignment] driver=keystone.assignment.backends.sql.Assignment [ldap] url=ldaps://localhost user=CN=svc_user,OU=Svc Acount Org Unit,DC=dc1,DC=example,DC=com query_scope=sub ... user_tree_dn=DC=dc1,DC=example,DC=com user_filter=(&(objectClass=organizationalPerson)(!(objectClass=computer))) user_objectclass=organizationalPerson user_name_attribute=sAMAccountName user_id_attribute=sAMAccountName ... group_tree_dn=OU=Users,OU=My Company,DC=Domain Comp 2,DC=Domain Comp 1 group_objectclass=group group_id_attribute=cn group_name_attribute=name group_member_attribute=member
- 11. Nova integration with AD: name uniqueness ● All VMs are register as in AD ● Server names must be: o Globally unique o Match a regex o Adhere to AD name length restrictions o Here’s a non-upstream-worthy patch to do so: https://gist.github.com/cjellick/3f528923e7b961bb32da ● osapi_compute_unique_server_name_scope=global
- 12. --- a/nova/api/openstack/compute/servers.py +++ b/nova/api/openstack/compute/servers.py ... def _validate_server_name(self, value): - self._check_string_length(value, 'Server name', max_length=255) + if isinstance(value, basestring): + value = value.strip() + name_max = CONF.els.server_name_max_length + self._check_string_length(value, 'Server name', max_length=name_max) + self._check_regex_match(value) + self._check_server_name_uniqueness(value)
- 13. Nova Integration with AD: DNS ● Internal DNS powered by AD ● ReST API to hide those details ● Windows VMs autoregister into DNS when they join the domain ● Hook into Nova notifications topic to know when to create/delete DNS entries for Linux VMs (and delete Windows entries)
- 14. Obligatory presentation clip art Source: http://www.projectation.com/when-to-hand-off-the-project/
- 15. Deployment with Puppet ● Stackforge Puppet modules ● ...with some modifications ● Mostly to implement OS SSL options
- 16. Prefetch Scale Fail http://docs.puppetlabs.com/guides/provider_development.html#prefetching ● Translates to 2 keystone CLI calls for every user (user- get + tenant-get)
- 17. Tenant Lazy Loading ● Only loads tenant info for users being managed by Puppet ● Scales for systems with 1000s of users http://x.co/4ZmNb
- 18. Which Domain Controller Do I Use? ● 10’s of DCs across the company and world ● AD is site aware and can choose a close one ● LDAP is not!
- 23. Some notes about inside the VM ● BeyondTrust PowerBroker on Linux ● Authentication to Linux with AD credentials ● Root password management with CyberArk ● This is good for a bunch of reasons! http://www.beyondtrust.com/Products/PowerBrokerUnixLinux/ http://www.cyberark.com/product-detail/enterprise-password-vault
- 24. User Access Control with Metadata
- 25. User Access Control with Metadata "meta": { "project_name": "user-mdorman", "created_by": "mdorman", ← ssh key configured for this guy "login_users": "DC1mdorman" "login_groups": "DC1ac_devcloud,DC1su_devcloud,DC1dev_cloud_els", "sudo_users": "DC1mdorman", "sudo_groups": "DC1ac_devcloud,DC1su_devcloud,DC1dev_cloud_els", }
- 26. User Access Control with Metadata /etc/login.groups: DC1ac_devcloud DC1dev_cloud_els DC1mdorman DC1su_devcloud /etc/sudoers.d/openstack-users: mdorman ALL = ALL %ac_devcloud ALL = ALL %su_devcloud ALL = ALL %dev_cloud_els ALL = ALL
- 27. This is your Linux, on AD ● Linux VMs get “joined” to the domain ● Name uniqueness requirement ● External clean-up hooks on VM termination