--- title: Charmhub | Deploy Keystone Ldap using Charmhub - The Open Operator Collection description: Deploy the latest version of Keystone Ldap on any cloud. url: https://charmhub.io/keystone-ldap/configurations --- # Keystone Ldap [OpenStack Charmers](https://charmhub.io/publisher/openstack-charmers "View all packages from OpenStack Charmers") * [OpenStack Charmers](https://charmhub.io/publisher/openstack-charmers "View all packages from OpenStack Charmers") * [Cloud](https://charmhub.io/?filter=cloud) * [Logging Tracing](https://charmhub.io/?filter=logging-tracing) * [Security](https://charmhub.io/?filter=security) Platform: 24.04 23.10 23.04 22.10 22.04 20.04 18.04 yoga/stable cc36940 ``` juju deploy keystone-ldap --channel yoga/stable ``` [Learn to deploy on juju >](https://juju.is/docs/juju/manage-applications) * [domain-name](https://charmhub.io/keystone-ldap/configurations#domain-name) * [ldap-config-flags](https://charmhub.io/keystone-ldap/configurations#ldap-config-flags) * [ldap-group-id-attribute](https://charmhub.io/keystone-ldap/configurations#ldap-group-id-attribute) * [ldap-group-member-attribute](https://charmhub.io/keystone-ldap/configurations#ldap-group-member-attribute) * [ldap-group-members-are-ids](https://charmhub.io/keystone-ldap/configurations#ldap-group-members-are-ids) * [ldap-group-name-attribute](https://charmhub.io/keystone-ldap/configurations#ldap-group-name-attribute) * [ldap-group-objectclass](https://charmhub.io/keystone-ldap/configurations#ldap-group-objectclass) * [ldap-group-tree-dn](https://charmhub.io/keystone-ldap/configurations#ldap-group-tree-dn) * [ldap-password](https://charmhub.io/keystone-ldap/configurations#ldap-password) * [ldap-pool-connection-timeout](https://charmhub.io/keystone-ldap/configurations#ldap-pool-connection-timeout) * [ldap-pool-retry-max](https://charmhub.io/keystone-ldap/configurations#ldap-pool-retry-max) * [ldap-pool-size](https://charmhub.io/keystone-ldap/configurations#ldap-pool-size) * [ldap-query-scope](https://charmhub.io/keystone-ldap/configurations#ldap-query-scope) * [ldap-readonly](https://charmhub.io/keystone-ldap/configurations#ldap-readonly) * [ldap-server](https://charmhub.io/keystone-ldap/configurations#ldap-server) * [ldap-suffix](https://charmhub.io/keystone-ldap/configurations#ldap-suffix) * [ldap-use-pool](https://charmhub.io/keystone-ldap/configurations#ldap-use-pool) * [ldap-user](https://charmhub.io/keystone-ldap/configurations#ldap-user) * [ldap-user-enabled-attribute](https://charmhub.io/keystone-ldap/configurations#ldap-user-enabled-attribute) * [ldap-user-enabled-default](https://charmhub.io/keystone-ldap/configurations#ldap-user-enabled-default) * [ldap-user-enabled-emulation](https://charmhub.io/keystone-ldap/configurations#ldap-user-enabled-emulation) * [ldap-user-enabled-emulation-dn](https://charmhub.io/keystone-ldap/configurations#ldap-user-enabled-emulation-dn) * [ldap-user-enabled-invert](https://charmhub.io/keystone-ldap/configurations#ldap-user-enabled-invert) * [ldap-user-enabled-mask](https://charmhub.io/keystone-ldap/configurations#ldap-user-enabled-mask) * [ldap-user-filter](https://charmhub.io/keystone-ldap/configurations#ldap-user-filter) * [ldap-user-id-attribute](https://charmhub.io/keystone-ldap/configurations#ldap-user-id-attribute) * [ldap-user-name-attribute](https://charmhub.io/keystone-ldap/configurations#ldap-user-name-attribute) * [ldap-user-objectclass](https://charmhub.io/keystone-ldap/configurations#ldap-user-objectclass) * [ldap-user-tree-dn](https://charmhub.io/keystone-ldap/configurations#ldap-user-tree-dn) * [tls-ca-ldap](https://charmhub.io/keystone-ldap/configurations#tls-ca-ldap) [Learn about configurations >](https://juju.is/docs/juju/configuration#heading--application-configuration) * domain-name | string Name of the keystone domain to configure; defaults to the deployed application name. * ldap-config-flags | string Additional LDAP configuration options. For simple configurations use a comma separated string of key=value pairs. "user\_allow\_create=False, user\_allow\_update=False, user\_allow\_delete=False" For more complex configurations use a json like string with double quotes and braces around all the options and single quotes around complex values. "{user\_tree\_dn: 'DC=dc1,DC=ad,DC=example,DC=com', user\_allow\_create: False, user\_allow\_delete: False}" See the README for more details. Note: The explicitly defined ldap-\* charm config options take precedence over the same LDAP config option also specified in ldap-config-flags. For example, if the LDAP config query\_scope is defined in ldap-query-scope as 'one' and in ldap-config-flags as "{query\_scope: 'sub'}" then the config query\_scope is set to 'one'. * ldap-group-id-attribute | string This option sets the LDAP attribute mapped to group IDs in keystone. * ldap-group-member-attribute | string This option sets the LDAP attribute that indicates user is a member of the group. * ldap-group-members-are-ids | boolean Enable this option if the members of group object class are keystone user IDs rather than LDAP DNs. * ldap-group-name-attribute | string This option sets the LDAP attribute mapped to group names in keystone. * ldap-group-objectclass | string This option sets the LDAP object class for groups. * ldap-group-tree-dn | string This option sets the search base to use for the groups. * ldap-password | string Password of the LDAP identity server. For anonymous binding, leave ldap-user and ldap-password empty. * ldap-pool-connection-timeout | int The connection timeout to use when pooling LDAP connections. A value of -1 means the connection will never timeout. * ldap-pool-retry-max | int This option allows to set the maximum number of retry attempts to connect to LDAP server before aborting. * ldap-pool-size | int This option sets the size of LDAP connection pool. * ldap-query-scope | string This option controls the scope level of data presented through LDAP. * ldap-readonly | boolean Default: True LDAP identity server backend readonly to keystone. * ldap-server | string LDAP server URL for keystone LDAP identity backend. Examples: ldap://10.10.10.10/ ldaps://10.10.10.10/ ldap://example.com:389,ldaps://ldaps.example.com:636 ldap://active-directory-host.com:3268/ ldaps://active-directory-host.com:3269/ An ldap:// URL will result in mandatory StartTLS usage if either the charm's tls-ca-ldap option has been specified or if the 'certificates' relation is present. * ldap-suffix | string LDAP server suffix to be used by keystone. * ldap-use-pool | boolean This option enables LDAP connection pooling. * ldap-user | string Username (Distinguished Name) used to bind to LDAP identity server. For anonymous binding, leave ldap-user and ldap-password empty. Example: cn=admin,dc=test,dc=com * ldap-user-enabled-attribute | string This option sets the LDAP attribute mapped to the user enabled attribute in keystone. * ldap-user-enabled-default | string The default value to enable users. The LDAP servers can use boolean or bit in the user enabled attribute to indicate if a user is enabled or disabled. If boolean is used by the ldap schema, then the appropriate value for this option is 'True' or 'False'. If bit is used by the ldap schema, this option should match an appropriate integer value based on ldap-user-enabled-mask. Please note the integer value should be specified as a string in quotes. This option is typically used when ldap-user-enabled-attribute is set to 'userAccountControl'. Example: Configuration options to use for ldap schema with userAccountControl as control attribute, uses bit 1 in control attribute to indicate enablement. ldap-user-enabled-attribute = "userAccountControl" ldap-user-enabled-mask = 2 ldap-user-enabled-default = "512" ldap-user-enabled-default should be set to integer value that represents a user being enabled. For Active Directory, 512 represents Normal Account. For more information on how to set up those config options, please refer to the OpenStack docs on Keystone and LDAP integration at https://docs.openstack.org/keystone/latest/admin/configuration.html#integrate-identity-back-end-with-ldap * ldap-user-enabled-emulation | boolean If enabled, keystone uses an alternative method to determine if a user is enabled or not by checking if they are a member of the group defined by the ldap-user-enabled\_emulation-dn option. * ldap-user-enabled-emulation-dn | string DN of the group entry to hold enabled users when using enabled emulation. Setting this option has no effect when ldap-user-enabled-emulation is False. * ldap-user-enabled-invert | boolean Setting this option to True allows LDAP servers to use lock attributes. This option has no effect when ldap-user-enabled-mask or ldap-user-enabled-emulation are in use. * ldap-user-enabled-mask | int Bitmask integer to select which bit indicates the enabled value if the LDAP server represents enabled as a bit on an integer rather than as a discrete boolean. If the option is set to 0, the mask is not used. This option is typically used when ldap-user-enabled-attribute is set to 'userAccessControl'. * ldap-user-filter | string This option sets the LDAP search filter to use for the users. * ldap-user-id-attribute | string This option sets the LDAP attribute mapped to User IDs in keystone. * ldap-user-name-attribute | string This option sets the LDAP attribute mapped to User names in keystone. * ldap-user-objectclass | string This option sets the LDAP object class for users. * ldap-user-tree-dn | string This option sets the search base to use for the users. * tls-ca-ldap | string This option controls which certificate (or a chain) will be used to connect to an ldap server(s) over TLS. Certificate contents should be either used directly or included via include-file:// An LDAP url should also be considered as ldaps and StartTLS are both valid methods of using TLS (see RFC 4513) with StartTLS using a non-ldaps url which, of course, still requires a CA certificate.