How to Integrate Active Directory with OpenStack for User Management

We recently received this question from someone exploring our hosted OpenStack private cloud services, and wanted to take the opportunity to answer it publicly for anyone else who may be wondering the same thing: can OpenStack integrate with Active Directory for user management? The answer is – yes! Part of the beauty of OpenStack is its ability to integrate and work with just about any other platform or piece of technology.

Maybe you’ve already spent a lot of time and resources building your business around a piece of software and getting rid of it is just not possible. Perhaps you absolutely love a certain service and want to explore options for other segments of your technology stack that will work with it. Every business is attached to different IT solutions for different reasons. Finding a platform that can do the job you need while integrating with your existing technology can be frustrating.

With OpenStack you may be surprised by how flexible and powerful it truly is! This is due in part to its modular design. When I was learning about OpenStack, an analogy that helped me understand it better was to think about it like Legos. There are many different types of pieces available to you, and you can design your structure from those pieces however you’d like. Choose to use all of them, or just some. It’s all up to you depending on what you’re trying to build.

An OpenStack cloud is made up of different services. These are your individual Lego pieces. One service, called Barbican, enables key management. Another service, Horizon, provides a frontend dashboard to help you manage your OpenStack environment through a GUI. There are a couple dozen of these services available that enable various capabilities that you may or may not want to use. It’s up to you to customize to your liking, just like building with Legos!

If you want to stick with using only OpenStack services in your cloud, then user management can be handled solely through Keystone. Keystone is an OpenStack service that provides API client authentication, service discovery, and distributed multi-tenant authorization. But since OpenStack is highly customizable, you’re free to use whatever else you’d like to support user and access management, including Active Directory. If that’s what you’re trying to do, keep reading to find out how to integrate Active Directory with OpenStack.

How It Works

OpenStack’s Identity service (Keystone) can be configured to use an external LDAP directory, such as Active Directory, as an authentication provider.

• Authentication: When a user tries to access OpenStack resources, Keystone will communicate with Active Directory to verify their credentials.
• Authorization: While Active Directory handles authentication, OpenStack maintains control over authorization (i.e., what resources the user has access to within OpenStack). You typically manage roles and permissions within OpenStack itself.

Benefits of AD Integration with OpenStack

• Centralized User Management: Manage users and passwords in one place (Active Directory). No need to create separate accounts for OpenStack.
• Reduced Administrative Overhead: Simplify user onboarding and offboarding processes.
• Improved Security: Take advantage of Active Directory’s great security features like password policies, multi-factor authentication, and account lockout policies.
• Better User Experience: Users can use their existing Active Directory credentials to access OpenStack.

How to Integrate Active Directory With OpenStack, Step by Step

Prepare Active Directory

1) Create an LDAP account for OpenStack to use for querying Active Directory.

Why: OpenStack needs an account with read permissions in Active Directory to authenticate users. This account should have a secure password and limited privileges. Think of it as the “connector” between OpenStack and your directory.

How:

1. 1. Open Active Directory Users and Computers.
   2. Right-click on the Organizational Unit (OU) where you want to create the account (or use the default “Users” OU).
   3. Select New -> User.
   4. Provide a descriptive name like “OpenStack_LDAP” or similar.
   5. Set a strong password and uncheck “User must change password at next logon”.
   6. Optionally, you can disable password expiration for this account.
   7. Click Finish.

2) Create groups in Active Directory to map to OpenStack roles if desired.

Why: This allows you to manage OpenStack role assignments centrally in Active Directory. For example, you might have an “OpenStack_Admins” group in AD that maps to the “admin” role in OpenStack.

How:

1. 1. Open Active Directory Users and Computers.
   2. Right-click on the OU where you want to create the group.
   3. Select New -> Group.
   4. Choose a Group scope (Domain Local, Global, or Universal) based on your AD structure and needs.
   5. Provide a descriptive name like “OpenStack_Admins” or “OpenStack_Users”.
   6. Click Finish.
   7. Add Active Directory users to these groups according to their intended OpenStack roles.

3) Export the LDAPS certificate from your Active Directory domain controller.

Why: LDAPS encrypts the communication between OpenStack and Active Directory, ensuring secure authentication. You need the domain controller’s certificate to establish this secure connection.

How:

1. 1. On your Active Directory domain controller, open the Microsoft Management Console (MMC).
   2. Add the Certificates snap-in for the Computer account.
   3. Expand Certificates (Local Computer) -> Personal -> Certificates.
   4. Locate the certificate for your domain controller (it might be listed under the server’s hostname or FQDN).
   5. Right-click the certificate, go to All Tasks -> Export.
   6. Follow the Certificate Export Wizard, choosing the Base-64 encoded X.509 (.CER) format.
   7. Save the certificate file to a secure location. You’ll need it for the OpenStack configuration.

Configure OpenStack Keystone

1) Install the LDAPS certificate on your OpenStack controller nodes.

Why: This ensures that your OpenStack controller nodes trust the Active Directory domain controller’s certificate, allowing for secure LDAPS communication.

How:

1. Transfer the certificate: Securely transfer the .cer certificate file (exported from your domain controller) to your OpenStack controller node(s). You can use scp, SFTP, or any other secure file transfer method.

2. Convert to PEM (if necessary): Some OpenStack deployments might require the certificate in PEM format. If your certificate is in .cer format, you can convert it using the following command on the controller node:
openssl x509 -in your_certificate.cer -out your_certificate.pem -outform PEM

3. Add the certificate to the trusted certificate store: The exact location and method for adding the certificate can vary depending on your OpenStack distribution. Here are some common approaches:

• Copy to a trusted directory: Often, you can copy the .pem file to a directory like /etc/pki/tls/certs/ or /usr/local/share/ca-certificates/.
• Update the CA certificate bundle: You might need to use a command like update-ca-certificates (on Debian/Ubuntu systems) after copying the certificate to the appropriate directory.
• Specific OpenStack configuration: Some OpenStack distributions might have specific configuration options within Keystone to specify the path to the LDAPS certificate.

2) Configure Keystone to use LDAP as an authentication backend.

Why: This tells Keystone to use Active Directory (via LDAP) for authenticating users.

How:

1. Edit the keystone.conf file: This file is usually located at /etc/keystone/keystone.conf.

2. Locate the [identity] section: Add or modify the following settings:
Ini, TOML
[identity]
driver = ldap

3. Configure the LDAP connection details: Create a new section (e.g., [ldap]) and provide the necessary information to connect to your Active Directory:

Ini, TOML
[ldap]
url = ldaps://your_ad_server:636/
user = cn=OpenStack_LDAP,ou=Users,dc=yourdomain,dc=com  # DN of the LDAP account you created
password = your_ldap_password
user_tree_dn = ou=Users,dc=yourdomain,dc=com  # Base DN for users
group_tree_dn = ou=Groups,dc=yourdomain,dc=com  # Base DN for groups (if using group mapping)

• url: The LDAPS URL of your Active Directory server (including the port, usually 636).
• user: The distinguished name (DN) of the LDAP account you created in Active Directory.
• password: The password for the LDAP account.
• user_tree_dn and group_tree_dn: The base DNs where users and groups are located in your Active Directory structure.

3) Configure Keystone to map Active Directory groups to OpenStack roles (optional).

Why: This automates role assignment in OpenStack based on users’ group memberships in Active Directory.

How:

1. Enable group mapping in keystone.conf:

Ini, TOML
[ldap]
# ... other LDAP settings ...
use_tls = True
group_filter = objectClass=group  # Or a more specific filter if needed

2. Define role mappings:

You can either:

• Use a static mapping: Define specific Active Directory groups and their corresponding OpenStack roles in keystone.conf.
• Use a dynamic mapping: Configure Keystone to dynamically map groups based on naming conventions or other attributes.

After making these changes to keystone.conf, restart the Keystone service to apply the new configuration.

Verify the Integration

Why: This is the primary test to confirm that your integration is working. It verifies that OpenStack can successfully authenticate users against your Active Directory.

How:

1. Open a web browser and navigate to the URL of your OpenStack Horizon dashboard (the graphical user interface for OpenStack).

2. On the login screen, enter the username and password of an Active Directory user.

Important: Use the user’s full Active Directory username. This might include the domain (e.g., user@yourdomain.com or yourdomain\\user).

3. If the authentication is successful, you should be logged into the OpenStack dashboard.

Confirm that users have the appropriate permissions based on their Active Directory group memberships.

Why: This ensures that your role mapping is configured correctly and that users have the expected access levels within OpenStack.

How:

1. 1. Create test users in Active Directory: If you haven’t already, create some test users in Active Directory and add them to the groups you created for OpenStack role mapping.
   2. Log in as each test user: Access the OpenStack dashboard using the credentials of each test user.
   3. Verify access to resources: Check if each user can access the resources they are supposed to based on their assigned roles. For example:
      • Can users in the “OpenStack_Admins” group access administrative functions?
      • Can users in the “OpenStack_Users” group create and manage instances?
   4. Troubleshooting: If users don’t have the correct permissions, review your group mapping configuration in keystone.conf and ensure that the groups and roles are correctly defined.

Additional Verification Steps (Optional)

• Examine Keystone logs: Look for any error messages or warnings related to LDAP authentication in the Keystone log files (usually located in /var/log/keystone/).
• Use the OpenStack command-line client: Try authenticating and performing actions using the openstack command-line client with Active Directory user credentials. This can help you verify authentication and authorization from a different interface.

Important Considerations

• LDAP Version: Ensure your Active Directory supports the LDAP version required by your OpenStack deployment.
• Security: Use LDAPS (LDAP over SSL/TLS) to encrypt communication between OpenStack and Active Directory.
• High Availability: If your Active Directory has multiple domain controllers, configure OpenStack to use them for failover.
• Performance: For large deployments, optimize LDAP queries and connection pooling to ensure good performance.
• User Attributes: Map the relevant Active Directory user attributes (e.g., username, email) to OpenStack user attributes.

Additional Resources

• OpenStack Documentation: Offers guidance on configuring LDAP backends for Keystone.

Hopefully you’ve now successfully integrated Active Directory with OpenStack! Enjoy streamlined user management and boosted security in your cloud environment.