具体自定义LDAP后端的示例：
Keystone的各个验证后端均是通过python语言实现，下面的具体的示例代码即是基于现有的SQL验证后端及LDAP后端，由python语言实现。具体示例代码，请参考如下清单一。
# vim: tabstop=4 shiftwidth=4 softtabstop=4
"""CustomLDAP Identity backend for Keystone on top of the LDAP and SQL backends"""
from keystone import config
from keystone import exception
from keystone.common import sql
from keystone.common import utils
from keystone import identity
from keystone.identity.backends import ldap as ldap_backend
from keystone.identity.backends import sql
CONF = config.CONF
class Identity(sql.Identity):
def _check_password(self, password, user_ref):
username = user_ref.get('name')
if (username in ['admin', 'nova', 'glance', 'cinder', 'swift', 'quantum']):
return super(Identity, self)._check_password(password, user_ref)
return base_ldap.UserApi(CONF).get_connection(base_ldap.UserApi(CONF)._id_to_dn(username), password)
"""CustomLDAP Identity backend for Keystone on top of the LDAP and SQL backends"""
from keystone import config
from keystone import exception
from keystone.common import sql
from keystone.common import utils
from keystone import identity
from keystone.identity.backends import ldap as ldap_backend
from keystone.identity.backends import sql
CONF = config.CONF
class Identity(sql.Identity):
def _check_password(self, password, user_ref):
username = user_ref.get('name')
if (username in ['admin', 'nova', 'glance', 'cinder', 'swift', 'quantum']):
return super(Identity, self)._check_password(password, user_ref)
return base_ldap.UserApi(CONF).get_connection(base_ldap.UserApi(CONF)._id_to_dn(username), password)
清单一：自定义LDAP后端customLDAP.py
4) 测试及总结
配置自定义LDAP后端
创建自定义LDAP后端
将自定义LDAP后端customLDAP.py复制到/usr/lib/python2.6/site-packages/keystone/identity/backends 目录下。并注意修改该文件的属主及权限信息，保持与其他该目录下的文件保持一致。
可通过chown命令修改属主，通过chmod命令修改文件权限。
修改/etc/keystone/keystone.conf配置文件
修改验证后端为自定义LDAP后端customLDAP 。
[identity]
driver = keystone.identity.backends.bluepages.Identity
driver = keystone.identity.backends.bluepages.Identity
