HP Helion CloudSystem 9.0: Configuring Multitenancy Using OpenLDAP or Microsoft Active Directory

Transcription

1 HP Helion CloudSystem Enterprise and Foundation Software HP Helion CloudSystem 9.0: Configuring Multitenancy Using OpenLDAP or Microsoft Active Directory This white paper describes how to configure multitenancy in HP CloudSystem 9.0 Foundation and Enterprise Software by mapping organizations in CloudSystem Enterprise onto projects in CloudSystem Foundation. Before you begin, configure the Foundation and Enterprise appliances to use OpenLDAP or Microsoft Active Directory for authentication. An overview of multitenancy in CloudSystem CloudSystem Enterprise implements organizations as they are defined by HP Cloud Service Automation (HP CSA). An organization is an entity defined by the HP CSA administrator and can be a company, business unit, department, or group. Membership in an organization is determined by the organization's identity management configuration, which HP CSA accesses to authenticate the user's login credentials. The administrator determines a member's entry point into the cloud and associates each member with services and resources. CloudSystem Foundation implements projects as they are defined by OpenStack technology. A project is a logical grouping of users, and is used to define quotas and access to virtual machine images. In CloudSystem, an administrator implements multitenancy by manually mapping HP CSA organizations to OpenStack projects. This mapping is established through the use of a directory service: OpenLDAP or Microsoft Active Directory. Mapping organizations to projects ensures that all subscription requests from organization users are fulfilled in the context of the corresponding project. Resources from only the user s project are consumed. The project quota is checked before fulfilling the request. Project networks are isolated, according to the template definition. In CloudSystem Enterprise, each organization is configured to use a directory service. The cloud administrator gives directory groups access to an organization, which enables authenticated users belonging to that group access to the Marketplace Portal for the organization. In CloudSystem Foundation, the administrator creates a project for each organization and gives it exactly the same name, and then adds all of the users in the appropriate directory group to the project. A user can log in to the Marketplace Portal to review offerings and request a subscription. HP CSA logs in to CloudSystem Foundation using the relevant project user credentials and orchestrates the provisioning of instances by CloudSystem. At the CloudSystem Foundation level, the provisioned instances are owned by the user and accessible to users with an admin role in the project.

2 The data model shown below illustrates how the mapping is established. The mapping between HP CSA organizations and CloudSystem Foundation projects Managing organizations in HP CSA To view and manage HP CSA organizations, launch the Cloud Service Automation Management Console.

3 From the Cloud Service Automation Console, select Organizations, which opens the existing organizations page, allowing the administrator to edit or create new organizations. New organizations can be created within Cloud Service Automation by clicking Create Organization and providing a name for the organization. The following figure shows five organizations defined in Cloud Service Automation. The Consumer and Provider are default HP CSA organizations. The BLUE, GREEN, and RED organizations have been previously created by the administrator.

4 The Organization tab of the Cloud Service Automation Console For information about setting up and configuring HP CSA organizations, refer to the Organization section of HP Cloud Service Automation: Cloud Service Management Console Help, available at Configuring HP CSA and OpenLDAP for multitenancy Note: If you are using Microsoft Active Directory, skip to the section Configuring HP CSA and Active Directory for Multitenancy. When you have completed those steps, continue to Create a project in CloudSystem Foundation for the organization. To configure HP CSA, configure each organization to use an OpenLDAP directory. The steps are: 1. Create an OpenLDAP group to hold organization users 2. Create and name the organization 3. Configure OpenLDAP authentication for the organization 4. Define the OpenLDAP Groups that can access the organization 5. Define the OpenLDAP Groups that can access the organization s catalog Step 1: Create an OpenLDAP group to hold organization users Create a groupofnames in OpenLDAP for each organization. For example, if you intend to create three organizations named BLUE, GREEN and RED, create three groups named BlueAdmin, GreenAdmin and RedAdmin. All of the users of the organization must be members of its group.

5 The attributes of the groupofnames BlueAdmin which holds the users for the BLUE organization The preceding figure shows the BlueAdmin group that has been established for a BLUE organization with members Steve1Blue, Steve2Blue, Steve3Blue, and BlueUser. Step 2: Create and name the organization in HP CSA Create organizations using the HP CSA Organizations > Create Organization screen. (The example organizations BLUE, GREEN, and RED have been previously created.) The Summary tab is displayed.

6 The HP CSA Organization Identifier is displayed in the General Information section of the HP CSA organization, as shown in the following figure. Note that each HP CSA organization must have a matching project in CloudSystem Foundation (which you will create in Create a project in CloudSystem Foundation for the organization ). By matching the HP CSA organization Identifier with a project in the OpenStack user portal, the instance will be provisioned to the appropriate project. For example, if the HP CSA organization identifier is BLUE and the CloudSystem project name is BLUE, then the instance is provisioned in the BLUE project. Step 3: Configure OpenLDAP authentication for the organization Select the organization and click LDAP. 1. Enter the Fully Qualified Domain Name (FQDN) name or IP address of the LDAP server. 2. Provide a port, either 389 or 636 (for secure LDAP). 3. Add the Base DN (Distinguished Name) for the search context. In the example shown in the following figure, the Base DN consists of the Domain Components dc=rose,dc=hp,dc=com. The search context uses the Base DN setting when building the LDAP search query. 4. Provide the Full DN and password of the OpenLDAP user that will bind to the Directory to perform the LDAP query. In the example, the user is identified as cn=admin,ou=users,dc=rose,dc=hp,dc=com.

7 5. Configure the User Login Information. In the example shown in the following figure, the User uses the common name (cn) attribute when logging in to HP CSA Marketplace Portal. When entering the User Name Attribute, the User Search Filter is automatically populated. Enter the User Search Base. In the example ou=users has been selected. This is combined with the Base DN setting to build the LDAP query ou=users,dc=rose,dc=hp,dc=com. 6. Save the configuration. Select Look Up User to test the configuration. In the example below, the user BlueUser is found after clicking the Search button.

8 Step 4: Define the OpenLDAP groups that can access the organization 1. Select Access Control, and specify the OpenLDAP group that has access to this organization as a Consumer Organization. A consumer requests and manages subscriptions offered to the organization through the Marketplace Portal. In step 1, BlueAdmin was defined for this purpose. 2. Select Add DN and enter the group name relative to the Base DN configured above in the LDAP settings. In the example shown in the following figures, cn=blueadmin,cn=groups has been

9 entered. This entry is combined with the base DN of dc=rose,dc=hp,dc=com to result in the fully qualified distinguished name of cn=blueadmin,cn=groups,dc=rose,dc=hp,dc=com. Step 5: Define the OpenLDAP groups that can access the organization s catalog To provision services from the Marketplace Portal, service offerings must be published to a catalog. There is a single, global catalog that is visible in every organization's Marketplace Portal. Additionally, every organization has a default catalog that is created automatically when the organization is created. The name of the default service catalog is the organization name followed by Catalog. Additional catalogs can be created for an organization. See HP Cloud Service Automation: Cloud Service Management Console Help for details.

10 Before a user can access the catalog for their organization, Access Control must be set for the catalog. 1. In HP CSA, select Catalogs > Organization Catalog > Access Control. 2. Click Add Group to use the existing DN that was created to grant access to the HP CSA organization in step 4, or enter a new DN.

11 The next step in configuring multitenancy is to create the corresponding project in Foundation, described in Create a project in CloudSystem Foundation for the organization. Configuring HP CSA and Active Directory for multitenancy Note: If you are using OpenLDAP, follow the steps in Configuring HP CSA and OpenLDAP for Multitenancy. When you have completed those steps, continue to Create a project in CloudSystem Foundation for the organization. To configure HP CSA, configure each organization to use Active Directory. The steps are: 1. Create an Active Directory group to hold organization users 2. Create and name the organization 3. Configure Active Directory authentication for the organization 4. Define the Active Directory Groups that can access the organization 5. Define the Active Directory Groups that can access the organization s catalog Step 1: Create an Active Directory group to hold organization users Create a security group in Active Directory for each organization. For example, for three organizations named BLUE, GREEN and RED, create three security groups named BlueAdmin, GreenAdmin and RedAdmin. All of the users of the organization must be members of its corresponding group. The following figure shows the BlueAdmin group that has been established for a BLUE organization with members Steve1Blue, Steve2Blue, Steve3Blue, and BlueUser.

12 The members of the Security Group BlueAdmin holds the users for the BLUE organization Step 2: Create and name the organization Create organizations using the HP CSA Management Console Organizations screen. The HP CSA Organization Identifier is displayed in the General Information section of the HP CSA organization, as shown in the following figure. (The example organizations BLUE, GREEN, and RED have been previously created.) The General Information tab is displayed. Note that each HP CSA organization must have a matching project in CloudSystem Foundation (see Create a project in CloudSystem Foundation for the organization ). By matching the HP CSA organization Identifier with a project in the Openstack user portal, the instance will be provisioned to the appropriate project. For example, if the HP CSA organization identifier is BLUE and the CloudSystem project name is BLUE, then the instance is provisioned in the BLUE project.

13 Step 3: Configure Active Directory authentication for the organization Select the organization and click LDAP. 1. Enter the Fully Qualified Domain Name (FQDN) or IP address of the Active Directory server. 2. Provide a port, either 389 or 636 (for secure Active Directory). 3. Add the Base DN (Distinguished Name) for the search context. In the example shown in the following figure, the Base DN consists of the Domain Component DC=cloud,DC=local. The search context uses the Base DN setting when building the Active Directory search query. 4. Provide the common name and password of the Active Directory user that will bind to the Directory to perform the Active Directory query. In the example shown in the following figure, the user ID is identified by the fully qualified domain name as: CN=admin Service,CN=Users,DC=cloud,DC=local.

14 The default LDAP Attributes values should be sufficient to provide user details as shown in the following figure. 5. Configure the User Login Information. In the example shown in the following figure, the User uses the common name (cn) attribute when logging in to HP CSA Marketplace Portal. When entering the User Name Attribute, the User Search Filter is automatically populated. Enter the User Search Base. In the example cn=users has been selected. This is

15 combined with the Base DN setting to build the Active Directory query cn=users,dc=cloud,dc=local. 6. Save the configuration. Select Look Up User to test the configuration. Successfully looking up the BlueUser verifies the credentials provided in the LDAP Server Information section as well as User Login Information attributes. Step 4: Define the Active Directory groups that can access the organization 1. Select Access Control to specify the Active Directory group that has access to this organization as a Service Consumer. A Service consumer requests and manages subscriptions offered to the organization through the Marketplace Portal. In step 1, BlueAdmin was defined for this purpose.

16 2. Select Add DN and enter the group name relative to the Base DN configured above in the Active Directory settings. 3. In the example shown in the following figure, CN=BlueAdmin,CN=Users has been entered. This entry is combined with the base DN of DC=cloud,DC=local to result in the full distinguished name of CN=BlueAdmin,CN=Users,DC=cloud,DC=local. Step 5: Define the Active Directory groups that can access the organization s catalog To provision services from the Marketplace Portal, service offerings must be published to a catalog. There is a single, global catalog that is visible in every organization's Marketplace Portal. Additionally, every organization has a default catalog that is created automatically when the organization is created. The name of the default service catalog is the organization name followed by Catalog. Additional catalogs can be created for an organization. See HP Cloud Service Automation: Cloud Service Management Console Help for details.

17 Before a user can access the catalog for their organization, Access Control must be set for the catalog. 1. In HP CSA, select Catalogs. 2. Click BLUE Catalog. 3. Select the Access Control tab. 4. Click the Add Group button to use the existing DN that was created in step 4, or enter a new DN to grant access to the HP CSA organization. This entry is combined with the base

18 DN of DC=cloud,DC=local to result in the full distinguished name of CN=BlueAdmin,CN=Users,DC=cloud,DC=local. After clicking the Add button the group is displayed in the catalog. Create a project in CloudSystem Foundation for the organization The next step in configuring multitenancy is to create the corresponding project in Foundation. 1. Log in to the OpenStack user portal as admin. 2. Select Identity and then Projects (on the left side bar), followed by +Create Project. 3. On the Project Information tab, enter a name for the project that is the same as the organization name.

19 4. Select the Project Members tab and individually add to the project all of the users that can access the organization. Provisioning HP CSA subscriptions After the HP CSA organization has been configured to use OpenLDAP or Active Directory, a user that is a member of the directory group specified in the organization s Service Consumer Role (Step 4 above) can log in to the organization s Marketplace Portal using the organization s unique URL. The organization s URL is shown in the General Information section of the Organization.

20 After logging to the Marketplace Portal for the BLUE organization, a user in the BlueAdmin group can request services from either the BLUE Catalog or the Global Shared catalog. If the provisioning succeeds, the resulting OpenStack instances, networks and storage volumes are created in the CloudSystem Foundation BLUE project. Only the user who provisioned the resources or an admin in the project will be able to manage these resources. The Group Ownership feature allows other users to manage the resources using the Marketplace Portal. Group ownership is an option when submitting a request to create a subscription. If Group Ownership is On, then the resulting subscription can be managed by all users in an directory group to which the user belongs (in this example, BlueAdmin). If the user belongs to multiple groups, then the appropriate group must be selected. In the context of multitenancy it is best practice to enable Group ownership, because this more closely corresponds to the behavior of CloudSystem Foundation projects where all instances in the project can be managed by all users in the project.

21 More information HP Helion CloudSystem 9.0 Update 1 Administrator Guide Configure OpenLDAP or Active Directory for OpenStack user portal authentication Using CloudSystem Enterprise to manage multiple HP Helion CloudSystem providers HP Helion CloudSystem 9.0: Deploying Multi-tier applications with HP OneView and Helion OpenStack technology in a multi-tenant environment (white paper) The latest versions of these and other HP Helion CloudSystem manuals and white papers, including HP CSA and HP Operations Orchestration, can be downloaded from the Enterprise Information Library at Learn more about HP Helion CloudSystem: Copyright Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. The only warranties for HP products and services are set forth in the express warranty statements accompanying such products and services. Nothing herein should be construed as constituting an additional warranty. HP shall not be liable for technical or editorial errors or omissions contained herein , December 2015