---
tripleo_heat_templates:
    []

custom_templates:
    parameter_defaults:
        KeystoneLDAPDomainEnable: true
        KeystoneLDAPBackendConfigs:
            REDHAT:
                url: ldaps://freeipa-0.redhat.local
                user: uid=svc-ldap,cn=users,cn=accounts,dc=redhat,dc=local
                password: 'RedHat1!'
                suffix: dc=redhat,dc=local
                user_tree_dn: cn=users,cn=accounts,dc=redhat,dc=local
                user_objectclass: person
                user_id_attribute: uid
                user_name_attribute: uid
                user_mail_attribute: mail
                user_allow_create: false
                user_allow_update: false
                user_allow_delete: false
                group_tree_dn: cn=groups,cn=accounts,dc=redhat,dc=local
                group_objectclass: groupOfNames
                group_id_attribute: cn
                group_name_attribute: cn
                group_member_attribute: member
                group_desc_attribute: description
                group_allow_create: false
                group_allow_update: false
                group_allow_delete: false
                user_enabled_attribute: nsAccountLock
                user_enabled_default: False
                user_enabled_invert: true
                tls_cacertfile: /etc/ipa/ca.crt

Add keystone ldap template for use IPA setups
Add keystone ldap template for use IPA setups

This will require a deploy to use TLS everywhere
so IPA is installed and configured. A automation
job will also need to setup the svc-ldap user for
keystone to bind to the Directory Server with.

Change-Id: I864d385088372cb9e4fe53a92b0ff7405dbda36b
