OpenNebula

Hold off on this please, it was a bit premature. I'm still investigating. I'll report back with what I figure out.

So, I had to make two changes, and things seem to be working now (with respect to group membership and AD):

# diff -u /usr/lib/one/ruby/opennebula/ldap_auth.rb.dist /usr/lib/one/ruby/opennebula/ldap_auth.rb
--- /usr/lib/one/ruby/opennebula/ldap_auth.rb.dist      2015-10-08 11:32:53.000000000 +0100
+++ /usr/lib/one/ruby/opennebula/ldap_auth.rb   2015-10-29 11:50:14.979641389 +0000
@@ -147,9 +147,9 @@

     def is_in_group?(user, group)
         result=@ldap.search(
-                    :base   => group,
-                    :attributes => @options[:group_field],
-                    :filter => "(#{@options[:group_field]}=#{user.first})")
+                    :base   => @options[:base],
+                    :attributes => @options[:attributes],
+                    :filter => "(&(objectClass=user)(sAMAccountName=#{user})(#{@options[:group_field]}=#{group}))")

         if result && result.first
             true

# diff -u /var/lib/one/remotes/auth/ldap/authenticate.dist /var/lib/one/remotes/auth/ldap/authenticate
--- /var/lib/one/remotes/auth/ldap/authenticate.dist    2015-10-08 11:32:54.000000000 +0100
+++ /var/lib/one/remotes/auth/ldap/authenticate 2015-10-29 11:47:50.714720051 +0000
@@ -76,7 +76,7 @@
     end

     if server_conf[:group]
-        if !ldap.is_in_group?(user_group_name, server_conf[:group])
+        if !ldap.is_in_group?(user, server_conf[:group])
             STDERR.puts "User #{user} is not in group #{server_conf[:group]}" 
             next
         end

I realize that it'll probably break OpenLDAP (since I'm guessing sAMAccountName probably isn't an attribute), so it's not a good fix or anything. But, I have AD so it got me going.