Updated openstack/openstack
Project: openstack/keystone  249d83529af0c746c6980aa0dbd2287bc8de345e

Avoid conversion of binary LDAP values

A few of the LDAP searches performed in the identity and assignment
LDAP drivers do not specify the list of attributes to return, which
causes all attributes present in the LDAP entry to be returned.  We
attempt to convery these values from utf8 to unicode, which fails
when we encounter a binary value.  This patch addresses this problem
in two ways.

The first is to only request the attributes that we actually need
returned from the LDAP server.  This avoids potential binary values
that we do not even need to be concerned with.

The second thing this patch does is to make our conversion code
more tolerant by ignoring attributes that contain binary values.  If
a binary value is present, we simply skip over that attribute in
the conversion and log a debug message.  We should not be encounting
binary values in a typical Keystone deployment, but this gives us
some protection just in case we do encounter a binary value.

Closes-bug: #1355489
Change-Id: I62325ab9c75bac67cca329fb7bd3c74aea7d2867