Updated openstack/openstack
Project: openstack/keystone  519161422dab4c25df79b6d4db35f7613847afd6

ldap/core deleteTree not always supported

Most LDAP servers do not support CONTROL_TREEDELETE
(OID 1.2.840.113556.1.4.805) e.g. openldap, 389, and many others.
The LDAP server will respond with ldap.NOT_ALLOWED_ON_NONLEAF
in that case, and the client will have to fallback on doing an
LDAP search to get the list of entries to delete, then deleting
the entries in order of child to parent, since LDAP forbids the
deletion of a parent entry which has children.  The simplest way
to generate a child to parent ordering is to delete the entries
in the order of the length of the DN, from longest to shortest.

Closes-Bug: #1282355

Change-Id: I3f08cc4bc890eec9f91945941c3636cb0b30658a