Red Hat Training
A Red Hat training course is available for Red Hat OpenStack Platform
3.3. Configure the Identity Service
3.3.1. Configure the Identity Service Database Connection
The database connection string used by the Identity service is defined in the
/etc/keystone/keystone.conf
file. It must be updated to point to a valid database server before starting the service.
All steps in this procedure must be performed on the server hosting the Identity service, while logged in as the
root
user.
Procedure 3.2. Configuring the Identity Service SQL Database Connection
- Set the value of the
connection
configuration key:#
openstack-config --set /etc/keystone/keystone.conf \
sql connection mysql://USER:PASS@IP/DB
Replace the following values:- Replace USER with the Identity service database user name, usually
keystone
. - Replace PASS with the password of the database user.
- Replace IP with the IP address or host name of the database server.
- Replace DB with the name of the Identity service database, usually
keystone
.
Important
The IP address or host name specified in the connection configuration key must match the IP address or host name to which the keystone database user was granted access when creating the keystone database. Moreover, if the database is hosted locally and you granted permissions to 'localhost' when creating the keystone database, you must enter 'localhost'.
3.3.2. Configure the Public Key Infrastructure
3.3.2.1. Public Key Infrastructure Overview
The Identity service generates tokens, which are cryptographically signed documents that users and other services use for authentication. The tokens are signed using a private key, while the public key is made available in an X509 certificate.
The certificates and relevant configuration keys are automatically generated by the
keystone-manage pki_setup
command. It is, however, possible to manually create and sign the required certificates using a third party certificate authority. If using third party certificates the Identity service configuration must be manually updated to point to the certificates and supporting files.
The configuration keys relevant to PKI setup appear in the
[signing]
section of the /etc/keystone/keystone.conf
configuration file. These keys are:
- ca_certs
- Specifies the location of the certificate for the authority that issued the certificate denoted by the
certfile
configuration key. The default value is/etc/keystone/ssl/certs/ca.pem
. - ca_key
- Specifies the key of the certificate authority that issued the certificate denoted by the
certfile
configuration key. The default value is/etc/keystone/ssl/certs/cakey.pem
. - ca_password
- Specifies the password, if applicable, required to open the certificate authority file. The default action if no value is specified is not to use a password.
- certfile
- Specifies the location of the certificate that must be used to verify tokens. The default value of
/etc/keystone/ssl/certs/signing_cert.pem
is used if no value is specified. - keyfile
- Specifies the location of the private key that must be used when signing tokens. The default value of
/etc/keystone/ssl/private/signing_key.pem
is used if no value is specified. - token_format
- Specifies the algorithm to use when generating tokens. Possible values are
UUID
andPKI
. The default value isPKI
.
3.3.2.2. Create the Public Key Infrastructure Files
Create and configure the PKI files to be used by the Identity service. All steps in this procedure must be performed on the server hosting the Identity service, while logged in as the
root
user.
Procedure 3.3. Creating the PKI Files to be Used by the Identity Service
- Run the
keystone-manage pki_setup
command:#
keystone-manage pki_setup \
--keystone-user keystone \
--keystone-group keystone
- Ensure that the
keystone
user owns the/var/log/keystone/
and/etc/keystone/ssl/
directories:#
chown -R keystone:keystone /var/log/keystone \
/etc/keystone/ssl/
3.3.2.3. Configure the Identity Service to Use Public Key Infrastructure Files
After generating the PKI files for use by the Identity service, you must enable the Identity service to use them.
Set the values of the attributes in the
/etc/keystone/keystone.conf
file:
#
openstack-config --set /etc/keystone/keystone.conf \
signing token_format PKI
#
openstack-config --set /etc/keystone/keystone.conf \
signing certfile /etc/keystone/ssl/certs/signing_cert.pem
#
openstack-config --set /etc/keystone/keystone.conf \
signing keyfile /etc/keystone/ssl/private/signing_key.pem
#
openstack-config --set /etc/keystone/keystone.conf \
signing ca_certs /etc/keystone/ssl/certs/ca.pem
#
openstack-config --set /etc/keystone/keystone.conf \
signing key_size 1024
#
openstack-config --set /etc/keystone/keystone.conf \
signing valid_days 3650
#
openstack-config --set /etc/keystone/keystone.conf \
signing ca_password None
You can also update these values directly by editing the
/etc/keystone/keystone.conf
file.
3.3.3. Configure the Firewall to Allow Identity Service Traffic
Each component in the OpenStack environment uses the Identity service for authentication and must be able to access the service.
The firewall on the system hosting the Identity service must be altered to allow network traffic on the required ports. All steps in this procedure must be run on the server hosting the Identity service, while logged in as the
root
user.
Procedure 3.4. Configuring the Firewall to Allow Identity Service Traffic
- Open the
/etc/sysconfig/iptables
file in a text editor. - Add an INPUT rule allowing TCP traffic on ports
5000
and35357
to the file. The new rule must appear before any INPUT rules that REJECT traffic:-A INPUT -p tcp -m multiport --dports 5000,35357 -j ACCEPT
- Save the changes to the
/etc/sysconfig/iptables
file. - Restart the
iptables
service to ensure that the change takes effect:#
systemctl restart iptables.service
3.3.4. Populate the Identity Service Database
Populate the Identity service database after you have successfully configured the Identity service database connection string.
Procedure 3.5. Populating the Identity Service Database
- Log in to the system hosting the Identity service.
- Switch to the
keystone
user and initialize and populate the database identified in/etc/keystone/keystone.conf
:#
su keystone -s /bin/sh -c "keystone-manage db_sync"
3.3.5. Limit the Number of Entities in a Collection
Use this procedure to set a limit on the number of results returned by list commands. You can use a lower limit to avoid problems when the number of results is larger than available memory or to avoid a long list's response times.
Procedure 3.6. Limiting the Number of Entities in a Collection
- Open the
/etc/keystone/keystone.conf
in a text editor. - Set a global value using
list_limit
in the[DEFAULT]
section. - Optionally override the global value with a specific limit in individual sections. For example:
[assignment] list_limit = 100
If a response to a
list_{entity}
call has been truncated, the response status code will still be 200 (OK), but the truncated
attribute in the collection will be set to true
.
3.3.6. Configuring the Appache HTTP server
In order to make the Identity service work properly, you have to configure the Apache server to use the appropriate configuration for the
keystone
service and the wsgi
module.
Procedure 3.7. Configuring the Appache HTTP server
- Edit the
/etc/httpd/conf/httpd.conf
file in a text editor. Set theServerName
option to reference the controller node:ServerName controller
- Create a link to the
/etc/httpd/conf/httpd.conf
file:# ln -s /usr/share/keystone/wsgi-keystone.conf /etc/httpd/conf.d