Red Hat Training

A Red Hat training course is available for Red Hat OpenStack Platform

3.3. Configure the Identity Service

3.3.1. Configure the Identity Service Database Connection

The database connection string used by the Identity service is defined in the /etc/keystone/keystone.conf file. It must be updated to point to a valid database server before starting the service.
All steps in this procedure must be performed on the server hosting the Identity service, while logged in as the root user.

Procedure 3.2. Configuring the Identity Service SQL Database Connection

  • Set the value of the connection configuration key: 
    # openstack-config --set /etc/keystone/keystone.conf \
   sql connection mysql://USER:PASS@IP/DB
    Replace the following values:
    • Replace USER with the Identity service database user name, usually keystone.
    • Replace PASS with the password of the database user.
    • Replace IP with the IP address or host name of the database server.
    • Replace DB with the name of the Identity service database, usually keystone.

Important

The IP address or host name specified in the connection configuration key must match the IP address or host name to which the keystone database user was granted access when creating the keystone database. Moreover, if the database is hosted locally and you granted permissions to 'localhost' when creating the keystone database, you must enter 'localhost'.

3.3.2. Configure the Public Key Infrastructure

3.3.2.1. Public Key Infrastructure Overview

The Identity service generates tokens, which are cryptographically signed documents that users and other services use for authentication. The tokens are signed using a private key, while the public key is made available in an X509 certificate.
The certificates and relevant configuration keys are automatically generated by the keystone-manage pki_setup command. It is, however, possible to manually create and sign the required certificates using a third party certificate authority. If using third party certificates the Identity service configuration must be manually updated to point to the certificates and supporting files.
The configuration keys relevant to PKI setup appear in the [signing] section of the /etc/keystone/keystone.conf configuration file. These keys are:
ca_certs
Specifies the location of the certificate for the authority that issued the certificate denoted by the certfile configuration key. The default value is /etc/keystone/ssl/certs/ca.pem.
ca_key
Specifies the key of the certificate authority that issued the certificate denoted by the certfile configuration key. The default value is /etc/keystone/ssl/certs/cakey.pem.
ca_password
Specifies the password, if applicable, required to open the certificate authority file. The default action if no value is specified is not to use a password.
certfile
Specifies the location of the certificate that must be used to verify tokens. The default value of /etc/keystone/ssl/certs/signing_cert.pem is used if no value is specified.
keyfile
Specifies the location of the private key that must be used when signing tokens. The default value of /etc/keystone/ssl/private/signing_key.pem is used if no value is specified.
token_format
Specifies the algorithm to use when generating tokens. Possible values are UUID and PKI. The default value is PKI.

3.3.2.2. Create the Public Key Infrastructure Files

Create and configure the PKI files to be used by the Identity service. All steps in this procedure must be performed on the server hosting the Identity service, while logged in as the root user.

Procedure 3.3. Creating the PKI Files to be Used by the Identity Service

  1. Run the keystone-manage pki_setup command: 
    # keystone-manage pki_setup \
   --keystone-user keystone \
   --keystone-group keystone
  2. Ensure that the keystone user owns the /var/log/keystone/ and /etc/keystone/ssl/ directories: 
    # chown -R keystone:keystone /var/log/keystone \
   /etc/keystone/ssl/

3.3.2.3. Configure the Identity Service to Use Public Key Infrastructure Files

After generating the PKI files for use by the Identity service, you must enable the Identity service to use them.
Set the values of the attributes in the /etc/keystone/keystone.conf file: 
# openstack-config --set /etc/keystone/keystone.conf \
 signing token_format PKI
# openstack-config --set /etc/keystone/keystone.conf \
 signing certfile /etc/keystone/ssl/certs/signing_cert.pem
# openstack-config --set /etc/keystone/keystone.conf \
 signing keyfile /etc/keystone/ssl/private/signing_key.pem
# openstack-config --set /etc/keystone/keystone.conf \
 signing ca_certs /etc/keystone/ssl/certs/ca.pem
# openstack-config --set /etc/keystone/keystone.conf \
 signing key_size 1024
# openstack-config --set /etc/keystone/keystone.conf \
 signing valid_days 3650
# openstack-config --set /etc/keystone/keystone.conf \
 signing ca_password None
You can also update these values directly by editing the /etc/keystone/keystone.conf file.

3.3.3. Configure the Firewall to Allow Identity Service Traffic

Each component in the OpenStack environment uses the Identity service for authentication and must be able to access the service.
The firewall on the system hosting the Identity service must be altered to allow network traffic on the required ports. All steps in this procedure must be run on the server hosting the Identity service, while logged in as the root user.

Procedure 3.4. Configuring the Firewall to Allow Identity Service Traffic

  1. Open the /etc/sysconfig/iptables file in a text editor.
  2. Add an INPUT rule allowing TCP traffic on ports 5000 and 35357 to the file. The new rule must appear before any INPUT rules that REJECT traffic: 
    -A INPUT -p tcp -m multiport --dports 5000,35357 -j ACCEPT
  3. Save the changes to the /etc/sysconfig/iptables file.
  4. Restart the iptables service to ensure that the change takes effect: 
    # systemctl restart iptables.service

3.3.4. Populate the Identity Service Database

Populate the Identity service database after you have successfully configured the Identity service database connection string.

Procedure 3.5. Populating the Identity Service Database

  1. Log in to the system hosting the Identity service.
  2. Switch to the keystone user and initialize and populate the database identified in /etc/keystone/keystone.conf: 
    # su keystone -s /bin/sh -c "keystone-manage db_sync"

3.3.5. Limit the Number of Entities in a Collection

Use this procedure to set a limit on the number of results returned by list commands. You can use a lower limit to avoid problems when the number of results is larger than available memory or to avoid a long list's response times.

Procedure 3.6. Limiting the Number of Entities in a Collection

  1. Open the /etc/keystone/keystone.conf in a text editor.
  2. Set a global value using list_limit in the [DEFAULT] section.
  3. Optionally override the global value with a specific limit in individual sections. For example: 
    [assignment]
list_limit = 100
If a response to a list_{entity} call has been truncated, the response status code will still be 200 (OK), but the truncated attribute in the collection will be set to true.

3.3.6. Configuring the Appache HTTP server

In order to make the Identity service work properly, you have to configure the Apache server to use the appropriate configuration for the keystone service and the wsgi module.

Procedure 3.7. Configuring the Appache HTTP server

  1. Edit the /etc/httpd/conf/httpd.conf file in a text editor. Set the ServerName option to reference the controller node: 
    ServerName controller
  2. Create a link to the /etc/httpd/conf/httpd.conf file: 
    # ln -s /usr/share/keystone/wsgi-keystone.conf /etc/httpd/conf.d