====== py-keystone ======

| [[https://www.freshports.org/security/py-keystone|security/py-keystone]] |

//%%OpenStack%% Keystone / Identity service//

===== Set up Keystone on FreeBSD =====

==== Prerequisites ====

On the system where Keystone will run:
  * a httpd service, e.g. [[https://www.freshports.org/www/apache24|www/apache24]], in conjunction with [[https://www.freshports.org/www/mod_wsgi4|www/mod_wsgi4]] or mod_proxy_uswgi is required to make Keystone available.

On the system that will be used to manage the Keystone service:
  * create an normal user 
  * [[https://www.freshports.org/net/py-python-openstackclient|net/py-python-openstackclient]] is required for the setup and administration tasks

==== Configure the Keystone service ====

=== keystone.conf ===

<code>
[database]
# ...
# Please make sure, that you use an absolute path otherwise Keystone won't work properly.
connection = sqlite:////var/lib/keystone/keystone.db

[token]
# ...
provider = fernet
</code>

=== Populate the Identity service database ===

<code>
# su -m keystone -c "keystone-manage db_sync"
</code>

=== Initialize Fernet key repositories ===

The key repositories will be placed by default in:

  * /usr/local/etc/keystone/credential-keys/
  * /usr/local/etc/keystone/fernet-keys/

<code>
# keystone-manage fernet_setup --keystone-user keystone --keystone-group keystone

# keystone-manage credential_setup --keystone-user keystone --keystone-group keystone
</code>

=== Bootstrap the Identity service ===

<code>
# keystone-manage bootstrap --bootstrap-password ADMIN_PASS --bootstrap-admin-url http://HOSTNAME:35357/v3/ --bootstrap-internal-url http://HOSTNAME:5000/v3/ --bootstrap-public-url http://HOSTNAME:5000/v3/ --bootstrap-region-id RegionOne
</code>

==== Configure the web server ====

=== Apache with mod_wsgi ===

<code>
ServerName keystone
Listen 5000
Listen 35357

<VirtualHost *:5000>
    WSGIDaemonProcess keystone-public processes=5 threads=1 user=keystone group=keystone display-name=%{GROUP}
    WSGIProcessGroup keystone-public
    WSGIScriptAlias / /usr/local/bin/keystone-wsgi-public
    WSGIApplicationGroup %{GLOBAL}
    WSGIPassAuthorization On
    LimitRequestBody 114688
    
    ErrorLogFormat "%{cu}t %M"
    ErrorLog /var/log/keystone.log
    CustomLog /var/log/keystone_access.log combined

    <Directory /usr/local/bin>
        Require all granted
    </Directory>
</VirtualHost>

<VirtualHost *:35357>
    WSGIDaemonProcess keystone-admin processes=5 threads=1 user=keystone group=keystone display-name=%{GROUP}
    WSGIProcessGroup keystone-admin
    WSGIScriptAlias / /usr/local/bin/keystone-wsgi-admin
    WSGIApplicationGroup %{GLOBAL}
    WSGIPassAuthorization On
    LimitRequestBody 114688
    ErrorLogFormat "%{cu}t %M"
    ErrorLog /var/log/keystone.log
    CustomLog /var/log/keystone_access.log combined

    <Directory /usr/local/bin>
        Require all granted
    </Directory>
</VirtualHost>

Alias /identity /usr/local/bin/keystone-wsgi-public
<Location /identity>
    SetHandler wsgi-script
    Options +ExecCGI

    WSGIProcessGroup keystone-public
    WSGIApplicationGroup %{GLOBAL}
    WSGIPassAuthorization On
</Location>

Alias /identity_admin /usr/local/bin/keystone-wsgi-admin
<Location /identity_admin>
    SetHandler wsgi-script
    Options +ExecCGI

    WSGIProcessGroup keystone-admin
    WSGIApplicationGroup %{GLOBAL}
    WSGIPassAuthorization On
</Location>
</code>

==== Configure the admin user ====

Login with the user that should be used for the administrative tasks and set the environment variables as listed below:

<code>
$ export OS_USERNAME=admin
$ export OS_PASSWORD=ADMIN_PASS
$ export OS_PROJECT_NAME=admin
$ export OS_USER_DOMAIN_NAME=Default
$ export OS_PROJECT_DOMAIN_NAME=Default
$ export OS_AUTH_URL=http://HOSTNAME:35357/v3
$ export OS_IDENTITY_API_VERSION=3
</code>

==== Create a domain, projects, users and roles ====

<code>
$ openstack domain create --description "An Example Domain" example
$ openstack project create --domain default --description "Service project" service
$ openstack project create --domain default --description "Demo Project" demo
$ openstack user create --domain default --password-prompt demo
</code>

==== Verify operation ====

<code>
$ unset OS_AUTH_URL OS_PASSWORD
$ openstack --os-auth-url http://HOSTNAME:35357/v3 --os-project-domain-name Default --os-user-domain-name Default --os-project-name admin --os-username admin token issue
$ openstack --os-auth-url http://HOSTNAME:5000/v3 --os-project-domain-name Default --os-user-domain-name Default --os-project-name demo --os-username demo token issue
</code>

===== References =====

[[https://docs.openstack.org/keystone/queens/install/index.html]]

----

{{tag>HowTo Ports}}