py-keystone

OpenStack Keystone / Identity service

On the system where Keystone will run:

• a httpd service, e.g. www/apache24, in conjunction with www/mod_wsgi4 or mod_proxy_uswgi is required to make Keystone available.

On the system that will be used to manage the Keystone service:

• create an normal user
• net/py-python-openstackclient is required for the setup and administration tasks

[database]
# ...
# Please make sure, that you use an absolute path otherwise Keystone won't work properly.
connection = sqlite:////var/lib/keystone/keystone.db

[token]
# ...
provider = fernet

# su -m keystone -c "keystone-manage db_sync"

The key repositories will be placed by default in:

• /usr/local/etc/keystone/credential-keys/
• /usr/local/etc/keystone/fernet-keys/

# keystone-manage fernet_setup --keystone-user keystone --keystone-group keystone

# keystone-manage credential_setup --keystone-user keystone --keystone-group keystone

# keystone-manage bootstrap --bootstrap-password ADMIN_PASS --bootstrap-admin-url http://HOSTNAME:35357/v3/ --bootstrap-internal-url http://HOSTNAME:5000/v3/ --bootstrap-public-url http://HOSTNAME:5000/v3/ --bootstrap-region-id RegionOne

ServerName keystone
Listen 5000
Listen 35357

<VirtualHost *:5000>
    WSGIDaemonProcess keystone-public processes=5 threads=1 user=keystone group=keystone display-name=%{GROUP}
    WSGIProcessGroup keystone-public
    WSGIScriptAlias / /usr/local/bin/keystone-wsgi-public
    WSGIApplicationGroup %{GLOBAL}
    WSGIPassAuthorization On
    LimitRequestBody 114688
    
    ErrorLogFormat "%{cu}t %M"
    ErrorLog /var/log/keystone.log
    CustomLog /var/log/keystone_access.log combined

    <Directory /usr/local/bin>
        Require all granted
    </Directory>
</VirtualHost>

<VirtualHost *:35357>
    WSGIDaemonProcess keystone-admin processes=5 threads=1 user=keystone group=keystone display-name=%{GROUP}
    WSGIProcessGroup keystone-admin
    WSGIScriptAlias / /usr/local/bin/keystone-wsgi-admin
    WSGIApplicationGroup %{GLOBAL}
    WSGIPassAuthorization On
    LimitRequestBody 114688
    ErrorLogFormat "%{cu}t %M"
    ErrorLog /var/log/keystone.log
    CustomLog /var/log/keystone_access.log combined

    <Directory /usr/local/bin>
        Require all granted
    </Directory>
</VirtualHost>

Alias /identity /usr/local/bin/keystone-wsgi-public
<Location /identity>
    SetHandler wsgi-script
    Options +ExecCGI

    WSGIProcessGroup keystone-public
    WSGIApplicationGroup %{GLOBAL}
    WSGIPassAuthorization On
</Location>

Alias /identity_admin /usr/local/bin/keystone-wsgi-admin
<Location /identity_admin>
    SetHandler wsgi-script
    Options +ExecCGI

    WSGIProcessGroup keystone-admin
    WSGIApplicationGroup %{GLOBAL}
    WSGIPassAuthorization On
</Location>

Login with the user that should be used for the administrative tasks and set the environment variables as listed below:

$ export OS_USERNAME=admin
$ export OS_PASSWORD=ADMIN_PASS
$ export OS_PROJECT_NAME=admin
$ export OS_USER_DOMAIN_NAME=Default
$ export OS_PROJECT_DOMAIN_NAME=Default
$ export OS_AUTH_URL=http://HOSTNAME:35357/v3
$ export OS_IDENTITY_API_VERSION=3

$ openstack domain create --description "An Example Domain" example
$ openstack project create --domain default --description "Service project" service
$ openstack project create --domain default --description "Demo Project" demo
$ openstack user create --domain default --password-prompt demo

$ unset OS_AUTH_URL OS_PASSWORD
$ openstack --os-auth-url http://HOSTNAME:35357/v3 --os-project-domain-name Default --os-user-domain-name Default --os-project-name admin --os-username admin token issue
$ openstack --os-auth-url http://HOSTNAME:5000/v3 --os-project-domain-name Default --os-user-domain-name Default --os-project-name demo --os-username demo token issue

https://docs.openstack.org/keystone/queens/install/index.html