Installing, Configuring, and Verifying Keystone

Keystone provides identity authentication and authorization for other service components in the OpenStack project.

Install, configure, and verify Keystone on the controller node.

Creating the Keystone Database

Access the MySQL database.
1

mysql -u root -p
Create a database for Keystone.
1

CREATE DATABASE keystone;

Authorize the local and remote servers to access MySQL. PASSWORD indicates the password of the root database user.

        
             GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'localhost' IDENTIFIED BY '<PASSWORD>';
GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'%' IDENTIFIED BY '<PASSWORD>';

Change the value of PASSWORD to the actual password. OpenStack user passwords support special characters & = $ - _ . + ! * ( ) excluding the number sign (#). OpenStack has no requirements on password complexity, and you can set a password without special characters.

Exit the database.
1

exit

Installing Keystone

Install the Keystone package.

        
             yum config-manager update --set-enabled
yum -y install openstack-keystone httpd python2-mod_wsgi

Open the /etc/keystone/keystone.conf file in insert mode.

Add the following to the [database] section:

        
             connection = mysql+pymysql://keystone:<PASSWORD>@controller/keystone

Add the following to the [token] section:

        
             provider = fernet

PASSWORD indicates the password set for the database.

Populate the Identity service database.

        
             su -s /bin/sh -c "keystone-manage db_sync" keystone

Initialize Fernet key repositories.

        
             keystone-manage fernet_setup --keystone-user keystone --keystone-group keystone
keystone-manage credential_setup --keystone-user keystone --keystone-group keystone

Bootstrap the Identity service.

        
             keystone-manage bootstrap --bootstrap-password <PASSWORD> \
--bootstrap-admin-url http://controller:5000/v3/ \
--bootstrap-internal-url http://controller:5000/v3/ \
--bootstrap-public-url http://controller:5000/v3/ \
--bootstrap-region-id RegionOne

Change the value of PASSWORD to the password of the admin user.

Configuring the Apache HTTP Service

Edit the /etc/httpd/conf/httpd.conf file and configure ServerName to reference the controller node.

This option is commented out by default. You need to locate and modify it.

Create a link to the /usr/share/keystone/wsgi-keystone.conf file.

        
             ln -s /usr/share/keystone/wsgi-keystone.conf /etc/httpd/conf.d/

Enable the Apache HTTP service and configure it to start as the system boots.

        
             systemctl enable httpd.service
systemctl start httpd.service

Create an OpenStack client environment script.

cat << EOF >> /etc/keystone/admin-openrc
export OS_PROJECT_DOMAIN_NAME=Default 
export OS_USER_DOMAIN_NAME=Default 
export OS_PROJECT_NAME=admin 
export OS_USERNAME=admin 
export OS_PASSWORD=ADMIN_PASSWORD 
export OS_AUTH_URL=http://controller:5000/v3 
export OS_IDENTITY_API_VERSION=3 
export OS_IMAGE_API_VERSION=2 
EOF

Replace ADMIN_PASSWORD with the password of the admin user.

Creating Domains, Projects, Users, and Roles

Import the environment variable.
```
source /etc/keystone/admin-openrc
```

Create a domain.

        
             openstack domain create --description "An Example Domain" example

This section describes how to create a domain. The default domain has been created in 5 in Installing Keystone.

Create the service project.

        
             openstack project create --domain default --description "Service Project" service

Create a common project myproject for common tasks.

        
             openstack project create --domain default --description "Demo Project" myproject

Create a common user myuser.

        
             openstack user create --domain default --password-prompt myuser

Set the password for the myuser user.

Create a role.
1

openstack role create myrole

Add the myrole role to the myproject project and myuser user.

        
             openstack role add --project myproject --user myuser myrole

Verifying Keystone

Cancel environment variables.
1

unset OS_AUTH_URL OS_PASSWORD

Request an authentication token as user admin.

        
             openstack --os-auth-url http://controller:5000/v3 \
--os-project-domain-name Default --os-user-domain-name Default \
--os-project-name admin --os-username admin token issue

Enter the password: PASSWORD

The password is user-defined. To ease description, this document uses PASSWORD. Here, PASSWORD is the password of the admin user.

Request an authentication token as user myuser.

        
             openstack --os-auth-url http://controller:5000/v3 \
--os-project-domain-name Default --os-user-domain-name Default \
--os-project-name myproject --os-username myuser token issue

Enter the password: PASSWORD

Run the script.

        
             source /etc/keystone/admin-openrc
openstack token issue

Parent topic: Installation and Verification