{"id":225,"date":"2015-09-07T09:37:27","date_gmt":"2015-09-07T09:37:27","guid":{"rendered":"http:\/\/onlinelab.info\/?p=225"},"modified":"2015-09-07T09:37:27","modified_gmt":"2015-09-07T09:37:27","slug":"openstack-kilo-on-ubuntu-14-04-2-configure-keystone-1","status":"publish","type":"post","link":"https:\/\/www.asianux.org.vn\/index.php\/2015\/09\/07\/openstack-kilo-on-ubuntu-14-04-2-configure-keystone-1\/","title":{"rendered":"OpenStack Kilo on Ubuntu 14.04.2 \u2013 Configure KeyStone #1"},"content":{"rendered":"
\"OpenStack
OpenStack Logo<\/figcaption><\/figure>\n

Keystone is the OpenStack identity service, it provides the functionality of tracking users and their permissions; catalog functions via API endpoints. It doesn\u2019t actually provide you any user management\u00a0 functions, rather, it provides plug-in interfaces to choose between current authentication service or third-party identity services that are available on the market.<\/p>\n

Before going ahead, take a look at our Infrastructure design<\/a> in previous article.<\/p>\n

This guide shows you how to install and configure OpenStack Identity service, code-named keystone, on the controller node.<\/p>\n

Prerequisites:<\/h2>\n

Before installing OpenStack identity service, you must create a database and administration token.<\/p>\n

# mysql -u root -p<\/pre>\n
create the keystone database.<\/p>\n
CREATE DATABASE keystone;<\/pre>\n
Set proper access to keystone database.<\/p>\n
GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'localhost' IDENTIFIED BY 'PASSWD';\nGRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'%' IDENTIFIED BY 'PASSWD';<\/pre>\n
Replace PASSWD with a suitable password.<\/p>\n
Generate a random value and that can be used as an administration token for initial configuration.<\/p>\n
# openssl rand -hex 10<\/pre>\n
Install and Configure KeyStone:<\/h2>\n
Disable keystone service from starting automatically after installation.<\/p>\n
# echo \"manual\" > \/etc\/init\/keystone.override<\/pre>\n
* In Kilo, Apache HTTP server is used to serve keystone requests on ports 5000 and 35357 with help of mod_wsgi instead of Eventlet which is depreciated in this version OpenStack.<\/p>\n
Install keystone.<\/p>\n
# apt-get install keystone python-openstackclient apache2 libapache2-mod-wsgi memcached python-memcache<\/pre>\n
Edit keystone configuration file.<\/p>\n
# nano \/etc\/keystone\/keystone.conf<\/pre>\n
Place the following entries in proper section of the above file.<\/p>\n
[DEFAULT]\n...\nadmin_token = 43405b090eda983ddde2<\/strong><\/em> ## Replace 43405b090eda983ddde2 with a random that you generated earlier<\/strong>\nverbose = True\n\n[database]\n...\nconnection = mysql:\/\/keystone:PASSWD<\/strong><\/em>@controller<\/strong><\/em>\/keystone\u00a0 ## Replace PASSWD with your KeyStone DB password<\/strong>\n[memcache]\n...\nservers = localhost:11211\n[token]\n...\nprovider = keystone.token.providers.uuid.Provider\ndriver = keystone.token.persistence.backends.memcache.Token\n[revoke]\n...\ndriver = keystone.contrib.revoke.backends.sql.Revoke<\/pre>\n
Run the following command to populate the identity service database.<\/p>\n
# keystone-manage db_sync<\/pre>\n
Configure Apache HTTP server:<\/h2>\n
Edit \/etc\/apache2\/apache2.conf and configure ServerName option to reference the controller node.<\/p>\n
ServerName controller<\/pre>\n
Create the below file.<\/p>\n
# nano \/etc\/apache2\/sites-enabled\/wsgi-keystone.conf<\/pre>\n
Paste the following content on to above file.<\/p>\n
Listen 5000\nListen 35357\n\n<VirtualHost *:5000>\n\u00a0\u00a0\u00a0 WSGIDaemonProcess keystone-public processes=5 threads=1 user=keystone display-name=%{GROUP}\n\u00a0\u00a0\u00a0 WSGIProcessGroup keystone-public\n\u00a0\u00a0\u00a0 WSGIScriptAlias \/ \/var\/www\/cgi-bin\/keystone\/main\n\u00a0\u00a0\u00a0 WSGIApplicationGroup %{GLOBAL}\n\u00a0\u00a0\u00a0 WSGIPassAuthorization On\n\u00a0\u00a0\u00a0 <IfVersion >= 2.4>\n\u00a0\u00a0\u00a0\u00a0\u00a0 ErrorLogFormat \"%{cu}t %M\"\n\u00a0\u00a0\u00a0 <\/IfVersion>\n\u00a0\u00a0\u00a0 LogLevel info\n\u00a0\u00a0\u00a0 ErrorLog \/var\/log\/apache2\/keystone-error.log\n\u00a0\u00a0\u00a0 CustomLog \/var\/log\/apache2\/keystone-access.log combined\n<\/VirtualHost>\n\n<VirtualHost *:35357>\n\u00a0\u00a0\u00a0 WSGIDaemonProcess keystone-admin processes=5 threads=1 user=keystone display-name=%{GROUP}\n\u00a0\u00a0\u00a0 WSGIProcessGroup keystone-admin\n\u00a0\u00a0\u00a0 WSGIScriptAlias \/ \/var\/www\/cgi-bin\/keystone\/admin\n\u00a0\u00a0\u00a0 WSGIApplicationGroup %{GLOBAL}\n\u00a0\u00a0\u00a0 WSGIPassAuthorization On\n\u00a0\u00a0\u00a0 <IfVersion >= 2.4>\n\u00a0\u00a0\u00a0\u00a0\u00a0 ErrorLogFormat \"%{cu}t %M\"\n\u00a0\u00a0\u00a0 <\/IfVersion>\n\u00a0\u00a0\u00a0 LogLevel info\n\u00a0\u00a0\u00a0 ErrorLog \/var\/log\/apache2\/keystone-error.log\n\u00a0\u00a0\u00a0 CustomLog \/var\/log\/apache2\/keystone-access.log combined\n<\/VirtualHost>\n<\/pre>\n
Create the directory for WSGI components.<\/p>\n
# mkdir -p \/var\/www\/cgi-bin\/keystone<\/pre>\n
Run the following command to download WSGI components from upstream repository.<\/p>\n
# curl http:\/\/git.openstack.org\/cgit\/openstack\/keystone\/plain\/httpd\/keystone.py?h=stable\/kilo | tee \/var\/www\/cgi-bin\/keystone\/main \/var\/www\/cgi-bin\/keystone\/admin<\/pre>\n
Change ownership and permissions.<\/p>\n
# chown -R keystone:keystone \/var\/www\/cgi-bin\/keystone\n# chmod 755 \/var\/www\/cgi-bin\/keystone\/*<\/pre>\n
Restart the Apache service.<\/p>\n
# service apache2 restart<\/pre>\n
Remove SQLite database as we are using MySQL database.<\/p>\n
# rm -f \/var\/lib\/keystone\/keystone.db<\/pre>\n
Next is to Create the service entity and API endpoints.<\/p>\n","protected":false},"excerpt":{"rendered":"
OpenStack Logo Keystone is the OpenStack identity service, it provides the functionality of tracking users and their permissions; catalog functions via API endpoints. It doesn\u2019t actually provide you any user management\u00a0 functions, rather, it provides…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[11],"tags":[],"class_list":["post-225","post","type-post","status-publish","format-standard","hentry","category-virtualization"],"_links":{"self":[{"href":"https:\/\/www.asianux.org.vn\/index.php\/wp-json\/wp\/v2\/posts\/225","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.asianux.org.vn\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.asianux.org.vn\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.asianux.org.vn\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.asianux.org.vn\/index.php\/wp-json\/wp\/v2\/comments?post=225"}],"version-history":[{"count":0,"href":"https:\/\/www.asianux.org.vn\/index.php\/wp-json\/wp\/v2\/posts\/225\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.asianux.org.vn\/index.php\/wp-json\/wp\/v2\/media?parent=225"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.asianux.org.vn\/index.php\/wp-json\/wp\/v2\/categories?post=225"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.asianux.org.vn\/index.php\/wp-json\/wp\/v2\/tags?post=225"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}