Install and configure

updated: 'Thu Jun 29 16:56:29 2017, commit bebd705'

Install and configure

Install and configure¶

This section describes how to install and configure the OpenStack Identity service, code-named keystone, on the controller node. For scalability purposes, this configuration deploys Fernet tokens and the Apache HTTP server to handle requests.

Prerequisites¶

Before you install and configure the Identity service, you must create a database.

Use the database access client to connect to the database server as the root user:
```
# mysql
```

Create the keystone database:

MariaDB [(none)]> CREATE DATABASE keystone;

Grant proper access to the keystone database:

MariaDB [(none)]> GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'localhost' \
IDENTIFIED BY 'KEYSTONE_DBPASS';
MariaDB [(none)]> GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'%' \
IDENTIFIED BY 'KEYSTONE_DBPASS';

Replace KEYSTONE_DBPASS with a suitable password.

Exit the database access client.

Install and configure components¶

Note

Default configuration files vary by distribution. You might need to add these sections and options rather than modifying existing sections and options. Also, an ellipsis (...) in the configuration snippets indicates potential default configuration options that you should retain.

Note

This guide uses the Apache HTTP server with mod_wsgi to serve Identity service requests on ports 5000 and 35357. By default, the keystone service still listens on these ports. The package handles all of the Apache configuration for you (including the activation of the mod_wsgi apache2 module and keystone configuration in Apache).

Run the following command to install the packages:
```
# apt install keystone
```

Edit the /etc/keystone/keystone.conf file and complete the following actions:
- In the [database] section, configure database access:
```
[database]
# ...
connection = mysql+pymysql://keystone:KEYSTONE_DBPASS@controller/keystone
```
  Replace KEYSTONE_DBPASS with the password you chose for the database.
  
  Note
  
  Comment out or remove any other connection options in the [database] section.
- In the [token] section, configure the Fernet token provider:
```
[token]
# ...
provider = fernet
```

Populate the Identity service database:

# su -s /bin/sh -c "keystone-manage db_sync" keystone

Initialize Fernet key repositories:

# keystone-manage fernet_setup --keystone-user keystone --keystone-group keystone
# keystone-manage credential_setup --keystone-user keystone --keystone-group keystone

Bootstrap the Identity service:

# keystone-manage bootstrap --bootstrap-password ADMIN_PASS \
  --bootstrap-admin-url http://controller:35357/v3/ \
  --bootstrap-internal-url http://controller:5000/v3/ \
  --bootstrap-public-url http://controller:5000/v3/ \
  --bootstrap-region-id RegionOne

Replace ADMIN_PASS with a suitable password for an administrative user.

Configure the Apache HTTP server¶

Edit the /etc/apache2/apache2.conf file and configure the ServerName option to reference the controller node:
```
ServerName controller
```

Finalize the installation¶

Restart the Apache service:
```
# service apache2 restart
```

Configure the administrative account

$ export OS_USERNAME=admin
$ export OS_PASSWORD=ADMIN_PASS
$ export OS_PROJECT_NAME=admin
$ export OS_USER_DOMAIN_NAME=Default
$ export OS_PROJECT_DOMAIN_NAME=Default
$ export OS_AUTH_URL=http://controller:35357/v3
$ export OS_IDENTITY_API_VERSION=3

Replace ADMIN_PASS with the password used in the keystone-manage bootstrap command in keystone-install-configure-ubuntu.