Chapter 12. Identity (keystone) Parameters

AdminEmail

The email for the OpenStack Identity (keystone) admin account. The default value is admin@example.com.

AdminPassword

The password for the OpenStack Identity (keystone) admin account.

AdminToken

The OpenStack Identity (keystone) secret and database password.

KeystoneChangePasswordUponFirstUse

Enabling this option requires users to change their password when the user is created, or upon administrative reset.

KeystoneCorsAllowedOrigin

Indicate whether this resource may be shared with the domain received in the request "origin" header.

KeystoneCredential0

The first OpenStack Identity (keystone) credential key. Must be a valid key.

KeystoneCredential1

The second OpenStack Identity (keystone) credential key. Must be a valid key.

KeystoneCronTokenFlushDestination

Cron to purge expired tokens - Log destination. The default value is /var/log/keystone/keystone-tokenflush.log.

KeystoneCronTokenFlushEnsure

Cron to purge expired tokens - Ensure. The default value is present.

KeystoneCronTokenFlushHour

Cron to purge expired tokens - Hour. The default value is *.

KeystoneCronTokenFlushMaxDelay

Cron to purge expired tokens - Max Delay. The default value is 0.

KeystoneCronTokenFlushMinute

Cron to purge expired tokens - Minute. The default value is 1.

KeystoneCronTokenFlushMonth

Cron to purge expired tokens - Month. The default value is *.

KeystoneCronTokenFlushMonthday

Cron to purge expired tokens - Month Day. The default value is *.

KeystoneCronTokenFlushUser

Cron to purge expired tokens - User. The default value is keystone.

KeystoneCronTokenFlushWeekday

Cron to purge expired tokens - Week Day. The default value is *.

KeystoneDisableUserAccountDaysInactive

The maximum number of days a user can go without authenticating before being considered "inactive" and automatically disabled (locked).

KeystoneEnableDBPurge

Whether to create cron job for purging soft deleted rows in OpenStack Identity (keystone) database. The default value is True.

KeystoneEnableMember

Create the member role, useful for undercloud deployment. The default value is False.

KeystoneFernetKey0

The first OpenStack Identity (keystone) fernet key. Must be a valid key.

KeystoneFernetKey1

The second OpenStack Identity (keystone) fernet key. Must be a valid key.

KeystoneFernetKeys

Mapping containing OpenStack Identity (keystone) fernet keys and their paths.

KeystoneFernetMaxActiveKeys

The maximum active keys in the OpenStack Identity (keystone) fernet key repository. The default value is 5.

KeystoneLDAPBackendConfigs

Hash containing the configurations for the LDAP backends configured in keystone.

KeystoneLDAPDomainEnable

Trigger to call ldap_backend puppet keystone define. The default value is False.

KeystoneLockoutDuration

The number of seconds a user account will be locked when the maximum number of failed authentication attempts (as specified by KeystoneLockoutFailureAttempts) is exceeded.

KeystoneLockoutFailureAttempts

The maximum number of times that a user can fail to authenticate before the user account is locked for the number of seconds specified by KeystoneLockoutDuration.

KeystoneMinimumPasswordAge

The number of days that a password must be used before the user can change it. This prevents users from changing their passwords immediately in order to wipe out their password history and reuse an old password.

KeystoneNotificationDriver

Comma-separated list of Oslo notification drivers used by OpenStack Identity (keystone). The default value is ['messaging'].

KeystoneNotificationFormat

The OpenStack Identity (keystone) notification format. The default value is basic.

KeystoneNotificationTopics

OpenStack Identity (keystone) notification topics to enable.

KeystonePasswordExpiresDays

The number of days for which a password will be considered valid before requiring it to be changed.

KeystonePasswordRegex

The regular expression used to validate password strength requirements.

KeystonePasswordRegexDescription

Describe your password regular expression here in language for humans.

KeystoneSSLCertificate

OpenStack Identity (keystone) certificate for verifying token validity.

KeystoneSSLCertificateKey

OpenStack Identity (keystone) key for signing tokens.

KeystoneTokenProvider

The OpenStack Identity (keystone) token format. The default value is fernet.

KeystoneUniqueLastPasswordCount

This controls the number of previous user password iterations to keep in history, in order to enforce that newly created passwords are unique.

KeystoneWorkers

Set the number of workers for the OpenStack Identity (keystone) service. Note that more workers creates a larger number of processes on systems, which results in excess memory consumption. The default value is %{::os_workers}.

ManageKeystoneFernetKeys

Whether director should manage the OpenStack Identity (keystone) fernet keys or not. If set to True, the fernet keys will get the values from the saved keys repository in OpenStack Workflow (mistral) from the KeystoneFernetKeys variable. If set to false, only the stack creation initializes the keys, but subsequent updates will not touch them. The default value is True.

NotificationDriver

Driver or drivers to handle sending notifications. The default value is messagingv2.

TokenExpiration

Set a token expiration time in seconds. The default value is 3600.