Red Hat Summit Red Hat SummitSuporteConsoleDesenvolvedoresComeçar um testeContato

Este conteúdo não está disponível no idioma selecionado.

3.3. Configure the Identity Service

3.3.1. Configure the Identity Service Database Connection
Copiar o link

The database connection string used by the Identity service is defined in the /etc/keystone/keystone.conf file. It must be updated to point to a valid database server before starting the service.
All steps in this procedure must be performed on the server hosting the Identity service, while logged in as the root user.

Procedure 3.2. Configuring the Identity Service SQL Database Connection

  • Set the value of the connection configuration key: 
    # openstack-config --set /etc/keystone/keystone.conf \
   sql connection mysql://USER:PASS@IP/DB
    Copy to Clipboard Toggle word wrap
    Replace the following values:
    • Replace USER with the Identity service database user name, usually keystone.
    • Replace PASS with the password of the database user.
    • Replace IP with the IP address or host name of the database server.
    • Replace DB with the name of the Identity service database, usually keystone.

Important

The IP address or host name specified in the connection configuration key must match the IP address or host name to which the keystone database user was granted access when creating the keystone database. Moreover, if the database is hosted locally and you granted permissions to 'localhost' when creating the keystone database, you must enter 'localhost'.

3.3.2. Configure the Public Key Infrastructure
Copiar o link

3.3.2.1. Public Key Infrastructure Overview
Copiar o link

The Identity service generates tokens, which are cryptographically signed documents that users and other services use for authentication. The tokens are signed using a private key, while the public key is made available in an X509 certificate.
The certificates and relevant configuration keys are automatically generated by the keystone-manage pki_setup command. It is, however, possible to manually create and sign the required certificates using a third party certificate authority. If using third party certificates the Identity service configuration must be manually updated to point to the certificates and supporting files.
The configuration keys relevant to PKI setup appear in the [signing] section of the /etc/keystone/keystone.conf configuration file. These keys are:
ca_certs
Specifies the location of the certificate for the authority that issued the certificate denoted by the certfile configuration key. The default value is /etc/keystone/ssl/certs/ca.pem.
ca_key
Specifies the key of the certificate authority that issued the certificate denoted by the certfile configuration key. The default value is /etc/keystone/ssl/certs/cakey.pem.
ca_password
Specifies the password, if applicable, required to open the certificate authority file. The default action if no value is specified is not to use a password.
certfile
Specifies the location of the certificate that must be used to verify tokens. The default value of /etc/keystone/ssl/certs/signing_cert.pem is used if no value is specified.
keyfile
Specifies the location of the private key that must be used when signing tokens. The default value of /etc/keystone/ssl/private/signing_key.pem is used if no value is specified.
token_format
Specifies the algorithm to use when generating tokens. Possible values are UUID and PKI. The default value is PKI.

3.3.2.2. Create the Public Key Infrastructure Files
Copiar o link

Create and configure the PKI files to be used by the Identity service. All steps in this procedure must be performed on the server hosting the Identity service, while logged in as the root user.

Procedure 3.3. Creating the PKI Files to be Used by the Identity Service

  1. Run the keystone-manage pki_setup command: 
    # keystone-manage pki_setup \
   --keystone-user keystone \
   --keystone-group keystone
    Copy to Clipboard Toggle word wrap
  2. Ensure that the keystone user owns the /var/log/keystone/ and /etc/keystone/ssl/ directories: 
    # chown -R keystone:keystone /var/log/keystone \
   /etc/keystone/ssl/
    Copy to Clipboard Toggle word wrap

3.3.2.3. Configure the Identity Service to Use Public Key Infrastructure Files
Copiar o link

After generating the PKI files for use by the Identity service, you must enable the Identity service to use them.
Set the values of the attributes in the /etc/keystone/keystone.conf file: 
# openstack-config --set /etc/keystone/keystone.conf \
 signing token_format PKI
# openstack-config --set /etc/keystone/keystone.conf \
 signing certfile /etc/keystone/ssl/certs/signing_cert.pem
# openstack-config --set /etc/keystone/keystone.conf \
 signing keyfile /etc/keystone/ssl/private/signing_key.pem
# openstack-config --set /etc/keystone/keystone.conf \
 signing ca_certs /etc/keystone/ssl/certs/ca.pem
# openstack-config --set /etc/keystone/keystone.conf \
 signing key_size 1024
# openstack-config --set /etc/keystone/keystone.conf \
 signing valid_days 3650
# openstack-config --set /etc/keystone/keystone.conf \
 signing ca_password None
Copy to Clipboard Toggle word wrap
You can also update these values directly by editing the /etc/keystone/keystone.conf file.

3.3.3. Configure the Firewall to Allow Identity Service Traffic
Copiar o link

Each component in the OpenStack environment uses the Identity service for authentication and must be able to access the service.
The firewall on the system hosting the Identity service must be altered to allow network traffic on the required ports. All steps in this procedure must be run on the server hosting the Identity service, while logged in as the root user.

Procedure 3.4. Configuring the Firewall to Allow Identity Service Traffic

  1. Open the /etc/sysconfig/iptables file in a text editor.
  2. Add an INPUT rule allowing TCP traffic on ports 5000 and 35357 to the file. The new rule must appear before any INPUT rules that REJECT traffic: 
    -A INPUT -p tcp -m multiport --dports 5000,35357 -j ACCEPT
    Copy to Clipboard Toggle word wrap
  3. Save the changes to the /etc/sysconfig/iptables file.
  4. Restart the iptables service to ensure that the change takes effect: 
    # systemctl restart iptables.service
    Copy to Clipboard Toggle word wrap

3.3.4. Populate the Identity Service Database
Copiar o link

Populate the Identity service database after you have successfully configured the Identity service database connection string.

Procedure 3.5. Populating the Identity Service Database

  1. Log in to the system hosting the Identity service.
  2. Switch to the keystone user and initialize and populate the database identified in /etc/keystone/keystone.conf: 
    # su keystone -s /bin/sh -c "keystone-manage db_sync"
    Copy to Clipboard Toggle word wrap

3.3.5. Limit the Number of Entities in a Collection
Copiar o link

Use this procedure to set a limit on the number of results returned by list commands. You can use a lower limit to avoid problems when the number of results is larger than available memory or to avoid a long list's response times.

Procedure 3.6. Limiting the Number of Entities in a Collection

  1. Open the /etc/keystone/keystone.conf in a text editor.
  2. Set a global value using list_limit in the [DEFAULT] section.
  3. Optionally override the global value with a specific limit in individual sections. For example: 
    [assignment]
list_limit = 100
    Copy to Clipboard Toggle word wrap
If a response to a list_{entity} call has been truncated, the response status code will still be 200 (OK), but the truncated attribute in the collection will be set to true.

3.3.6. Configuring the Appache HTTP server
Copiar o link

In order to make the Identity service work properly, you have to configure the Apache server to use the appropriate configuration for the keystone service and the wsgi module.

Procedure 3.7. Configuring the Appache HTTP server

  1. Edit the /etc/httpd/conf/httpd.conf file in a text editor. Set the ServerName option to reference the controller node: 
    ServerName controller
    Copy to Clipboard Toggle word wrap
  2. Create a link to the /etc/httpd/conf/httpd.conf file: 
    # ln -s /usr/share/keystone/wsgi-keystone.conf /etc/httpd/conf.d
    Copy to Clipboard Toggle word wrap
Voltar ao topo
Red Hat logoGithubredditYoutubeTwitter

Aprender

Experimente, compre e venda

Comunidades

Sobre a documentação da Red Hat

Ajudamos os usuários da Red Hat a inovar e atingir seus objetivos com nossos produtos e serviços com conteúdo em que podem confiar. Explore nossas atualizações recentes.

Tornando o open source mais inclusivo

A Red Hat está comprometida em substituir a linguagem problemática em nosso código, documentação e propriedades da web. Para mais detalhes veja o Blog da Red Hat.

Sobre a Red Hat

Fornecemos soluções robustas que facilitam o trabalho das empresas em plataformas e ambientes, desde o data center principal até a borda da rede.

Theme

© 2025 Red Hat