3.3. Configure the Identity Service

Procedure 3.2. Configuring the Identity Service SQL Database Connection

• Set the value of the connection configuration key:

  # openstack-config --set /etc/keystone/keystone.conf \
     sql connection mysql://USER:PASS@IP/DB

  Copy to Clipboard
  Replace the following values:

  • Replace USER with the Identity service database user name, usually keystone.
  • Replace PASS with the password of the database user.
  • Replace IP with the IP address or host name of the database server.
  • Replace DB with the name of the Identity service database, usually keystone.

Procedure 3.3. Setting the Identity Service Administration Token

1. Generate an initial service token and save it in the OS_SERVICE_TOKEN environment variable:

   # export OS_SERVICE_TOKEN=$(openssl rand -hex 10)

   Copy to Clipboard
2. Store the value of the administration token in a file for future use:

   # echo $OS_SERVICE_TOKEN > ~/ks_admin_token

   Copy to Clipboard
3. Set the value of the admin_token configuration key to that of the newly created token:

   # openstack-config --set /etc/keystone/keystone.conf \
      DEFAULT admin_token $OS_SERVICE_TOKEN

   Copy to Clipboard

Procedure 3.5. Configuring the Firewall to Allow Identity Service Traffic

1. Open the /etc/sysconfig/iptables file in a text editor.
2. Add an INPUT rule allowing TCP traffic on ports 5000 and 35357 to the file. The new rule must appear before any INPUT rules that REJECT traffic:

   -A INPUT -p tcp -m multiport --dports 5000,35357 -j ACCEPT

   Copy to Clipboard
3. Save the changes to the /etc/sysconfig/iptables file.
4. Restart the iptables service to ensure that the change takes effect:

   # systemctl restart iptables.service

   Copy to Clipboard

Procedure 3.6. Populating the Identity Service Database

1. Log in to the system hosting the Identity service.
2. Switch to the keystone user and initialize and populate the database identified in /etc/keystone/keystone.conf:

   # su keystone -s /bin/sh -c "keystone-manage db_sync"

   Copy to Clipboard

Procedure 3.7. Limiting the Number of Entities in a Collection

1. Open the /etc/keystone/keystone.conf in a text editor.
2. Set a global value using list_limit in the [DEFAULT] section.
3. Optionally override the global value with a specific limit in individual sections. For example:

   [assignment]
   list_limit = 100
   

   Copy to Clipboard