blob: ec124cbaaaa86116fe9af92e565c3554fd273445 [file] [log] [blame]
Dean Troyerd81a0272012-08-31 18:04:55 -05001# lib/keystone
2# Functions to control the configuration and operation of **Keystone**
3
4# Dependencies:
Adam Spiers6a5aa7c2013-10-24 11:27:02 +01005#
6# - ``functions`` file
Jamie Lennoxbd24a8d2013-09-20 16:26:42 +10007# - ``tls`` file
Adam Spiers6a5aa7c2013-10-24 11:27:02 +01008# - ``DEST``, ``STACK_USER``
9# - ``IDENTITY_API_VERSION``
10# - ``BASE_SQL_CONN``
11# - ``SERVICE_HOST``, ``SERVICE_PROTOCOL``
12# - ``SERVICE_TOKEN``
13# - ``S3_SERVICE_PORT`` (template backend only)
Dean Troyerd81a0272012-08-31 18:04:55 -050014
Dean Troyerd81a0272012-08-31 18:04:55 -050015# ``stack.sh`` calls the entry points in this order:
16#
Adam Spiers6a5aa7c2013-10-24 11:27:02 +010017# - install_keystone
18# - configure_keystone
19# - _config_keystone_apache_wsgi
20# - init_keystone
21# - start_keystone
22# - create_keystone_accounts
23# - stop_keystone
24# - cleanup_keystone
25# - _cleanup_keystone_apache_wsgi
Dean Troyerd81a0272012-08-31 18:04:55 -050026
Dean Troyer7903b792012-09-13 17:16:12 -050027# Save trace setting
28XTRACE=$(set +o | grep xtrace)
29set +o xtrace
Dean Troyerd81a0272012-08-31 18:04:55 -050030
Dean Troyerd81a0272012-08-31 18:04:55 -050031# Defaults
32# --------
33
Dean Troyerd81a0272012-08-31 18:04:55 -050034# Set up default directories
35KEYSTONE_DIR=$DEST/keystone
36KEYSTONE_CONF_DIR=${KEYSTONE_CONF_DIR:-/etc/keystone}
37KEYSTONE_CONF=$KEYSTONE_CONF_DIR/keystone.conf
Alan Pevece0bb4472013-03-12 11:10:52 +010038KEYSTONE_PASTE_INI=${KEYSTONE_PASTE_INI:-$KEYSTONE_CONF_DIR/keystone-paste.ini}
Dean Troyerbc071bc2012-10-01 14:06:44 -050039KEYSTONE_AUTH_CACHE_DIR=${KEYSTONE_AUTH_CACHE_DIR:-/var/cache/keystone}
Jamie Lennoxa00e5f82013-09-17 12:47:03 +100040KEYSTONE_WSGI_DIR=${KEYSTONE_WSGI_DIR:-/var/www/keystone}
Dean Troyerd81a0272012-08-31 18:04:55 -050041
Morgan Fainberg58936fd2014-06-24 12:26:07 -070042KEYSTONEMIDDLEWARE_DIR=$DEST/keystonemiddleware
Dean Troyerd81a0272012-08-31 18:04:55 -050043KEYSTONECLIENT_DIR=$DEST/python-keystoneclient
44
Julien Vey00da58a2014-05-27 15:51:49 +020045# Set up additional extensions, such as oauth1, federation
46# Example of KEYSTONE_EXTENSIONS=oauth1,federation
47KEYSTONE_EXTENSIONS=${KEYSTONE_EXTENSIONS:-}
48
Morgan Fainberg46455a32014-06-20 10:37:18 -070049# Toggle for deploying Keystone under HTTPD + mod_wsgi
50KEYSTONE_USE_MOD_WSGI=${KEYSTONE_USE_MOD_WSGI:-False}
51
Dean Troyerbc071bc2012-10-01 14:06:44 -050052# Select the backend for Keystone's service catalog
Dean Troyerb80379c2012-09-10 18:30:37 -050053KEYSTONE_CATALOG_BACKEND=${KEYSTONE_CATALOG_BACKEND:-sql}
Dean Troyerd81a0272012-08-31 18:04:55 -050054KEYSTONE_CATALOG=$KEYSTONE_CONF_DIR/default_catalog.templates
55
Davanum Srinivas5bd96f92013-01-29 15:12:20 -050056# Select the backend for Tokens
57KEYSTONE_TOKEN_BACKEND=${KEYSTONE_TOKEN_BACKEND:-sql}
58
Alex Rudenkocd770582013-09-01 16:26:03 +020059# Select the backend for Identity
60KEYSTONE_IDENTITY_BACKEND=${KEYSTONE_IDENTITY_BACKEND:-sql}
61
62# Select the backend for Assignment
63KEYSTONE_ASSIGNMENT_BACKEND=${KEYSTONE_ASSIGNMENT_BACKEND:-sql}
64
Dean Troyerbc071bc2012-10-01 14:06:44 -050065# Select Keystone's token format
Brant Knudson754c4402014-06-04 09:06:01 -050066# Choose from 'UUID', 'PKI', or 'PKIZ'
Brant Knudson1e1fce82014-06-19 16:55:45 -050067KEYSTONE_TOKEN_FORMAT=$(echo ${KEYSTONE_TOKEN_FORMAT} | tr '[:upper:]' '[:lower:]')
Dean Troyerbc071bc2012-10-01 14:06:44 -050068
Dean Troyerd81a0272012-08-31 18:04:55 -050069# Set Keystone interface configuration
Dean Troyerd81a0272012-08-31 18:04:55 -050070KEYSTONE_AUTH_HOST=${KEYSTONE_AUTH_HOST:-$SERVICE_HOST}
71KEYSTONE_AUTH_PORT=${KEYSTONE_AUTH_PORT:-35357}
Dean Troyerc83a7e12012-11-29 11:47:58 -060072KEYSTONE_AUTH_PORT_INT=${KEYSTONE_AUTH_PORT_INT:-35358}
73KEYSTONE_AUTH_PROTOCOL=${KEYSTONE_AUTH_PROTOCOL:-$SERVICE_PROTOCOL}
74
75# Public facing bits
Dean Troyerd81a0272012-08-31 18:04:55 -050076KEYSTONE_SERVICE_HOST=${KEYSTONE_SERVICE_HOST:-$SERVICE_HOST}
77KEYSTONE_SERVICE_PORT=${KEYSTONE_SERVICE_PORT:-5000}
Dean Troyerc83a7e12012-11-29 11:47:58 -060078KEYSTONE_SERVICE_PORT_INT=${KEYSTONE_SERVICE_PORT_INT:-5001}
79KEYSTONE_SERVICE_PROTOCOL=${KEYSTONE_SERVICE_PROTOCOL:-$SERVICE_PROTOCOL}
Dean Troyerd81a0272012-08-31 18:04:55 -050080
David Kranz041fa712014-02-24 13:30:59 -050081# Bind hosts
82KEYSTONE_ADMIN_BIND_HOST=${KEYSTONE_ADMIN_BIND_HOST:-$KEYSTONE_SERVICE_HOST}
Dean Troyerb7490da2013-03-18 16:07:56 -050083# Set the tenant for service accounts in Keystone
84SERVICE_TENANT_NAME=${SERVICE_TENANT_NAME:-service}
85
Alex Rudenkocd770582013-09-01 16:26:03 +020086# valid identity backends as per dir keystone/identity/backends
87KEYSTONE_VALID_IDENTITY_BACKENDS=kvs,ldap,pam,sql
88
89# valid assignment backends as per dir keystone/identity/backends
90KEYSTONE_VALID_ASSIGNMENT_BACKENDS=kvs,ldap,sql
Dean Troyerd81a0272012-08-31 18:04:55 -050091
Jamie Lennoxbd24a8d2013-09-20 16:26:42 +100092# if we are running with SSL use https protocols
93if is_ssl_enabled_service "key"; then
94 KEYSTONE_AUTH_PROTOCOL="https"
95 KEYSTONE_SERVICE_PROTOCOL="https"
96fi
97
Jamie Lennox3561d7f2014-05-21 17:18:43 +100098# complete URIs
99KEYSTONE_AUTH_URI=${KEYSTONE_AUTH_PROTOCOL}://${KEYSTONE_AUTH_HOST}:${KEYSTONE_AUTH_PORT}
100KEYSTONE_SERVICE_URI=${KEYSTONE_SERVICE_PROTOCOL}://${KEYSTONE_SERVICE_HOST}:${KEYSTONE_SERVICE_PORT}
101
Dean Troyercc6b4432013-04-08 15:38:03 -0500102# Functions
103# ---------
Dean Troyerd81a0272012-08-31 18:04:55 -0500104# cleanup_keystone() - Remove residual data files, anything left over from previous
105# runs that a clean run would need to clean up
Ian Wienandaee18c72014-02-21 15:35:08 +1100106function cleanup_keystone {
Dean Troyerd81a0272012-08-31 18:04:55 -0500107 # kill instances (nova)
108 # delete image files (glance)
109 # This function intentionally left blank
110 :
111}
112
Jamie Lennoxa00e5f82013-09-17 12:47:03 +1000113# _cleanup_keystone_apache_wsgi() - Remove wsgi files, disable and remove apache vhost file
Ian Wienandaee18c72014-02-21 15:35:08 +1100114function _cleanup_keystone_apache_wsgi {
Jamie Lennoxa00e5f82013-09-17 12:47:03 +1000115 sudo rm -f $KEYSTONE_WSGI_DIR/*.wsgi
116 disable_apache_site keystone
Morgan Fainberg970ee902014-06-09 12:07:29 -0700117 sudo rm -f $(apache_site_config_for keystone)
Morgan Fainberg46455a32014-06-20 10:37:18 -0700118 restart_apache_server
Jamie Lennoxa00e5f82013-09-17 12:47:03 +1000119}
120
121# _config_keystone_apache_wsgi() - Set WSGI config files of Keystone
Ian Wienandaee18c72014-02-21 15:35:08 +1100122function _config_keystone_apache_wsgi {
Jamie Lennoxa00e5f82013-09-17 12:47:03 +1000123 sudo mkdir -p $KEYSTONE_WSGI_DIR
124
Morgan Fainberg970ee902014-06-09 12:07:29 -0700125 local keystone_apache_conf=$(apache_site_config_for keystone)
126
Jamie Lennoxa00e5f82013-09-17 12:47:03 +1000127 # copy proxy vhost and wsgi file
128 sudo cp $KEYSTONE_DIR/httpd/keystone.py $KEYSTONE_WSGI_DIR/main
129 sudo cp $KEYSTONE_DIR/httpd/keystone.py $KEYSTONE_WSGI_DIR/admin
130
Morgan Fainberg970ee902014-06-09 12:07:29 -0700131 sudo cp $FILES/apache-keystone.template $keystone_apache_conf
Jamie Lennoxa00e5f82013-09-17 12:47:03 +1000132 sudo sed -e "
133 s|%PUBLICPORT%|$KEYSTONE_SERVICE_PORT|g;
134 s|%ADMINPORT%|$KEYSTONE_AUTH_PORT|g;
135 s|%APACHE_NAME%|$APACHE_NAME|g;
136 s|%PUBLICWSGI%|$KEYSTONE_WSGI_DIR/main|g;
137 s|%ADMINWSGI%|$KEYSTONE_WSGI_DIR/admin|g;
138 s|%USER%|$STACK_USER|g
Morgan Fainberg970ee902014-06-09 12:07:29 -0700139 " -i $keystone_apache_conf
Jamie Lennoxa00e5f82013-09-17 12:47:03 +1000140 enable_apache_site keystone
141}
142
Dean Troyerd81a0272012-08-31 18:04:55 -0500143# configure_keystone() - Set config files, create data dirs, etc
Ian Wienandaee18c72014-02-21 15:35:08 +1100144function configure_keystone {
Dean Troyerd81a0272012-08-31 18:04:55 -0500145 if [[ ! -d $KEYSTONE_CONF_DIR ]]; then
146 sudo mkdir -p $KEYSTONE_CONF_DIR
Dean Troyerd81a0272012-08-31 18:04:55 -0500147 fi
Attila Fazekas91b8d132013-01-06 22:40:09 +0100148 sudo chown $STACK_USER $KEYSTONE_CONF_DIR
Dean Troyerd81a0272012-08-31 18:04:55 -0500149
150 if [[ "$KEYSTONE_CONF_DIR" != "$KEYSTONE_DIR/etc" ]]; then
151 cp -p $KEYSTONE_DIR/etc/keystone.conf.sample $KEYSTONE_CONF
Dean Troyerd561b702013-10-22 17:46:00 -0500152 chmod 600 $KEYSTONE_CONF
Dean Troyerd81a0272012-08-31 18:04:55 -0500153 cp -p $KEYSTONE_DIR/etc/policy.json $KEYSTONE_CONF_DIR
Alan Pevece0bb4472013-03-12 11:10:52 +0100154 if [[ -f "$KEYSTONE_DIR/etc/keystone-paste.ini" ]]; then
155 cp -p "$KEYSTONE_DIR/etc/keystone-paste.ini" "$KEYSTONE_PASTE_INI"
156 fi
157 fi
158 if [[ -f "$KEYSTONE_PASTE_INI" ]]; then
159 iniset "$KEYSTONE_CONF" paste_deploy config_file "$KEYSTONE_PASTE_INI"
160 else
161 # compatibility with mixed cfg and paste.deploy configuration
162 KEYSTONE_PASTE_INI="$KEYSTONE_CONF"
Dean Troyerd81a0272012-08-31 18:04:55 -0500163 fi
164
Julien Vey00da58a2014-05-27 15:51:49 +0200165 configure_keystone_extensions
166
Dean Troyerd81a0272012-08-31 18:04:55 -0500167 # Rewrite stock ``keystone.conf``
Dean Troyerc83a7e12012-11-29 11:47:58 -0600168
Brad Topolf127e2f2013-01-22 10:17:50 -0600169 if is_service_enabled ldap; then
170 #Set all needed ldap values
Dean Troyerb9e25132013-10-01 14:45:04 -0500171 iniset $KEYSTONE_CONF ldap password $LDAP_PASSWORD
172 iniset $KEYSTONE_CONF ldap user $LDAP_MANAGER_DN
173 iniset $KEYSTONE_CONF ldap suffix $LDAP_BASE_DN
Brad Topolf41024e2013-02-19 15:36:41 -0600174 iniset $KEYSTONE_CONF ldap use_dumb_member "True"
Morgan Fainberg2dc11fb2013-09-24 23:43:08 -0700175 iniset $KEYSTONE_CONF ldap user_attribute_ignore "enabled,email,tenants,default_project_id"
Brad Topolf41024e2013-02-19 15:36:41 -0600176 iniset $KEYSTONE_CONF ldap tenant_attribute_ignore "enabled"
177 iniset $KEYSTONE_CONF ldap tenant_domain_id_attribute "businessCategory"
178 iniset $KEYSTONE_CONF ldap tenant_desc_attribute "description"
Dean Troyerb9e25132013-10-01 14:45:04 -0500179 iniset $KEYSTONE_CONF ldap tenant_tree_dn "ou=Projects,$LDAP_BASE_DN"
Brad Topolf41024e2013-02-19 15:36:41 -0600180 iniset $KEYSTONE_CONF ldap user_domain_id_attribute "businessCategory"
Dean Troyerb9e25132013-10-01 14:45:04 -0500181 iniset $KEYSTONE_CONF ldap user_tree_dn "ou=Users,$LDAP_BASE_DN"
Brad Topolf41024e2013-02-19 15:36:41 -0600182 iniset $KEYSTONE_CONF DEFAULT member_role_id "9fe2ff9ee4384b1894a90878d3e92bab"
183 iniset $KEYSTONE_CONF DEFAULT member_role_name "_member_"
Brad Topolf127e2f2013-01-22 10:17:50 -0600184 fi
185
Alex Rudenkocd770582013-09-01 16:26:03 +0200186 # check if identity backend is valid
187 if [[ "$KEYSTONE_VALID_IDENTITY_BACKENDS" =~ "$KEYSTONE_IDENTITY_BACKEND" ]]; then
188 iniset $KEYSTONE_CONF identity driver "keystone.identity.backends.$KEYSTONE_IDENTITY_BACKEND.Identity"
189 fi
190
191 # check if assignment backend is valid
192 if [[ "$KEYSTONE_VALID_ASSIGNMENT_BACKENDS" =~ "$KEYSTONE_ASSIGNMENT_BACKEND" ]]; then
193 iniset $KEYSTONE_CONF assignment driver "keystone.assignment.backends.$KEYSTONE_ASSIGNMENT_BACKEND.Assignment"
Brad Topolf127e2f2013-01-22 10:17:50 -0600194 fi
195
Dean Troyer245a4312013-06-28 09:16:08 -0500196 # Set the URL advertised in the ``versions`` structure returned by the '/' route
197 iniset $KEYSTONE_CONF DEFAULT public_endpoint "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:%(public_port)s/"
198 iniset $KEYSTONE_CONF DEFAULT admin_endpoint "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:%(admin_port)s/"
David Kranz041fa712014-02-24 13:30:59 -0500199 iniset $KEYSTONE_CONF DEFAULT admin_bind_host "$KEYSTONE_ADMIN_BIND_HOST"
Dean Troyer245a4312013-06-28 09:16:08 -0500200
Jamie Lennoxbd24a8d2013-09-20 16:26:42 +1000201 # Register SSL certificates if provided
202 if is_ssl_enabled_service key; then
203 ensure_certificates KEYSTONE
204
205 iniset $KEYSTONE_CONF ssl enable True
206 iniset $KEYSTONE_CONF ssl certfile $KEYSTONE_SSL_CERT
207 iniset $KEYSTONE_CONF ssl keyfile $KEYSTONE_SSL_KEY
208 fi
209
Dean Troyerc83a7e12012-11-29 11:47:58 -0600210 if is_service_enabled tls-proxy; then
211 # Set the service ports for a proxy to take the originals
212 iniset $KEYSTONE_CONF DEFAULT public_port $KEYSTONE_SERVICE_PORT_INT
213 iniset $KEYSTONE_CONF DEFAULT admin_port $KEYSTONE_AUTH_PORT_INT
214 fi
215
Dean Troyerd81a0272012-08-31 18:04:55 -0500216 iniset $KEYSTONE_CONF DEFAULT admin_token "$SERVICE_TOKEN"
Sudarshan Acharya37631412013-07-16 00:47:54 +0000217
Brant Knudson1e1fce82014-06-19 16:55:45 -0500218 if [[ "$KEYSTONE_TOKEN_FORMAT" != "" ]]; then
219 iniset $KEYSTONE_CONF token provider keystone.token.providers.$KEYSTONE_TOKEN_FORMAT.Provider
Sudarshan Acharya37631412013-07-16 00:47:54 +0000220 fi
221
Brant Knudson16d3ad02014-02-13 18:59:50 -0600222 iniset $KEYSTONE_CONF database connection `database_connection_url keystone`
Dean Troyerd81a0272012-08-31 18:04:55 -0500223 iniset $KEYSTONE_CONF ec2 driver "keystone.contrib.ec2.backends.sql.Ec2"
Dean Troyerd81a0272012-08-31 18:04:55 -0500224
Davanum Srinivas5bd96f92013-01-29 15:12:20 -0500225 if [[ "$KEYSTONE_TOKEN_BACKEND" = "sql" ]]; then
226 iniset $KEYSTONE_CONF token driver keystone.token.backends.sql.Token
Peter Feiner61ae7c12013-11-15 10:42:30 -0500227 elif [[ "$KEYSTONE_TOKEN_BACKEND" = "memcache" ]]; then
228 iniset $KEYSTONE_CONF token driver keystone.token.backends.memcache.Token
Davanum Srinivas5bd96f92013-01-29 15:12:20 -0500229 else
230 iniset $KEYSTONE_CONF token driver keystone.token.backends.kvs.Token
231 fi
232
Dean Troyerd81a0272012-08-31 18:04:55 -0500233 if [[ "$KEYSTONE_CATALOG_BACKEND" = "sql" ]]; then
234 # Configure ``keystone.conf`` to use sql
235 iniset $KEYSTONE_CONF catalog driver keystone.catalog.backends.sql.Catalog
236 inicomment $KEYSTONE_CONF catalog template_file
237 else
238 cp -p $FILES/default_catalog.templates $KEYSTONE_CATALOG
239
240 # Add swift endpoints to service catalog if swift is enabled
Chmouel Boudjnah0c3a5582013-03-06 10:58:33 +0100241 if is_service_enabled s-proxy; then
Dean Troyerd81a0272012-08-31 18:04:55 -0500242 echo "catalog.RegionOne.object_store.publicURL = http://%SERVICE_HOST%:8080/v1/AUTH_\$(tenant_id)s" >> $KEYSTONE_CATALOG
243 echo "catalog.RegionOne.object_store.adminURL = http://%SERVICE_HOST%:8080/" >> $KEYSTONE_CATALOG
244 echo "catalog.RegionOne.object_store.internalURL = http://%SERVICE_HOST%:8080/v1/AUTH_\$(tenant_id)s" >> $KEYSTONE_CATALOG
245 echo "catalog.RegionOne.object_store.name = Swift Service" >> $KEYSTONE_CATALOG
246 fi
247
Mark McClainb05c8762013-07-06 23:29:39 -0400248 # Add neutron endpoints to service catalog if neutron is enabled
249 if is_service_enabled neutron; then
Dean Troyerd81a0272012-08-31 18:04:55 -0500250 echo "catalog.RegionOne.network.publicURL = http://%SERVICE_HOST%:$Q_PORT/" >> $KEYSTONE_CATALOG
251 echo "catalog.RegionOne.network.adminURL = http://%SERVICE_HOST%:$Q_PORT/" >> $KEYSTONE_CATALOG
252 echo "catalog.RegionOne.network.internalURL = http://%SERVICE_HOST%:$Q_PORT/" >> $KEYSTONE_CATALOG
Mark McClainb05c8762013-07-06 23:29:39 -0400253 echo "catalog.RegionOne.network.name = Neutron Service" >> $KEYSTONE_CATALOG
Dean Troyerd81a0272012-08-31 18:04:55 -0500254 fi
255
Vincent Untz7e86dbe2012-12-13 08:50:37 +0100256 sed -e "
Dean Troyerd81a0272012-08-31 18:04:55 -0500257 s,%SERVICE_HOST%,$SERVICE_HOST,g;
258 s,%S3_SERVICE_PORT%,$S3_SERVICE_PORT,g;
259 " -i $KEYSTONE_CATALOG
260
261 # Configure ``keystone.conf`` to use templates
262 iniset $KEYSTONE_CONF catalog driver "keystone.catalog.backends.templated.TemplatedCatalog"
263 iniset $KEYSTONE_CONF catalog template_file "$KEYSTONE_CATALOG"
264 fi
265
266 # Set up logging
Dean Troyerd81a0272012-08-31 18:04:55 -0500267 if [ "$SYSLOG" != "False" ]; then
Brant Knudson4968d1a2014-01-22 19:06:44 -0600268 iniset $KEYSTONE_CONF DEFAULT use_syslog "True"
Dean Troyerd81a0272012-08-31 18:04:55 -0500269 fi
Brant Knudson4968d1a2014-01-22 19:06:44 -0600270
271 # Format logging
Morgan Fainberg46455a32014-06-20 10:37:18 -0700272 if [ "$LOG_COLOR" == "True" ] && [ "$SYSLOG" == "False" ] && [ "$KEYSTONE_USE_MOD_WSGI" == "False" ] ; then
Brant Knudson4968d1a2014-01-22 19:06:44 -0600273 setup_colorized_logging $KEYSTONE_CONF DEFAULT
274 fi
Jamie Lennoxa00e5f82013-09-17 12:47:03 +1000275
Morgan Fainberg46455a32014-06-20 10:37:18 -0700276 if [ "$KEYSTONE_USE_MOD_WSGI" == "True" ]; then
Morgan Fainberg2c2b1cc2014-05-01 22:05:41 -0700277 iniset $KEYSTONE_CONF DEFAULT debug "True"
278 # Eliminate the %(asctime)s.%(msecs)03d from the log format strings
279 iniset $KEYSTONE_CONF DEFAULT logging_context_format_string "%(process)d %(levelname)s %(name)s [%(request_id)s %(user_identity)s] %(instance)s%(message)s"
280 iniset $KEYSTONE_CONF DEFAULT logging_default_format_string "%(process)d %(levelname)s %(name)s [-] %(instance)s%(message)s"
281 iniset $KEYSTONE_CONF DEFAULT logging_debug_format_suffix "%(funcName)s %(pathname)s:%(lineno)d"
282 iniset $KEYSTONE_CONF DEFAULT logging_exception_prefix "%(process)d TRACE %(name)s %(instance)s"
Jamie Lennoxa00e5f82013-09-17 12:47:03 +1000283 _config_keystone_apache_wsgi
284 fi
Bartosz Górski0abde392014-02-28 14:15:19 +0100285
286 iniset $KEYSTONE_CONF DEFAULT max_token_size 16384
Dean Troyerd81a0272012-08-31 18:04:55 -0500287}
288
Julien Vey00da58a2014-05-27 15:51:49 +0200289function configure_keystone_extensions {
290 # Add keystone extension into keystone v3 application pipeline
291 local extension_value
292 local api_v3
293 local extension
294 local api_v3_extension
295 for extension_value in ${KEYSTONE_EXTENSIONS//,/ }; do
296 if [[ -z "${extension_value}" ]]; then
297 continue
298 fi
299 api_v3=$(iniget $KEYSTONE_PASTE_INI pipeline:api_v3 pipeline)
300 extension=$(echo $api_v3 | sed -ne "/${extension_value}/ p;" )
301 if [[ -z $extension ]]; then
302 api_v3_extension=$(echo $api_v3 | sed -ne "s/service_v3/${extension_value}_extension service_v3/p;" )
303 iniset $KEYSTONE_PASTE_INI pipeline:api_v3 pipeline "$api_v3_extension"
304 fi
305 done
306}
307
Dean Troyerd835de82012-11-29 17:11:35 -0600308# create_keystone_accounts() - Sets up common required keystone accounts
309
310# Tenant User Roles
311# ------------------------------------------------------------------
Dean Troyerd835de82012-11-29 17:11:35 -0600312# admin admin admin
Dean Troyer42a59c22014-03-03 14:31:29 -0600313# service -- --
314# -- -- service
315# -- -- ResellerAdmin
316# -- -- Member
Dean Troyerd835de82012-11-29 17:11:35 -0600317# demo admin admin
318# demo demo Member, anotherrole
319# invisible_to_admin demo Member
320
321# Migrated from keystone_data.sh
Ian Wienandaee18c72014-02-21 15:35:08 +1100322function create_keystone_accounts {
Dean Troyerd835de82012-11-29 17:11:35 -0600323
324 # admin
Bartosz Górski0abde392014-02-28 14:15:19 +0100325 ADMIN_TENANT=$(get_or_create_project "admin")
326 ADMIN_USER=$(get_or_create_user "admin" \
327 "$ADMIN_PASSWORD" "$ADMIN_TENANT" "admin@example.com")
328 ADMIN_ROLE=$(get_or_create_role "admin")
329 get_or_add_user_role $ADMIN_ROLE $ADMIN_USER $ADMIN_TENANT
Dean Troyerd835de82012-11-29 17:11:35 -0600330
Dean Troyer42a59c22014-03-03 14:31:29 -0600331 # Create service project/role
Bartosz Górski0abde392014-02-28 14:15:19 +0100332 get_or_create_project "$SERVICE_TENANT_NAME"
Dean Troyer42a59c22014-03-03 14:31:29 -0600333
334 # Service role, so service users do not have to be admins
Bartosz Górski0abde392014-02-28 14:15:19 +0100335 get_or_create_role service
Dean Troyer42a59c22014-03-03 14:31:29 -0600336
337 # The ResellerAdmin role is used by Nova and Ceilometer so we need to keep it.
338 # The admin role in swift allows a user to act as an admin for their tenant,
339 # but ResellerAdmin is needed for a user to act as any tenant. The name of this
340 # role is also configurable in swift-proxy.conf
Bartosz Górski0abde392014-02-28 14:15:19 +0100341 get_or_create_role ResellerAdmin
Dean Troyerd835de82012-11-29 17:11:35 -0600342
343 # The Member role is used by Horizon and Swift so we need to keep it:
Bartosz Górski0abde392014-02-28 14:15:19 +0100344 MEMBER_ROLE=$(get_or_create_role "Member")
345
Dean Troyerd835de82012-11-29 17:11:35 -0600346 # ANOTHER_ROLE demonstrates that an arbitrary role may be created and used
347 # TODO(sleepsonthefloor): show how this can be used for rbac in the future!
Bartosz Górski0abde392014-02-28 14:15:19 +0100348
349 ANOTHER_ROLE=$(get_or_create_role "anotherrole")
Dean Troyerd835de82012-11-29 17:11:35 -0600350
351 # invisible tenant - admin can't see this one
Bartosz Górski0abde392014-02-28 14:15:19 +0100352 INVIS_TENANT=$(get_or_create_project "invisible_to_admin")
Dean Troyerd835de82012-11-29 17:11:35 -0600353
354 # demo
Bartosz Górski0abde392014-02-28 14:15:19 +0100355 DEMO_TENANT=$(get_or_create_project "demo")
356 DEMO_USER=$(get_or_create_user "demo" \
357 "$ADMIN_PASSWORD" "$DEMO_TENANT" "demo@example.com")
Steve Martinelli19685422014-01-24 13:02:26 -0600358
Bartosz Górski0abde392014-02-28 14:15:19 +0100359 get_or_add_user_role $MEMBER_ROLE $DEMO_USER $DEMO_TENANT
360 get_or_add_user_role $ADMIN_ROLE $ADMIN_USER $DEMO_TENANT
361 get_or_add_user_role $ANOTHER_ROLE $DEMO_USER $DEMO_TENANT
362 get_or_add_user_role $MEMBER_ROLE $DEMO_USER $INVIS_TENANT
Dean Troyerd835de82012-11-29 17:11:35 -0600363
364 # Keystone
365 if [[ "$KEYSTONE_CATALOG_BACKEND" = 'sql' ]]; then
Bartosz Górski0abde392014-02-28 14:15:19 +0100366
367 KEYSTONE_SERVICE=$(get_or_create_service "keystone" \
368 "identity" "Keystone Identity Service")
369 get_or_create_endpoint $KEYSTONE_SERVICE \
370 "$REGION_NAME" \
371 "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_SERVICE_PORT/v$IDENTITY_API_VERSION" \
372 "$KEYSTONE_AUTH_PROTOCOL://$KEYSTONE_AUTH_HOST:$KEYSTONE_AUTH_PORT/v$IDENTITY_API_VERSION" \
373 "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_SERVICE_PORT/v$IDENTITY_API_VERSION"
Dean Troyerd835de82012-11-29 17:11:35 -0600374 fi
Dean Troyerd835de82012-11-29 17:11:35 -0600375}
376
Vincent Hou21fe4e72013-11-21 03:10:27 -0500377# Configure the API version for the OpenStack projects.
378# configure_API_version conf_file version
Ian Wienandaee18c72014-02-21 15:35:08 +1100379function configure_API_version {
Vincent Hou21fe4e72013-11-21 03:10:27 -0500380 local conf_file=$1
381 local api_version=$2
382 iniset $conf_file keystone_authtoken auth_uri $KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_SERVICE_PORT/v$api_version
383}
384
Dean Troyerd81a0272012-08-31 18:04:55 -0500385# init_keystone() - Initialize databases, etc.
Ian Wienandaee18c72014-02-21 15:35:08 +1100386function init_keystone {
Dean Troyerb9e25132013-10-01 14:45:04 -0500387 if is_service_enabled ldap; then
388 init_ldap
389 fi
390
Dean Troyerd81a0272012-08-31 18:04:55 -0500391 # (Re)create keystone database
Terry Wilson428af5a2012-11-01 16:12:39 -0400392 recreate_database keystone utf8
Dean Troyerd81a0272012-08-31 18:04:55 -0500393
394 # Initialize keystone database
395 $KEYSTONE_DIR/bin/keystone-manage db_sync
396
Julien Vey00da58a2014-05-27 15:51:49 +0200397 local extension_value
398 for extension_value in ${KEYSTONE_EXTENSIONS//,/ }; do
399 if [[ -z "${extension_value}" ]]; then
400 continue
401 fi
402 $KEYSTONE_DIR/bin/keystone-manage db_sync --extension "${extension_value}"
403 done
404
Brant Knudson1e1fce82014-06-19 16:55:45 -0500405 if [[ "$KEYSTONE_TOKEN_FORMAT" != "uuid" ]]; then
Dean Troyerbc071bc2012-10-01 14:06:44 -0500406 # Set up certificates
Vishvananda Ishaya23431f32012-12-12 15:57:33 -0800407 rm -rf $KEYSTONE_CONF_DIR/ssl
Dean Troyerbc071bc2012-10-01 14:06:44 -0500408 $KEYSTONE_DIR/bin/keystone-manage pki_setup
409
410 # Create cache dir
411 sudo mkdir -p $KEYSTONE_AUTH_CACHE_DIR
Attila Fazekas91b8d132013-01-06 22:40:09 +0100412 sudo chown $STACK_USER $KEYSTONE_AUTH_CACHE_DIR
Vishvananda Ishaya23431f32012-12-12 15:57:33 -0800413 rm -f $KEYSTONE_AUTH_CACHE_DIR/*
Dean Troyerbc071bc2012-10-01 14:06:44 -0500414 fi
Dean Troyerd81a0272012-08-31 18:04:55 -0500415}
416
417# install_keystoneclient() - Collect source and prepare
Ian Wienandaee18c72014-02-21 15:35:08 +1100418function install_keystoneclient {
Dean Troyerd81a0272012-08-31 18:04:55 -0500419 git_clone $KEYSTONECLIENT_REPO $KEYSTONECLIENT_DIR $KEYSTONECLIENT_BRANCH
Sean Dague1b4b4be2013-04-01 16:44:31 -0400420 setup_develop $KEYSTONECLIENT_DIR
Attila Fazekasfac533e2013-08-14 16:04:01 +0200421 sudo install -D -m 0644 -o $STACK_USER {$KEYSTONECLIENT_DIR/tools/,/etc/bash_completion.d/}keystone.bash_completion
Dean Troyerd81a0272012-08-31 18:04:55 -0500422}
423
Morgan Fainberg58936fd2014-06-24 12:26:07 -0700424# install_keystonemiddleware() - Collect source and prepare
425function install_keystonemiddleware {
426 git_clone $KEYSTONEMIDDLEWARE_REPO $KEYSTONEMIDDLEWARE_DIR $KEYSTONEMIDDLEWARE_BRANCH
427 setup_install $KEYSTONEMIDDLEWARE_DIR
428}
429
Dean Troyerd81a0272012-08-31 18:04:55 -0500430# install_keystone() - Collect source and prepare
Ian Wienandaee18c72014-02-21 15:35:08 +1100431function install_keystone {
Brad Topolf127e2f2013-01-22 10:17:50 -0600432 # only install ldap if the service has been enabled
433 if is_service_enabled ldap; then
434 install_ldap
435 fi
Peter Feiner61ae7c12013-11-15 10:42:30 -0500436 if [[ "$KEYSTONE_TOKEN_BACKEND" = "memcache" ]]; then
437 # Install memcached and the memcache Python library that keystone uses.
438 # Unfortunately the Python library goes by different names in the .deb
439 # and .rpm circles.
440 install_package memcached
441 if is_ubuntu; then
442 install_package python-memcache
443 else
444 install_package python-memcached
445 fi
446 fi
Dean Troyerd81a0272012-08-31 18:04:55 -0500447 git_clone $KEYSTONE_REPO $KEYSTONE_DIR $KEYSTONE_BRANCH
Sean Dague1b4b4be2013-04-01 16:44:31 -0400448 setup_develop $KEYSTONE_DIR
Morgan Fainberg46455a32014-06-20 10:37:18 -0700449 if [ "$KEYSTONE_USE_MOD_WSGI" == "True" ]; then
Jamie Lennoxa00e5f82013-09-17 12:47:03 +1000450 install_apache_wsgi
451 fi
Dean Troyerd81a0272012-08-31 18:04:55 -0500452}
453
454# start_keystone() - Start running processes, including screen
Ian Wienandaee18c72014-02-21 15:35:08 +1100455function start_keystone {
Dean Troyerc83a7e12012-11-29 11:47:58 -0600456 # Get right service port for testing
457 local service_port=$KEYSTONE_SERVICE_PORT
458 if is_service_enabled tls-proxy; then
459 service_port=$KEYSTONE_SERVICE_PORT_INT
460 fi
461
Morgan Fainberg46455a32014-06-20 10:37:18 -0700462 if [ "$KEYSTONE_USE_MOD_WSGI" == "True" ]; then
Jamie Lennoxa00e5f82013-09-17 12:47:03 +1000463 restart_apache_server
464 screen_it key "cd $KEYSTONE_DIR && sudo tail -f /var/log/$APACHE_NAME/keystone"
465 else
466 # Start Keystone in a screen window
Brant Knudson4968d1a2014-01-22 19:06:44 -0600467 screen_it key "cd $KEYSTONE_DIR && $KEYSTONE_DIR/bin/keystone-all --config-file $KEYSTONE_CONF --debug"
Jamie Lennoxa00e5f82013-09-17 12:47:03 +1000468 fi
469
Dean Troyerd835de82012-11-29 17:11:35 -0600470 echo "Waiting for keystone to start..."
Stanislaw Pituchabe4c9532014-06-11 17:52:49 +0100471 # Check that the keystone service is running. Even if the tls tunnel
472 # should be enabled, make sure the internal port is checked using
473 # unencryted traffic at this point.
474 if ! timeout $SERVICE_TIMEOUT sh -c "while ! curl --noproxy '*' -k -s http://$KEYSTONE_SERVICE_HOST:$service_port/v$IDENTITY_API_VERSION/ >/dev/null; do sleep 1; done"; then
Sean Dague101b4242013-10-22 08:47:11 -0400475 die $LINENO "keystone did not start"
Dean Troyerd835de82012-11-29 17:11:35 -0600476 fi
Dean Troyerc83a7e12012-11-29 11:47:58 -0600477
478 # Start proxies if enabled
479 if is_service_enabled tls-proxy; then
480 start_tls_proxy '*' $KEYSTONE_SERVICE_PORT $KEYSTONE_SERVICE_HOST $KEYSTONE_SERVICE_PORT_INT &
481 start_tls_proxy '*' $KEYSTONE_AUTH_PORT $KEYSTONE_AUTH_HOST $KEYSTONE_AUTH_PORT_INT &
482 fi
Dean Troyerd81a0272012-08-31 18:04:55 -0500483}
484
485# stop_keystone() - Stop running processes
Ian Wienandaee18c72014-02-21 15:35:08 +1100486function stop_keystone {
Dean Troyerd81a0272012-08-31 18:04:55 -0500487 # Kill the Keystone screen window
Dean Troyer9fc87922013-05-22 17:19:06 -0500488 screen_stop key
Morgan Fainbergc11d6e02014-05-01 22:57:06 -0700489 # Cleanup the WSGI files and VHOST
490 _cleanup_keystone_apache_wsgi
Dean Troyerd81a0272012-08-31 18:04:55 -0500491}
Dean Troyer7903b792012-09-13 17:16:12 -0500492
Dean Troyer1a6d4492013-06-03 16:47:36 -0500493
Dean Troyer7903b792012-09-13 17:16:12 -0500494# Restore xtrace
495$XTRACE
Sean Dague584d90e2013-03-29 14:34:53 -0400496
Adam Spiers6a5aa7c2013-10-24 11:27:02 +0100497# Tell emacs to use shell-script-mode
498## Local variables:
499## mode: shell-script
500## End: