Keystone配置，分domain对接Ldap

1、安装mysql，并修改密码

2、登录mysql创建数据库并赋权

mysql -u root -p

CREATE DATABASE keystone;

GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'localhost' IDENTIFIED BY 'your-password';

GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'%' IDENTIFIED BY 'your-password';

3、安装keystone，设置主机等

yum install openstack-keystone httpd mod_wsgi

vi /etc/hosts

127.0.0.1 controller

/etc/selinux/config文件

SELINUX=enforcing改为disabled

一次性的执行命令setenforce 0，这样不用重启，也可以生效

4、修改配置文件

/etc/keystone/keystone.conf

connection = mysql+pymysql://keystone:your-password@controller/keystone

provider = fernet

5、同步数据库表

su -s /bin/sh -c "keystone-manage db_sync" keystone

keystone-manage fernet_setup --keystone-user keystone --keystone-group keystone

keystone-manage credential_setup --keystone-user keystone --keystone-group keystone

6、Bootstrap the Identity service

keystone-manage bootstrap --bootstrap-password your-password \ --bootstrap-admin-url http://controller:5000/v3/ \ --bootstrap-internal-url http://controller:5000/v3/ \ --bootstrap-public-url http://controller:5000/v3/ \ --bootstrap-region-id RegionOne

7、Configure the Apache HTTP server

/etc/httpd/conf/httpd.conf

ServerName 127.0.0.1

ln -s /usr/share/keystone/wsgi-keystone.conf /etc/httpd/conf.d/

systemctl enable httpd.service

systemctl start httpd.service

export OS_USERNAME=admin

export OS_PASSWORD=your-password

export OS_PROJECT_NAME=admin

export OS_USER_DOMAIN_NAME=Default

export OS_PROJECT_DOMAIN_NAME=Default

export OS_AUTH_URL=http://controller:5000/v3

export OS_IDENTITY_API_VERSION=3

8、设置keystone.conf

admin_token

[identity]

domain_specific_drivers_enabled = true //允许特殊域驱动

domain_config_dir = /etc/keystone/domains //特殊域配置文件路径

driver = sql //默认域驱动为sql

9、设置Ldap特殊域

mkdir /etc/keystone/domains

复制一份keystone.conf到domains下，改名为keystone.Ldap.conf //文件名中的Ldap要和domain的name对应。

chmod 777 domains/

chmod 777 keystone.Ldap.conf

去掉其他所有的配置，只保留：

[identity]

driver = ldap

[ldap]

url = your url

user = your username

password = your password

suffix = your suffix

user_tree_dn = your baseDn

user_id_attribute = //keystone id

user_name_attribute = //keystone name

user_description_attribute =

user_mail_attribute =

group_tree_dn = your baseDn

service httpd restart：重启服务