Keystone

Learn about configurations >

• admin-password | string

  Default: admin

  Admin password to be created when starting the service

• admin-project | string

  Default: admin

  Admin project to be created when starting the service

• admin-username | string

  Default: admin

  Admin username to be created when starting the service

• keystone-db-password | string

  Default: admin

  Keystone DB Password

• ldap-authentication-domain-name | string

  Name of the domain which use LDAP authentication

• ldap-bind-password | string

  Password to bind and search for users

• ldap-bind-user | string

  User to bind and search for users

• ldap-chase-referrals | string

  Sets keystone’s referral chasing behavior across directory partitions. If left unset, the system’s default behavior will be used.

• ldap-enabled | boolean

  Boolean to enable/disable LDAP authentication

• ldap-group-objectclass | string

  Default: groupOfNames

  The LDAP object class to use for groups.

• ldap-group-tree-dn | string

  The search base to use for groups.

• ldap-page-size | int

  Defines the maximum number of results per page that keystone should request from the LDAP server when listing objects. A value of zero (0) disables paging.

• ldap-tls-cacert-base64 | string

  CA certificate in Base64 format (if you have the PEM file, text inside "-----BEGIN CERTIFICATE-----"/"-----END CERTIFICATE-----" tags).

• ldap-tls-req-cert | string

  Default: demand

  Defines how the certificates are checked for validity in the client (i.e., Keystone end) of the secure connection (this doesn’t affect what level of checking the server is doing on the certificates it receives from Keystone). Possible values are "demand", "never", and "allow". The default of demand means the client always checks the certificate and will drop the connection if it is not provided or invalid. never is the opposite—it never checks it, nor requires it to be provided. allow means that if it is not provided then the connection is allowed to continue, but if it is provided it will be checked—and if invalid, the connection will be dropped.

• ldap-url | string

  Default: ldap://localhost

  URL of the LDAP server

• ldap-use-starttls | boolean

  Enable Transport Layer Security (TLS) for providing a secure connection from Keystone to LDAP (StartTLS, not LDAPS).

• ldap-user-enabled-attribute | string

  Default: enabled

  In Keystone, a user entity can be either enabled or disabled. Setting the above option will give a mapping to an equivalent attribute in LDAP, allowing your LDAP management tools to disable a user.

• ldap-user-enabled-default | string

  Default: true

  Most LDAP servers use a boolean or bit in a control field to indicate enablement. However, some schemas might use an integer value in an attribute. In this situation, set user_enabled_default to the integer value that represents a user being enabled.

• ldap-user-enabled-invert | boolean

  Some LDAP schemas have an “account locked” attribute, which is the equivalent to account being “disabled.” In order to map this to the Keystone enabled attribute, you can utilize the user_enabled_invert setting in conjunction with user_enabled_attribute to map the lock status to disabled in Keystone.

• ldap-user-enabled-mask | int

  Some LDAP schemas, rather than having a dedicated attribute for user enablement, use a bit within a general control attribute (such as userAccountControl) to indicate this. Setting user_enabled_mask will cause Keystone to look at only the status of this bit in the attribute specified by user_enabled_attribute, with the bit set indicating the user is enabled.

• ldap-user-filter | string

  This filter option allow additional filter (over and above user_objectclass) to be included into the search of user. One common use of this is to provide more efficient searching, where the recommended search for user objects is (&(objectCategory=person)(objectClass=user)). By specifying user_objectclass as user and user_filter as objectCategory=person in the Keystone configuration file, this can be achieved.

• ldap-user-id-attribute | string

  Default: cn

  This set of options define the mapping to LDAP attributes for the three key user attributes supported by Keystone. The LDAP attribute chosen for user_id must be something that is immutable for a user and no more than 64 characters in length. Notice that Distinguished Name (DN) may be longer than 64 characters and thus is not suitable. An uid, or mail may be appropriate.

• ldap-user-name-attribute | string

  Default: sn

  This set of options define the mapping to LDAP attributes for the three key user attributes supported by Keystone. The LDAP attribute chosen for user_id must be something that is immutable for a user and no more than 64 characters in length. Notice that Distinguished Name (DN) may be longer than 64 characters and thus is not suitable. An uid, or mail may be appropriate.

• ldap-user-objectclass | string

  Default: inetOrgPerson

  LDAP object class that Keystone will filter on within user_tree_dn to find user objects. Any objects of other classes will be ignored.

• ldap-user-pass-attribute | string

  Default: userPassword

  This set of options define the mapping to LDAP attributes for the three key user attributes supported by Keystone. The LDAP attribute chosen for user_id must be something that is immutable for a user and no more than 64 characters in length. Notice that Distinguished Name (DN) may be longer than 64 characters and thus is not suitable. An uid, or mail may be appropriate.

• ldap-user-tree-dn | string

  Root of the tree in LDAP server in which Keystone will search for users

• mysql-uri | string

  Mysql URI with the following format: mysql://<user>:<password>@<mysql_host>:<mysql_port>/<database>

• project-domain-name | string

  Default: default

  Project domain name (Hardcoded in the container start.sh script)

• region-id | string

  Default: RegionOne

  Region ID to be created when starting the service

• service-password | string

  Default: nbi

  Service Password to be created when starting the service

• service-project | string

  Default: service

  Service Project to be created when starting the service

• service-username | string

  Default: nbi

  Service Username to be created when starting the service

• token-expiration | int

  Default: 3600

  Token keys expiration in seconds

• user-domain-name | string

  Default: default

  User domain name (Hardcoded in the container start.sh script)