1 # Copyright 2020 Canonical Ltd.
3 # Licensed under the Apache License, Version 2.0 (the "License");
4 # you may not use this file except in compliance with the License.
5 # You may obtain a copy of the License at
7 # http://www.apache.org/licenses/LICENSE-2.0
9 # Unless required by applicable law or agreed to in writing, software
10 # distributed under the License is distributed on an "AS IS" BASIS,
11 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 # See the License for the specific language governing permissions and
13 # limitations under the License.
18 The maximum file size, in megabytes.
20 If there is a reverse proxy in front of Keystone, it may
21 need to be configured to handle the requested size.
23 ingress_whitelist_source_range:
26 A comma-separated list of CIDRs to store in the
27 ingress.kubernetes.io/whitelist-source-range annotation.
29 This can be used to lock down access to
30 Keystone based on source IP address.
34 description: TLS Secret name
38 description: Ingress URL
42 description: Region ID to be created when starting the service
46 description: Keystone DB Password
50 description: MySQL Host (external database)
53 description: MySQL Port (external database)
56 description: MySQL Root Password (external database)
59 description: Admin username to be created when starting the service
63 description: Admin password to be created when starting the service
67 description: Admin project to be created when starting the service
71 description: Service Username to be created when starting the service
75 description: Service Password to be created when starting the service
79 description: Service Project to be created when starting the service
83 description: User domain name (Hardcoded in the container start.sh script)
88 Project domain name (Hardcoded in the container start.sh script)
92 description: Token keys expiration in seconds
96 description: Boolean to enable/disable LDAP authentication
98 ldap_authentication_domain_name:
100 description: Name of the domain which use LDAP authentication
104 description: URL of the LDAP server
105 default: "ldap://localhost"
108 description: User to bind and search for users
112 description: Password to bind and search for users
114 ldap_chase_referrals:
117 Sets keystone’s referral chasing behavior across directory partitions.
118 If left unset, the system’s default behavior will be used.
123 Defines the maximum number of results per page that keystone should
124 request from the LDAP server when listing objects. A value of zero (0)
130 Root of the tree in LDAP server in which Keystone will search for users
132 ldap_user_objectclass:
135 LDAP object class that Keystone will filter on within user_tree_dn to
136 find user objects. Any objects of other classes will be ignored.
137 default: inetOrgPerson
138 ldap_user_id_attribute:
141 This set of options define the mapping to LDAP attributes for the three
142 key user attributes supported by Keystone. The LDAP attribute chosen for
143 user_id must be something that is immutable for a user and no more than
144 64 characters in length. Notice that Distinguished Name (DN) may be
145 longer than 64 characters and thus is not suitable. An uid, or mail may
148 ldap_user_name_attribute:
151 This set of options define the mapping to LDAP attributes for the three
152 key user attributes supported by Keystone. The LDAP attribute chosen for
153 user_id must be something that is immutable for a user and no more than
154 64 characters in length. Notice that Distinguished Name (DN) may be
155 longer than 64 characters and thus is not suitable. An uid, or mail may
158 ldap_user_pass_attribute:
161 This set of options define the mapping to LDAP attributes for the three
162 key user attributes supported by Keystone. The LDAP attribute chosen for
163 user_id must be something that is immutable for a user and no more than
164 64 characters in length. Notice that Distinguished Name (DN) may be
165 longer than 64 characters and thus is not suitable. An uid, or mail may
167 default: userPassword
171 This filter option allow additional filter (over and above
172 user_objectclass) to be included into the search of user. One common use
173 of this is to provide more efficient searching, where the recommended
174 search for user objects is (&(objectCategory=person)(objectClass=user)).
175 By specifying user_objectclass as user and user_filter as
176 objectCategory=person in the Keystone configuration file, this can be
179 ldap_user_enabled_attribute:
182 In Keystone, a user entity can be either enabled or disabled. Setting
183 the above option will give a mapping to an equivalent attribute in LDAP,
184 allowing your LDAP management tools to disable a user.
186 ldap_user_enabled_mask:
189 Some LDAP schemas, rather than having a dedicated attribute for user
190 enablement, use a bit within a general control attribute (such as
191 userAccountControl) to indicate this. Setting user_enabled_mask will
192 cause Keystone to look at only the status of this bit in the attribute
193 specified by user_enabled_attribute, with the bit set indicating the
196 ldap_user_enabled_default:
199 Most LDAP servers use a boolean or bit in a control field to indicate
200 enablement. However, some schemas might use an integer value in an
201 attribute. In this situation, set user_enabled_default to the integer
202 value that represents a user being enabled.
204 ldap_user_enabled_invert:
207 Some LDAP schemas have an “account locked” attribute, which is the
208 equivalent to account being “disabled.” In order to map this to the
209 Keystone enabled attribute, you can utilize the user_enabled_invert
210 setting in conjunction with user_enabled_attribute to map the lock
211 status to disabled in Keystone.
213 ldap_group_objectclass:
215 description: The LDAP object class to use for groups.
216 default: groupOfNames
219 description: The search base to use for groups.
224 Enable Transport Layer Security (TLS) for providing a secure connection
225 from Keystone to LDAP (StartTLS, not LDAPS).
227 ldap_tls_cacert_base64:
230 CA certificate in Base64 format (if you have the PEM file, text inside
231 "-----BEGIN CERTIFICATE-----"/"-----END CERTIFICATE-----" tags).
236 Defines how the certificates are checked for validity in the client
237 (i.e., Keystone end) of the secure connection (this doesn’t affect what
238 level of checking the server is doing on the certificates it receives
239 from Keystone). Possible values are "demand", "never", and "allow". The
240 default of demand means the client always checks the certificate and
241 will drop the connection if it is not provided or invalid. never is the
242 opposite—it never checks it, nor requires it to be provided. allow means
243 that if it is not provided then the connection is allowed to continue,
244 but if it is provided it will be checked—and if invalid, the connection