[Rdo-list] Glance Image list not working after Keystone SSL setup

Sun Apr 13 11:55:07 UTC 2014

Hi,

I have configured keystone to SSL and also update the endpoint in
service catalog. Keystone operations like endpoint/tenant list working
fine. I also update glance-api.conf and glance-registry.conf files
with ssl enabled keystone details but still glance is unable to find
images. It fails with following:

[root at openstack-centos65 glance(keystone_admin)]# glance --insecure image-list
Request returned failure status.
Invalid OpenStack Identity credentials.

Please see attached keystone.conf, glance-api.conf and
glance-registry.conf and debug output of glance image-list and
endpoint list.

Regards,
Devendra
-------------- next part --------------
+----------------------------------+-----------+---------------------------------------------------------+---------------------------------------------------------+--------------------------------------------------------+----------------------------------+
|                id                |   region  |                        publicurl                        |                       internalurl                       |                        adminurl                        |            service_id            |
+----------------------------------+-----------+---------------------------------------------------------+---------------------------------------------------------+--------------------------------------------------------+----------------------------------+
| 2ba1fc5b5fa040cba1fa99f3a0f16b31 | RegionOne |         http://openstack-centos65:8773/services/Cloud        |         http://openstack-centos65:8773/services/Cloud        |        http://openstack-centos65:8773/services/Admin        | 07acc02f8da44aabb6d74f8bfeb73110 |
| 34c308699eed49498dbb572624a89d78 | RegionOne |        http://openstack-centos65:8776/v1/%(tenant_id)s       |        http://openstack-centos65:8776/v1/%(tenant_id)s       |       http://openstack-centos65:8776/v1/%(tenant_id)s       | 58ddbeb7bfa241b8abf5d4b00fa60796 |
| 35383c51b83146cd9d5920e3b598812c | RegionOne |        http://openstack-centos65:8774/v2/%(tenant_id)s       |        http://openstack-centos65:8774/v2/%(tenant_id)s       |       http://openstack-centos65:8774/v2/%(tenant_id)s       | 5e3c505c2b684b80afe1d1f62963f48b |
| 4364a747f16549bb90f0820288ca62ea | RegionOne |        http://openstack-centos65:8776/v2/%(tenant_id)s       |        http://openstack-centos65:8776/v2/%(tenant_id)s       |       http://openstack-centos65:8776/v2/%(tenant_id)s       | ca4e340f3ac84871b47a7bf32f88ec47 |
| 7beb09e4b38a4a0cb115e2b28cff20d7 | RegionOne |                http://openstack-centos65:9292                |                http://openstack-centos65:9292                |               http://openstack-centos65:9292                | 8046b0a30eb5478b82d9f34560ab2848 |
| 8b3680803d034ccc9bd8994c214e5652 | RegionOne |                http://openstack-centos65:8777                |                http://openstack-centos65:8777                |               http://openstack-centos65:8777                | 2861404c9ff4467cadf617f3fa281256 |
| b0013f4bf78b4c31a078c48edc847025 | RegionOne |     http://openstack-centos65:8080/v1/AUTH_%(tenant_id)s     |     http://openstack-centos65:8080/v1/AUTH_%(tenant_id)s     |               http://openstack-centos65:8080/               | 4f9d0f3af6e64e1d9f7d6e18cc9d843c |
| c17ff619f0dd49eda15704dd137dce57 | RegionOne |                http://openstack-centos65:9696/               |                http://openstack-centos65:9696/               |               http://openstack-centos65:9696/               | 0a6a913e64364ea0888380d4011dace7 |
| d15b58c95b344d01bbaa4537618571f2 | RegionOne | https://openstack-centos65:$(public_port)s/v2.0 | https://openstack-centos65:$(public_port)s/v2.0 | https://openstack-centos65:$(admin_port)s/v2.0 | 9ab7d84f23094cb58a1614f2c99b38f2 |
| de343660051145b8996459691eabe64e | RegionOne |                http://openstack-centos65:8080                |                http://openstack-centos65:8080                |               http://openstack-centos65:8080                | c71f1a7cb5264938be8e2631622f7168 |
+----------------------------------+-----------+---------------------------------------------------------+---------------------------------------------------------+--------------------------------------------------------+----------------------------------+
-------------- next part --------------
[root at openstack-centos65 glance(keystone_admin)]# glance --insecure --debug image-list
curl -i -X GET -H 'X-Auth-Token: MIIPwQYJKoZIhvcNAQcCoIIPsjCCD64CAQExCTAHBgUrDgMCGjCCDo0GCSqGSIb3DQEHAaCCDn4Egg56eyJhY2Nlc3MiOiB7InRva2VuIjogeyJpc3N1ZWRfYXQiOiAiMjAxNC0wNC0xM1QxODo1MTozNi41NjMyNTkiLCAiZXhwaXJlcyI6ICIyMDE0LTA0LTE0VDE4OjUxOjM2WiIsICJpZCI6ICJwbGFjZWhvbGRlciIsICJ0ZW5hbnQiOiB7ImRlc2NyaXB0aW9uIjogImFkbWluIHRlbmFudCIsICJlbmFibGVkIjogdHJ1ZSwgImlkIjogImIzMjczMTNlYmU1ZDRiYTI5YTI2YmU0NjNlMTNhNGVjIiwgIm5hbWUiOiAiYWRtaW4ifX0sICJzZXJ2aWNlQ2F0YWxvZyI6IFt7ImVuZHBvaW50cyI6IFt7ImFkbWluVVJMIjogImh0dHA6Ly8xMC4xMjkuNTYuMjMwOjg3NzQvdjIvYjMyNzMxM2ViZTVkNGJhMjlhMjZiZTQ2M2UxM2E0ZWMiLCAicmVnaW9uIjogIlJlZ2lvbk9uZSIsICJpbnRlcm5hbFVSTCI6ICJodHRwOi8vMTAuMTI5LjU2LjIzMDo4Nzc0L3YyL2IzMjczMTNlYmU1ZDRiYTI5YTI2YmU0NjNlMTNhNGVjIiwgImlkIjogIjY3YjJhZWIxY2FiMjQ5Yjg5YzM2ZThkNjhjN2JhYTY3IiwgInB1YmxpY1VSTCI6ICJodHRwOi8vMTAuMTI5LjU2LjIzMDo4Nzc0L3YyL2IzMjczMTNlYmU1ZDRiYTI5YTI2YmU0NjNlMTNhNGVjIn1dLCAiZW5kcG9pbnRzX2xpbmtzIjogW10sICJ0eXBlIjogImNvbXB1dGUiLCAibmFtZSI6ICJub3ZhIn0sIHsiZW5kcG9pbnRzIjogW3siYWRtaW5VUkwiOiAiaHR0cDovLzEwLjEyOS41Ni4yMzA6OTY5Ni8iLCAicmVnaW9uIjogIlJlZ2lvbk9uZSIsICJpbnRlcm5hbFVSTCI6ICJodHRwOi8vMTAuMTI5LjU2LjIzMDo5Njk2LyIsICJpZCI6ICIwNWE2MWM2NDM2NGM0MmNmODhhYjJkYjJkYmIxY2RlNSIsICJwdWJsaWNVUkwiOiAiaHR0cDovLzEwLjEyOS41Ni4yMzA6OTY5Ni8ifV0sICJlbmRwb2ludHNfbGlua3MiOiBbXSwgInR5cGUiOiAibmV0d29yayIsICJuYW1lIjogIm5ldXRyb24ifSwgeyJlbmRwb2ludHMiOiBbeyJhZG1pblVSTCI6ICJodHRwOi8vMTAuMTI5LjU2LjIzMDo4Nzc2L3YyL2IzMjczMTNlYmU1ZDRiYTI5YTI2YmU0NjNlMTNhNGVjIiwgInJlZ2lvbiI6ICJSZWdpb25PbmUiLCAiaW50ZXJuYWxVUkwiOiAiaHR0cDovLzEwLjEyOS41Ni4yMzA6ODc3Ni92Mi9iMzI3MzEzZWJlNWQ0YmEyOWEyNmJlNDYzZTEzYTRlYyIsICJpZCI6ICI3Y2FkYzE1ZjlhMGQ0YjYyYWQyMDRiNmIwNTE3ZjMyMCIsICJwdWJsaWNVUkwiOiAiaHR0cDovLzEwLjEyOS41Ni4yMzA6ODc3Ni92Mi9iMzI3MzEzZWJlNWQ0YmEyOWEyNmJlNDYzZTEzYTRlYyJ9XSwgImVuZHBvaW50c19saW5rcyI6IFtdLCAidHlwZSI6ICJ2b2x1bWV2MiIsICJuYW1lIjogImNpbmRlcl92MiJ9LCB7ImVuZHBvaW50cyI6IFt7ImFkbWluVVJMIjogImh0dHA6Ly8xMC4xMjkuNTYuMjMwOjgwODAiLCAicmVnaW9uIjogIlJlZ2lvbk9uZSIsICJpbnRlcm5hbFVSTCI6ICJodHRwOi8vMTAuMTI5LjU2LjIzMDo4MDgwIiwgImlkIjogIjExOGJiYWQ3MTlhYjQyYWE4ZTYwZDg0NTMyYWFjZTA2IiwgInB1YmxpY1VSTCI6ICJodHRwOi8vMTAuMTI5LjU2LjIzMDo4MDgwIn1dLCAiZW5kcG9pbnRzX2xpbmtzIjogW10sICJ0eXBlIjogInMzIiwgIm5hbWUiOiAic3dpZnRfczMifSwgeyJlbmRwb2ludHMiOiBbeyJhZG1pblVSTCI6ICJodHRwOi8vMTAuMTI5LjU2LjIzMDo5MjkyIiwgInJlZ2lvbiI6ICJSZWdpb25PbmUiLCAiaW50ZXJuYWxVUkwiOiAiaHR0cDovLzEwLjEyOS41Ni4yMzA6OTI5MiIsICJpZCI6ICI0MTUzZDZlOGQ0NDE0MzM5YjU2Njk3MGRkN2U2YzI0YyIsICJwdWJsaWNVUkwiOiAiaHR0cDovLzEwLjEyOS41Ni4yMzA6OTI5MiJ9XSwgImVuZHBvaW50c19saW5rcyI6IFtdLCAidHlwZSI6ICJpbWFnZSIsICJuYW1lIjogImdsYW5jZSJ9LCB7ImVuZHBvaW50cyI6IFt7ImFkbWluVVJMIjogImh0dHA6Ly8xMC4xMjkuNTYuMjMwOjg3NzciLCAicmVnaW9uIjogIlJlZ2lvbk9uZSIsICJpbnRlcm5hbFVSTCI6ICJodHRwOi8vMTAuMTI5LjU2LjIzMDo4Nzc3IiwgImlkIjogIjRlNGJjZGJmNzZiOTQ1ZWY4MGRmMjIzMmZjZGFmNzFlIiwgInB1YmxpY1VSTCI6ICJodHRwOi8vMTAuMTI5LjU2LjIzMDo4Nzc3In1dLCAiZW5kcG9pbnRzX2xpbmtzIjogW10sICJ0eXBlIjogIm1ldGVyaW5nIiwgIm5hbWUiOiAiY2VpbG9tZXRlciJ9LCB7ImVuZHBvaW50cyI6IFt7ImFkbWluVVJMIjogImh0dHA6Ly8xMC4xMjkuNTYuMjMwOjg3NzYvdjEvYjMyNzMxM2ViZTVkNGJhMjlhMjZiZTQ2M2UxM2E0ZWMiLCAicmVnaW9uIjogIlJlZ2lvbk9uZSIsICJpbnRlcm5hbFVSTCI6ICJodHRwOi8vMTAuMTI5LjU2LjIzMDo4Nzc2L3YxL2IzMjczMTNlYmU1ZDRiYTI5YTI2YmU0NjNlMTNhNGVjIiwgImlkIjogIjRhZGQzMWIzM2M2MzRhMWU4ZDIwYTA3MzhjNmQ1ZjExIiwgInB1YmxpY1VSTCI6ICJodHRwOi8vMTAuMTI5LjU2LjIzMDo4Nzc2L3YxL2IzMjczMTNlYmU1ZDRiYTI5YTI2YmU0NjNlMTNhNGVjIn1dLCAiZW5kcG9pbnRzX2xpbmtzIjogW10sICJ0eXBlIjogInZvbHVtZSIsICJuYW1lIjogImNpbmRlciJ9LCB7ImVuZHBvaW50cyI6IFt7ImFkbWluVVJMIjogImh0dHA6Ly8xMC4xMjkuNTYuMjMwOjg3NzMvc2VydmljZXMvQWRtaW4iLCAicmVnaW9uIjogIlJlZ2lvbk9uZSIsICJpbnRlcm5hbFVSTCI6ICJodHRwOi8vMTAuMTI5LjU2LjIzMDo4NzczL3NlcnZpY2VzL0Nsb3VkIiwgImlkIjogIjc3YWE0NWM5MWY3MDQzYmNhOWFiYWE0NmM4MzYzODJjIiwgInB1YmxpY1VSTCI6ICJodHRwOi8vMTAuMTI5LjU2LjIzMDo4NzczL3NlcnZpY2VzL0Nsb3VkIn1dLCAiZW5kcG9pbnRzX2xpbmtzIjogW10sICJ0eXBlIjogImVjMiIsICJuYW1lIjogIm5vdmFfZWMyIn0sIHsiZW5kcG9pbnRzIjogW3siYWRtaW5VUkwiOiAiaHR0cDovLzEwLjEyOS41Ni4yMzA6ODA4MC8iLCAicmVnaW9uIjogIlJlZ2lvbk9uZSIsICJpbnRlcm5hbFVSTCI6ICJodHRwOi8vMTAuMTI5LjU2LjIzMDo4MDgwL3YxL0FVVEhfYjMyNzMxM2ViZTVkNGJhMjlhMjZiZTQ2M2UxM2E0ZWMiLCAiaWQiOiAiMjc5NWNjMTQzMTFjNGZmZThhZjE3OTI1OTY1Nzk1ZDYiLCAicHVibGljVVJMIjogImh0dHA6Ly8xMC4xMjkuNTYuMjMwOjgwODAvdjEvQVVUSF9iMzI3MzEzZWJlNWQ0YmEyOWEyNmJlNDYzZTEzYTRlYyJ9XSwgImVuZHBvaW50c19saW5rcyI6IFtdLCAidHlwZSI6ICJvYmplY3Qtc3RvcmUiLCAibmFtZSI6ICJzd2lmdCJ9LCB7ImVuZHBvaW50cyI6IFt7ImFkbWluVVJMIjogImh0dHBzOi8vb3BlbnN0YWNrLWNlbnRvczY1LmJtYy5jb206MzUzNTcvdjIuMCIsICJyZWdpb24iOiAiUmVnaW9uT25lIiwgImludGVybmFsVVJMIjogImh0dHBzOi8vb3BlbnN0YWNrLWNlbnRvczY1LmJtYy5jb206NTAwMC92Mi4wIiwgImlkIjogIjU0YmMzYjRjNzM2ODQ3NDk4M2IxZTcyYTc0ZDIwYWIzIiwgInB1YmxpY1VSTCI6ICJodHRwczovL29wZW5zdGFjay1jZW50b3M2NS5ibWMuY29tOjUwMDAvdjIuMCJ9XSwgImVuZHBvaW50c19saW5rcyI6IFtdLCAidHlwZSI6ICJpZGVudGl0eSIsICJuYW1lIjogImtleXN0b25lIn1dLCAidXNlciI6IHsidXNlcm5hbWUiOiAiYWRtaW4iLCAicm9sZXNfbGlua3MiOiBbXSwgImlkIjogIjVlZGYyNWY1YTI5YTQ3NGViZTE2ODBiMmFiOGY4MTk1IiwgInJvbGVzIjogW3sibmFtZSI6ICJhZG1pbiJ9XSwgIm5hbWUiOiAiYWRtaW4ifSwgIm1ldGFkYXRhIjogeyJpc19hZG1pbiI6IDAsICJyb2xlcyI6IFsiYzM4ZWE0NDdlMmM4NDFiMmEzZDk4ZjI5NDU5YzQ5NzYiXX19fTGCAQswggEHAgEBMGcwYjELMAkGA1UEBhMCVVMxDjAMBgNVBAgMBVVuc2V0MQ4wDAYDVQQHDAVVbnNldDEOMAwGA1UECgwFVW5zZXQxIzAhBgNVBAMMGm9wZW5zdGFjay1jZW50b3M2NS5ibWMuY29tAgEBMAcGBSsOAwIaMA0GCSqGSIb3DQEBAQUABIGAf62TPWxtBj3BDkliPtWmz-r+Z7TPDKSbT9GUAFO27xwa68WxtgbQbVC8xpNcvOg8gNQhWvgV20L-oDDEUHhxcHCP-qqO8LdD+5YbzOwn8rlS0CAaUFoElA-ZDW1EVMpaXWII7YFFm+6VlSMKmVh0rEr7RT70EVHUeoAD+aVwtrA=' -H 'Content-Type: application/json' -H 'User-Agent: python-glanceclient' http://openstack-centos65:9292/v1/images/detail?sort_key=name&sort_dir=asc&limit=20

HTTP/1.1 401 Unauthorized
date: Sun, 13 Apr 2014 18:51:40 GMT
content-length: 253
content-type: text/plain; charset=UTF-8

401 Unauthorized

This server could not verify that you are authorized to access the document you requested. Either you supplied the wrong credentials (e.g., bad password), or your browser does not understand how to supply the credentials required.

Request returned failure status.
Invalid OpenStack Identity credentials.
[root at openstack-centos65 glance(keystone_admin)]# glance --insecure image-list
Request returned failure status.
Invalid OpenStack Identity credentials.
-------------- next part --------------
[DEFAULT]
# Show more verbose log output (sets INFO log level output)
#verbose=True
verbose=True

# Show debugging output in logs (sets DEBUG log level output)
#debug=False
debug=False

# Which backend scheme should Glance use by default is not specified
# in a request to add a new image to Glance? Known schemes are determined
# by the known_stores option below.
# Default: 'file'
default_store = file

# List of which store classes and store class locations are
# currently known to glance at startup.
#known_stores = glance.store.filesystem.Store,
#               glance.store.http.Store,
#               glance.store.rbd.Store,
#               glance.store.s3.Store,
#               glance.store.swift.Store,
#               glance.store.sheepdog.Store,
#               glance.store.cinder.Store,

# Maximum image size (in bytes) that may be uploaded through the
# Glance API server. Defaults to 1 TB.
# WARNING: this value should only be increased after careful consideration
# and must be set to a value under 8 EB (9223372036854775808).
#image_size_cap = 1099511627776

# Address to bind the API server
bind_host = 0.0.0.0

# Port the bind the API server to
bind_port = 9292

# Log to this file. Make sure you do not set the same log
# file for both the API and registry servers!
#log_file=/var/log/glance/api.log
log_file=/var/log/glance/api.log

# Backlog requests when creating socket
backlog = 4096

# TCP_KEEPIDLE value in seconds when creating socket.
# Not supported on OS X.
#tcp_keepidle = 600

# API to use for accessing data. Default value points to sqlalchemy
# package, it is also possible to use: glance.db.registry.api
# data_api = glance.db.sqlalchemy.api

# SQLAlchemy connection string for the reference implementation
# registry server. Any valid SQLAlchemy connection string is fine.
# See: http://www.sqlalchemy.org/docs/05/reference/sqlalchemy/connections.html#sqlalchemy.create_engine
#sql_connection=mysql://glance:glance@localhost/glance
sql_connection=mysql://glance:5266553a114e4208@openstack-centos65/glance

# Period in seconds after which SQLAlchemy should reestablish its connection
# to the database.
#
# MySQL uses a default `wait_timeout` of 8 hours, after which it will drop
# idle connections. This can result in 'MySQL Gone Away' exceptions. If you
# notice this, you can lower this value to ensure that SQLAlchemy reconnects
# before MySQL can drop the connection.
sql_idle_timeout = 3600

# Number of Glance API worker processes to start.
# On machines with more than one CPU increasing this value
# may improve performance (especially if using SSL with
# compression turned on). It is typically recommended to set
# this value to the number of CPUs present on your machine.
workers = 4

# Role used to identify an authenticated user as administrator
#admin_role = admin

# Allow unauthenticated users to access the API with read-only
# privileges. This only applies when using ContextMiddleware.
#allow_anonymous_access = False

# Allow access to version 1 of glance api
#enable_v1_api = True

# Allow access to version 2 of glance api
#enable_v2_api = True

# Return the URL that references where the data is stored on
# the backend storage system.  For example, if using the
# file system store a URL of 'file:///path/to/image' will
# be returned to the user in the 'direct_url' meta-data field.
# The default value is false.
#show_image_direct_url = False

# Send headers containing user and tenant information when making requests to
# the v1 glance registry. This allows the registry to function as if a user is
# authenticated without the need to authenticate a user itself using the
# auth_token middleware.
# The default value is false.
#send_identity_headers = False

# Supported values for the 'container_format' image attribute
#container_formats=ami,ari,aki,bare,ovf

# Supported values for the 'disk_format' image attribute
#disk_formats=ami,ari,aki,vhd,vmdk,raw,qcow2,vdi,iso

# Directory to use for lock files. Default to a temp directory
# (string value). This setting needs to be the same for both
# glance-scrubber and glance-api.
#lock_path=<None>
#
# Property Protections config file
# This file contains the rules for property protections and the roles
# associated with it.
# If this config value is not specified, by default, property protections
# won't be enforced.
# If a value is specified and the file is not found, then an
# HTTPInternalServerError will be thrown.
#property_protection_file =

# Set a system wide quota for every user.  This value is the total number
# of bytes that a user can use across all storage systems.  A value of
# 0 means unlimited.
#user_storage_quota = 0

# ================= Syslog Options ============================

# Send logs to syslog (/dev/log) instead of to file specified
# by `log_file`
#use_syslog = False
use_syslog = False

# Facility to use. If unset defaults to LOG_USER.
#syslog_log_facility = LOG_LOCAL0

# ================= SSL Options ===============================

# Certificate file to use when starting API server securely
#cert_file = /path/to/certfile

# Private key file to use when starting API server securely
#key_file = /path/to/keyfile

# CA certificate file to use to verify connecting clients
#ca_file = /path/to/cafile

# ================= Security Options ==========================

# AES key for encrypting store 'location' metadata, including
# -- if used -- Swift or S3 credentials
# Should be set to a random string of length 16, 24 or 32 bytes
#metadata_encryption_key = <16, 24 or 32 char registry metadata key>

# ============ Registry Options ===============================

# Address to find the registry server
registry_host = 0.0.0.0

# Port the registry server is listening on
registry_port = 9191

# What protocol to use when connecting to the registry server?
# Set to https for secure HTTP communication
registry_client_protocol = http

# The path to the key file to use in SSL connections to the
# registry server, if any. Alternately, you may set the
# GLANCE_CLIENT_KEY_FILE environ variable to a filepath of the key file
#registry_client_key_file = /path/to/key/file

# The path to the cert file to use in SSL connections to the
# registry server, if any. Alternately, you may set the
# GLANCE_CLIENT_CERT_FILE environ variable to a filepath of the cert file
#registry_client_cert_file = /path/to/cert/file

# The path to the certifying authority cert file to use in SSL connections
# to the registry server, if any. Alternately, you may set the
# GLANCE_CLIENT_CA_FILE environ variable to a filepath of the CA cert file
#registry_client_ca_file = /path/to/ca/file

# When using SSL in connections to the registry server, do not require
# validation via a certifying authority. This is the registry's equivalent of
# specifying --insecure on the command line using glanceclient for the API
# Default: False
#registry_client_insecure = False

# The period of time, in seconds, that the API server will wait for a registry
# request to complete. A value of '0' implies no timeout.
# Default: 600
#registry_client_timeout = 600

# Whether to automatically create the database tables.
# Default: False
#db_auto_create = False

# Enable DEBUG log messages from sqlalchemy which prints every database
# query and response.
# Default: False
#sqlalchemy_debug = True

# ============ Notification System Options =====================

# Notifications can be sent when images are create, updated or deleted.
# There are three methods of sending notifications, logging (via the
# log_file directive), rabbit (via a rabbitmq queue), qpid (via a Qpid
# message queue), or noop (no notifications sent, the default)
#notifier_strategy=qpid
notifier_strategy=qpid

# Configuration options if sending notifications via rabbitmq (these are
# the defaults)
rabbit_host = localhost
rabbit_port = 5672
rabbit_use_ssl = false
rabbit_userid = guest
rabbit_password = guest
rabbit_virtual_host = /
rabbit_notification_exchange = glance
rabbit_notification_topic = notifications
rabbit_durable_queues = False

# Configuration options if sending notifications via Qpid (these are
# the defaults)
qpid_notification_exchange = glance
qpid_notification_topic = notifications
qpid_hostname = openstack-centos65
qpid_port = 5672
qpid_username =guest
qpid_password =guest
qpid_sasl_mechanisms =
qpid_reconnect_timeout = 0
qpid_reconnect_limit = 0
qpid_reconnect_interval_min = 0
qpid_reconnect_interval_max = 0
qpid_reconnect_interval = 0
#qpid_heartbeat=60
# Set to 'ssl' to enable SSL
qpid_protocol = tcp
qpid_tcp_nodelay = True

# ============ Filesystem Store Options ========================

# Directory that the Filesystem backend store
# writes image data to
#filesystem_store_datadir=/var/lib/glance/images/
filesystem_store_datadir=/var/lib/glance/images/

# A path to a JSON file that contains metadata describing the storage
# system.  When show_multiple_locations is True the information in this
# file will be returned with any location that is contained in this
# store.
#filesystem_store_metadata_file = None

# ============ Swift Store Options =============================

# Version of the authentication service to use
# Valid versions are '2' for keystone and '1' for swauth and rackspace
swift_store_auth_version = 2

# Address where the Swift authentication service lives
# Valid schemes are 'http://' and 'https://'
# If no scheme specified,  default to 'https://'
# For swauth, use something like '127.0.0.1:8080/v1.0/'
swift_store_auth_address = 127.0.0.1:5000/v2.0/

# User to authenticate against the Swift authentication service
# If you use Swift authentication service, set it to 'account':'user'
# where 'account' is a Swift storage account and 'user'
# is a user in that account
swift_store_user = jdoe:jdoe

# Auth key for the user authenticating against the
# Swift authentication service
swift_store_key = a86850deb2742ec3cb41518e26aa2d89

# Container within the account that the account should use
# for storing images in Swift
swift_store_container = glance

# Do we create the container if it does not exist?
swift_store_create_container_on_put = False

# What size, in MB, should Glance start chunking image files
# and do a large object manifest in Swift? By default, this is
# the maximum object size in Swift, which is 5GB
swift_store_large_object_size = 5120

# When doing a large object manifest, what size, in MB, should
# Glance write chunks to Swift? This amount of data is written
# to a temporary disk buffer during the process of chunking
# the image file, and the default is 200MB
swift_store_large_object_chunk_size = 200

# Whether to use ServiceNET to communicate with the Swift storage servers.
# (If you aren't RACKSPACE, leave this False!)
#
# To use ServiceNET for authentication, prefix hostname of
# `swift_store_auth_address` with 'snet-'.
# Ex. https://example.com/v1.0/ -> https://snet-example.com/v1.0/
swift_enable_snet = False

# If set to True enables multi-tenant storage mode which causes Glance images
# to be stored in tenant specific Swift accounts.
#swift_store_multi_tenant = False

# A list of swift ACL strings that will be applied as both read and
# write ACLs to the containers created by Glance in multi-tenant
# mode. This grants the specified tenants/users read and write access
# to all newly created image objects. The standard swift ACL string
# formats are allowed, including:
# <tenant_id>:<username>
# <tenant_name>:<username>
# *:<username>
# Multiple ACLs can be combined using a comma separated list, for
# example: swift_store_admin_tenants = service:glance,*:admin
#swift_store_admin_tenants =

# The region of the swift endpoint to be used for single tenant. This setting
# is only necessary if the tenant has multiple swift endpoints.
#swift_store_region =

# If set to False, disables SSL layer compression of https swift requests.
# Setting to 'False' may improve performance for images which are already
# in a compressed format, eg qcow2. If set to True, enables SSL layer
# compression (provided it is supported by the target swift proxy).
#swift_store_ssl_compression = True

# ============ S3 Store Options =============================

# Address where the S3 authentication service lives
# Valid schemes are 'http://' and 'https://'
# If no scheme specified,  default to 'http://'
s3_store_host = 127.0.0.1:8080/v1.0/

# User to authenticate against the S3 authentication service
s3_store_access_key = <20-char AWS access key>

# Auth key for the user authenticating against the
# S3 authentication service
s3_store_secret_key = <40-char AWS secret key>

# Container within the account that the account should use
# for storing images in S3. Note that S3 has a flat namespace,
# so you need a unique bucket name for your glance images. An
# easy way to do this is append your AWS access key to "glance".
# S3 buckets in AWS *must* be lowercased, so remember to lowercase
# your AWS access key if you use it in your bucket name below!
s3_store_bucket = <lowercased 20-char aws access key>glance

# Do we create the bucket if it does not exist?
s3_store_create_bucket_on_put = False

# When sending images to S3, the data will first be written to a
# temporary buffer on disk. By default the platform's temporary directory
# will be used. If required, an alternative directory can be specified here.
#s3_store_object_buffer_dir = /path/to/dir

# When forming a bucket url, boto will either set the bucket name as the
# subdomain or as the first token of the path. Amazon's S3 service will
# accept it as the subdomain, but Swift's S3 middleware requires it be
# in the path. Set this to 'path' or 'subdomain' - defaults to 'subdomain'.
#s3_store_bucket_url_format = subdomain

# ============ RBD Store Options =============================

# Ceph configuration file path
# If using cephx authentication, this file should
# include a reference to the right keyring
# in a client.<USER> section
rbd_store_ceph_conf = /etc/ceph/ceph.conf

# RADOS user to authenticate as (only applicable if using cephx)
rbd_store_user = glance

# RADOS pool in which images are stored
rbd_store_pool = images

# Images will be chunked into objects of this size (in megabytes).
# For best performance, this should be a power of two
rbd_store_chunk_size = 8

# ============ Sheepdog Store Options =============================

sheepdog_store_address = localhost

sheepdog_store_port = 7000

# Images will be chunked into objects of this size (in megabytes).
# For best performance, this should be a power of two
sheepdog_store_chunk_size = 64

# ============ Cinder Store Options ===============================

# Info to match when looking for cinder in the service catalog
# Format is : separated values of the form:
# <service_type>:<service_name>:<endpoint_type> (string value)
#cinder_catalog_info = volume:cinder:publicURL

# Override service catalog lookup with template for cinder endpoint
# e.g. http://localhost:8776/v1/%(project_id)s (string value)
#cinder_endpoint_template = <None>

# Region name of this node (string value)
#os_region_name = <None>

# Location of ca certicates file to use for cinder client requests
# (string value)
#cinder_ca_certificates_file = <None>

# Number of cinderclient retries on failed http calls (integer value)
#cinder_http_retries = 3

# Allow to perform insecure SSL requests to cinder (boolean value)
#cinder_api_insecure = False

# ============ Delayed Delete Options =============================

# Turn on/off delayed delete
delayed_delete = False

# Delayed delete time in seconds
scrub_time = 43200

# Directory that the scrubber will use to remind itself of what to delete
# Make sure this is also set in glance-scrubber.conf
#scrubber_datadir=/var/lib/glance/scrubber

# =============== Image Cache Options =============================

# Base directory that the Image Cache uses
#image_cache_dir=/var/lib/glance/image-cache/

[keystone_authtoken]
#auth_host=127.0.0.1
#auth_host=openstack-centos65
auth_host=openstack-centos65
#auth_port=35357
auth_port=35357
#auth_protocol=http
auth_protocol=https
#admin_tenant_name=%SERVICE_TENANT_NAME%
admin_tenant_name=services
#admin_user=%SERVICE_USER%
admin_user=glance
#admin_password=%SERVICE_PASSWORD%
admin_password=9910fdcb05c4439a
#auth_uri=http://openstack-centos65:5000/
auth_uri=https://openstack-centos65:5000/

[paste_deploy]
# Name of the paste configuration file that defines the available pipelines
#config_file=/usr/share/glance/glance-api-dist-paste.ini

# Partial name of a pipeline in your paste configuration file with the
# service name removed. For example, if your paste section name is
# [pipeline:glance-api-keystone], you would configure the flavor below
# as 'keystone'.
#flavor=
flavor=keystone
-------------- next part --------------
[DEFAULT]
# Show more verbose log output (sets INFO log level output)
#verbose=True
verbose=True

# Show debugging output in logs (sets DEBUG log level output)
#debug=False
debug=False

# Address to bind the registry server
bind_host = 0.0.0.0

# Port the bind the registry server to
bind_port = 9191

# Log to this file. Make sure you do not set the same log
# file for both the API and registry servers!
#log_file=/var/log/glance/registry.log

# Backlog requests when creating socket
backlog = 4096

# TCP_KEEPIDLE value in seconds when creating socket.
# Not supported on OS X.
#tcp_keepidle = 600

# API to use for accessing data. Default value points to sqlalchemy
# package.
# data_api = glance.db.sqlalchemy.api

# SQLAlchemy connection string for the reference implementation
# registry server. Any valid SQLAlchemy connection string is fine.
# See: http://www.sqlalchemy.org/docs/05/reference/sqlalchemy/connections.html#sqlalchemy.create_engine
#sql_connection=mysql://glance:glance@localhost/glance
sql_connection=mysql://glance:5266553a114e4208@openstack-centos65/glance

# Period in seconds after which SQLAlchemy should reestablish its connection
# to the database.
#
# MySQL uses a default `wait_timeout` of 8 hours, after which it will drop
# idle connections. This can result in 'MySQL Gone Away' exceptions. If you
# notice this, you can lower this value to ensure that SQLAlchemy reconnects
# before MySQL can drop the connection.
sql_idle_timeout = 3600

# Limit the api to return `param_limit_max` items in a call to a container. If
# a larger `limit` query param is provided, it will be reduced to this value.
api_limit_max = 1000

# If a `limit` query param is not provided in an api request, it will
# default to `limit_param_default`
limit_param_default = 25

# Role used to identify an authenticated user as administrator
#admin_role = admin

# Whether to automatically create the database tables.
# Default: False
#db_auto_create = False

# Enable DEBUG log messages from sqlalchemy which prints every database
# query and response.
# Default: False
#sqlalchemy_debug = True

# ================= Syslog Options ============================

# Send logs to syslog (/dev/log) instead of to file specified
# by `log_file`
#use_syslog = False
use_syslog = False

# Facility to use. If unset defaults to LOG_USER.
#syslog_log_facility = LOG_LOCAL1

# ================= SSL Options ===============================

# Certificate file to use when starting registry server securely
#cert_file = /path/to/certfile

# Private key file to use when starting registry server securely
#key_file = /path/to/keyfile

# CA certificate file to use to verify connecting clients
#ca_file = /path/to/cafile

[keystone_authtoken]
#auth_host=127.0.0.1
auth_host=openstack-centos65
#auth_port=35357
auth_port=35357
#auth_protocol=http
auth_protocol=https
#admin_tenant_name=%SERVICE_TENANT_NAME%
admin_tenant_name=services
#admin_user=%SERVICE_USER%
admin_user=glance
#admin_password=%SERVICE_PASSWORD%
admin_password=9910fdcb05c4439a
auth_uri=https://openstack-centos65:5000/

[paste_deploy]
# Name of the paste configuration file that defines the available pipelines
#config_file=/usr/share/glance/glance-registry-dist-paste.ini

# Partial name of a pipeline in your paste configuration file with the
# service name removed. For example, if your paste section name is
# [pipeline:glance-registry-keystone], you would configure the flavor below
# as 'keystone'.
#flavor=
flavor=keystone
-------------- next part --------------
f[DEFAULT]
# A "shared secret" between keystone and other openstack services
# admin_token = ADMIN
admin_token = 768b64d7641f49b3b3f98fb0d60dc1bc

# The IP address of the network interface to listen on
# bind_host = 0.0.0.0
bind_host = 0.0.0.0

# The port number which the public service listens on
# public_port = 5000
public_port = 5000

# The port number which the public admin listens on
# admin_port = 35357
admin_port = 35357

# The base endpoint URLs for keystone that are advertised to clients
# (NOTE: this does NOT affect how keystone listens for connections)
# public_endpoint = http://localhost:%(public_port)s/
# admin_endpoint = http://localhost:%(admin_port)s/

# The port number which the OpenStack Compute service listens on
# compute_port = 8774
compute_port = 8774

# Path to your policy definition containing identity actions
# policy_file = policy.json

# Rule to check if no matching policy definition is found
# FIXME(dolph): This should really be defined as [policy] default_rule
# policy_default_rule = admin_required

# Role for migrating membership relationships
# During a SQL upgrade, the following values will be used to create a new role
# that will replace records in the user_tenant_membership table with explicit
# role grants.  After migration, the member_role_id will be used in the API
# add_user_to_project, and member_role_name will be ignored.
# member_role_id = 9fe2ff9ee4384b1894a90878d3e92bab
# member_role_name = _member_

# enforced by optional sizelimit middleware (keystone.middleware:RequestBodySizeLimiter)
# max_request_body_size = 114688

# limit the sizes of user & tenant ID/names
# max_param_size = 64

# similar to max_param_size, but provides an exception for token values
# max_token_size = 8192

# === Logging Options ===
# Print debugging output
# (includes plaintext request logging, potentially including passwords)
# debug = False
debug = False

# Print more verbose output
# verbose = False
verbose = True

# Name of log file to output to. If not set, logging will go to stdout.
# log_file = /var/log/keystone/keystone.log

# The directory to keep log files in (will be prepended to --logfile)
# log_dir = /var/log/keystone
log_dir = /var/log/keystone

# Use syslog for logging.
# use_syslog = False
use_syslog = False

# syslog facility to receive log lines
# syslog_log_facility = LOG_USER

# If this option is specified, the logging configuration file specified is
# used and overrides any other logging options specified. Please see the
# Python logging module documentation for details on logging configuration
# files.
# log_config = logging.conf

# A logging.Formatter log message format string which may use any of the
# available logging.LogRecord attributes.
# log_format = %(asctime)s %(levelname)8s [%(name)s] %(message)s

# Format string for %(asctime)s in log records.
# log_date_format = %Y-%m-%d %H:%M:%S

# onready allows you to send a notification when the process is ready to serve
# For example, to have it notify using systemd, one could set shell command:
# onready = systemd-notify --ready
# or a module with notify() method:
# onready = keystone.common.systemd

# === Notification Options ===

# Notifications can be sent when users or projects are created, updated or
# deleted. There are three methods of sending notifications: logging (via the
# log_file directive), rpc (via a message queue) and no_op (no notifications
# sent, the default)

# notification_driver can be defined multiple times
# Do nothing driver (the default)
# notification_driver = keystone.openstack.common.notifier.no_op_notifier
# Logging driver example (not enabled by default)
# notification_driver = keystone.openstack.common.notifier.log_notifier
# RPC driver example (not enabled by default)
# notification_driver = keystone.openstack.common.notifier.rpc_notifier

# Default notification level for outgoing notifications
# default_notification_level = INFO

# Default publisher_id for outgoing notifications; included in the payload.
# default_publisher_id =

# AMQP topics to publish to when using the RPC notification driver.
# Multiple values can be specified by separating with commas.
# The actual topic names will be %s.%(default_notification_level)s
# notification_topics = notifications

# === RPC Options ===

# For Keystone, these options apply only when the RPC notification driver is
# used.

# The messaging module to use, defaults to kombu.
# rpc_backend = keystone.openstack.common.rpc.impl_kombu

# Size of RPC thread pool
# rpc_thread_pool_size = 64

# Size of RPC connection pool
# rpc_conn_pool_size = 30

# Seconds to wait for a response from call or multicall
# rpc_response_timeout = 60

# Seconds to wait before a cast expires (TTL). Only supported by impl_zmq.
# rpc_cast_timeout = 30

# Modules of exceptions that are permitted to be recreated upon receiving
# exception data from an rpc call.
# allowed_rpc_exception_modules = keystone.openstack.common.exception,nova.exception,cinder.exception,exceptions

# If True, use a fake RabbitMQ provider
# fake_rabbit = False

# AMQP exchange to connect to if using RabbitMQ or Qpid
# control_exchange = openstack

[sql]
# The SQLAlchemy connection string used to connect to the database
# connection = mysql://keystone:keystone@localhost/keystone
connection = mysql://keystone_admin:1817719f79c54395@openstack-centos65/keystone

# the timeout before idle sql connections are reaped
# idle_timeout = 200
idle_timeout = 200

[identity]
# driver = keystone.identity.backends.sql.Identity

# This references the domain to use for all Identity API v2 requests (which are
# not aware of domains). A domain with this ID will be created for you by
# keystone-manage db_sync in migration 008.  The domain referenced by this ID
# cannot be deleted on the v3 API, to prevent accidentally breaking the v2 API.
# There is nothing special about this domain, other than the fact that it must
# exist to order to maintain support for your v2 clients.
# default_domain_id = default
#
# A subset (or all) of domains can have their own identity driver, each with
# their own partial configuration file in a domain configuration directory.
# Only values specific to the domain need to be placed in the domain specific
# configuration file. This feature is disabled by default; set
# domain_specific_drivers_enabled to True to enable.
# domain_specific_drivers_enabled = False
# domain_config_dir = /etc/keystone/domains

# Maximum supported length for user passwords; decrease to improve performance.
# max_password_length = 4096

[credential]
# driver = keystone.credential.backends.sql.Credential

[trust]
# driver = keystone.trust.backends.sql.Trust

# delegation and impersonation features can be optionally disabled
# enabled = True

[os_inherit]
# role-assignment inheritance to projects from owning domain can be
# optionally enabled
# enabled = False

[catalog]
# dynamic, sql-based backend (supports API/CLI-based management commands)
# driver = keystone.catalog.backends.sql.Catalog
driver = keystone.catalog.backends.sql.Catalog

# static, file-based backend (does *NOT* support any management commands)
# driver = keystone.catalog.backends.templated.TemplatedCatalog

# template_file = /etc/keystone/default_catalog.templates

[endpoint_filter]
# extension for creating associations between project and endpoints in order to
# provide a tailored catalog for project-scoped token requests.
# driver = keystone.contrib.endpoint_filter.backends.sql.EndpointFilter
# return_all_endpoints_if_no_filter = True

[token]
# Provides token persistence.
# driver = keystone.token.backends.sql.Token
driver = keystone.token.backends.sql.Token

# Controls the token construction, validation, and revocation operations.
# Core providers are keystone.token.providers.[pki|uuid].Provider
# provider =
provider =keystone.token.providers.pki.Provider

# Amount of time a token should remain valid (in seconds)
# expiration = 86400
expiration = 86400

# External auth mechanisms that should add bind information to token.
# eg kerberos, x509
# bind =

# Enforcement policy on tokens presented to keystone with bind information.
# One of disabled, permissive, strict, required or a specifically required bind
# mode e.g. kerberos or x509 to require binding to that authentication.
# enforce_token_bind = permissive

# Token specific caching toggle. This has no effect unless the global caching
# option is set to True
# caching = True

# Token specific cache time-to-live (TTL) in seconds.
# cache_time =

# Revocation-List specific cache time-to-live (TTL) in seconds.
# revocation_cache_time = 3600

[cache]
# Global cache functionality toggle.
# enabled = False

# Prefix for building the configuration dictionary for the cache region. This
# should not need to be changed unless there is another dogpile.cache region
# with the same configuration name
# config_prefix = cache.keystone

# Default TTL, in seconds, for any cached item in the dogpile.cache region.
# This applies to any cached method that doesn't have an explicit cache
# expiration time defined for it.
# expiration_time = 600

# Dogpile.cache backend module. It is recommended that Memcache
# (dogpile.cache.memcache) or Redis (dogpile.cache.redis) be used in production
# deployments.  Small workloads (single process) like devstack can use the
# dogpile.cache.memory backend.
# backend = keystone.common.cache.noop

# Arguments supplied to the backend module. Specify this option once per
# argument to be passed to the dogpile.cache backend.
# Example format: <argname>:<value>
# backend_argument =

# Proxy Classes to import that will affect the way the dogpile.cache backend
# functions.  See the dogpile.cache documentation on changing-backend-behavior.
# Comma delimited list e.g. my.dogpile.proxy.Class, my.dogpile.proxyClass2
# proxies =

# Use a key-mangling function (sha1) to ensure fixed length cache-keys. This
# is toggle-able for debugging purposes, it is highly recommended to always
# leave this set to True.
# use_key_mangler = True

# Extra debugging from the cache backend (cache keys, get/set/delete/etc calls)
# This is only really useful if you need to see the specific cache-backend
# get/set/delete calls with the keys/values.  Typically this should be left
# set to False.
# debug_cache_backend = False

[policy]
# driver = keystone.policy.backends.sql.Policy

[ec2]
# driver = keystone.contrib.ec2.backends.sql.Ec2

[assignment]
# driver =

# Assignment specific caching toggle. This has no effect unless the global
# caching option is set to True
# caching = True

# Assignment specific cache time-to-live (TTL) in seconds.
# cache_time =

[oauth1]
# driver = keystone.contrib.oauth1.backends.sql.OAuth1

# The Identity service may include expire attributes.
# If no such attribute is included, then the token lasts indefinitely.
# Specify how quickly the request token will expire (in seconds)
# request_token_duration = 28800
# Specify how quickly the access token will expire (in seconds)
# access_token_duration = 86400

[ssl]
enable = True
certfile = /etc/keystone/ssl/certs/signing_cert.pem
keyfile = /etc/keystone/ssl/private/signing_key.pem
ca_certs = /etc/keystone/ssl/certs/ca.pem
ca_key = /etc/keystone/ssl/certs/cakey.pem
key_size = 1024
valid_days = 3650
cert_required = False
cert_subject = /C=US/ST=Unset/L=Unset/O=Unset/CN=openstack-centos65

[signing]
# Deprecated in favor of provider in the [token] section
# Allowed values are PKI or UUID
#token_format = PKI

#certfile = /etc/keystone/pki/certs/signing_cert.pem
#keyfile = /etc/keystone/pki/private/signing_key.pem
#ca_certs = /etc/keystone/pki/certs/cacert.pem
#ca_key = /etc/keystone/pki/private/cakey.pem
#key_size = 2048
#valid_days = 3650
#cert_subject = /C=US/ST=Unset/L=Unset/O=Unset/CN=www.example.com

[ldap]
# url = ldap://localhost
# user = dc=Manager,dc=example,dc=com
# password = None
# suffix = cn=example,cn=com
# use_dumb_member = False
# allow_subtree_delete = False
# dumb_member = cn=dumb,dc=example,dc=com

# Maximum results per page; a value of zero ('0') disables paging (default)
# page_size = 0

# The LDAP dereferencing option for queries. This can be either 'never',
# 'searching', 'always', 'finding' or 'default'. The 'default' option falls
# back to using default dereferencing configured by your ldap.conf.
# alias_dereferencing = default

# The LDAP scope for queries, this can be either 'one'
# (onelevel/singleLevel) or 'sub' (subtree/wholeSubtree)
# query_scope = one

# user_tree_dn = ou=Users,dc=example,dc=com
# user_filter =
# user_objectclass = inetOrgPerson
# user_id_attribute = cn
# user_name_attribute = sn
# user_mail_attribute = email
# user_pass_attribute = userPassword
# user_enabled_attribute = enabled
# user_enabled_mask = 0
# user_enabled_default = True
# user_attribute_ignore = default_project_id,tenants
# user_default_project_id_attribute =
# user_allow_create = True
# user_allow_update = True
# user_allow_delete = True
# user_enabled_emulation = False
# user_enabled_emulation_dn =

# tenant_tree_dn = ou=Projects,dc=example,dc=com
# tenant_filter =
# tenant_objectclass = groupOfNames
# tenant_domain_id_attribute = businessCategory
# tenant_id_attribute = cn
# tenant_member_attribute = member
# tenant_name_attribute = ou
# tenant_desc_attribute = desc
# tenant_enabled_attribute = enabled
# tenant_attribute_ignore =
# tenant_allow_create = True
# tenant_allow_update = True
# tenant_allow_delete = True
# tenant_enabled_emulation = False
# tenant_enabled_emulation_dn =

# role_tree_dn = ou=Roles,dc=example,dc=com
# role_filter =
# role_objectclass = organizationalRole
# role_id_attribute = cn
# role_name_attribute = ou
# role_member_attribute = roleOccupant
# role_attribute_ignore =
# role_allow_create = True
# role_allow_update = True
# role_allow_delete = True

# group_tree_dn =
# group_filter =
# group_objectclass = groupOfNames
# group_id_attribute = cn
# group_name_attribute = ou
# group_member_attribute = member
# group_desc_attribute = desc
# group_attribute_ignore =
# group_allow_create = True
# group_allow_update = True
# group_allow_delete = True

# ldap TLS options
# if both tls_cacertfile and tls_cacertdir are set then
# tls_cacertfile will be used and tls_cacertdir is ignored
# valid options for tls_req_cert are demand, never, and allow
# use_tls = False
# tls_cacertfile =
# tls_cacertdir =
# tls_req_cert = demand

# Additional attribute mappings can be used to map ldap attributes to internal
# keystone attributes. This allows keystone to fulfill ldap objectclass
# requirements. An example to map the description and gecos attributes to a
# user's name would be:
# user_additional_attribute_mapping = description:name, gecos:name
#
# domain_additional_attribute_mapping =
# group_additional_attribute_mapping =
# role_additional_attribute_mapping =
# project_additional_attribute_mapping =
# user_additional_attribute_mapping =

[auth]
methods = external,password,token,oauth1
#external = keystone.auth.plugins.external.ExternalDefault
password = keystone.auth.plugins.password.Password
token = keystone.auth.plugins.token.Token
oauth1 = keystone.auth.plugins.oauth1.OAuth

[paste_deploy]
# Name of the paste configuration file that defines the available pipelines
# config_file = /usr/share/keystone/keystone-dist-paste.ini