I’ve shown how to set up OpenStack Keystone Federation with SSSD. We know we can set up Horizon with Federation using SAML. Here is how to set up Web Single Sign On (WebSSO) for SSSD and Kerberos.
Horizon WebSSO via SSSD
1
OpenStack keeps resetting my hostname
No matter what I changed, something kept setting the hostname on my vm to federate.cloudlab.freeipa.org.novalocal. Even forcing the /etc/hostname file to be uneditable did not prevent this change. Hunting this down took far too long, and here is the result of my journey.
Continue reading
Troubleshooting Keystone in a New Install
Recently heard complaints:
I’ve done a deployment , and every time I try to log in to the dashboard, I get “An error occurred authenticating. Please try again later.” Somewhat surprisingly, the only log that I’m noticing showing anything of note is the Apache error log, which reports ‘Login failed for user “admin”‘. I’ve bumped keystone — where I’d assume the error is happening — to DEBUG, but it’s showing exactly zero activity. How do I go about debugging this?’
Trying to enable LDAP with OpenStack/keystone in Juno release. All the horizon users return error “You are not authorized for any projects.” Similarly, all the OpenStack services are reported not to be authorized.’
What is supposed to happen:
Firewalld rule for Minecraft Server
My sons play Minecraft. I recently decided to let them play head to head on the same server. Aside from the financial aspect (I had to buy a second account) it was fairly straightforward running the server. The one thing that tripped me up was a firewall rule that prevented a remote client machine from connecting to the server. Fix was pretty simple.
Emilio’s Craftsmanship
My Saxophone is back from the workshop of Emilio Lyons. It is a pleasure to play on it. I would say “like new” but for two things. First, the horn was twenty years old when I got it, so I never played it new. Second, Emilio has customized the feel of the horn enough that o suspect it never played like this. What did he do?
Keystone Federation via mod_lookup_identity redux
Last year I wrote a proof-of-concept for Federation via mod_lookup_identity. Some of the details have changed since then, and I wanted to do a formal one based on the code that will ship for Kilo. This was based on a devstack deployment.
Convince Nova to Use the V3 version of the API
In a recent post I showed how to set up the LDAP in a domain other than default. It turns out that the Nova configuration does accept these tokens; by default, Nova uses the V2 version of the Keystone API only. This is easy to fix.
Continue reading
Three Types of Tokens
One of the most annoying administrative issues in Keystone is The MySQL backend to the token database filling up. While we have a flush scrit, it needs to be scheduled via cron. Here is a short over view of the types of tokens, why the backend is necessary, and what is being done to mitigate the problem. Continue reading
The Sax Doctor
Ring of a Selmer Paris Saxophone
Dropped my Sax off at Emilio Lyon’s house and workshop. My folks bought it for me from him at Rayburn Music in Boston back when I was a High School Freshman. I still remember him pointing to the sticker on it that indicated “This is my work.”
As someone who loves both the saxophone and working with my hands, I have to admit I was looking forward to meeting him. I was even a little nervous. He has a great reputation. Was he going to chastise me for the state of my horn? It hadn’t been serviced in…way too long. I was a little worried that the lack of changing the oil on the rods would have worn down some of the metal connections.
Continue reading
Adding an LDAP backed domain to a Packstack install
I’ve been meaning to put all the steps together to do this for a while:
Got an IPA server running on Centos7
Got a Packstack all in one install on Centos 7. I registered this host as a FreeIPA client, though that is not strictly required.
Continue reading