Below versions of Keystone are available in respective distributions at the time of creation of these build instructions:

• Ubuntu 22.04 has 21.0.1
• Ubuntu 24.04 has 25.0.0
• Ubuntu 24.10 has 26.0.0

The instructions provided below specify the steps to build Keystone latest version on Linux on IBM Z for following distributions:

• RHEL (8.8, 8.10, 9.2, 9.4, 9.5)
• SLES 15 SP6
• Ubuntu (22.04, 24.04, 24.10)

General notes:

• When following the steps below please use a standard permission user unless otherwise specified

Note:

• Keystone(v26.0.0) was verified at the time of creation of these instructions

If you want to build and install Keystone using manual steps, go to step 2.

Use the following commands to build Keystone using the build script. Please make sure you have wget installed.

wget https://raw.githubusercontent.com/linux-on-ibm-z/scripts/master/Keystone/26.0.0/build_keystone.sh

# Run bash build_keystone.sh -h to see all available options
bash build_keystone.sh

• RHEL (8.8, 8.10, 9.2, 9.4, 9.5)

  sudo yum install -y curl wget openssl-devel gcc make gcc-c++ httpd httpd-devel mariadb-server procps sqlite-devel perl mariadb-devel mariadb-server rust cargo
  export PATH=/usr/local/bin:$PATH
  
  # For RHEL 8.x
  sudo yum install -y python39-devel python39-mod_wsgi python39-pip
  
  # For RHEL 9.x
  sudo yum install -y python3-devel python3-mod_wsgi python3-pip

• SLES 15 SP6

  sudo zypper install -y lsof libopenssl-devel gcc make python312-devel python312-pip gawk apache2 apache2-devel mariadb libmariadb-devel gcc-c++ cargo curl wget

• Ubuntu (22.04, 24.04, 24.10)

  sudo apt-get update
  sudo apt-get install -y python3-pip mysql-server libmysqlclient-dev libapache2-mod-wsgi-py3 apache2 apache2-dev wget curl uwsgi-plugin-python3 rustc cargo librust-openssl-dev python3-mysqldb

• RHEL (8.x, 9.x)

  sudo yum remove -y python3-requests # For RHEL 9.x
  
  sudo -H pip3 install --upgrade pip
  sudo pip3 install bcrypt==4.0.1 keystone==26.0.0 python-openstackclient mysqlclient

• SLES 15 SP6

  sudo pip3 install cryptography==41.0.7 bcrypt==4.0.1 keystone==26.0.0 python-openstackclient mysqlclient mod-wsgi uwsgi

• Ubuntu (22.04, 24.04, 24.10)

  PIP_OPTIONS="--break-system-packages" # For Ubuntu 24.04+
  
  #For Ubuntu 24.10
  sudo apt install -y python3-setuptools
  sudo apt remove -y python3-blinker
  
  sudo -H pip3 install $PIP_OPTIONS --upgrade --user pip
  sudo pip3 install $PIP_OPTIONS bcrypt==4.0.1 keystone==26.0.0 python-openstackclient

  Note: You may also use sudo env PATH=$PATH <command> if any command fails with command not found error.

• Initialize MariaDB server (For RHEL and SLES)

  sudo /usr/bin/mysql_install_db --user=mysql

• Start MariaDB service

  sudo /usr/bin/mysqld_safe --user=mysql &       # For RHEL 8.x, SLES 15 SP6
  sudo mysqld_safe &                             # For RHEL 9.x, Ubuntu

Note:

• <KEYSTONE_HOST_IP>- IP of your machine where you are installing Keystone Service
• <DB_HOST> - IP or HostName of machine,where the MariaDB service is running e.g. 127.0.0.1
• <KEYSTONE_DBPASS> - database password for Keystone
• <PASSWORD> - database password for root user

Follow below instruction to create Keystone database and grant required privileges:

• Create database, grant privileges to "keystone" user

  sudo mysql -e "CREATE DATABASE keystone"
  sudo mysql -e "CREATE USER 'keystone'@'localhost' IDENTIFIED BY '<KEYSTONE_DBPASS>'"
  sudo mysql -e "CREATE USER 'keystone'@'%' IDENTIFIED BY '<KEYSTONE_DBPASS>'"
  sudo mysql -e "GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'%'"
  sudo mysql -e "GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'localhost'"

sudo mkdir -p /etc/keystone/
cd /etc/keystone/
sudo wget -O keystone.conf https://docs.openstack.org/keystone/2024.2/_static/keystone.conf.sample
export OS_KEYSTONE_CONFIG_DIR=/etc/keystone

• Edit keystone.conf file

  sudo sed -i "s|#connection = <None>|connection = mysql://keystone:<KEYSTONE_DBPASS>@localhost/keystone|g" /etc/keystone/keystone.conf
  sudo sed -i "s|#provider = fernet|provider = fernet|g" /etc/keystone/keystone.conf

• Populate Keystone database

  sudo keystone-manage db_sync

sudo groupadd keystone
sudo useradd -m -g keystone keystone
sudo mkdir -p /etc/keystone/fernet-keys
sudo chown -R keystone:keystone fernet-keys
sudo keystone-manage fernet_setup --keystone-user keystone --keystone-group keystone
sudo keystone-manage credential_setup --keystone-user keystone --keystone-group keystone

sudo keystone-manage bootstrap \
--bootstrap-password ADMIN_PASS \
--bootstrap-admin-url http://<KEYSTONE_HOST_IP>:35357/v3/ \
--bootstrap-internal-url http://<KEYSTONE_HOST_IP>:5000/v3/ \
--bootstrap-public-url http://<KEYSTONE_HOST_IP>:5000/v3/ \
--bootstrap-region-id RegionOne

Note: You may also use sudo env PATH=$PATH <command> if any command fails with command not found or connection error for above steps.

Follow below instructions to enable wsgi to serve Keystone requests

• Edit httpd.conf

  • RHEL (8.x, 9.x)

    • Add below content at end of /etc/httpd/conf/httpd.conf file:

      ServerName <KEYSTONE_HOST_IP>
      Include /etc/httpd/sites-enabled/
      LoadModule wsgi_module /usr/local/lib64/python3.9/site-packages/mod_wsgi/server/mod_wsgi-py39.cpython-39-s390x-linux-gnu.so

  • SLES 15 SP6

    • Add below content at end of /etc/apache2/httpd.conf file:

      ServerName <KEYSTONE_HOST_IP>
      Include /etc/apache2/sites-enabled/
      LoadModule wsgi_module /usr/local/lib64/python3.12/site-packages/mod_wsgi/server/mod_wsgi-py312.cpython-312-s390x-linux-gnu.so

      Note: Comment out the below line in /etc/apache2/httpd.conf file if it exist:

      Include /etc/apache2/sysconfig.d/include.conf

• Add wsgi-keystone.conf

  • RHEL (8.x, 9.x)

    sudo mkdir -p /etc/httpd/sites-available
    sudo mkdir -p /etc/httpd/sites-enabled
    sudo curl -SL -o wsgi-keystone.conf https://raw.githubusercontent.com/linux-on-ibm-z/scripts/master/Keystone/26.0.0/conf/rhel-wsgi-keystone.conf
    sudo mv wsgi-keystone.conf /etc/httpd/sites-available/

  • SLES 15 SP6

    sudo mkdir -p /etc/apache2/sites-available
    sudo mkdir -p /etc/apache2/sites-enabled
    sudo curl -SL -o wsgi-keystone.conf https://raw.githubusercontent.com/linux-on-ibm-z/scripts/master/Keystone/26.0.0/conf/sles-wsgi-keystone.conf
    sudo mv wsgi-keystone.conf /etc/apache2/sites-available/

• Enable the Identity service virtual host

  • RHEL (8.x, 9.x)

    sudo ln -s /etc/httpd/sites-available/wsgi-keystone.conf /etc/httpd/sites-enabled

  • SLES 15 SP6

    sudo ln -s /etc/apache2/sites-available/wsgi-keystone.conf /etc/apache2/sites-enabled

• Start keystone service

  • RHEL

    sudo /usr/sbin/httpd

  • Ubuntu and SLES

    sudo uwsgi --http-socket 127.0.0.1:5000 --plugin /usr/lib/uwsgi/plugins/python3_plugin.so --wsgi-file $(which keystone-wsgi-public) &

Note:

• Comment ulimit section if required, in file /usr/sbin/apache2ctl and restart apache

• Set variables

  export OS_USERNAME=admin
  export OS_PASSWORD=ADMIN_PASS
  export OS_PROJECT_NAME=admin
  export OS_USER_DOMAIN_NAME=Default
  export OS_PROJECT_DOMAIN_NAME=Default
  export OS_AUTH_URL=http://<KEYSTONE_HOST_IP>:5000/v3
  export OS_IDENTITY_API_VERSION=3

• Create symlinks for RHEL (8.x, 9.x)

  sudo ln -s /usr/local/bin/keystone-wsgi-admin /bin/
  sudo ln -s /usr/local/bin/keystone-wsgi-public /bin/

• Run any Keystone command and check if it succeeds. For example

  openstack service list
  openstack token issue

• https://docs.openstack.org/keystone/latest/