Bug 978853

Summary:	token_format should be configurable
Product:	Red Hat OpenStack	Reporter:	Martin Magr <mmagr>
Component:	openstack-packstack	Assignee:	Martin Magr <mmagr>
Status:	CLOSED ERRATA	QA Contact:	Nir Magnezi <nmagnezi>
Severity:	urgent	Docs Contact:
Priority:	urgent
Version:	3.0	CC:	ajeain, aortega, apevec, ayoung, dallan, derekh, gfidente, jkt, lhh, mmagr, sclewis, sgordon
Target Milestone:	async	Keywords:	ZStream
Target Release:	3.0
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	openstack-packstack-2013.1.1-0.23.dev642.el6ost	Doc Type:	Enhancement
Doc Text:	PackStack now allows user selection of the token format to be used by the Identity service (Keystone). The new configuration key is CONFIG_KEYSTONE_TOKEN_FORMAT controls which token format is used. Valid values are UUID of PKI. The recommended value for new deployments is PKI.	Story Points:	---
Clone Of:	975153
Clones:	984683 (view as bug list)		Environment:
Last Closed:	2013-07-15 19:17:02 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	975050, 975153
Bug Blocks:

Description Martin Magr 2013-06-27 08:30:12 UTC

+++ This bug was initially created as a clone of Bug #975153 +++

+++ This bug was initially created as a clone of Bug #975050 +++

Description of problem:
in Grizzly the default token_format changed from UUID to PKI.

While in the RHOS 3.0 release, we primarily worked with UUID, we would like to follow upstream in the future.

For RHOS 4.0, we would like to use PKI by default from packstack.

Perhaps as a 3.0.z release of packstack, it would be ideal to have the option to turn on PKI tokens but not affect existing answer files.  That is, prompt the user for a token type, and the default should be 'UUID', but allow 'PKI'.

Version-Release number of selected component (if applicable):
openstack-packstack-2013.1.1-0.17.dev631.el6ost.noarch

--- Additional comment from Adam Young on 2013-06-17 13:38:01 EDT ---

Specifically, we should not force the token format to be UUID tokens.  This was done by a puppet module chance in 3.0 but has been changed in upstream puppet to align with upstream Keystone.

Comment 1 Martin Magr 2013-06-27 08:36:36 UTC

Backported to Grizzly branch.

Comment 3 Alan Pevec 2013-07-11 18:39:26 UTC

Note that upstream packstack grizzly has "DEFAULT_VALUE"   : 'PKI'
but RHOS rpm includes additional patch which keeps default UUID:
 http://pkgs.devel.redhat.com/cgit/rpms/openstack-packstack/tree/0007-token_format-bz975050.patch?h=rh-grizzly-rhel-6

Comment 4 Nir Magnezi 2013-07-14 09:31:23 UTC

Verified NVR: openstack-packstack-2013.1.1-0.23.dev642.el6ost.noarch
* Verified With RHOS

Verification Steps:
===================
1. Installed packstack and generated an answer-file
2. Verified that an attribute named CONFIG_KEYSTONE_TOKEN_FORMAT was added to the file.
3. Verified that CONFIG_KEYSTONE_TOKEN_FORMAT default value is UUID
4. Installed Openstack with UUID Configured
5. Installed Openstack with PKI Configured

Result:
=======
1. Both installations (steps 4,5) passed OK.
2. Sanity tests passed OK.

Comment 6 errata-xmlrpc 2013-07-15 19:17:02 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2013-1058.html