From 7346b2076aa99d85e466981fd394d2f0a5ba631a Mon Sep 17 00:00:00 2001 From: Emilien Macchi Date: Mon, 15 Feb 2016 13:16:09 -0500 Subject: [PATCH] disabling the admin_token after bootstrap The keystone documentation highly recommends disabling the admin_token authentication after the initial bootstrap because it exposes a major attack vector. A patch in puppet-keystone [1] added the support to remove admin_token_auth keyword from the pipeline lists. This patch aims to use this new class when deploying Keystone. [1] https://review.openstack.org/#/c/256248 Change-Id: Ic545005122a0f7b92b8a9d3f1e4978b397bfc9c2 --- manifests/keystone.pp | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/manifests/keystone.pp b/manifests/keystone.pp index c7335e29f..35073d413 100644 --- a/manifests/keystone.pp +++ b/manifests/keystone.pp @@ -43,5 +43,10 @@ class openstack_integration::keystone ( class { '::keystone::endpoint': default_domain => $default_domain, } - + class { '::keystone::disable_admin_token_auth': } + class { '::openstack_extras::auth_file': + password => 'a_big_secret', + project_domain => $default_domain, + user_domain => $default_domain, + } }