Chapter 2. Troubleshooting OpenStack Identity

Keystone plays a crucial role in the OpenStack deployment. This project is responsible for providing services that support an identity, token management, a service catalog, and policy functionality. While Keystone does not depend on any other OpenStack services, most other OpenStack services depend on Keystone. This core dependency on Keystone means that problems with your Keystone services can cascade, causing problems for many of the other OpenStack services. Tracking down a problem in OpenStack can be complicated due to the different projects that operate together to provide a functionality. When troubleshooting OpenStack, it's smart to make sure that Keystone is operating as intended. In this chapter, we will explore the following topics:

• Identifying different versions of the Keystone API and how to avoid configuration problems
• Troubleshooting the command-line interface clients
• Checking the Identity API
• Fixing issues with the Keystone database
• Confirming the accuracy of the service catalog
• Configuring Keystone to run it as a WSGI application under Apache