Connecting to OpenStack-based clouds with Keystone authentication
To use the accounts on an OpenStack Keystone server for authentication to the OpenStack cloud connection, create an authentication realm that points to the Keystone server. Then, configure security for that authentication realm.
- Configure the images for use with the blueprint designer. See Configuring OpenStack images.
- Extend the Heat engine that is associated with the OpenStack server. You must use an OpenStack Heat engine that is installed with the OpenStack server, not an engine that you install with IBM® UrbanCode® Deploy. See Installing the blueprint design server.
- Install the blueprint design server. See Installing the blueprint design server.
- Connect the blueprint design server to the server. See Connecting the blueprint design server to the server.
- Ensure that the blueprint design server can connect to the cloud. You can verify the connection path with the curl or telnet commands. For example, make sure that no firewall, proxy, or security settings prevent communication between the blueprint design server and the cloud.
Log in to the blueprint designer as a user with the following System
- Configure Security
- Manage Users & Groups
- Create an authentication realm that points to the Keystone server. See Creating OpenStack identity service authentication realms for the blueprint designer.
Import the users from that authentication realm.
The blueprint designer creates the following artifacts:
- The blueprint designer creates a user in the authentication realm for each user on the Keystone server.
- The blueprint designer creates a cloud connection on the Clouds tab. (Click .)
- The blueprint designer creates a cloud project for each tenant or project on the cloud. If your OpenStack identity service uses Identity API v3, the domain for each project is specified.
- Add the cloud projects to teams.
Add one or more users from that authentication realm to a team and assign those users one or
The users on the team have access to the cloud projects that are associated with that team.
- Make sure that the team roles include the appropriate permissions for those users, such as creating and editing blueprints.
- If the cloud uses SSL security, configure SSL security on the blueprint design server. See Configuring SSL security for OpenStack clouds.
Note: When a user logs in to the blueprint designer, the blueprint designer matches the user name to the authentication realms, starting at the top of the list. If the user name is present in more than one authentication realm, the blueprint designer uses the listing in the highest authentication realm.