# keystone.conf.identity_mapping

# Source code for keystone.conf.identity_mapping

    # Licensed under the Apache License, Version 2.0 (the "License"); you may
    # not use this file except in compliance with the License. You may obtain
    # a copy of the License at
    #
    #      http://www.apache.org/licenses/LICENSE-2.0
    #
    # Unless required by applicable law or agreed to in writing, software
    # distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
    # WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
    # License for the specific language governing permissions and limitations
    # under the License.

    from oslo_config import cfg

    from keystone.conf import utils

    driver = cfg.StrOpt(
        'driver',
        default='sql',
        help=utils.fmt(
            """
    Entry point for the identity mapping backend driver in the
    `keystone.identity.id_mapping` namespace. Keystone only provides a `sql`
    driver, so there is no reason to change this unless you are providing a custom
    entry point.
    """
        ),
    )

    generator = cfg.StrOpt(
        'generator',
        default='sha256',
        help=utils.fmt(
            """
    Entry point for the public ID generator for user and group entities in the
    `keystone.identity.id_generator` namespace. The Keystone identity mapper only
    supports generators that produce 64 bytes or less. Keystone only provides a
    `sha256` entry point, so there is no reason to change this value unless you're
    providing a custom entry point.
    """
        ),
    )

    backward_compatible_ids = cfg.BoolOpt(
        'backward_compatible_ids',
        default=True,
        help=utils.fmt(
            """
    The format of user and group IDs changed in Juno for backends that do not
    generate UUIDs (for example, LDAP), with keystone providing a hash mapping to
    the underlying attribute in LDAP. By default this mapping is disabled, which
    ensures that existing IDs will not change. Even when the mapping is enabled by
    using domain-specific drivers (`[identity] domain_specific_drivers_enabled`),
    any users and groups from the default domain being handled by LDAP will still
    not be mapped to ensure their IDs remain backward compatible. Setting this
    value to false will enable the new mapping for all backends, including the
    default LDAP driver. It is only guaranteed to be safe to enable this option
    if you do not already have assignments for users and groups from the default
    LDAP domain, and you consider it to be acceptable for Keystone to provide the
    different IDs to clients than it did previously (existing IDs in the API will
    suddenly change). Typically this means that the only time you can set this
    value to false is when configuring a fresh installation, although that is the
    recommended value.
    """
        ),
    )

    GROUP_NAME = __name__.split('.')[-1]
    ALL_OPTS = [driver, generator, backward_compatible_ids]

    def register_opts(conf):
        conf.register_opts(ALL_OPTS, group=GROUP_NAME)

    def list_opts():
        return {GROUP_NAME: ALL_OPTS}

this page last updated: 2026-04-01 20:09:17

Except where otherwise noted, this document is licensed under Creative Commons Attribution 3.0 License. See all OpenStack Legal Documents.

found an error? report a bug