<?xml version="1.0" ?>

<!DOCTYPE service_bundle SYSTEM '/usr/share/lib/xml/dtd/service_bundle.dtd.1'>

<!--

 Copyright (c) 2013, 2015, Oracle and/or its affiliates. All rights reserved.

 Licensed under the Apache License, Version 2.0 (the "License"); you may

 not use this file except in compliance with the License. You may obtain

 a copy of the License at

      http://www.apache.org/licenses/LICENSE-2.0

 Unless required by applicable law or agreed to in writing, software

 distributed under the License is distributed on an "AS IS" BASIS, WITHOUT

 WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the

 License for the specific language governing permissions and limitations

 under the License.

 NOTE:  This service manifest is not editable; its contents will

 be overwritten by package or patch operations, including

 operating system upgrade.  Make customizations in a different

 file.

-->

<service_bundle type="manifest" name="keystone">

  <service version="1" type="service"

    name="application/openstack/keystone">

    <dependency name='multiuser' grouping='require_all' restart_on='error'

      type='service'>

      <service_fmri value='svc:/milestone/multi-user:default' />

    </dependency>

    <dependency name='upgrade' grouping='require_all' restart_on='none'

      type='service'>

      <service_fmri

        value='svc:/application/openstack/keystone/keystone-upgrade' />

    </dependency>

    <dependency name='ntp' grouping='optional_all' restart_on='none'

      type='service'>

      <service_fmri value='svc:/network/ntp'/>

    </dependency>

    <dependency name='mysql' grouping='optional_all' restart_on='none'

      type='service'>

      <service_fmri value='svc:/application/database/mysql'/>

    </dependency>

    <dependency name='rabbitmq' grouping='optional_all' restart_on='none'

      type='service'>

      <service_fmri value='svc:/application/rabbitmq'/>

    </dependency>

    <logfile_attributes permissions='600'/>

    <exec_method timeout_seconds="60" type="method" name="start"

      exec="/lib/svc/method/keystone %m">

      <method_context>

        <method_credential user='keystone' group='keystone'

          privileges='basic,{zone}:/system/volatile/keystone_wsgi_*'/>

      </method_context>

    </exec_method>

    <exec_method timeout_seconds="60" type="method" name="stop"

      exec="/lib/svc/method/keystone %m">

      <method_context>

        <method_credential user='keystone' group='keystone'/>

      </method_context>

    </exec_method>

    <exec_method timeout_seconds="60" type="method" name="restart"

      exec="/lib/svc/method/keystone %m">

      <method_context>

        <method_credential user='keystone' group='keystone' />

      </method_context>

    </exec_method>

    <property_group type="framework" name="startd">

      <propval type="astring" name="ignore_error" value="core,signal"/>

    </property_group>

    <instance name='default' enabled='false'>

      <!-- to start/stop/refresh the service -->

      <property_group name='general' type='framework'>

        <propval name='action_authorization' type='astring'

                 value='solaris.smf.manage.keystone' />

        <propval name='value_authorization' type='astring'

                 value='solaris.smf.value.keystone' />

      </property_group>

      <property_group name='keystone_stencil' type='configfile'>

        <propval name='path' type='astring'

          value='/var/lib/keystone/keystone.httpd.conf'/>

        <propval name='stencil' type='astring' value='keystone.stencil'/>

        <propval name='mode' type='astring' value='0444'/>

        <propval name='owner' type='astring' value='keystone'/>

        <propval name='group' type='astring' value='keystone'/>

      </property_group>

      <property_group name='config' type='application'>

        <propval name='admin_port' type='count' value='35357'/>

        <propval name='access_log' type='astring'

          value='/var/log/keystone/keystone_access.log'/>

        <propval name='error_log' type='astring'

          value='/var/log/keystone/keystone_error.log'/>

        <propval name='public_port' type='count' value='5000'/>

        <propval name='use_tls' type='boolean' value='false'/>

      </property_group>

    </instance>

    <template>

      <common_name>

        <loctext xml:lang="C">

          OpenStack Keystone Identity Service

        </loctext>

      </common_name>

      <description>

        <loctext xml:lang="C">

          keystone starts both the service and administrative APIs in a single

          process to provide catalog, authorization, and authentication

          services for OpenStack.

        </loctext>

      </description>

      <pg_pattern required='true' type='application' name='config'>

        <prop_pattern required='true' type='count' name='admin_port'>

          <description>

            <loctext xml:lang='C'>

              The port for admin requests.  Default value is 35357.

            </loctext>

          </description>

        </prop_pattern>

        <prop_pattern required='true' type='astring' name='access_log'>

          <description>

            <loctext xml:lang='C'>

              The absolute path for the Apache access log file.  Defaults to

              /var/log/keystone/keystone_access.log

            </loctext>

          </description>

        </prop_pattern>

        <prop_pattern required='true' type='astring' name='error_log'>

          <description>

            <loctext xml:lang='C'>

              The absolute path for the Apache error log file.  Defaults to

              /var/log/keystone/keystone_error.log

            </loctext>

          </description>

        </prop_pattern>

        <prop_pattern required='true' type='count' name='public_port'>

          <description>

            <loctext xml:lang='C'>

              The port for public requests.  Default value is 5000.

            </loctext>

          </description>

        </prop_pattern>

        <prop_pattern required='false' type='astring' name='ssl_cert_file'>

          <description>

            <loctext xml:lang='C'>

              Server PEM-encoded X.509 Certificate file.

            </loctext>

          </description>

        </prop_pattern>

        <prop_pattern required='false' type='astring' name='ssl_ca_cert_file'>

          <description>

            <loctext xml:lang='C'>

              File of concatenated PEM-encoded CA Certificates for Client Auth.

            </loctext>

          </description>

        </prop_pattern>

        <prop_pattern required='false' type='astring' name='ssl_cert_key_file'>

          <description>

            <loctext xml:lang='C'>

              Server PEM-encoded Private Key file.

            </loctext>

          </description>

        </prop_pattern>

        <prop_pattern required='true' type='boolean' name='use_tls'>

          <description>

            <loctext xml:lang='C'>

              Boolean property to indicate usage of TLS.  Defaults to 'false'.

            </loctext>

          </description>

        </prop_pattern>

      </pg_pattern>

    </template>

  </service>

  <service version="1" type="service"

    name="application/openstack/keystone/keystone-token-flush">

    <logfile_attributes permissions='600'/>

    <!-- to start/stop/refresh the service -->

    <property_group name='general' type='framework'>

      <propval name='action_authorization' type='astring'

               value='solaris.smf.manage.keystone' />

      <propval name='value_authorization' type='astring'

               value='solaris.smf.value.keystone' />

    </property_group>

    <instance name='default' enabled='false'>

      <dependency name='keystone' grouping='require_all' restart_on='none'

        type='service'>

        <service_fmri value='svc:/application/openstack/keystone:default' />

      </dependency>

      <scheduled_method interval='hour'

        exec='/usr/bin/keystone-manage token_flush' timeout_seconds = '0' >

        <method_context>

          <method_credential user='keystone' group='keystone' />

        </method_context>

      </scheduled_method>

      <template>

        <common_name>

          <loctext xml:lang="C">

            OpenStack Keystone Token Flush Service

          </loctext>

        </common_name>

        <description>

          <loctext xml:lang="C">

            The keystone database needs to flush the expired tokens on a regular

            basis. As the default expiration is one hour, this will flush those

            expired tokens once an hour.

          </loctext>

        </description>

      </template>

    </instance>

  </service>

</service_bundle>