// Module included in the following assemblies:
//
// * authentication/identity_providers/configuring-keystone-identity-provider.adoc

:_mod-docs-content-type: REFERENCE
[id="identity-provider-keystone-CR_{context}"]
= Sample Keystone CR

The following custom resource (CR) shows the parameters and acceptable values for a
Keystone identity provider.

.Keystone CR

[source,yaml]
----
apiVersion: config.openshift.io/v1
kind: OAuth
metadata:
  name: cluster
spec:
  identityProviders:
  - name: keystoneidp <1>
    mappingMethod: claim <2>
    type: Keystone
    keystone:
      domainName: default <3>
      url: https://keystone.example.com:5000 <4>
      ca: <5>
        name: ca-config-map
      tlsClientCert: <6>
        name: client-cert-secret
      tlsClientKey: <7>
        name: client-key-secret
----
<1> This provider name is prefixed to provider user names to form an identity name.
<2> Controls how mappings are established between this provider's identities and `User` objects.
<3> Keystone domain name. In Keystone, usernames are domain-specific. Only a single domain is supported.
<4> The URL to use to connect to the Keystone server (required). This must
use https.
<5> Optional: Reference to an {product-title} `ConfigMap` object containing the
PEM-encoded certificate authority bundle to use in validating server
certificates for the configured URL.
<6> Optional: Reference to an {product-title} `Secret` object containing the client
certificate to present when making requests to the configured URL.
<7> Reference to an {product-title} `Secret` object containing the key for the
client certificate. Required if `tlsClientCert` is specified.
