Openstack multiple nodes: separate Glance and Keystone machines

First check out: http://docs.openstack.org/ops/OpenStackOperationsGuide.pdf

Looking at the glance source code...

tools/migrate_image_owners.py 

... is the only file that references auth_uri.

It appears this variable is all over the place and it assists with auth token handling in clients and across the whole of openstack. It's not used by glance specifically... but it is used by utilities that work with the middleware stack.

As for the differences between 5000 and 35357 on keystone...

http://docs.openstack.org/developer/keystone/api_curl_examples.html has a pretty explicit discussion of what API examples work on both, or not.

My understanding of port 5000 is that its specific purpose is to allow for public API authentication to keystone, so you don't need to expose 35357 just to allow people to authenticate to it.

As for why there are auth creds inside of each of the openstack components that tie into keystone... truthfully I don't. know.

However I should point out that API v2 is coming in grizzly. Not fully documented yet, and it will begin to introduce some radical changes in how keystone operates.

The error you see is because Keystone is running using the deprecated Eventlet, thus it is listening on the port 5000. In order to get it working with Apache, you have to stop and disable the Keystone service before. Keystone won't be executed as a service, as it will be executed as a WSGI application in Apache using mod_wsgi.

So, to get things working, roll back your configuration so that you have <VirtualHost *:5000> again. Then, stop and disable the keystone service and restart Apache:

service keystone stop
update-rc.d keystone disable
service apache2 restart