openstack之keystone
keystone在openstack中充当认证作用用户与认证：用户权限和用户行为跟踪
服务目录：提供一个服务目录，包括所有服务项和API端点
1、安装keystone
yum install openstack-keystone httpd mod_wsgi python-openstackclient memcached python-memcached -y
# systemctl enable memcached.service
Created symlink from /etc/systemd/system/multi-user.target.wants/memcached.service to /usr/lib/systemd/system/memcached.service.
# systemctl start memcached.service
2、配置keystone配置文件
#grep -n"^" /etc/keystone/keystone.conf
12:admin_token = ADMIN
107:verbose = true
495:connection = mysql://keystone:keystone@172.16.80.130/keystone
1313:servers = 172.16.80.130:11211
1718:driver = sql
1911:provider = uuid
1916:driver = memcache
3、导入数据库
# su -s /bin/sh -c "keystone-manage db_sync" keystone
4、检查导入结果
# mysql -e 'use keystone;show tables;'
+------------------------+
| Tables_in_keystone |
+------------------------+
| access_token |
| assignment |
| config_register |
| consumer |
| credential |
| domain |
| endpoint |
| endpoint_group |
| federation_protocol |
| group |
| id_mapping |
| identity_provider |
| idp_remote_ids |
| mapping |
| migrate_version |
| policy |
| policy_association |
| project |
| project_endpoint |
| project_endpoint_group |
| region |
| request_token |
| revocation_event |
| role |
| sensitive_config |
| service |
| service_provider |
| token |
| trust |
| trust_role |
| user |
| user_group_membership|
| whitelisted_config |
+------------------------+ 5、配置keystone的http服务
# vim /etc/httpd/conf/httpd.conf
ServerName controller
# vim /etc/httpd/conf.d/wsgi-keystone.conf
Listen 5000
Listen 35357
<VirtualHost *:5000>
WSGIDaemonProcess keystone-public processes=5 threads=1 user=keystone group=keystone display-name=%{GROUP}
WSGIProcessGroup keystone-public
WSGIScriptAlias / /usr/bin/keystone-wsgi-public
WSGIApplicationGroup %{GLOBAL}
WSGIPassAuthorization On
<IfVersion >= 2.4>
ErrorLogFormat "%{cu}t %M"
</IfVersion>
ErrorLog /var/log/httpd/keystone-error.log
CustomLog /var/log/httpd/keystone-access.log combined
<Directory /usr/bin>
<IfVersion >= 2.4>
Require all granted
</IfVersion>
<IfVersion < 2.4>
Order allow,deny
Allow from all
</IfVersion>
</Directory>
</VirtualHost>
<VirtualHost *:35357>
WSGIDaemonProcess keystone-admin processes=5 threads=1 user=keystone group=keystone display-name=%{GROUP}
WSGIProcessGroup keystone-admin
WSGIScriptAlias / /usr/bin/keystone-wsgi-admin
WSGIApplicationGroup %{GLOBAL}
WSGIPassAuthorization On
<IfVersion >= 2.4>
ErrorLogFormat "%{cu}t %M"
</IfVersion>
ErrorLog /var/log/httpd/keystone-error.log
CustomLog /var/log/httpd/keystone-access.log combined
<Directory /usr/bin>
<IfVersion >= 2.4>
Require all granted
</IfVersion>
<IfVersion < 2.4>
Order allow,deny
Allow from all
</IfVersion>
</Directory>
</VirtualHost>
# systemctl enable httpd.service
Created symlink from /etc/systemd/system/multi-user.target.wants/httpd.service to /usr/lib/systemd/system/httpd.service.
# systemctl start httpd.service 6、注册keystone api服务，创建project.user,role
# export OS_TOKEN=ADMIN
# export OS_URL=http://172.16.80.130:35357/v3
# export OS_IDENTITY_API_VERSION=3
# openstack service create --name keystone --description "OpenStack Identity" identity
+-------------+----------------------------------+
| Field | Value |
+-------------+----------------------------------+
| description | OpenStack Identity |
| enabled | True |
| id | a5c2ef28a5d5402195e761761f438b15 |
| name | keystone |
| type | identity |
+-------------+----------------------------------+
分别创建三种类型的endpoint,分别为public:对外可见，internal内部使用，admin管理使用
# openstack endpoint create --region RegionOne identity public http://172.16.80.130:5000/v2.0
+--------------+----------------------------------+
| Field | Value |
+--------------+----------------------------------+
| enabled | True |
| id | 0c199cc25852452d8b4a428edd4af515 |
| interface | public |
| region | RegionOne |
| region_id | RegionOne |
| service_id | a5c2ef28a5d5402195e761761f438b15 |
| service_name | keystone |
| service_type | identity |
| url | http://172.16.80.130:5000/v2.0 |
+--------------+----------------------------------+
#
#openstack endpoint create --region RegionOne identity internal http://172.16.80.130:5000/v2.0
+--------------+----------------------------------+
| Field | Value |
+--------------+----------------------------------+
| enabled | True |
| id | 09a1cd321fd64049980096e7a940f6f8 |
| interface | internal |
| region | RegionOne |
| region_id | RegionOne |
| service_id | a5c2ef28a5d5402195e761761f438b15 |
| service_name | keystone |
| service_type | identity |
| url | http://172.16.80.130:5000/v2.0 |
+--------------+----------------------------------+
#
# openstack endpoint create --region RegionOne identity admin http://172.16.80.130:35357/v2.0
+--------------+----------------------------------+
| Field | Value |
+--------------+----------------------------------+
| enabled | True |
| id | 1b875e33729a4ea4aa9f1e3f5d28bfd1 |
| interface | admin |
| region | RegionOne |
| region_id | RegionOne |
| service_id | a5c2ef28a5d5402195e761761f438b15 |
| service_name | keystone |
| service_type | identity |
| url | http://172.16.80.130:35357/v2.0|
+--------------+----------------------------------+
7、创建admin项目
# openstack project create --domain default --description "Admin Project" admin
+-------------+----------------------------------+
| Field | Value |
+-------------+----------------------------------+
| description | Admin Project |
| domain_id | default |
| enabled | True |
| id | 8a3b7f9f1b2c4f7eaf7780d268e672d1 |
| is_domain | False |
| name | admin |
| parent_id | None |
+-------------+----------------------------------+
#
# openstack user create --domain default --password-prompt admin
User Password:密码设定为123456
Repeat User Password:
+-----------+----------------------------------+
| Field | Value |
+-----------+----------------------------------+
| domain_id | default |
| enabled | True |
| id | d1ea9577f35247a794f92598fbb6cd00 |
| name | admin |
+-----------+----------------------------------+
# openstack role create admin
+-------+----------------------------------+
| Field | Value |
+-------+----------------------------------+
| id | 0e98eecac3e94b22a51404a79848bdb7 |
| name| admin |
+-------+----------------------------------+
# openstack role add --project admin --user admin admin 8、创建一个普通用户demo,demo项目，角色为普通用户（uesr）
# openstack project create --domain default --description "Demo Project" demo
+-------------+----------------------------------+
| Field | Value |
+-------------+----------------------------------+
| description | Demo Project |
| domain_id | default |
| enabled | True |
| id | 3653ec22551f472b94e9438bcd9097bf |
| is_domain | False |
| name | demo |
| parent_id | None |
+-------------+----------------------------------+
# openstack user create --domain default --password=demo demo
+-----------+----------------------------------+
| Field | Value |
+-----------+----------------------------------+
| domain_id | default |
| enabled | True |
| id | da1ed7fb5f494091a633afd6da29f900 |
| name | demo |
+-----------+----------------------------------+
# openstack role create user
+-------+----------------------------------+
| Field | Value |
+-------+----------------------------------+
| id | 770c40490791437d97481465f8dd7251 |
| name| user |
+-------+----------------------------------+
# openstack role add --project demo --user demo user
创建项目service
# openstack project create --domain default --description "Service Project" service
+-------------+----------------------------------+
| Field | Value |
+-------------+----------------------------------+
| description | Service Project |
| domain_id | default |
| enabled | True |
| id | 38e8f9eb1cb44d428f589703e663d995 |
| is_domain | False |
| name | service |
| parent_id | None |
+-------------+----------------------------------+
9、验证相关
# openstack user list
+----------------------------------+-------+
| ID | Name|
+----------------------------------+-------+
| d1ea9577f35247a794f92598fbb6cd00 | admin |
| da1ed7fb5f494091a633afd6da29f900 | demo|
+----------------------------------+-------+
# openstack project list
+----------------------------------+---------+
| ID | Name |
+----------------------------------+---------+
| 3653ec22551f472b94e9438bcd9097bf | demo |
| 38e8f9eb1cb44d428f589703e663d995 | service |
| 8a3b7f9f1b2c4f7eaf7780d268e672d1 | admin |
+----------------------------------+---------+
# openstack role list
+----------------------------------+-------+
| ID | Name|
+----------------------------------+-------+
| 0e98eecac3e94b22a51404a79848bdb7 | admin |
| 770c40490791437d97481465f8dd7251 | user|
+----------------------------------+-------+
#
#
# openstack endpoint list
+----------------------------------+-----------+--------------+--------------+---------+-----------+---------------------------------+
| ID | Region | Service Name | Service Type | Enabled | Interface | URL |
+----------------------------------+-----------+--------------+--------------+---------+-----------+---------------------------------+
| 09a1cd321fd64049980096e7a940f6f8 | RegionOne | keystone | identity | True | internal| http://172.16.80.130:5000/v2.0|
| 0c199cc25852452d8b4a428edd4af515 | RegionOne | keystone | identity | True | public | http://172.16.80.130:5000/v2.0|
| 1b875e33729a4ea4aa9f1e3f5d28bfd1 | RegionOne | keystone | identity | True | admin | http://172.16.80.130:35357/v2.0 |
+----------------------------------+-----------+--------------+--------------+---------+-----------+---------------------------------+
#
#
# unset OS_TOKEN
#unset OS_URL
#openstack --os-auth-url http://172.16.80.130:35357/v3 \
> --os-project-domain-id default --os-user-domain-id default \
> --os-project-name admin --os-username admin --os-auth-type password \
> token issue
Password:
+------------+----------------------------------+
| Field | Value |
+------------+----------------------------------+
| expires | 2016-10-29T17:53:21.237891Z |
| id | 1d3fc859a41848a7a4af688e3f9efcd0 |
| project_id | 8a3b7f9f1b2c4f7eaf7780d268e672d1 |
| user_id | d1ea9577f35247a794f92598fbb6cd00 |
+------------+----------------------------------+
10、创建环境变量
# cat admin-openrc.sh
export OS_PROJECT_DOMAIN_ID=default
export OS_USER_DOMAIN_ID=default
export OS_PROJECT_NAME=admin
export OS_TENANT_NAME=admin
export OS_USERNAME=admin
export OS_PASSWORD=123456
export OS_AUTH_URL=http://172.16.80.130:35357/v3
export OS_IDENTITY_API_VERSION=3
#
# cat demo-openrc.sh
export OS_PROJECT_DOMAIN_ID=default
export OS_USER_DOMAIN_ID=default
export OS_PROJECT_NAME=demo
export OS_TENANT_NAME=demo
export OS_USERNAME=demo
export OS_PASSWORD=demo
export OS_AUTH_URL=http://172.16.80.130:5000/v3
export OS_IDENTITY_API_VERSION=3
#
# source admin-openrc.sh
#
# openstack token issue
+------------+----------------------------------+
| Field | Value |
+------------+----------------------------------+
| expires | 2016-10-29T18:00:54.127266Z |
| id | 2e9bfe2f30b941e391a987784ad31daf |
| project_id | 8a3b7f9f1b2c4f7eaf7780d268e672d1 |
| user_id | d1ea9577f35247a794f92598fbb6cd00 |
+------------+----------------------------------+
#
#
# source demo-openrc.sh
#
# openstack token issue
+------------+----------------------------------+
| Field | Value |
+------------+----------------------------------+
| expires | 2016-10-29T18:01:05.293502Z |
| id | f2b7f727e4d74aa88a315012f6f7d1f0 |
| project_id | 3653ec22551f472b94e9438bcd9097bf |
| user_id | da1ed7fb5f494091a633afd6da29f900 |
+------------+----------------------------------+
页:
[1]