Centos7 install Openstack - (第二节)添加认证服务(Keystone)

我的blog地址:http://www.cnblogs.com/caoguo

根据openstack官方文档配置

官方文档地址: http://docs.openstack.org/juno/install-guide/install/yum/content/#

0x01.认证服务安装与配置(控制节点)

[root@controller ~]# mysql -uroot -p
MariaDB [(none)]> CREATE DATABASE keystone; MariaDB [(none)]> GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'localhost' \
-> IDENTIFIED BY 'KEYSTONE_DBPASS'; MariaDB [(none)]> GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'%' \
-> IDENTIFIED BY 'KEYSTONE_DBPASS'; MariaDB [(none)]> flush privileges;
[root@controller ~]# openssl rand -hex 
cdda1486bf623ac74d53
[root@controller ~]# yum install -y openstack-keystone python-keystoneclient
[root@controller ~]# cp -rf /etc/keystone/keystone.conf /etc/keystone/keystone.conf.old
[root@controller ~]# vi /etc/keystone/keystone.conf   #增加一下配置就可以了
[DEFAULT]
admin_token = cdda1486bf623ac74d53
verbose = True [database]
connection = mysql://keystone:KEYSTONE_DBPASS@controller/keystone [token]
provider = keystone.token.providers.uuid.Provider
driver = keystone.token.persistence.backends.sql.Token [revoke]
driver = keystone.contrib.revoke.backends.sql.Revoke
[root@controller ~]# keystone-manage pki_setup --keystone-user keystone --keystone-group keystone
[root@controller ~]# chown -R keystone:keystone /var/log/keystone
[root@controller ~]# chown -R keystone:keystone /etc/keystone/ssl
[root@controller ~]# chmod -R o-rwx /etc/keystone/ssl
[root@controller ~]# su -s /bin/sh -c "keystone-manage db_sync" keystone [root@controller ~]# systemctl enable openstack-keystone.service
[root@controller ~]# systemctl start openstack-keystone.service

0x02. Create tenants, users, and roles(控制节点)

[root@controller ~]# export OS_SERVICE_TOKEN=cdda1486bf623ac74d53
[root@controller ~]# export OS_SERVICE_ENDPOINT=http://controller:35357/v2.0

2-1. Create an administrative tenant, user, and role for administrative operations in your environment:
  a. Create the admin tenant:(创建租户admin)

[root@controller ~]# keystone tenant-create --name admin --description "Admin Tenant"
+-------------+----------------------------------+
| Property | Value |
+-------------+----------------------------------+
| description | Admin Tenant |
| enabled | True |
| id | f42937a2fd484d638ce58e67fef59b67 |
| name | admin |
+-------------+----------------------------------+

  b. Create the admin user:(创建用户admin)

[root@controller ~]# keystone user-create --name admin --pass ADMIN_PASS --email admin@example.com

+----------+----------------------------------+
| Property | Value |
+----------+----------------------------------+
| email | admin@example.com |
| enabled | True |
| id | cc58749f0ecb402d9f627ee72bda5afb |
| name | admin |
| username | admin |
+----------+----------------------------------+

  c. Create the admin role:(创建角色admin)

[root@controller ~]# keystone role-create --name admin
+----------+----------------------------------+
| Property | Value |
+----------+----------------------------------+
| id | 4fa15a3b9fc6464694696fa75696b191 |
| name | admin |
+----------+----------------------------------+

  d. Add the admin role to the admin tenant and user:(添加用户到租户以及角色中)

[root@controller ~]# keystone user-role-add --user admin --tenant admin --role admin

2-2. Create a demo tenant and user for typical operations in your environment:
  a. Create the demo tenant:(创建租户demo)

[root@controller ~]# keystone tenant-create --name demo --description "Demo Tenant"
+-------------+----------------------------------+
| Property | Value |
+-------------+----------------------------------+
| description | Demo Tenant |
| enabled | True |
| id | e15976585a8b45c4984f4ebd9db90b5c |
| name | demo |
+-------------+----------------------------------+

  b. Create the demo user under the demo tenant:(添加demo用户到租户demo中)

[root@controller ~]# keystone user-create --name demo --tenant demo --pass DEMO_PASS --email demo@example.com
+----------+----------------------------------+
| Property | Value |
+----------+----------------------------------+
| email | demo@example.com |
| enabled | True |
| id | 5c8155359c20422c96e7bcd6aa6388ba |
| name | demo |
| tenantId | e15976585a8b45c4984f4ebd9db90b5c |
| username | demo |
+----------+----------------------------------+

2-3.OpenStack services also require a tenant, user, and role to interact with other services.
Each service typically requires creating one or more unique users with the admin role
under the service tenant

 a. Create the service tenant:(创建租户service)

[root@controller ~]# keystone tenant-create --name service --description "Service Tenant"
+-------------+----------------------------------+
| Property | Value |
+-------------+----------------------------------+
| description | Service Tenant |
| enabled | True |
| id | 6826a4d9fa7f4e438f3c79010ad80dcd |
| name | service |
+-------------+----------------------------------+

0x03. Create the service entity and API endpoint(控制节点)
  3-1. Create the service entity for the Identity service:

[root@controller ~]# keystone service-create --name keystone --type identity \
--description "OpenStack Identity"
+-------------+----------------------------------+
| Property | Value |
+-------------+----------------------------------+
| description | OpenStack Identity |
| enabled | True |
| id | 5da5b6f72df341a7959ee7b42131c082 |
| name | keystone |
| type | identity |
+-------------+----------------------------------+

  3-2. Create the Identity service API endpoints:

[root@controller ~]# keystone endpoint-create \
--service-id $(keystone service-list | awk '/ identity / {print $2}') \
--publicurl http://controller:5000/v2.0 \
--internalurl http://controller:5000/v2.0 \
--adminurl http://controller:35357/v2.0 \
--region regionOne
+-------------+----------------------------------+
| Property | Value |
+-------------+----------------------------------+
| adminurl | http://controller:35357/v2.0 |
| id | 90af99e76cc54249b5ac3ec4269b0d99 |
| internalurl | http://controller:5000/v2.0 |
| publicurl | http://controller:5000/v2.0 |
| region | regionOne |
| service_id | 5da5b6f72df341a7959ee7b42131c082 |
+-------------+----------------------------------+

0x04. 确认以上操作(控制节点)
  4-1. 销毁变量

[root@controller ~]# unset OS_SERVICE_TOKEN OS_SERVICE_ENDPOINT

  4-2. 验证token

[root@controller ~]# keystone --os-tenant-name admin --os-username admin --os-password ADMIN_PASS \
--os-auth-url http://controller:35357/v2.0 token-get
+-----------+----------------------------------+
| Property | Value |
+-----------+----------------------------------+
| expires | --01T09::34Z |
| id | 6ce0cc1d7cf94cd39f66f8cad8d78da1 |
| tenant_id | f42937a2fd484d638ce58e67fef59b67 |
| user_id | cc58749f0ecb402d9f627ee72bda5afb |
+-----------+----------------------------------+

  4-3.租户列表

[root@controller ~]# keystone --os-tenant-name admin --os-username admin --os-password ADMIN_PASS \
--os-auth-url http://controller:35357/v2.0 tenant-list
+----------------------------------+---------+---------+
| id | name | enabled |
+----------------------------------+---------+---------+
| f42937a2fd484d638ce58e67fef59b67 | admin | True |
| e15976585a8b45c4984f4ebd9db90b5c | demo | True |
| 6826a4d9fa7f4e438f3c79010ad80dcd | service | True |
+----------------------------------+---------+---------+

  

  4-4. 用户列表

[root@controller ~]# keystone --os-tenant-name admin --os-username admin --os-password ADMIN_PASS \
--os-auth-url http://controller:35357/v2.0 user-list
+----------------------------------+-------+---------+------------------+
| id | name | enabled | email |
+----------------------------------+-------+---------+------------------+
| cc58749f0ecb402d9f627ee72bda5afb | admin | True | admin@example.com |
| 5c8155359c20422c96e7bcd6aa6388ba | demo | True | demo@example.com |
+----------------------------------+-------+---------+------------------+

  4-5. 角色列表

[root@controller ~]# keystone --os-tenant-name admin --os-username admin --os-password ADMIN_PASS \
--os-auth-url http://controller:35357/v2.0 role-list
+----------------------------------+----------+
| id | name |
+----------------------------------+----------+
| 9fe2ff9ee4384b1894a90878d3e92bab | _member_ |
| 4fa15a3b9fc6464694696fa75696b191 | admin |
+----------------------------------+----------+

  4-6.  demo用户获取token

[root@controller ~]# keystone --os-tenant-name demo --os-username demo --os-password DEMO_PASS \
--os-auth-url http://controller:35357/v2.0 token-get
+-----------+----------------------------------+
| Property | Value |
+-----------+----------------------------------+
| expires | --01T10::54Z |
| id | 8beacb3ab30e402583b9e1ff2bdf05ba |
| tenant_id | e15976585a8b45c4984f4ebd9db90b5c |
| user_id | 5c8155359c20422c96e7bcd6aa6388ba |
+-----------+----------------------------------+

  4-7. 尝试无权限访问

[root@controller ~]# keystone --os-tenant-name demo --os-username demo --os-password DEMO_PASS \
> --os-auth-url http://controller:35357/v2.0 user-list
You are not authorized to perform the requested action: admin_required (HTTP )

0x05. Create OpenStack client environment scripts(控制节点)
  5-1. 添加admin的环境变量

[root@controller ~]# vi admin-openrc.s
export OS_TENANT_NAME=admin
export OS_USERNAME=admin
export OS_PASSWORD=ADMIN_PASS
export OS_AUTH_URL=http://controller:35357/v2.0

  5-2. 添加demo用户的环境变量

[root@controller ~]# vi demo-openrc.sh
export OS_TENANT_NAME=demo
export OS_USERNAME=demo
export OS_PASSWORD=DEMO_PASS
export OS_AUTH_URL=http://controller:5000/v2.0

Centos7 Openstack - (第二节)添加认证服务(Keystone)的更多相关文章

  1. Centos7 Openstack - (第一节)基本环境配置

    Centos7 install Openstack - (第一节)基本环境配置 我的blog地址:http://www.cnblogs.com/caoguo 根据openstack官方文档配置 官方文 ...

  2. 【openstack N版】——认证服务keystone

    一. 基础环境 1.1环境介绍 linux-node1(控制节点) #系统版本 [root@linux-node1 ~]# cat /etc/redhat-release CentOS Linux r ...

  3. Centos7 install Openstack - (第四节)添加计算服务(Nova)

    Centos7 install Openstack - (第四节)添加计算服务(Nova) 我的blog地址:http://www.cnblogs.com/caoguo 该文根据openstack官方 ...

  4. Centos7 install Openstack - (第三节)添加镜像服务(Glance)

    Centos7 install Openstack - (第三节)添加镜像服务(Glance) 我的blog地址:http://www.cnblogs.com/caoguo 该文根据openstack ...

  5. OpenStack实践系列②认证服务Keystone

    OpenStack实践系列②认证服务Keystone 三.实战OpenStack之控制节点3.1 CentOS7的时间同步服务器chrony 下载chrony # yum install -y chr ...

  6. OpenStack入门篇(七)之认证服务Keystone

    一.Keystone的概述 Keystone是Openstack的组件之一,用于为Openstack家族中的其它组件成员提供统一的认证服务,包括身份验证,令牌的发放和校验,服务列表,用户权限的定义等. ...

  7. [ Openstack ] OpenStack-Mitaka 高可用之 认证服务(keystone)

    目录 Openstack-Mitaka 高可用之 概述    Openstack-Mitaka 高可用之 环境初始化    Openstack-Mitaka 高可用之 Mariadb-Galera集群 ...

  8. OpenStack 认证服务 KeyStone 服务注册(五)

    创建服务实体和API端点 创建服务 openstack service create --name keystone --description "OpenStack Identity&qu ...

  9. OpenStack Swift集群与Keystone的整合使用说明

    之前已经介绍了OpenStack Swift集群和Keystone的安装部署,最后来讲一讲Swift集群与Keystone的整合使用吧. 1. 简介 本文档描述了Keystone与Swift集群的整合 ...

随机推荐

  1. 安装Ubuntu 16.04时出现:没有定义根文件系统,请到分区菜单修改

    在安装Ubuntu 16.04时,尤其是选项空闲硬盘新建分区安装时,容易出现这种情况,这个是由于没有配置挂载点导致的,解决方法如下: 在挂在点输入“/”. 原理: Linux和Windows的文件系统 ...

  2. java ee开发常用类和接口

    1.javax.Validation接口,做mvc传入数据验证用 2.javax.servlet接口 3.javax.datasource接口 4.javax.session接口 5.javax.ht ...

  3. 假设写一段代码引导PC开机这段代码是 ? Here is a tiny "OS" :-D

    Hello world -- OS 我找到了华科绍志远博士的相关代码,发现他依据MIT的JOS的boot.S 稍作改动.然后单独剥离出来,能够非常好玩~ 资料下载地址: http://download ...

  4. TwoSum leetcode

    class Solution { public: vector<int> twoSum(vector<int>& nums, int target) { vector& ...

  5. java文件和目录的增删复制

    在使用java进行开发时常常会用到文件和目录的增删复制等方法.我写了一个小工具类.和大家分享,希望大家指正: package com.wangpeng.utill; import java.io.Fi ...

  6. 把ANSI格式的TXT文件批量转换成UTF-8文件类型

    把ANSI格式的TXT文件批量转换成UTF-8文件类型 Posted on 2010-08-05 10:38 moss_tan_jun 阅读(3635) 评论(0) 编辑 收藏 #region 把AN ...

  7. Gift

    [问题描述] 人生赢家老王在网上认识了一个妹纸,然后妹纸的生日到了,为了表示自己的心 意,他决定送她礼物.可是她喜爱的东西特别多,然而他的钱数有限,因此他想 知道当他花一定钱数后剩余钱数无法再购买任何 ...

  8. 66.extjs 里对getvalue() 和getRawValue()

    转自:https://blog.csdn.net/u014236541/article/details/49663589?locationNum=8

  9. PCB WebAPI跨域访问 实现方式

    我们写WebAPI不仅自己系统调用,也需要给其它系统调用,那么如何实现跨域访问了,在这里介绍2种方法实现 方法一.修改Web.Config文件   实现 此方法是全局实现跨域,如果仅想某个方法实现跨域 ...

  10. [Swift通天遁地]八、媒体与动画-(10)在项目中播放GIF动画

    ★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★➤微信公众号:山青咏芝(shanqingyongzhi)➤博客园地址:山青咏芝(https://www.cnblogs. ...