openstack-keystone
一 keystone 的介绍
keystone是openstack的组件之一,组要为openstack的其他组件提供认证的功能,云环境中所有服务之间的授权和认证都需要经过keystone
keystone主要的任务:
1 管理用户及权限
2 维护opnetack service 的endpoint
3 认证 和鉴权
用户类别:
1 user :是系统真正的用户,当user访问openstack,keystone 会对其进行验证,openstack会为对应的服务创建对应的user
2 admin : 超级管理用户,负责openstack服务的管理和访问权限
3 demo: 常规任务应该使用无特权的项目和用户
概念定义:
1 Credentials 是 User 用来证明自己身份的信息,可以是: 用户名/密码;Token;API Key;其他高级方式
2 Authentication 是 Keystone 验证 User 身份的过程。User 访问 OpenStack 时向 Keystone 提交用户名和密码形式的 Credentials,Keystone 验证通过后会给 User 签发一个 Token 作为后续访问的 Credential。
3 Token 是由数字和字母组成的字符串,User 成功 Authentication 后 Keystone 生成 Token 并分配给 User。Token 用做访问 Service 的 Credential,Service 会通过 Keystone 验证 Token 的有效性,Token 的有效期默认是 24 小时
4 server:OpenStack 的 Service 包括 Compute (Nova)、Block Storage (Cinder)、Object Storage (Swift)、Image Service (Glance) 、Networking Service (Neutron) 等。每个 Service 都会提供若干个 Endpoint,User 通过 Endpoint 访问资源和执行操作。
5 Endpoint 是一个网络上可访问的地址,通常是一个 URL。Service 通过 Endpoint 暴露自己的 API。 Keystone 负责管理和维护每个 Service 的 Endpoint。
keystone 架构
Token: 用来生成和管理token
CREATE DATABASE keystone;
用户授权:
MariaDB [(none)]> GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'localhost' \
-> IDENTIFIED BY 'KEYSTONE_DBPASS';
Query OK, 0 rows affected (0.00 sec)
MariaDB [(none)]> GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'%' \
-> IDENTIFIED BY 'KEYSTONE_DBPASS';
Query OK, 0 rows affected (0.00 sec)
/etc/keystone/keystone.conf
[database]
connection = mysql+pymysql://keystone:KEYSTONE_DBPASS@node1/keystone
[token]
provider = fernet
同步数据库:
# su -s /bin/sh -c "keystone-manage db_sync" keystone
初始化密钥库:
[root@node1 ~]# keystone-manage fernet_setup --keystone-user keystone --keystone-group keystone
[root@node1 ~]# keystone-manage credential_setup --keystone-user keystone --keystone-group keystone
创建服务端点地址:
[root@node1 ~]# keystone-manage bootstrap --bootstrap-password admin \
--bootstrap-admin-url http://node1:35357/v3/ \
--bootstrap-internal-url http://node1:5000/v3/ \
--bootstrap-public-url http://node1:5000/v3/ \
--bootstrap-region-id RegionOne
配置文件
/etc/httpd/conf/httpd.conf
ServerName node1
[root@node1 ~]# ln -s /usr/share/keystone/wsgi-keystone.conf /etc/httpd/conf.d/
启动服务 -只需要启动http服务
设定admin用户的环境变量,用于登录操作openstack,可以写到一个文件中source一下
export OS_USERNAME=admin
export OS_PASSWORD=admin
export OS_PROJECT_NAME=admin
export OS_USER_DOMAIN_NAME=Default
export OS_PROJECT_DOMAIN_NAME=Default
export OS_AUTH_URL=http://node1:35357/v3
export OS_IDENTITY_API_VERSION=3
[root@node1 data]# source openrc
解决:# yum install python2-openstackclient -y
问题2:
[root@node1 ~]# curl http://node1:35357/v3
curl: (7) Failed connect to node1:35357; 拒绝连接
编辑# vim wsgi-keystone.conf 创建一个监听虚拟机
![](https://images.cnblogs.com/OutliningIndicators/ContractedBlock.gif)
Listen 5000 Listen 35357 <VirtualHost *:5000> WSGIDaemonProcess keystone-public processes=5 threads=1 user=keystone group=keystone display-name=%{GROUP} WSGIProcessGroup keystone-public WSGIScriptAlias / /usr/bin/keystone-wsgi-public WSGIApplicationGroup %{GLOBAL} WSGIPassAuthorization On LimitRequestBody 114688 <IfVersion >= 2.4> ErrorLogFormat "%{cu}t %M" </IfVersion> ErrorLog /var/log/httpd/keystone.log CustomLog /var/log/httpd/keystone_access.log combined <Directory /usr/bin> <IfVersion >= 2.4> Require all granted </IfVersion> <IfVersion < 2.4> Order allow,deny Allow from all </IfVersion> </Directory> </VirtualHost> Alias /identity /usr/bin/keystone-wsgi-public <Location /identity> SetHandler wsgi-script Options +ExecCGI WSGIProcessGroup keystone-public WSGIApplicationGroup %{GLOBAL} WSGIPassAuthorization On </Location> <VirtualHost *:35357> WSGIDaemonProcess keystone-admin processes=5 threads=1 user=keystone group=keystone display-name=%{GROUP} WSGIProcessGroup keystone-admin WSGIScriptAlias / /usr/bin/keystone-wsgi-admin WSGIApplicationGroup %{GLOBAL} WSGIPassAuthorization On LimitRequestBody 114688 <IfVersion >= 2.4> ErrorLogFormat "%{cu}t %M" </IfVersion> ErrorLog /var/log/httpd/keystone.log CustomLog /var/log/httpd/keystone_access.log combined <Directory /usr/bin> <IfVersion >= 2.4> Require all granted </IfVersion> <IfVersion < 2.4> Order allow,deny Allow from all </IfVersion> </Directory> </VirtualHost>
# openstack project create --domain default --description "Service Project" service
# openstack project create --domain default --description "Demo Project" demo
查看:
[root@node1 ~]# openstack project list
创建用户
删除用户:
# openstack user delete demo
openstack role create user
把用户设置user角色
# openstack role add --project demo --user demo user