Openstack-Keystone-身份验证
教程大纲
1. keystone的服务组件介绍
2. keystone的安装部署
3. keystone V3的新特性
1.创建keystone的数据库并授权访问连接
mysql -u root -p -e "create database keystone;"
mysql -u root -p -e "grant all privileges on keystone.* to ‘keystone‘@‘localhost‘ identified by ‘keystone‘;"
mysql -u root -p -e "grant all privileges on keystone.* to ‘keystone‘@‘%‘ identified by ‘keystone‘;"
2. 安装keystone支持安装包
yum install openstack-keystone httpd mod_wsgi memcached python-memcached
3.修改keystone的配置文件
创建一个随机token的值 命令为
$ openssl rand -hex 10
13: admin_token = 7b016f6702c9ac4cbd6e
124: verbose = true
549: connection = mysql://keystone:[email protected]/keystone
1252: servers = 192.168.100.40:11211
1773: driver = sql
2005: provider = fernet
2010: driver = memcache
4.同步keystone的数据库
su -s /bin/sh -c "keystone-manage db_sync" keystone
5.初始化fernet
keystone-manage fernet_setup --keystone-user keystone --keystone-group keystone
6.开启memcahed 的服务
systemctl enable memcached.service
systemctl start memcached.service
7.创建配置apache服务wsgi-keyston.config
/etc/httpd/conf.d/wsgi-keystone.conf
Listen 5000 #5000的端口是给正常的API来访问的。
Listen 35357 #35357端口是给admin的管理来用的。
<VirtualHost *:5000>
WSGIDaemonProcess keystone-public processes=5 threads=1 user=keystone group=keystone display-name=%{GROUP}
WSGIProcessGroup keystone-public
WSGIScriptAlias / /usr/bin/keystone-wsgi-public
WSGIApplicationGroup %{GLOBAL}
WSGIPassAuthorization On
ErrorLogFormat "%{cu}t %M"
ErrorLog /var/log/httpd/keystone-error.log
CustomLog /var/log/httpd/keystone-access.log combined
<Directory /usr/bin>
Require all granted
</Directory>
</VirtualHost>
<VirtualHost *:35357>
WSGIDaemonProcess keystone-admin processes=5 threads=1 user=keystone group=keystone display-name=%{GROUP}
WSGIProcessGroup keystone-admin
WSGIScriptAlias / /usr/bin/keystone-wsgi-admin
WSGIApplicationGroup %{GLOBAL}
WSGIPassAuthorization On
ErrorLogFormat "%{cu}t %M"
ErrorLog /var/log/httpd/keystone-error.log
CustomLog /var/log/httpd/keystone-access.log combined
<Directory /usr/bin>
Require all granted
</Directory>
</VirtualHost>
8.修改http的服务的http.conf 的ServerName 地址
ServerName 192.168.100.40:80
9.启动httpd服务
# systemctl enable httpd.service # systemctl start httpd.service
10.设置keyston的环境变量
export OS_TOKEN=ef33d18ffbd5a54dac62
export OS_URL=http://192.168.100.40:35357/v3
export OS_IDENTITY_API_VERSION=3
11.创建admin的demo用户组和用户角色并授权
keyston创建用户（默认用户时domian）
openstack domain create --description "Default Domain" default
创建一个admin的项目
openstack project create --domain default --description "Admin Project" admin
创建admin的用户
openstack user create --domain default --password-prompt admin
创建admin的角色
openstack role create admin
将admin用户添加admin组赋予admin角色
openstack role add --project admin --user admin admin
创建普通用户demo
openstack project create --domain default --description "Demo Project" demo
为demo 创建用户名和密码
openstack user create --domain default --password=demo demo
创建一个普通用户的角色
openstack role create user
将demo角色加入demo 组赋予user普通用户
openstack role add --project demo --user demo user
创建service项目服务加入进去
openstack project create --domain default --description "Service Project" service
添加keystone的服务
openstack service create --name keystone --description "Openstack Identity" identity
12.创建api节点和endpoint（断点） public 、admin、internal
public 5000端口
openstack endpoint create --region RegionOne \
identity public http://192.168.100.40:5000/v3
internal 5000端口
openstack endpoint create --region RegionOne \
identity internal http://192.168.100.40:5000/v3
Admin 35357 端口
openstack endpoint create --region RegionOne \
identity admin http://192.168.100.40:35357/v3
13.测试查看
查看所有的用户组
openstack user list
查看所有的用户
openstack role list
查看所有的工程
openstack project list
查看所有的endpoint 服务
openstack endpoint list
14.去OS_TOKEN 和OS_URL 环境变量
unset OS_TOKEN
unset OS_URL
15.demo和admin验证token的返回值
openstack --os-auth-url http://192.168.100.40:5000/v3 \
--os-project-domain-name default --os-user-domain-name default \
--os-project-name demo --os-username demo token issue
输入demo的密码：
openstack --os-auth-url http://192.168.100.40:35357/v3 \
--os-project-domain-name default --os-user-domain-name default \
--os-project-name admin --os-username admin token issue
数据admin的密码：
16.配置keyston的环境变量，方便执行操作
Admin的环境变量的配置
export OS_PROJECT_DOMAIN_NAME=default
export OS_USER_DOMAIN_NAME=default
export OS_PROJECT_NAME=admin
export OS_USERNAME=admin
export OS_PASSWORD=admin
export OS_AUTH_URL=http://192.168.100.40:35357/v3
export OS_IDENTITY_API_VERSION=3
export OS_IMAGE_API_VERSION=2 这个是在验证glance命令是l 版后面加上
Demo 的环境的配置
export OS_PROJECT_DOMAIN_NAME=default
export OS_USER_DOMAIN_NAME=default
export OS_PROJECT_NAME=demo
export OS_USERNAME=demo
export OS_PASSWORD=demo
export OS_AUTH_URL=http://192.168.100.40:5000/v3
export OS_IDENTITY_API_VERSION=3
export OS_IMAGE_API_VERSION=2
执行时 添加执行权限 用时 source admin-openrc.sh
请观看视屏
视屏会在腾讯课堂和优酷、56视屏网站中上传。请大家搜索中祥课堂即可观看
