码迷,mamicode.com
首页 > 其他好文 > 详细

keystone认证服务

时间:2019-01-25 16:00:04      阅读:701      评论:0      收藏:0      [点我收藏+]

标签:src   ice   rip   als   决定   alice   演示   stack   mail   

实验操作平台:OpenStack单节点操作

一、相关概念

1、认证(authentication)

认证是确认允许一个用户访问的进程

2、证书(credentials)

用于确认用户身份的数据

3、令牌(token)

通常指的是一串比特值或者字符串,用来作为访问资源的记号。(令牌的有效期是有限的,可以随时被撤回)

4、租户(tenant)

早期版本又称为project,它是各服务中的一些可以访问的资源集合

平台构建完毕会产生admin、service和demo三个租户。

admin租户代表管理组,拥有平台的最高权限,可以更新、删除和修改系统的任何数据。

service代表平台内所有的服务的总集合,平台安装的所有服务默认会加入到此租户中,为后期的统一管理提供帮助,此租户可以修改当期租户下所有服务的配置信息,提交租户的内容以及修改。

demo则是一个演示测试租户

5、用户(user)

使用服务的用户,可以是人、服务或系统使用OpenStack相关服务的一个组织

6、角色(role)

代表一组用户可以访问的资源权限

平台构建完毕,系统会创建_member_、admin两个用户权限,

_member_表示系统的普通用户的权限,拥有系统的正常使用和对当前租户的管理权限

admin角色是代表系统的管理员身份,对系统又绝对的管理权限

7、关系

OpenStack中项目(project)、用户(user)和角色(role)3者的关系如下:

项目是用户的集合,项目又称为租户或accounts,用户可以属于一个或多个项目,角色决定了用户的权限,可以分配角色给user-project组

8、认证服务流程

用户请求云主机的流程涉及认证Keystone服务、计算Nova服务、镜像Glance服务,在服务流程中,令牌(Token)作为流程认证传递,具体服务申请认证机制流程,如图:

服务申请认证机制流程

技术分享图片

 

二、配置keystone应用环境

管理用户的环境变量:admin-openrc.sh

来管理最终的凭证和终端

主配置文件位置

[root@controller ~]# cd /etc/keystone/
[root@controller keystone]# ls
admin-openrc.sh  default_catalog.templates  keystone.conf  logging.conf  policy.json  ssl

请求身份令牌来验证服务

[root@controller ~]# keystone --os-username=admin --os-password=000000 --os-auth-url=http://192.168.100.10:35357/v2.0 token-get
+-----------+------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
|  Property |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Value                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
+-----------+------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
|  expires  |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       2019-01-24T17:05:36Z                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
|     id    | MIIM0gYJKoZIhvcNAQcCoIIMwzCCDL8CAQExCTAHBgUrDgMCGjCCCygGCSqGSIb3DQEHAaCCCxkEggsVeyJhY2Nlc3MiOiB7InRva2VuIjogeyJpc3N1ZWRfYXQiOiAiMjAxOS0wMS0yNFQxNjowNTozNi40MDE4NDIiLCAiZXhwaXJlcyI6ICIyMDE5LTAxLTI0VDE3OjA1OjM2WiIsICJpZCI6ICJwbGFjZWhvbGRlciIsICJ0ZW5hbnQiOiB7ImRlc2NyaXB0aW9uIjogIkFkbWluIFRlbmFudCIsICJlbmFibGVkIjogdHJ1ZSwgImlkIjogIjE4ZTM4NTQ1YTIwZjRmYmI4ZGJhODk0NDExOGQ0M2JjIiwgIm5hbWUiOiAiYWRtaW4ifX0sICJzZXJ2aWNlQ2F0YWxvZyI6IFt7ImVuZHBvaW50cyI6IFt7ImFkbWluVVJMIjogImh0dHA6Ly9jb250cm9sbGVyOjg3NzQvdjIvMThlMzg1NDVhMjBmNGZiYjhkYmE4OTQ0MTE4ZDQzYmMiLCAicmVnaW9uIjogInJlZ2lvbk9uZSIsICJpbnRlcm5hbFVSTCI6ICJodHRwOi8vY29udHJvbGxlcjo4Nzc0L3YyLzE4ZTM4NTQ1YTIwZjRmYmI4ZGJhODk0NDExOGQ0M2JjIiwgImlkIjogIjQ1N2IzODViNzBiYzQxMDI4ZGIzOThkZGZiMmM1ODUzIiwgInB1YmxpY1VSTCI6ICJodHRwOi8vY29udHJvbGxlcjo4Nzc0L3YyLzE4ZTM4NTQ1YTIwZjRmYmI4ZGJhODk0NDExOGQ0M2JjIn1dLCAiZW5kcG9pbnRzX2xpbmtzIjogW10sICJ0eXBlIjogImNvbXB1dGUiLCAibmFtZSI6ICJub3ZhIn0sIHsiZW5kcG9pbnRzIjogW3siYWRtaW5VUkwiOiAiaHR0cDovL2NvbnRyb2xsZXI6OTY5NiIsICJyZWdpb24iOiAicmVnaW9uT25lIiwgImludGVybmFsVVJMIjogImh0dHA6Ly9jb250cm9sbGVyOjk2OTYiLCAiaWQiOiAiN2M0OWI0YjI3M2Y2NDA3ZGI1YjM2ZmZmMGUyM2ZlYTciLCAicHVibGljVVJMIjogImh0dHA6Ly9jb250cm9sbGVyOjk2OTYifV0sICJlbmRwb2ludHNfbGlua3MiOiBbXSwgInR5cGUiOiAibmV0d29yayIsICJuYW1lIjogIm5ldXRyb24ifSwgeyJlbmRwb2ludHMiOiBbeyJhZG1pblVSTCI6ICJodHRwOi8vY29udHJvbGxlcjo4Nzc2L3YyLzE4ZTM4NTQ1YTIwZjRmYmI4ZGJhODk0NDExOGQ0M2JjIiwgInJlZ2lvbiI6ICJyZWdpb25PbmUiLCAiaW50ZXJuYWxVUkwiOiAiaHR0cDovL2NvbnRyb2xsZXI6ODc3Ni92Mi8xOGUzODU0NWEyMGY0ZmJiOGRiYTg5NDQxMThkNDNiYyIsICJpZCI6ICI0MmYyMDIxOTYzOWU0NzY4OGViZGMzNmZjMDAxOWJiYyIsICJwdWJsaWNVUkwiOiAiaHR0cDovL2NvbnRyb2xsZXI6ODc3Ni92Mi8xOGUzODU0NWEyMGY0ZmJiOGRiYTg5NDQxMThkNDNiYyJ9XSwgImVuZHBvaW50c19saW5rcyI6IFtdLCAidHlwZSI6ICJ2b2x1bWV2MiIsICJuYW1lIjogImNpbmRlcnYyIn0sIHsiZW5kcG9pbnRzIjogW3siYWRtaW5VUkwiOiAiaHR0cDovL2NvbnRyb2xsZXI6OTI5MiIsICJyZWdpb24iOiAicmVnaW9uT25lIiwgImludGVybmFsVVJMIjogImh0dHA6Ly9jb250cm9sbGVyOjkyOTIiLCAiaWQiOiAiMjk3MTg2MTUyZGQ4NDI1MTk3OWNkYmVhMDY1ZWM2ODgiLCAicHVibGljVVJMIjogImh0dHA6Ly9jb250cm9sbGVyOjkyOTIifV0sICJlbmRwb2ludHNfbGlua3MiOiBbXSwgInR5cGUiOiAiaW1hZ2UiLCAibmFtZSI6ICJnbGFuY2UifSwgeyJlbmRwb2ludHMiOiBbeyJhZG1pblVSTCI6ICJodHRwOi8vY29udHJvbGxlcjo4Nzc2L3YxLzE4ZTM4NTQ1YTIwZjRmYmI4ZGJhODk0NDExOGQ0M2JjIiwgInJlZ2lvbiI6ICJyZWdpb25PbmUiLCAiaW50ZXJuYWxVUkwiOiAiaHR0cDovL2NvbnRyb2xsZXI6ODc3Ni92MS8xOGUzODU0NWEyMGY0ZmJiOGRiYTg5NDQxMThkNDNiYyIsICJpZCI6ICIzMTdjYWZhYTliZjA0YmE2ODU2MjkyYTJkMjRjY2IwYiIsICJwdWJsaWNVUkwiOiAiaHR0cDovL2NvbnRyb2xsZXI6ODc3Ni92MS8xOGUzODU0NWEyMGY0ZmJiOGRiYTg5NDQxMThkNDNiYyJ9XSwgImVuZHBvaW50c19saW5rcyI6IFtdLCAidHlwZSI6ICJ2b2x1bWUiLCAibmFtZSI6ICJjaW5kZXIifSwgeyJlbmRwb2ludHMiOiBbeyJhZG1pblVSTCI6ICJodHRwOi8vY29udHJvbGxlcjo4MDgwL3YyL0FVVEhfMThlMzg1NDVhMjBmNGZiYjhkYmE4OTQ0MTE4ZDQzYmMiLCAicmVnaW9uIjogInJlZ2lvbk9uZSIsICJpbnRlcm5hbFVSTCI6ICJodHRwOi8vY29udHJvbGxlcjo4MDgwL3YyL0FVVEhfMThlMzg1NDVhMjBmNGZiYjhkYmE4OTQ0MTE4ZDQzYmMiLCAiaWQiOiAiM2Q5ZTVmM2JhNWJlNDgzOWFlNjVlOGYwNjQxNzA5NTEiLCAicHVibGljVVJMIjogImh0dHA6Ly9jb250cm9sbGVyOjgwODAvdjIvQVVUSF8xOGUzODU0NWEyMGY0ZmJiOGRiYTg5NDQxMThkNDNiYyJ9XSwgImVuZHBvaW50c19saW5rcyI6IFtdLCAidHlwZSI6ICJvYmplY3Qtc3RvcmUiLCAibmFtZSI6ICJzd2lmdCJ9LCB7ImVuZHBvaW50cyI6IFt7ImFkbWluVVJMIjogImh0dHA6Ly9jb250cm9sbGVyOjM1MzU3L3YyLjAiLCAicmVnaW9uIjogInJlZ2lvbk9uZSIsICJpbnRlcm5hbFVSTCI6ICJodHRwOi8vY29udHJvbGxlcjo1MDAwL3YyLjAiLCAiaWQiOiAiMDVjMjI1NzcwMjVhNDA5MzkzZWU2NGY0NmU5N2FjNDAiLCAicHVibGljVVJMIjogImh0dHA6Ly9jb250cm9sbGVyOjUwMDAvdjIuMCJ9XSwgImVuZHBvaW50c19saW5rcyI6IFtdLCAidHlwZSI6ICJpZGVudGl0eSIsICJuYW1lIjogImtleXN0b25lIn1dLCAidXNlciI6IHsidXNlcm5hbWUiOiAiYWRtaW4iLCAicm9sZXNfbGlua3MiOiBbXSwgImlkIjogIjRkZmE1NzE4MDQ0NDRiODY4NGY0MmQyNTY2N2UyZTBjIiwgInJvbGVzIjogW3sibmFtZSI6ICJfbWVtYmVyXyJ9LCB7Im5hbWUiOiAiYWRtaW4ifV0sICJuYW1lIjogImFkbWluIn0sICJtZXRhZGF0YSI6IHsiaXNfYWRtaW4iOiAwLCAicm9sZXMiOiBbIjlmZTJmZjllZTQzODRiMTg5NGE5MDg3OGQzZTkyYmFiIiwgImI1NjJkMTRlY2M5MTRlMDNiYjRjZDRiMGJhZDAwYTg4Il19fX0xggGBMIIBfQIBATBcMFcxCzAJBgNVBAYTAlVTMQ4wDAYDVQQIDAVVbnNldDEOMAwGA1UEBwwFVW5zZXQxDjAMBgNVBAoMBVVuc2V0MRgwFgYDVQQDDA93d3cuZXhhbXBsZS5jb20CAQEwBwYFKw4DAhowDQYJKoZIhvcNAQEBBQAEggEAktxDU55tvzHyCI6x7dtYo9fhvKovjC24EsQTYOiUAFN4jNcrViNEvWX4U4Ohy6HE1p+6V2KPLR+z3-5-PEL21llnujgVm6Nvcw3AIPOmOFwVI5S5skrIWX56r1fowUmImqeeBhzc7yf98-4dVGdgtsvXCoUZFXw+1xBHLpRZvKNvvvp6w+rhn0GXIVcW+4eDgUw4yhyhOX7Skgq+vRz2u9y2masGKEwHacN9e55Hnwh6ISL8fYeE8zSk8ABUs91tk0g33T6kLA-lGZDnQ+YZ6-P0lpIAzVsYI5qqhxvilB-W2nqtXlVNBxwcQ1JyCXdfxYTiZ-Fb3nC7cG27QXfwzg== |
| tenant_id |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 18e38545a20f4fbb8dba8944118d43bc                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
|  user_id  |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 4dfa571804444b8684f42d25667e2e0c                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
+-----------+------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
[root@controller ~]# 

 以admin用户访问http://172.24.0.10:35357/v2.0地址获取token值

技术分享图片

三、管理认证用户

1、创建用户

创建一个名称为“alice”账户,密码为“mypassword123”,邮箱为“alice@example.com”

 # keystone user-create --name=alice --pass=mypassword123 --email=alice@example.com

格式如下

keystone user-create --name <user-name> --tenant <tenant> --pass <pass> --email <email> --enabled <true|false>

参数 <tenant>代表绑定租户

[root@controller ~]# keystone user-create --name=alice --pass=mypassword123 --email=alice@example.com
+----------+----------------------------------+
| Property |              Value               |
+----------+----------------------------------+
|  email   |        alice@example.com         |
| enabled  |               True               |
|    id    | cf126a8e69574dd6ba48acff29046951 |
|   name   |              alice               |
| username |              alice               |
+----------+----------------------------------+

 查看

技术分享图片

2、创建租户

 创建一个名为“acme”租户

其他参数:

租户描述名:[--description <tenant-description>]

[--enabled <true|false>]

# keystone tenant-create --name=acme

[root@controller ~]# keystone tenant-create --name=acme
+-------------+----------------------------------+
|   Property  |              Value               |
+-------------+----------------------------------+
| description |                                  |
|   enabled   |               True               |
|      id     | 12ad967d5d6742328f007749917cc5b1 |
|     name    |               acme               |
+-------------+----------------------------------+

 技术分享图片

3、创建角色

角色限定了用户的操作权限。例如,创建一个角色“compute-user”。

# keystone role-create --name=compute-user

[root@controller ~]# keystone role-create --name=compute-user
+----------+----------------------------------+
| Property |              Value               |
+----------+----------------------------------+
|    id    | c26db3d217044f32a3f27fa88874eba6 |
|   name   |           compute-user           |
+----------+----------------------------------+

 

 4、绑定用户和租户权限

把用户关联绑定到对应的租户和角色

给用户“alice”分配“acme”租户下的“compute-user”角色

# keystone user-role-add --user=alice --role=compute-user --tenant-id=12ad967d5d6742328f007749917cc5b1

[root@controller ~]# keystone user-role-add --user=alice --role=compute-user --tenant-id=12ad967d5d6742328f007749917cc5b1
[root@controller ~]#

 

技术分享图片

技术分享图片

end

keystone认证服务

标签:src   ice   rip   als   决定   alice   演示   stack   mail   

原文地址:https://www.cnblogs.com/djlsunshine/p/10316361.html

(0)
(0)
   
举报
评论 一句话评论(0
登录后才能评论!
© 2014 mamicode.com 版权所有  联系我们:gaon5@hotmail.com
迷上了代码!