雲計算管理平台之OpenStack認證服務Keystone
- 2020 年 10 月 28 日
- 筆記
- Keystone, openstack, OpenStack認證服務, 雲計算
一、keystone簡介
keystone是openstack中的核心服務，它主要作用是實現用戶認證和授權以及服務目錄；所謂服務目錄指所有可用服務的資訊庫，包含所有可用服務及其API endport路徑；簡單點講就是存儲各服務的API endport路徑和各服務的其他資訊；對於openstack的認證服務來講，有幾個核心的術語要了解下；
user：這裡指使用openstack的用戶，一個用戶可以以關聯多個tenant（租戶）
tenant：租戶，這裡的租戶指openstack上的項目project，或者一個組織；通常一個租戶對應一個project或一個組織；
role：角色，這裡的角色類似Linux用戶里的用戶組概念，擁有授權為一個用戶為一個角色，那麼這個用戶就擁有這個角色所對應的許可權；
token：令牌，用於認證和授權；這是另一種認證的方式；在openstack中各服務之間通過令牌來做認證的；
service：服務，這個和我們理解的服務一樣，沒有特別的不一樣；
endport：服務端點，通常指服務訪問入口；
上述這些術語對應的數據，通常會用一個資料庫來存儲，我們把這個資料庫統稱為driver，對於不同類型的數據我們可以選擇不同的driver來存儲；比如對於token我們可以選擇存儲到k/v鍵值存儲系統中，也可以選擇存儲在memcached中或者mysql中；catalog我們可以選擇存儲在k/v鍵值存儲系統中，也可選擇存儲到mysql中，也可以選擇存儲到一個模板中；identity我們可以存儲k/v鍵值存儲系統中，也可選擇存儲到mysql中或者pam中也可以；
提示：上圖是一個用戶在openstack上創建一個虛擬機內部驗證的過程；首先用戶要登入openstack上要把用戶的用戶名和密碼發送給keystone進行驗證，如果在keystone中驗證通過後，keystone會給用戶返回一個token，此時用戶就可以拿著這個返回的token去計算節點請求nova服務，進行創建虛擬機請求，在nova服務接受到用戶的請求後，nova它不能直接相信用戶的token是否是keystone給的，它會把這個token發送給keystone進行驗證，如果keystone驗證通過，此時nova才會拿著這個token去請求glance進行虛擬機鏡像請求，同樣的glance也不相信nova拿到這個token，它會去找keystone驗證，只有keystone通過後，glance才會把鏡像發送給nova,nova拿到鏡像啟動虛擬機；啟動虛擬機過程中nova還會拿著用戶的token去請求neutron服務給虛擬機分配網路，同樣neutron也是不相信nova的token，它也會去keystone上驗證token，只有驗證通過後才給nova創建的虛擬機分配網路；最後nova啟動好虛擬以後在返回，告訴用戶虛擬機啟動成功；從上面的過程來看，幾乎所有服務都會去keystone上驗證用戶的token，所以keystone服務會非常繁忙；
二、keystone服務安裝、配置、測試
1、創建資料庫
[root@node02 ~]# mysql Welcome to the MariaDB monitor. Commands end with ; or \g. Your MariaDB connection id is 2 Server version: 10.1.20-MariaDB MariaDB Server Copyright (c) 2000, 2016, Oracle, MariaDB Corporation Ab and others. Type 'help;' or '\h' for help. Type '\c' to clear the current input statement. MariaDB [(none)]> CREATE DATABASE keystone; Query OK, 1 row affected (0.00 sec) MariaDB [(none)]> SHOW DATABASES; +--------------------+ | Database | +--------------------+ | information_schema | | keystone | | mysql | | performance_schema | | test | +--------------------+ 5 rows in set (0.04 sec) MariaDB [(none)]>
2、創建keystone用戶並授權允許從任何主機連接資料庫
MariaDB [(none)]> GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'%' IDENTIFIED BY 'keystone123'; Query OK, 0 rows affected (0.00 sec) MariaDB [(none)]> flush privileges; Query OK, 0 rows affected (0.00 sec) MariaDB [(none)]>
驗證：在node01上使用keystone用戶連接資料庫，看看是否能夠正常連接？
[root@node01 ~]# mysql -ukeystone -pkeystone123 -hnode02 Welcome to the MariaDB monitor. Commands end with ; or \g. Your MariaDB connection id is 4 Server version: 10.1.20-MariaDB MariaDB Server Copyright (c) 2000, 2016, Oracle, MariaDB Corporation Ab and others. Type 'help;' or '\h' for help. Type '\c' to clear the current input statement. MariaDB [(none)]> show databases; +--------------------+ | Database | +--------------------+ | information_schema | | keystone | | test | +--------------------+ 3 rows in set (0.00 sec) MariaDB [(none)]>
提示：能夠從別的主機用keystone帳號連接到mysql，並看到我們剛才創建的資料庫，說明我們創建的keystone帳號沒有問題；
3、在控制節點安裝openstack-keystone、httpd和mod_wsgi
[root@node01 ~]# yum install -y openstack-keystone httpd mod_wsgi Loaded plugins: fastestmirror Loading mirror speeds from cached hostfile * base: mirrors.aliyun.com * centos-qemu-ev: mirrors.aliyun.com * extras: mirrors.aliyun.com * updates: mirrors.aliyun.com Resolving Dependencies --> Running transaction check ---> Package httpd.x86_64 0:2.4.6-93.el7.centos will be installed --> Processing Dependency: httpd-tools = 2.4.6-93.el7.centos for package: httpd-2.4.6-93.el7.centos.x86_64 --> Processing Dependency: /etc/mime.types for package: httpd-2.4.6-93.el7.centos.x86_64 --> Processing Dependency: libaprutil-1.so.0()(64bit) for package: httpd-2.4.6-93.el7.centos.x86_64 --> Processing Dependency: libapr-1.so.0()(64bit) for package: httpd-2.4.6-93.el7.centos.x86_64 ---> Package mod_wsgi.x86_64 0:3.4-18.el7 will be installed ……省略部分內容…… Dependency Installed: MySQL-python.x86_64 0:1.2.5-1.el7 apr.x86_64 0:1.4.8-5.el7 apr-util.x86_64 0:1.5.2-6.el7 httpd-tools.x86_64 0:2.4.6-93.el7.centos mailcap.noarch 0:2.1.41-2.el7 python-aniso8601.noarch 0:0.82-3.el7 python-beaker.noarch 0:1.5.4-10.el7 python-editor.noarch 0:0.4-4.el7 python-jwcrypto.noarch 0:0.4.2-1.el7 python-keystone.noarch 1:14.2.0-1.el7 python-mako.noarch 0:0.8.1-2.el7 python-migrate.noarch 0:0.11.0-1.el7 python-oslo-cache-lang.noarch 0:1.30.4-1.el7 python-oslo-concurrency-lang.noarch 0:3.27.0-1.el7 python-oslo-db-lang.noarch 0:4.40.2-1.el7 python-oslo-middleware-lang.noarch 0:3.36.0-1.el7 python-oslo-policy-lang.noarch 0:1.38.1-1.el7 python-paste.noarch 0:1.7.5.1-9.20111221hg1498.el7 python-paste-deploy.noarch 0:1.5.2-6.el7 python-pycadf-common.noarch 0:2.8.0-1.el7 python-routes.noarch 0:2.4.1-1.el7 python-sqlparse.noarch 0:0.1.18-5.el7 python-tempita.noarch 0:0.5.1-8.el7 python2-alembic.noarch 0:0.9.7-1.el7 python2-amqp.noarch 0:2.4.0-1.el7 python2-bcrypt.x86_64 0:3.1.6-2.el7 python2-cachetools.noarch 0:2.1.0-1.el7 python2-click.noarch 0:6.7-8.el7 python2-defusedxml.noarch 0:0.5.0-2.el7 python2-eventlet.noarch 0:0.20.1-6.el7 python2-fasteners.noarch 0:0.14.1-6.el7 python2-flask.noarch 1:1.0.2-1.el7 python2-flask-restful.noarch 0:0.3.6-7.el7 python2-future.noarch 0:0.18.2-2.el7 python2-futurist.noarch 0:1.7.0-1.el7 python2-greenlet.x86_64 0:0.4.12-1.el7 python2-itsdangerous.noarch 0:0.24-14.el7 python2-jinja2.noarch 0:2.10-2.el7 python2-keystonemiddleware.noarch 0:5.2.2-1.el7 python2-kombu.noarch 1:4.2.2-1.el7 python2-ldap.x86_64 0:3.1.0-1.el7 python2-ldappool.noarch 0:2.3.1-1.el7 python2-markupsafe.x86_64 0:0.23-16.el7 python2-oauthlib.noarch 0:2.0.1-8.el7 python2-oslo-cache.noarch 0:1.30.4-1.el7 python2-oslo-concurrency.noarch 0:3.27.0-1.el7 python2-oslo-db.noarch 0:4.40.2-1.el7 python2-oslo-messaging.noarch 0:8.1.4-1.el7 python2-oslo-middleware.noarch 0:3.36.0-1.el7 python2-oslo-policy.noarch 0:1.38.1-1.el7 python2-oslo-service.noarch 0:1.31.8-1.el7 python2-osprofiler.noarch 0:2.3.1-1.el7 python2-passlib.noarch 0:1.7.1-1.el7 python2-pyasn1.noarch 0:0.3.7-6.el7 python2-pyasn1-modules.noarch 0:0.3.7-6.el7 python2-pycadf.noarch 0:2.8.0-1.el7 python2-pyngus.noarch 0:2.3.0-1.el7 python2-pysaml2.noarch 0:4.5.0-4.el7 python2-qpid-proton.x86_64 0:0.32.0-2.el7 python2-scrypt.x86_64 0:0.8.0-2.el7 python2-sqlalchemy.x86_64 0:1.2.7-1.el7 python2-statsd.noarch 0:3.2.1-5.el7 python2-tenacity.noarch 0:4.12.0-1.el7 python2-vine.noarch 0:1.2.0-1.el7 python2-webob.noarch 0:1.8.2-1.el7 python2-werkzeug.noarch 0:0.14.1-3.el7 qpid-proton-c.x86_64 0:0.32.0-2.el7 Complete! [root@node01 ~]#
4、生成token
[root@node01 ~]# openssl rand -hex 10 752e7981c9f3bb1b1a91 [root@node01 ~]#
5、編輯keystone配置文件/etc/keystone/keystone.conf，在default配置段里添加admin_token，把我們生成的token配置上；
在database配置段配置連接資料庫的地址；
提示：連接資料庫前邊的mysql+pymysql：//這一段不用變，默認格式就是這個，雙斜線後面的是keystone用戶，冒號後面是對應keystone用戶的密碼；@後面是資料庫伺服器地址；斜線後面是指連接那個資料庫；我這裡是因為配置了主機名解析，所以資料庫伺服器我用主機名代替了；
在token配置段配置provider = fernet
keystone的最終配置
[root@node01 ~]# grep "^[a-Z\[]" /etc/keystone/keystone.conf [DEFAULT] admin_token = 752e7981c9f3bb1b1a91 [application_credential] [assignment] [auth] [cache] [catalog] [cors] [credential] [database] connection = mysql+pymysql://keystone:keystone123@node02/keystone [domain_config] [endpoint_filter] [endpoint_policy] [eventlet_server] [federation] [fernet_tokens] [healthcheck] [identity] [identity_mapping] [ldap] [matchmaker_redis] [memcache] [oauth1] [oslo_messaging_amqp] [oslo_messaging_kafka] [oslo_messaging_notifications] [oslo_messaging_rabbit] [oslo_messaging_zmq] [oslo_middleware] [oslo_policy] [policy] [profiler] [resource] [revoke] [role] [saml] [security_compliance] [shadow_users] [signing] [token] provider = fernet [tokenless_auth] [trust] [unified_limit] [wsgi] [root@node01 ~]#
提示：這個配置文件是ini風格的配置文件，裡面有很多配置段，其實生效的就只有我們剛才配置的三段；
6、在控制節點初始化keystone資料庫
[root@node01 ~]# su -s /bin/sh -c "keystone-manage db_sync" keystone [root@node01 ~]#
提示：以上命令會通過我們剛才配置的連接資料庫的地址，通過keystone連接到資料庫中創建一堆表；
驗證：在node02上驗證，看看keystone庫中是否多了很多表？
MariaDB [(none)]> use keystone Reading table information for completion of table and column names You can turn off this feature to get a quicker startup with -A Database changed MariaDB [keystone]> show tables; +-----------------------------+ | Tables_in_keystone | +-----------------------------+ | access_token | | application_credential | | application_credential_role | | assignment | | config_register | | consumer | | credential | | endpoint | | endpoint_group | | federated_user | | federation_protocol | | group | | id_mapping | | identity_provider | | idp_remote_ids | | implied_role | | limit | | local_user | | mapping | | migrate_version | | nonlocal_user | | password | | policy | | policy_association | | project | | project_endpoint | | project_endpoint_group | | project_tag | | region | | registered_limit | | request_token | | revocation_event | | role | | sensitive_config | | service | | service_provider | | system_assignment | | token | | trust | | trust_role | | user | | user_group_membership | | user_option | | whitelisted_config | +-----------------------------+ 44 rows in set (0.00 sec) MariaDB [keystone]>
7、在控制節點上初始化Fernet密鑰
[root@node01 ~]# keystone-manage fernet_setup --keystone-user keystone --keystone-group keystone [root@node01 ~]# keystone-manage credential_setup --keystone-user keystone --keystone-group keystone [root@node01 ~]#
提示：以上命令會在/etc/keystone/fernet-keys/目錄下生成兩個key文件；
驗證：查看/etc/keystone/fernet-keys/目錄下是否有兩個key生成？
[root@node01 ~]# ll /etc/keystone/fernet-keys/ total 8 -rw------- 1 keystone keystone 44 Oct 28 19:23 0 -rw------- 1 keystone keystone 44 Oct 28 19:23 1 [root@node01 ~]#
8、配置httpd代理keystone
提示：以上主要修改了httpd的servername監聽地址，其實這裡不修改也行，不影響；重要的是下面的配置；
把/usr/share/keystone/wsgi-keystone.conf連接至/etc/httpd/conf.d/下
[root@node01 ~]# ln -sv /usr/share/keystone/wsgi-keystone.conf /etc/httpd/conf.d/ 『/etc/httpd/conf.d/wsgi-keystone.conf』 -> 『/usr/share/keystone/wsgi-keystone.conf』 [root@node01 ~]# ll /etc/httpd/conf.d/ total 16 -rw-r--r-- 1 root root 2926 Apr 2 2020 autoindex.conf -rw-r--r-- 1 root root 366 Apr 2 2020 README -rw-r--r-- 1 root root 1252 Nov 27 2019 userdir.conf -rw-r--r-- 1 root root 824 Nov 27 2019 welcome.conf lrwxrwxrwx 1 root root 38 Oct 28 19:30 wsgi-keystone.conf -> /usr/share/keystone/wsgi-keystone.conf [root@node01 ~]#
提示：以上操作就是把httpd代理keystone的配置導入到httpd中，默認安裝keystone以後就會有一個這樣的配置文件；我們只需要把這個配置文件軟連接到httpd的配置目錄下即可；
啟動httpd，並設置為開機啟動
[root@node01 ~]# systemctl start httpd [root@node01 ~]# systemctl enable httpd Created symlink from /etc/systemd/system/multi-user.target.wants/httpd.service to /usr/lib/systemd/system/httpd.service. [root@node01 ~]# ss -tnl State Recv-Q Send-Q Local Address:Port Peer Address:Port LISTEN 0 128 *:22 *:* LISTEN 0 100 127.0.0.1:25 *:* LISTEN 0 128 :::80 :::* LISTEN 0 128 :::22 :::* LISTEN 0 100 ::1:25 :::* LISTEN 0 128 :::5000 :::* [root@node01 ~]#
提示：如果能夠看到5000埠正常監聽，說明我們導入的配置沒有問題；
9、通過OS_TOKEN環境變數導出admin的token,使用OS_URL環境變數導出控制節點api介面地址，使用OS_IDENTITY_API_VERSION環境變數導出api的版本號
[root@node01 ~]# export OS_TOKEN=752e7981c9f3bb1b1a91 [root@node01 ~]# export OS_URL=//node01:5000/v3 [root@node01 ~]# export OS_IDENTITY_API_VERSION=3
提示：這裡的admin_token就是我們剛才在配置文件中配置的token；因為最開始我們只有手動生成一個token進行驗證；
10、在導出以上三個環境變數的終端上創建域、用戶、項目、角色、服務；
創建default域
[root@node01 ~]# openstack domain create --description "Default Domain" default +-------------+----------------------------------+ | Field | Value | +-------------+----------------------------------+ | description | Default Domain | | enabled | True | | id | 47c0915c914c49bb8670703e4315a80f | | name | default | | tags | [] | +-------------+----------------------------------+ [root@node01 ~]#
創建一個admin的項目 並把域指向default
[root@node01 ~]# openstack project create --domain default --description "Admin Project" admin +-------------+----------------------------------+ | Field | Value | +-------------+----------------------------------+ | description | Admin Project | | domain_id | 47c0915c914c49bb8670703e4315a80f | | enabled | True | | id | b4e56eeb160948c581e98d685133d19a | | is_domain | False | | name | admin | | parent_id | 47c0915c914c49bb8670703e4315a80f | | tags | [] | +-------------+----------------------------------+ [root@node01 ~]#
創建admin用戶並設置密碼為admin
[root@node01 ~]# openstack user create --domain default --password-prompt admin
User Password:
Repeat User Password:
+---------------------+----------------------------------+
| Field | Value |
+---------------------+----------------------------------+
| domain_id | 47c0915c914c49bb8670703e4315a80f |
| enabled | True |
| id | a105f256dc9f42438212e9d96d46b60d |
| name | admin |
| options | {} |
| password_expires_at | None |
+---------------------+----------------------------------+
[root@node01 ~]#
創建admin角色
[root@node01 ~]# openstack role create admin +-----------+----------------------------------+ | Field | Value | +-----------+----------------------------------+ | domain_id | None | | id | 7f1f7aa119034c2fbd15b46b90632d18 | | name | admin | +-----------+----------------------------------+ [root@node01 ~]#
給admin用戶授權，將admin用戶授予admin項目的admin角色
[root@node01 ~]# openstack role add --project admin --user admin admin [root@node01 ~]#
創建一個用於測試的demo項目
[root@node01 ~]# openstack project create --domain default --description "Demo Project" demo +-------------+----------------------------------+ | Field | Value | +-------------+----------------------------------+ | description | Demo Project | | domain_id | 47c0915c914c49bb8670703e4315a80f | | enabled | True | | id | 1a918887f38a42c28f9d0d3774f34b16 | | is_domain | False | | name | demo | | parent_id | 47c0915c914c49bb8670703e4315a80f | | tags | [] | +-------------+----------------------------------+ [root@node01 ~]#
創建demo用戶並設置密碼為demo
[root@node01 ~]# openstack user create --domain default --password-prompt demo
User Password:
Repeat User Password:
+---------------------+----------------------------------+
| Field | Value |
+---------------------+----------------------------------+
| domain_id | 47c0915c914c49bb8670703e4315a80f |
| enabled | True |
| id | 5453d68782a34429a7dab7da9c51f0d9 |
| name | demo |
| options | {} |
| password_expires_at | None |
+---------------------+----------------------------------+
[root@node01 ~]#
創建一個user角色
[root@node01 ~]# openstack role create user +-----------+----------------------------------+ | Field | Value | +-----------+----------------------------------+ | domain_id | None | | id | ee2f38096e42409eb47ae67a8c289279 | | name | user | +-----------+----------------------------------+ [root@node01 ~]#
把demo用戶添加到demo項目，然後賦予user角色許可權
[root@node01 ~]# openstack role add --project demo --user demo user [root@node01 ~]#
驗證：查看現有的用戶、項目、角色、域是否是我們創建的
[root@node01 ~]# openstack user list +----------------------------------+-------+ | ID | Name | +----------------------------------+-------+ | 5453d68782a34429a7dab7da9c51f0d9 | demo | | a105f256dc9f42438212e9d96d46b60d | admin | +----------------------------------+-------+ [root@node01 ~]# openstack project list +----------------------------------+-------+ | ID | Name | +----------------------------------+-------+ | 1a918887f38a42c28f9d0d3774f34b16 | demo | | b4e56eeb160948c581e98d685133d19a | admin | +----------------------------------+-------+ [root@node01 ~]# openstack role list +----------------------------------+-------+ | ID | Name | +----------------------------------+-------+ | 7f1f7aa119034c2fbd15b46b90632d18 | admin | | ee2f38096e42409eb47ae67a8c289279 | user | +----------------------------------+-------+ [root@node01 ~]# openstack domain list +----------------------------------+---------+---------+----------------+ | ID | Name | Enabled | Description | +----------------------------------+---------+---------+----------------+ | 47c0915c914c49bb8670703e4315a80f | default | True | Default Domain | +----------------------------------+---------+---------+----------------+ [root@node01 ~]#
提示：可以看到當前控制節點上有兩個用戶,兩個項目，兩個角色，分別是admin和demo；一個default域；這都是我們剛才創建的；
創建一個service項目，各服務之間與keystone進行訪問和認證，service用於給服務創建用戶；
[root@node01 ~]# openstack project create --domain default --description "Service Project" service +-------------+----------------------------------+ | Field | Value | +-------------+----------------------------------+ | description | Service Project | | domain_id | 47c0915c914c49bb8670703e4315a80f | | enabled | True | | id | 9c9d6f24fc23464a810ef97ce199bffa | | is_domain | False | | name | service | | parent_id | 47c0915c914c49bb8670703e4315a80f | | tags | [] | +-------------+----------------------------------+ [root@node01 ~]#
創建一個keystone認證服務
[root@node01 ~]# openstack service create --name keystone --description "OpenStack Identity" identity +-------------+----------------------------------+ | Field | Value | +-------------+----------------------------------+ | description | OpenStack Identity | | enabled | True | | id | a32cffed26924a87b21b4e86e00c63b4 | | name | keystone | | type | identity | +-------------+----------------------------------+ [root@node01 ~]#
查看當前服務列表
[root@node01 ~]# openstack service list +----------------------------------+----------+----------+ | ID | Name | Type | +----------------------------------+----------+----------+ | a32cffed26924a87b21b4e86e00c63b4 | keystone | identity | +----------------------------------+----------+----------+ [root@node01 ~]#
11、創建endpoint（註冊服務）
創建公共端
[root@node01 ~]# openstack endpoint create --region RegionOne identity public //controller:5000/v3 +--------------+----------------------------------+ | Field | Value | +--------------+----------------------------------+ | enabled | True | | id | 5293ad18db674ea1b01d8f401cb2cf14 | | interface | public | | region | RegionOne | | region_id | RegionOne | | service_id | a32cffed26924a87b21b4e86e00c63b4 | | service_name | keystone | | service_type | identity | | url | //controller:5000/v3 | +--------------+----------------------------------+ [root@node01 ~]#
創建私有端
[root@node01 ~]# openstack endpoint create --region RegionOne identity internal //controller:5000/v3 +--------------+----------------------------------+ | Field | Value | +--------------+----------------------------------+ | enabled | True | | id | 6593f8d808094b01a6311828f2ef72bd | | interface | internal | | region | RegionOne | | region_id | RegionOne | | service_id | a32cffed26924a87b21b4e86e00c63b4 | | service_name | keystone | | service_type | identity | | url | //controller:5000/v3 | +--------------+----------------------------------+ [root@node01 ~]#
創建管理端
[root@node01 ~]# openstack endpoint create --region RegionOne identity admin //controller:5000/v3 +--------------+----------------------------------+ | Field | Value | +--------------+----------------------------------+ | enabled | True | | id | 3bd05493999b462eb4b4af8d5e5c1fa9 | | interface | admin | | region | RegionOne | | region_id | RegionOne | | service_id | a32cffed26924a87b21b4e86e00c63b4 | | service_name | keystone | | service_type | identity | | url | //controller:5000/v3 | +--------------+----------------------------------+ [root@node01 ~]#
驗證：看看endport 列表是否都已經有我們剛才創建的三個端點？
[root@node01 ~]# openstack endpoint list +----------------------------------+-----------+--------------+--------------+---------+-----------+---------------------------+ | ID | Region | Service Name | Service Type | Enabled | Interface | URL | +----------------------------------+-----------+--------------+--------------+---------+-----------+---------------------------+ | 3bd05493999b462eb4b4af8d5e5c1fa9 | RegionOne | keystone | identity | True | admin | //controller:5000/v3 | | 5293ad18db674ea1b01d8f401cb2cf14 | RegionOne | keystone | identity | True | public | //controller:5000/v3 | | 6593f8d808094b01a6311828f2ef72bd | RegionOne | keystone | identity | True | internal | //controller:5000/v3 | +----------------------------------+-----------+--------------+--------------+---------+-----------+---------------------------+ [root@node01 ~]#
提示：如果創建錯誤或者多創建了，就需要全部刪除，重新註冊；
到此keystone服務就配置完了；接下來測試keystone是否可以用來做認證服務
驗證：重新打開一個終端窗口，導出OS_IDENTITY_API_VERSION環境變數，使用命令的方式驗證admin用戶密碼是admin
[root@node01 ~]# echo $OS_IDENTITY_API_VERSION [root@node01 ~]# export OS_IDENTITY_API_VERSION=3 [root@node01 ~]# echo $OS_IDENTITY_API_VERSION 3 [root@node01 ~]# openstack --os-auth-url //node01:5000/v3 --os-project-domain-name default --os-user-domain-name default --os-project-name admin --os-username admin token issue Password: +------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | Field | Value | +------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | expires | 2020-10-28T13:16:54+0000 | | id | gAAAAABfmWE2udKuo4ambgxh3RsrzoDwrA8IHa1dx5gYk_sZoU5HmZUM9qHTguwMasYGzRIno0LawlZDbB4i3IJold3sZdAlEZGwiNuPtYJMgP5nikDUR8YrXNPNQNDMjCchDMMN6bWhZ26pQXVEZ0VXcN5v5xOj_bx7nskJ8bnvKWFiRf4ckPQ | | project_id | b4e56eeb160948c581e98d685133d19a | | user_id | a105f256dc9f42438212e9d96d46b60d | +------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ [root@node01 ~]#
提示：輸入正確的密碼會返回一個表，記錄的有過期時長，id,和項目id和用戶id;如果輸入密碼錯誤則不會返回這些內容，其實這些內容主要用來描述返回給用戶token屬性，我們可以理解它就是返回了這樣一個token給我們；
[root@node01 ~]# openstack --os-auth-url //node01:5000/v3 --os-project-domain-name default --os-user-domain-name default --os-project-name admin --os-username admin token issue Password: The request you have made requires authentication. (HTTP 401) (Request-ID: req-79d8afbe-56dc-47f9-ab4e-8065a295923e) [root@node01 ~]#
提示：輸入錯誤的密碼它給我們返回了響應碼為401，表示驗證未通過；
創建admin用戶環境變數腳本
[root@node01 ~]# cat admin.sh #!/bin/bash export OS_PROJECT_DOMAIN_NAME=Default export OS_USER_DOMAIN_NAME=Default export OS_PROJECT_NAME=admin export OS_USERNAME=admin export OS_PASSWORD=admin export OS_AUTH_URL=//controller:5000/v3 export OS_IDENTITY_API_VERSION=3 export OS_IMAGE_API_VERSION=2 [root@node01 ~]# chmod a+x admin.sh [root@node01 ~]#
創建demo用戶環境變數腳本
[root@node01 ~]# cat demo.sh #!/bin/bash export OS_PROJECT_DOMAIN_NAME=Default export OS_USER_DOMAIN_NAME=Default export OS_PROJECT_NAME=demo export OS_USERNAME=demo export OS_PASSWORD=demo export OS_AUTH_URL=//controller:5000/v3 export OS_IDENTITY_API_VERSION=3 export OS_IMAGE_API_VERSION=2 [root@node01 ~]# chmod a+x demo.sh [root@node01 ~]#
提示：有了上面兩個腳本以後，我們就實現要使用那個用戶測試，直接把對應的用戶環境變數導出即可；
驗證：測試admin用戶的環境變數腳本是否可用？
[root@node01 ~]# ll total 8 -rwxr-xr-x 1 root root 272 Oct 28 20:23 admin.sh -rwxr-xr-x 1 root root 269 Oct 28 20:24 demo.sh [root@node01 ~]# source admin.sh [root@node01 ~]# openstack token issue +------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | Field | Value | +------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | expires | 2020-10-28T13:29:08+0000 | | id | gAAAAABfmWQU2Z97wzxv94lLY4hcSWe4X6Udp_OyeYw3_wY54_znLFb4TFLcMnR96-ogNAcJEvXiQcJWdvQJHBObYbR-gAEulagQq2sjXLxedMYLUN4j2y_L4G5NhbaogGKtHed4WMR0N72Js4INyHjKWCwwSd2d4NJpZUe14pQjNX8ihleP09g | | project_id | b4e56eeb160948c581e98d685133d19a | | user_id | a105f256dc9f42438212e9d96d46b60d | +------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ [root@node01 ~]#
提示：重新開一個終端，導出admin用戶環境變數，然後直接使用openstack token issue命令就能驗證admin用戶；有了這個環境變數腳本，我們不用輸密碼和不用寫那麼長的命令了；
驗證demo用戶的環境變數腳本
[root@node01 ~]# ll total 8 -rwxr-xr-x 1 root root 272 Oct 28 20:23 admin.sh -rwxr-xr-x 1 root root 269 Oct 28 20:24 demo.sh [root@node01 ~]# source demo.sh [root@node01 ~]# openstack token issue +------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | Field | Value | +------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | expires | 2020-10-28T13:31:34+0000 | | id | gAAAAABfmWSmj5PHp8x3m3szKwZ0_dWSdY-JM-TBbo-bMk4OaTHl3BLNVrglKXRMe5jpbCOBPb5l2AyHWVvzvJdi2Jx4va7PJksJGlx_JluhOx9vry1kjiZoKcW7Ri3Y7qkYFvDcpDHXy0KkYeHSyMW9zjNaFvvJtrPpozgfw7gsghYJNfZoYz0 | | project_id | 1a918887f38a42c28f9d0d3774f34b16 | | user_id | 5453d68782a34429a7dab7da9c51f0d9 | +------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ [root@node01 ~]#
提示：demo用戶的環境變數腳本也都能夠正常通過驗證；到此keystone服務的安裝配置測試就完成了；
