|
关于 identity service的组成有几个概念需要理解（user, credentials, authentication, token, tenant, service, endpoint, role），如果以后想通过http API来交互openstack的话，这些知识是必需的。
OpenStack Identity concepts – OpenStack Installation Guide for Red Hat Enterprise Linux 7, CentOS 7, and Fedora 20 – juno
-
User
-
Digital representation of a person, system, or service who uses OpenStack cloud services. The Identity service validates that incoming requests are made by the user who claims to be making the call. Users have a login and may be assigned tokens to access resources. Users can be directly assigned to a particular tenant and behave as if they are contained in that tenant.
-
Credentials
-
Data that confirms the user’s identity. For example: user name and password, user name and API key, or an authentication token provided by the Identity Service.
-
Authentication
-
The process of confirming the identity of a user. OpenStack Identity confirms an incoming request by validating a set of credentials supplied by the user.
These credentials are initially a user name and password, or a user name and API key. When user credentials are validated, OpenStack Identity issues an authentication token which the user provides in subsequent requests.
-
Token
-
An alpha-numeric string of text used to access OpenStack APIs and resources. A token may be revoked at any time and is valid for a finite duration.
While OpenStack Identity supports token-based authentication in this release, the intention is to support additional protocols in the future. Its main purpose is to be an integration service, and not aspire to be a full-fledged identity store and management solution.
-
Tenant
-
A container used to group or isolate resources. Tenants also group or isolate identity objects. Depending on the service operator, a tenant may map to a customer, account, organization, or project.
-
Service
-
An OpenStack service, such as Compute (nova), Object Storage (swift), or Image Service (glance). It provides one or more endpoints in which users can access resources and perform operations.
-
Endpoint
-
A network-accessible address where you access a service, usually a URL address. If you are using an extension for templates, an endpoint template can be created, which represents the templates of all the consumable services that are available across the regions.
-
Role
-
A personality with a defined set of user rights and privileges to perform a specific set of operations.
In the Identity service, a token that is issued to a user includes the list of roles. Services that are being called by that user determine how they interpret the set of roles a user has and to which operations or resources each role grants access.
具体参见：http://docs.openstack.org/juno/install-guide/install/yum/content/keystone-concepts.html
1，创建数据库
进入数据库命令行
创建keystone的database并分配用户及权限：
|
|
CREATE DATABASE keystone;
GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'localhost' IDENTIFIED BY 'keystone123';
GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'%' IDENTIFIED BY 'keystone123';
|
2，安装keystone工具包
|
|
yum install openstack-keystone python-keystoneclient
|
3，编辑/etc/keystone/keystone.conf
|
|
[DEFAULT]
admin_token = ADMIN_TOKEN #此处为一个随机字符串建议用 openssl rand -hex 10 生成
[database]
connection = mysql://keystone:keystone123@10.4.10.213/keystone
[token]
provider = keystone.token.providers.uuid.Provider
driver = keystone.token.persistence.backends.sql.Token
|
4，创建证书密钥以及设置目录权限
|
|
keystone-manage pki_setup --keystone-user keystone --keystone-group keystone
chown -R keystone:keystone /var/log/keystone
chown -R keystone:keystone /etc/keystone/ssl
chmod -R o-rwx /etc/keystone/ssl
su -s /bin/sh -c "keystone-manage db_sync" keystone
|
5，注册service并启动
|
|
systemctl enable openstack-keystone.service
systemctl start openstack-keystone.service
|
6，创建定时任务，用以管理token过期，这边将token的过期时间设为1小时
|
|
(crontab -l -u keystone 2>&1 | grep -q token_flush) || echo '@hourly /usr/bin/keystone-manage token_flush >/var/log/keystone/keystone-tokenflush.log 2>&1' >> /var/spool/cron/keystone
|
到此安装结束，下一章节就是配置了
(责任编辑：IT) |
