[Note] Note In Kilo, the keystone project deprecates Eventlet in favor of a WSGI server. This guide uses the Apache HTTP server with mod_wsgi to serve keystone requests on ports 5000 and 35357. By default, the keystone service still listens on ports 5000 and 35357. Therefore, this guide disables the keystone service.
在安装OpensStack认证服务前，需要先创建数据库和administration token。
创建数据库：
# mysql -u root -p
MariaDB [(none)]>
CREATE DATABASE keystone;
GRANT ALL PRIVILEGES ON keystone.* TO'keystone'@'localhost' IDENTIFIED BY'KEYSTONE_DBPASS'; GRANT ALL PRIVILEGES ON keystone.* TO'keystone'@'%' IDENTIFIED BY'KEYSTONE_DBPASS';
# curl http://git.openstack.org/cgit/openstack/keystone/plain/httpd/keystone.py?h=stable/kilo | tee var/www/cgi-bin/keystone/main var/www/cgi-bin/keystone/admin
由于这个需要联网下载，我把内容直接贴过来了。
# echo"import os from keystone.server import wsgi as wsgi_server name = os.path.basename(__file__) application = wsgi_server.initialize_application(name)" >/var/www/cgi-bin/keystone/main echo"import os from keystone.server import wsgi as wsgi_server name = os.path.basename(__file__) application = wsgi_server.initialize_application(name)" >/var/www/cgi-bin/keystone/admin
The Identity service provides authentication services for each OpenStack service. The authentication service uses a combination of domains, projects (tenants), users, and roles.
# openstack role add --project demo --user demo user
Verify operation
Verify operation of the Identity service before installing other services.
For security reasons, disable the temporary authentication token mechanism:
Edit the usr/share/keystone/keystone-dist-paste.ini file and remove admin_token_auth from the [pipeline:public_api], [pipeline:admin_api], and [pipeline:api_v3] sections.
Unset the temporary OS_TOKEN and OS_URL environment variables:
# unset OS_TOKEN OS_URL
As the admin user, request an authentication token from the Identity version 2.0 API:
The Identity version 3 API adds support for domains that contain projects and users. Projects and users can use the same names in different domains. Therefore, in order to use the version 3 API, requests must also explicitly contain at least the default domain or use IDs. For simplicity, this guide explicitly uses the default domain so examples can use names instead of IDs.
As the admin user, list projects to verify that the admin user can execute admin-only CLI commands and that the Identity service contains the projects that you created in the section called “Create projects, users, and roles”:
As the admin user, list users to verify that the Identity service contains the users that you created in the section called “Create projects, users, and roles”:
# openstack --os-auth-url http://controller:35357 \ --os-project-name admin --os-username admin --os-auth-type password \ user list
As the admin user, list roles to verify that the Identity service contains the role that you created in the section called “Create projects, users, and roles”:
# openstack --os-auth-url http://controller:35357 \ --os-project-name admin --os-username admin --os-auth-type password \ role list
As the demo user, request an authentication token from the Identity version 3 API:
ERROR: openstack You are not authorized to perform the requested action, admin_required. (HTTP 403)
Create OpenStack client environment scripts
The previous section used a combination of environment variables and command options to interact with the Identity service via the openstack client. To increase efficiency of client operations, OpenStack supports simple client environment scripts also known as OpenRC files. These scripts typically contain common options for all clients, but also support unique options. For more information, see the OpenStack User Guide.
