企业空间 采购商城 存储论坛
首页 > Openstack > 正文

OpenStack安装手册 - KEYSTONE身份认证服务配置安装

2016-03-09 13:08来源：中国存储网
导读：OpenStack安装手册 - KEYSTONE身份认证服务配置安装.,建立KEYSTONE服务数据库,建立KEYSTONE服务配置文件存放目录

目录   上一篇   下一篇

3.13 KEYSTONE身份认证服务配置

·         建立KEYSTONE服务数据库

mysql -uroot -popenstack -e 'create database keystone'

·         建立KEYSTONE服务配置文件存放目录

mkdir /etc/keystone

·         建立KEYSTONE服务启动用户

useradd -s /sbin/nologin -m -d /var/log/keystone keystone

·         在/etc/keystone建立default_catalog.templates作为KEYSTONE服务服务点配置文件，内容如下：

catalog.RegionOne.identity.publicURL = http://60.12.206.105:$(public_port)s/v2.0

catalog.RegionOne.identity.adminURL = http://60.12.206.105:$(admin_port)s/v2.0

catalog.RegionOne.identity.internalURL = http://60.12.206.105:$(public_port)s/v2.0

catalog.RegionOne.identity.name = Identity Service

 

catalog.RegionOne.compute.publicURL = http://60.12.206.105:8774/v2/$(tenant_id)s

catalog.RegionOne.compute.adminURL = http://60.12.206.105:8774/v2/$(tenant_id)s

catalog.RegionOne.compute.internalURL = http://60.12.206.105:8774/v2/$(tenant_id)s

catalog.RegionOne.compute.name = Compute Service

 

catalog.RegionOne.volume.publicURL = http://60.12.206.105:8776/v1/$(tenant_id)s

catalog.RegionOne.volume.adminURL = http://60.12.206.105:8776/v1/$(tenant_id)s

catalog.RegionOne.volume.internalURL = http://60.12.206.105:8776/v1/$(tenant_id)s

catalog.RegionOne.volume.name = Volume Service

 

catalog.RegionOne.ec2.publicURL = http://60.12.206.105:8773/services/Cloud

catalog.RegionOne.ec2.adminURL = http://60.12.206.105:8773/services/Admin

catalog.RegionOne.ec2.internalURL = http://60.12.206.105:8773/services/Cloud

catalog.RegionOne.ec2.name = EC2 Service

 

catalog.RegionOne.s3.publicURL = http://60.12.206.105:3333

catalog.RegionOne.s3.adminURL = http://60.12.206.105:3333

catalog.RegionOne.s3.internalURL = http://60.12.206.105:3333

catalog.RegionOne.s3.name = S3 Service

 

catalog.RegionOne.image.publicURL = http://60.12.206.105:9292/v1

catalog.RegionOne.image.adminURL = http://60.12.206.105:9292/v1

catalog.RegionOne.image.internalURL = http://60.12.206.105:9292/v1

catalog.RegionOne.image.name = Image Service

 

catalog.RegionOne.object_store.publicURL = http://60.12.206.105:8080/v1/AUTH_$(tenant_id)s

catalog.RegionOne.object_store.adminURL = http://60.12.206.105:8080/

catalog.RegionOne.object_store.internalURL = http://60.12.206.105:8080/v1/AUTH_$(tenant_id)s

catalog.RegionOne.object_store.name = Swift Service

·         在/etc/keystone建立policy.json作为KEYSTONE服务策略文件，内容如下：

{

    "admin_required": [["role:admin"], ["is_admin:1"]]

}

·         在/etc/keystone建立keystone.conf作为KEYSTONE服务配置文件，内容如下：

[DEFAULT]

public_port = 5000

admin_port = 35357

admin_token = ADMIN

compute_port = 8774

verbose = True

debug = True

log_file = /var/log/keystone/keystone.log

use_syslog = False

syslog_log_facility = LOG_LOCAL0

 

[sql]

connection = mysql://root:openstack@localhost/keystone

idle_timeout = 30

min_pool_size = 5

max_pool_size = 10

pool_timeout = 200

 

[identity]

driver = keystone.identity.backends.sql.Identity

 

[catalog]

driver = keystone.catalog.backends.templated.TemplatedCatalog

template_file = /etc/keystone/default_catalog.templates

 

[token]

driver = keystone.token.backends.kvs.Token

 

[policy]

driver = keystone.policy.backends.simple.SimpleMatch

 

[ec2]

driver = keystone.contrib.ec2.backends.sql.Ec2

 

[filter:debug]

paste.filter_factory = keystone.common.wsgi:Debug.factory

 

[filter:token_auth]

paste.filter_factory = keystone.middleware:TokenAuthMiddleware.factory

 

[filter:admin_token_auth]

paste.filter_factory = keystone.middleware:AdminTokenAuthMiddleware.factory

 

[filter:xml_body]

paste.filter_factory = keystone.middleware:XmlBodyMiddleware.factory

 

[filter:json_body]

paste.filter_factory = keystone.middleware:JsonBodyMiddleware.factory

 

[filter:crud_extension]

paste.filter_factory = keystone.contrib.admin_crud:CrudExtension.factory

 

[filter:ec2_extension]

paste.filter_factory = keystone.contrib.ec2:Ec2Extension.factory

 

[filter:s3_extension]

paste.filter_factory = keystone.contrib.s3:S3Extension.factory

 

[app:public_service]

paste.app_factory = keystone.service:public_app_factory

 

[app:admin_service]

paste.app_factory = keystone.service:admin_app_factory

 

[pipeline:public_api]

pipeline = token_auth admin_token_auth xml_body json_body debug ec2_extension s3_extension public_service

 

[pipeline:admin_api]

pipeline = token_auth admin_token_auth xml_body json_body debug ec2_extension crud_extension admin_service

 

[app:public_version_service]

paste.app_factory = keystone.service:public_version_app_factory

 

[app:admin_version_service]

paste.app_factory = keystone.service:admin_version_app_factory

 

[pipeline:public_version_api]

pipeline = xml_body public_version_service

 

[pipeline:admin_version_api]

pipeline = xml_body admin_version_service

 

[composite:main]

use = egg:Paste#urlmap

/v2.0 = public_api

/ = public_version_api

 

[composite:admin]

use = egg:Paste#urlmap

/v2.0 = admin_api

/ = admin_version_api

·         在/etc/init.d/下建立名为keystone的KEYSTONE服务启动脚本，内容如下：

#!/bin/sh

#

# keystone  OpenStack Identity Service

#

# chkconfig:   - 20 80

# description: keystone works provide apis to  \

#               * Authenticate users and provide a token \

#               * Validate tokens

### END INIT INFO

 

. /etc/rc.d/init.d/functions

 

prog=keystone

prog_exec=keystone-all

exec="/usr/bin/$prog_exec"

config="/etc/$prog/$prog.conf"

pidfile="/var/run/$prog/$prog.pid"

 

[ -e /etc/sysconfig/$prog ] && . /etc/sysconfig/$prog

 

lockfile=/var/lock/subsys/$prog

 

start() {

    [ -x $exec ] || exit 5

    [ -f $config ] || exit 6

    echo -n $"Starting $prog: "

    daemon --user keystone --pidfile $pidfile "$exec --config-file=$config &>/dev/null & echo \$! > $pidfile"

    retval=$?

    echo

    [ $retval -eq 0 ] && touch $lockfile

    return $retval

}

 

stop() {

    echo -n $"Stopping $prog: "

    killproc -p $pidfile $prog

    retval=$?

    echo

    [ $retval -eq 0 ] && rm -f $lockfile

    return $retval

}

 

restart() {

    stop

    start

}

 

reload() {

    restart

}

 

force_reload() {

    restart

}

 

rh_status() {

    status -p $pidfile $prog

}

 

rh_status_q() {

    rh_status >/dev/null 2>&1

}

 

case "$1" in

    start)

        rh_status_q && exit 0

        $1

        ;;

    stop)

        rh_status_q || exit 0

        $1

        ;;

    restart)

        $1

        ;;

    reload)

        rh_status_q || exit 7

        $1

        ;;

    force-reload)

        force_reload

        ;;

    status)

        rh_status

        ;;

    condrestart|try-restart)

        rh_status_q || exit 0

        restart

        ;;

    *)

        echo $"Usage: $0 {start|stop|status|restart|condrestart|try-restart|reload|force-reload}"

        exit 2

esac

exit $?

·         配置启动脚本：

chmod 755 /etc/init.d/keystone

mkdir /var/run/keystone

mkdir /var/lock/keystone

chown keystone:root /var/run/keystone

chown keystone:root /var/lock/keystone

·         启动KEYSTONE服务

/etc/init.d/keystone start

·         检测服务是否正常启动

通过netstat -ltunp查看是否有tcp 5000和tcp 35357端口监听
如果没有正常启动请查看/var/log/keystone/keystone.log文件排错

·         建立KEYSTONE服务初始化数据脚本keystone_data.sh，内容如下：

#!/bin/bash

# Variables set before calling this script:

# SERVICE_TOKEN - aka admin_token in keystone.conf

# SERVICE_ENDPOINT - local Keystone admin endpoint

# SERVICE_TENANT_NAME - name of tenant containing service accounts

# ENABLED_SERVICES - stack.sh's list of services to start

# DEVSTACK_DIR - Top-level DevStack directory

 

ADMIN_PASSWORD=${ADMIN_PASSWORD:-secrete}

SERVICE_PASSWORD=${SERVICE_PASSWORD:-service}

export SERVICE_TOKEN=ADMIN

export SERVICE_ENDPOINT=http://localhost:35357/v2.0

SERVICE_TENANT_NAME=${SERVICE_TENANT_NAME:-tenant}

 

function get_id () {

    echo `$@ | awk '/ id / { print $4 }'`

}

 

# Tenants

ADMIN_TENANT=$(get_id keystone tenant-create --name=admin)

SERVICE_TENANT=$(get_id keystone tenant-create --name=$SERVICE_TENANT_NAME)

DEMO_TENANT=$(get_id keystone tenant-create --name=demo)

INVIS_TENANT=$(get_id keystone tenant-create --name=invisible_to_admin)

 

# Users

ADMIN_USER=$(get_id keystone user-create --name=admin \

                                         --pass="$ADMIN_PASSWORD" \

                                         --email=admin@example.com)

DEMO_USER=$(get_id keystone user-create --name=demo \

                                        --pass="$ADMIN_PASSWORD" \

                                        --email=demo@example.com)

 

# Roles

ADMIN_ROLE=$(get_id keystone role-create --name=admin)

KEYSTONEADMIN_ROLE=$(get_id keystone role-create --name=KeystoneAdmin)

KEYSTONESERVICE_ROLE=$(get_id keystone role-create --name=KeystoneServiceAdmin)

ANOTHER_ROLE=$(get_id keystone role-create --name=anotherrole)

 

# Add Roles to Users in Tenants

keystone user-role-add --user $ADMIN_USER --role $ADMIN_ROLE --tenant_id $ADMIN_TENANT

keystone user-role-add --user $ADMIN_USER --role $ADMIN_ROLE --tenant_id $DEMO_TENANT

keystone user-role-add --user $DEMO_USER --role $ANOTHER_ROLE --tenant_id $DEMO_TENANT

 

# TODO(termie): these two might be dubious

keystone user-role-add --user $ADMIN_USER --role $KEYSTONEADMIN_ROLE --tenant_id $ADMIN_TENANT

keystone user-role-add --user $ADMIN_USER --role $KEYSTONESERVICE_ROLE --tenant_id $ADMIN_TENANT

 

# The Member role is used by Horizon and Swift so we need to keep it:

MEMBER_ROLE=$(get_id keystone role-create --name=Member)

keystone user-role-add --user $DEMO_USER --role $MEMBER_ROLE --tenant_id $DEMO_TENANT

keystone user-role-add --user $DEMO_USER --role $MEMBER_ROLE --tenant_id $INVIS_TENANT

 

NOVA_USER=$(get_id keystone user-create --name=nova \

                                        --pass="$SERVICE_PASSWORD" \

                                        --tenant_id $SERVICE_TENANT \

                                        --email=nova@example.com)

keystone user-role-add --tenant_id $SERVICE_TENANT \

                       --user $NOVA_USER \

                       --role $ADMIN_ROLE

 

GLANCE_USER=$(get_id keystone user-create --name=glance \

                                          --pass="$SERVICE_PASSWORD" \

                                          --tenant_id $SERVICE_TENANT \

                                          --email=glance@example.com)

keystone user-role-add --tenant_id $SERVICE_TENANT \

                       --user $GLANCE_USER \

                       --role $ADMIN_ROLE

 

SWIFT_USER=$(get_id keystone user-create --name=swift \

                                         --pass="$SERVICE_PASSWORD" \

                                         --tenant_id $SERVICE_TENANT \

                                         --email=swift@example.com)

keystone user-role-add --tenant_id $SERVICE_TENANT \

                       --user $SWIFT_USER \

                       --role $ADMIN_ROLE

 

RESELLER_ROLE=$(get_id keystone role-create --name=ResellerAdmin)

keystone user-role-add --tenant_id $SERVICE_TENANT \

                       --user $NOVA_USER \

                       --role $RESELLER_ROLE

·         建立KEYSTONE服务数据库结构

keystone-manage db_sync

·         执行初始化数据脚本

bash keystone_data.sh

继续阅读
关键词 :
OpenStack安装手册
分享新浪微博QQ空间微信腾讯微博
中国存储网声明：此文观点不代表本站立场，如有版权疑问请联系我们。
相关阅读
产品推荐

IDC全球服务器市场季度跟踪报告：2020年第四季度全球市场同比增长1.5％
IDC全球服务器市场季度跟踪报告：2020年第四季度全球市场同比增
河北：税收大数据为企业“精准导航”
河北：税收大数据为企业“精准导航”
估值达到30亿美元，数据库厂商Couchbase申请IPO
估值达到30亿美元，数据库厂商Couchbase申请IPO
医药广告造假，360搜索被央视315晚会曝光
医药广告造假，360搜索被央视315晚会曝光
狼的种类介绍及相关品种的狼的图片
狼的种类介绍及相关品种的狼的图片
农科院所长：转基因是科学 明确标识是歧视
农科院所长：转基因是科学 明确标识是歧视
头条阅读
栏目热点
在线资源
HBase中文指南 Linux系统管理员手册 Linux命令大全 Linux调用大全 Backup Exec中文手册 TSM5.2中文手册 比特币 Raid技术 Python教程 MySQL中文手册 2016大数据标准白皮书 系统集成商资质查询 存储百科 存储器/芯片

关于我们 | 联系我们 | 广告服务 | 合作伙伴 | 网站地图 | 版权声明 | 隐私条款 | 在线投稿

Copyright @ 2006-2019 ChinaStor.COM 版权所有 京ICP备14047533号

中国存储网

存储第一站，存储门户，存储在线交流平台