OpenStack Keystone Charm

Bug #1774733
Comment #1

Comment 1 for bug 1774733

Revision history for this message

Dmitrii Shcherbakov (dmitriis) wrote on 2018-06-13:

An example of how to create a system-scoped token via keystone API (openstack client support seems to be missing at the time of writing) with a notably different scope section in the request:

cat > token-request.json
{
    "auth": {
        "identity": {
            "methods": [
                "password"
            ],
            "password": {
                "user": {
                    "domain": {
                        "name": "admin_domain"
                    },
                    "name": "admin",
                    "password": "t0ughpasswd"
                }
            }
        },
        "scope": {
            "project": {
                "domain": {
                    "name": "admin_domain"
                },
                "name": "admin"
            }
        }
    }
}

curl -si -d @token-request.json -H "Content-type: application/json" http://10.232.6.4:5000/v3/auth/tokens | awk '/X-Subject-Token/ {print $2}'
1374d65b4bd04f29bcd888af7c3a7568

curl -s -H"X-Auth-Token:1374d65b4bd04f29bcd888af7c3a7568" http://10.232.6.4:5000/v3/auth/system | jq
{
  "system": [],
  "links": {
    "self": "http://10.232.45.175:5000/v3/auth/system"
  }
}

curl -X PUT -s -H"X-Auth-Token:1374d65b4bd04f29bcd888af7c3a7568" http://10.232.6.4:5000/v3/system/users/c35ddbaea658492baa16c7e15a14320f/roles/2c998c11b22d40cd98e617060447579e | jq

curl -s -H"X-Auth-Token:1374d65b4bd04f29bcd888af7c3a7568" http://10.232.6.4:5000/v3/auth/system | jq
{
  "system": [
    {
      "all": true
    }
  ],
  "links": {
    "self": "http://10.232.45.175:5000/v3/auth/system"
  }
}

cat > usera-token-request.json
{
    "auth": {
        "identity": {
            "methods": [
                "password"
            ],
            "password": {
                "user": {
                    "domain": {
                        "name": "a"
                    },
                    "name": "usera",
                    "password": "test"
                }
            }
        },
        "scope": {
  "system": {
        "all": true
  }
        }
    }
}

curl -si -d @usera-token-request.json -H "Content-type: application/json" http://10.232.6.4:5000/v3/auth/tokens | awk '/X-Subject-Token/ {print $2}'
365aa5b8c9b4417e9c6e0ad3b12ea2c1

curl -s -H"X-Auth-Token:365aa5b8c9b4417e9c6e0ad3b12ea2c1" http://10.232.6.4:5000/v3/auth/system | jq
{
  "system": [
    {
      "all": true
    }
  ],
  "links": {
    "self": "http://10.232.45.175:5000/v3/auth/system"
  }
}

An example of how to create a system-scoped token via keystone API (openstack client support seems to be missing at the time of writing) with a notably different scope section in the request:

cat > token-request.json 
{
    "auth": {
        "identity": {
            "methods": [
                "password"
            ],
            "password": {
                "user": {
                    "domain": {
                        "name": "admin_domain"
                    },
                    "name": "admin",
                    "password": "t0ughpasswd"
                }
            }
        },
        "scope": {
            "project": {
                "domain": {
                    "name": "admin_domain"
                },
                "name": "admin"
            }
        }
    }
}

curl -si -d @token-request.json -H "Content-type: application/json" http://10.232.6.4:5000/v3/auth/tokens | awk '/X-Subject-Token/ {print $2}'
1374d65b4bd04f29bcd888af7c3a7568

curl -s -H"X-Auth-Token:1374d65b4bd04f29bcd888af7c3a7568" http://10.232.6.4:5000/v3/auth/system | jq
{
  "system": [],
  "links": {
    "self": "http://10.232.45.175:5000/v3/auth/system"
  }
}

curl -X PUT -s -H"X-Auth-Token:1374d65b4bd04f29bcd888af7c3a7568" http://10.232.6.4:5000/v3/system/users/c35ddbaea658492baa16c7e15a14320f/roles/2c998c11b22d40cd98e617060447579e | jq

cat > usera-token-request.json
{
    "auth": {
        "identity": {
            "methods": [
                "password"
            ],
            "password": {
                "user": {
                    "domain": {
                        "name": "a"
                    },
                    "name": "usera",
                    "password": "test"
                }
            }
        },
        "scope": {
		"system": {
		      "all": true
		}
        }
    }
}

curl -si -d @usera-token-request.json -H "Content-type: application/json" http://10.232.6.4:5000/v3/auth/tokens | awk '/X-Subject-Token/ {print $2}'
365aa5b8c9b4417e9c6e0ad3b12ea2c1