Difference between revisions of "Keystone"
From Funtoo Linux
(→Keystone Concepts) |
|||
| Line 9: | Line 9: | ||
;Tenants: In Keystone, "tenants" represent groups of users. Virtual machines ([[Nova]]) and containers ([[Swift]]) are assigned to tenants, not to users directly. Keystone users can be part of more than one tenant, and can have different types of roles defined for each tenant that they're a part of. Think of tenants as a logical way to organize computing and storage resources without assigning them to user accounts directly. Keystone allows you to create and delete tenants, and also enable and disable them. | ;Tenants: In Keystone, "tenants" represent groups of users. Virtual machines ([[Nova]]) and containers ([[Swift]]) are assigned to tenants, not to users directly. Keystone users can be part of more than one tenant, and can have different types of roles defined for each tenant that they're a part of. Think of tenants as a logical way to organize computing and storage resources without assigning them to user accounts directly. Keystone allows you to create and delete tenants, and also enable and disable them. | ||
| − | ;Roles: A role is a common security concept, where a user is assigned a certain set of privileges. This set of privileges is called a role, has a name, and can be managed independently of the specific user account(s) that are part of the role | + | ;Roles: A role is a common security concept, where a user is assigned a certain set of privileges. This set of privileges is called a role, has a name, and can be managed independently of the specific user account(s) that are part of the role. Keystone allows you to create and delete roles, add a user to a role for a specific tenant, remove a user from a role for a specific tenant, and of course list all the roles that have been defined. |
;Users: Keystone is used to define users. Users are accounts for specific individuals, and typically have a password and email associated with them. Keystone allows you to list, create, delete, enable/disable, update email addresses, and change passwords of Users. | ;Users: Keystone is used to define users. Users are accounts for specific individuals, and typically have a password and email associated with them. Keystone allows you to list, create, delete, enable/disable, update email addresses, and change passwords of Users. | ||
Revision as of 04:27, 17 April 2012
Keystone is the OpenStack identity service, and is the most foundational Python-based component of OpenStack (that is, ignoring RabbitMQ and any SQL databases you might need).
Contents |
Keystone Concepts
This section describes the various concepts and definitions that are part of Keystone.
- Tenants
- In Keystone, "tenants" represent groups of users. Virtual machines (Nova) and containers (Swift) are assigned to tenants, not to users directly. Keystone users can be part of more than one tenant, and can have different types of roles defined for each tenant that they're a part of. Think of tenants as a logical way to organize computing and storage resources without assigning them to user accounts directly. Keystone allows you to create and delete tenants, and also enable and disable them.
- Roles
- A role is a common security concept, where a user is assigned a certain set of privileges. This set of privileges is called a role, has a name, and can be managed independently of the specific user account(s) that are part of the role. Keystone allows you to create and delete roles, add a user to a role for a specific tenant, remove a user from a role for a specific tenant, and of course list all the roles that have been defined.
- Users
- Keystone is used to define users. Users are accounts for specific individuals, and typically have a password and email associated with them. Keystone allows you to list, create, delete, enable/disable, update email addresses, and change passwords of Users.
- Services
- Keystone allows you to define services (more info needed.) Services can be created and deleted, and you can "get" a handle to a service that has been defined.
Quick Start
Installation
In Funtoo Linux, Keystone can be merged by typing:
# emerge sys-auth/keystone
Emerging Keystone will also pull in sys-auth/keystone-client as a runtime dependency. keystone-client (which provides the keystone executable) is now maintained in a separate GitHub repository, and connects to Keystone using the OpenStack identity API, more info on which can be found here:
- http://docs.openstack.org/api/openstack-identity-service/2.0/content/
- https://github.com/openstack/identity-api
Configuration
- Copy /etc/keystone/keystone.conf.sample to /etc/keystone/keystone.conf.
- Change the config line connection = to read sqlite:////var/tmp/keystone.db (four slashes after the colon)
- /etc/init.d/keystone start
- export SERVICE_ENDPOINT=http://127.0.0.1:35357/v2.0/
- export SERVICE_TOKEN=ADMIN
Now, initialize the Keystone database:
# keystone-manage db_sync
Now, test connecting to Keystone using the Keystone client:
# keystone tenant-list
+----+------+---------+
| id | name | enabled |
+----+------+---------+
+----+------+---------+
If you see this output, then keystone used SERVICE_ENDPOINT and SERVICE_TOKEN environmental variables to connect and successfully query Keystone for tenants.
