简介
Keystone是Openstack的身份认证服务，作为Openstack的基础支持服务，keystone提供下面
几种功能：
- 管理用户及其权限
- 维护Openstack Services的Endpoint
- Authentication（认证）和Authorization（鉴权）
Keystone的主要概念
-
User
User 指代任何使用 OpenStack 的实体，可以是真正的用户，其他系统或者服务。
-
Credentials
Credentials 是 User 用来证明自己身份的信息，可以是：
- 用户名/密码
- Token
- API Key
- 其他高级方式
-
Authentication
确认用户身份的过程。User 访问 OpenStack 时向 Keystone 提交用户名和密码形式的
Credentials，Keystone 验证通过后会给 User 签发一个 Token 作为后续访问的
Credential。 -
Token
Token 是由数字和字母组成的字符串，User 成功 Authentication 后 Keystone 生成
Token 并分配给 User。- Token 用做访问 Service 的 Credential
- Service 会通过 Keystone 验证 Token 的有效性
- Token 的有效期默认是 24 小时
-
Project
Project 用于将 OpenStack 的资源（计算、存储和网络）进行分组和隔离。
根据 OpenStack 服务的对象不同，Project 可以是一个客户（公有云，也叫租户）、部门
或者项目组（私有云）。 -
Service
OpenStack 的 Service 包括 Compute (Nova)、Block Storage (Cinder)、
Object Storage (Swift)、Image Service (Glance) 、Networking Service
(Neutron) 等。
每个 Service 都会提供若干个 Endpoint，User 通过 Endpoint 访问资源和执行操作。 -
Endpoint
Endpoint是一个网络上可访问服务的地址，通常是一个URL。Service通过Endpoint暴露自
己的API。
[root@openstack-controller keystone]# source /home/fbo/tools/admin-openrc.sh
[root@openstack-controller keystone]# openstack catalog list
+----------+----------+----------------------------------------------------------------------------------+
| Name | Type | Endpoints |
+----------+----------+----------------------------------------------------------------------------------+
| neutron | network | RegionOne |
| | | admin: http://openstack-controller:9696 |
| | | RegionOne |
| | | public: http://openstack-controller:9696 |
| | | RegionOne |
| | | internal: http://openstack-controller:9696 |
| | | |
| nova | compute | RegionOne |
| | | public: http://openstack-controller:8774/v2/471592a4281e4223b2ad578b5c9b8442 |
| | | RegionOne |
| | | internal: http://openstack-controller:8774/v2/471592a4281e4223b2ad578b5c9b8442 |
| | | RegionOne |
| | | admin: http://openstack-controller:8774/v2/471592a4281e4223b2ad578b5c9b8442 |
| | | |
| keystone | identity | RegionOne |
| | | internal: http://openstack-controller:5000/v2.0 |
| | | RegionOne |
| | | admin: http://openstack-controller:35357/v2.0 |
| | | RegionOne |
| | | public: http://openstack-controller:5000/v2.0 |
| | | |
| cinder | volume | RegionOne |
| | | admin: http://openstack-controller:8776/v1/471592a4281e4223b2ad578b5c9b8442 |
| | | RegionOne |
| | | public: http://openstack-controller:8776/v1/471592a4281e4223b2ad578b5c9b8442 |
| | | RegionOne |
| | | internal: http://openstack-controller:8776/v1/471592a4281e4223b2ad578b5c9b8442 |
| | | |
| cinderv2 | volumev2 | RegionOne |
| | | admin: http://openstack-controller:8776/v2/471592a4281e4223b2ad578b5c9b8442 |
| | | RegionOne |
| | | internal: http://openstack-controller:8776/v2/471592a4281e4223b2ad578b5c9b8442 |
| | | RegionOne |
| | | public: http://openstack-controller:8776/v2/471592a4281e4223b2ad578b5c9b8442 |
| | | |
| glance | image | RegionOne |
| | | admin: http://openstack-controller:9292 |
| | | RegionOne |
| | | public: http://openstack-controller:9292 |
| | | RegionOne |
| | | internal: http://openstack-controller:9292 |
| | | |
+----------+----------+----------------------------------------------------------------------------------+
-
Role
Keystone借助Role实现Authorization。
- keystone定义Role
[root@openstack-controller keystone]# openstack role list +----------------------------------+--------------+ | ID | Name | +----------------------------------+--------------+ | 268b282d5d4c44fd9f4ef6f4d3538ac2 | compute-user | | 36b27d9db66b4d2799770d59d25610ff | user | | ea7ae29ac10344f5b2f432246a78b26a | admin | +----------------------------------+--------------+- Service决定每个Role能做什么事情。
Service通过
/etc/[SERVICE_CODENAME]/policy.json文件对Role进行访问控制，
例如，下面的/etc/cinder/policy.json的配置就没有限制用户创建卷：[root@openstack-controller keystone]# grep volume:create /etc/cinder/policy.json "volume:create": "",Openstack默认只区分admin用户和非admin用户，如果想实现细粒度授权的话，可以定制修
改policy.json文件。
Keystone使用示例
[root@openstack-controller keystone]# openstack user create --password-prompt --email alice@example alice
User Password:
Repeat User Password:
+-----------+----------------------------------+
| Field | Value |
+-----------+----------------------------------+
| domain_id | default |
| email | alice@example |
| enabled | True |
| id | 02a0447e04bf420db7c0d5aec6308ebe |
| name | alice |
+-----------+----------------------------------+
[root@openstack-controller keystone]# openstack project create acme --domain default
+-------------+----------------------------------+
| Field | Value |
+-------------+----------------------------------+
| description | |
| domain_id | default |
| enabled | True |
| id | bc657759d86f4296a317d738fed09710 |
| is_domain | False |
| name | acme |
| parent_id | None |
+-------------+----------------------------------+
[root@openstack-controller keystone]# openstack domain list
+---------+---------+---------+----------------------------------------------------------------------+
| ID | Name | Enabled | Description |
+---------+---------+---------+----------------------------------------------------------------------+
| default | Default | True | Owns users and tenants (i.e. projects) available on Identity API v2. |
+---------+---------+---------+----------------------------------------------------------------------+
[root@openstack-controller keystone]# openstack --os-identity-api-version=3 domain create emea
+---------+----------------------------------+
| Field | Value |
+---------+----------------------------------+
| enabled | True |
| id | e0d06f7bf37147088e888c1198e547ee |
| name | emea |
+---------+----------------------------------+
[root@openstack-controller keystone]# openstack domain list
+----------------------------------+---------+---------+----------------------------------------------------------------------+
| ID | Name | Enabled | Description |
+----------------------------------+---------+---------+----------------------------------------------------------------------+
| default | Default | True | Owns users and tenants (i.e. projects) available on Identity API v2. |
| e0d06f7bf37147088e888c1198e547ee | emea | True | |
+----------------------------------+---------+---------+----------------------------------------------------------------------+
[root@openstack-controller keystone]# openstack role create compute-user
+-------+----------------------------------+
| Field | Value |
+-------+----------------------------------+
| id | 268b282d5d4c44fd9f4ef6f4d3538ac2 |
| name | compute-user |
+-------+----------------------------------+
[root@openstack-controller keystone]# openstack role add --project acme --user alice compute-user
