pip 安装keystone_如何在阿里云上安装keystone

阿里云的虚拟机操作系统要选择ubuntu 14.04

1.参考openstack官网首先执行如下配置命令：

# apt-get install software-properties-common

# add-apt-repository cloud-archive:mitaka

# add-apt-repository cloud-archive:mitaka-proposed

# apt-get install python-openstackclient

2.先配置pip，再安装pymysql(openstack官网指导文档的命令安装失败：# apt-get install mariadb-server python-pymysql)

# apt-get install python-pip

# pip install pymysql

3.安装mysql

# wget http://oss.aliyuncs.com/aliyunecs/onekey/mysql/mysql-5.5.35-linux2.6-x86_64.tar.gz

# tar zxvf mysql-5.5.35-linux2.6-x86_64.tar.gz -C /alidata/server/

# groupadd mysql

# useradd -g mysql -s /sbin/nologin mysql

# /opt/test/mysql/mysql-5.5.35-linux2.6-x86_64/scripts/mysql_install_db --datadir=/opt/test/mysql/mysql-5.5.35-linux2.6-x86_64/data/ --basedir=/opt/test/mysql/mysql-5.5.35-linux2.6-x86_64/ --user=mysql

# chown -R mysql:mysql /opt/test/mysql/mysql-5.5.35-linux2.6-x86_64/

# chown -R mysql:mysql /opt/test/mysql/mysql-5.5.35-linux2.6-x86_64/data/

# chown -R mysql:mysql /var/log/mysql

\cp -f /opt/test/mysql/mysql-5.5.35-linux2.6-x86_64/support-files/mysql.server /etc/init.d/mysql

# sed -i 's#^basedir=$#basedir=/opt/test/mysql/mysql-5.5.35-linux2.6-x86_64/#' /etc/init.d/mysql

# sed -i 's#^datadir=$#datadir=/opt/test/mysql/mysql-5.5.35-linux2.6-x86_64/data#' /etc/init.d/mysql

\cp -f /opt/test/mysql/mysql-5.5.35-linux2.6-x86_64/support-files/my-huge.cnf /etc/my.cnf

# sed -i 's#skip-locking#skip-external-locking\nlog-error=/var/log/mysql/error.log#' /etc/my.cnf

# chmod 755 /etc/init.d/mysql

# service mysql restart

# /opt/test/mysql/mysql-5.5.35-linux2.6-x86_64/bin/mysqladmin -u root password 'password'

# ln -s /opt/test/mysql/mysql-5.5.35-linux2.6-x86_64/bin/mysql /usr/bin

# ln -s /opt/test/mysql/mysql-5.5.35-linux2.6-x86_64/bin/mysqladmin /usr/bin

4.然后登录下试试能否连接数据库

mysql -u root -p

5.接下来创建keystone数据库

# CREATE DATABASE keystone;

# GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'localhost' \

IDENTIFIED BY 'KEYSTONE_DBPASS';

# GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'%' \

IDENTIFIED BY 'KEYSTONE_DBPASS';

6.安装keystone

# echo "manual" > /etc/init/keystone.override

# apt-get install keystone apache2 libapache2-mod-wsgi

7.配置keystone配置项

# vi  /etc/keystone/keystone.conf

admin_token = ADMIN_TOKEN

connection = mysql+pymysql://keystone:KEYSTONE_DBPASS@127.0.0.1/keystone

provider = keystone.token.providers.pki.Provider

8.继续执行下面同步命令

# su -s /bin/sh -c "keystone-manage db_sync" keystone

# keystone-manage pki_setup --keystone-user keystone --keystone-group keystone

9.新增如下配置内容，其中35357是管理地址的端口，5000是外网可访问的普通用户的token调用的地址

# vi  /etc/apache2/sites-available/wsgi-keystone.conf

Listen 5000

Listen 35357

WSGIDaemonProcess keystone-public processes=5 threads=1 user=keystone group=keystone display-name=%{GROUP}

WSGIProcessGroup keystone-public

WSGIScriptAlias / /usr/bin/keystone-wsgi-public

WSGIApplicationGroup %{GLOBAL}

WSGIPassAuthorization On

ErrorLogFormat "%{cu}t %M"

ErrorLog /var/log/apache2/keystone.log

CustomLog /var/log/apache2/keystone_access.log combined

Require all granted

WSGIDaemonProcess keystone-admin processes=5 threads=1 user=keystone group=keystone display-name=%{GROUP}

WSGIProcessGroup keystone-admin

WSGIScriptAlias / /usr/bin/keystone-wsgi-admin

WSGIApplicationGroup %{GLOBAL}

WSGIPassAuthorization On

ErrorLogFormat "%{cu}t %M"

ErrorLog /var/log/apache2/keystone.log

CustomLog /var/log/apache2/keystone_access.log combined

Require all granted

10.启用apache服务

# ln -s /etc/apache2/sites-available/wsgi-keystone.conf /etc/apache2/sites-enabled

# service apache2 restart

11.启动keystone

# keystone-all --config-file=/etc/keystone/keystone.conf

12.在另一个xshell页签执行下面命令添加数据

添加domain

curl  -H"X-Auth-Token:ADMIN" -H "Content-type: application/json" -d '{"domain": {"description": "--optional--", "enabled": true, "name": "mydomain"}}'  http://localhost:35357/v3/domains

添加project，其中红色的domain id是上面操作的返回值

curl  -H"X-Auth-Token:ADMIN" -H "Content-type: application/json" -d '{"project": {"description": "My new project","domain_id": "0fea14887b294ed692d547c4757d030f","enabled": true,"is_domain": true,"name": "project1"}}'  http://localhost:35357/v3/projects

创建用户

curl  -H"X-Auth-Token:ADMIN" -H "Content-type: application/json" -d '{"user": {"default_project_id": "0a4a842c59c049ba983a1121194deaaa","description": "myuser","domain_id": "0fea14887b294ed692d547c4757d030f","email": "myuser@example.com","enabled": true,"name": "myuser","password": "password"}}'  http://localhost:35357/v3/users

最后让我们获取一个用户的token

curl  -H"X-Auth-Token:ADMIN" -H "Content-type: application/json" -d '{"auth": {"identity": {"methods": ["password"],"password": {"user": {"name": "myuser","password": "password","domain": {"name": "mydomain"}}}}}}'  http://localhost:35357/v3/auth/tokens

返回值：

root@iZ28ke4gfdZ:~# curl -i -k -H"X-Auth-Token:ADMIN" -H "Content-type: application/json" -d '{"auth": {"identity": {"methods": ["password"],"password": {"user": {"name": "myuser","password": "password","domain": {"name": "mydomain"}}}}}}' http://localhost:35357/v3/auth/tokens

HTTP/1.1 201 Created

X-Subject-Token: MIIC4AYJKoZIhvcNAQcCoIIC0TCCAs0CAQExDTALBglghkgBZQMEAgEwggEuBgkqhkiG9w0BBwGgggEfBIIBG3sidG9rZW4iOiB7Imlzc3VlZF9hdCI6ICIyMDE2LTA1LTAxVDE3OjAzOjI1Ljg5MTU4NFoiLCAiZXh0cmFzIjoge30sICJtZXRob2RzIjogWyJwYXNzd29yZCJdLCAiZXhwaXJlc19hdCI6ICIyMDE2LTA1LTAxVDE4OjAzOjI1Ljg5MTU0OVoiLCAidXNlciI6IHsiZG9tYWluIjogeyJpZCI6ICIwZmVhMTQ4ODdiMjk0ZWQ2OTJkNTQ3YzQ3NTdkMDMwZiIsICJuYW1lIjogIm15ZG9tYWluIn0sICJpZCI6ICJiOWZmOTQxOTBiMDY0NmE0OTA1ODRhZWM2NWM4MDA1ZSIsICJuYW1lIjogIm15dXNlciJ9fX0xggGFMIIBgQIBATBcMFcxCzAJBgNVBAYTAlVTMQ4wDAYDVQQIDAVVbnNldDEOMAwGA1UEBwwFVW5zZXQxDjAMBgNVBAoMBVVuc2V0MRgwFgYDVQQDDA93d3cuZXhhbXBsZS5jb20CAQEwCwYJYIZIAWUDBAIBMA0GCSqGSIb3DQEBAQUABIIBAGR-gNszAHoMVAcp1tcZ6U2RAKd7KgRT12gAUwNSvia22u0+JKDYFSniLUpzLmPGSsqFfyE-ilW912nBvKUwPjiG-PDLtGq9r39WeJPU14w6IZXYJ-iTLIPN0t-60j89mU7AWXk89y0cxE-3OxwElr-FIiBmQWnsmuQTrUlRG6AYoUHPt2RHY2GsrDmQbTwFqU5EUYVWMiBUCtLdb95xTkYiA8huR86OH06pysfSadk5GWOyfOuCoenHY0-85y6lRTOYRaJOV7U0mDIamFIv9cBHrRpm5BdFFfVQkPBMbKTDEyZFLskdUJbYAw72a8BuKXrK0omMuy4n4byh7U49iSE=

Vary: X-Auth-Token

X-Distribution: Ubuntu

Content-Type: application/json

Content-Length: 283

Date: Sun, 01 May 2016 17:03:25 GMT

{"token": {"issued_at": "2016-05-01T17:03:25.891584Z", "extras": {}, "methods": ["password"], "expires_at": "2016-05-01T18:03:25.891549Z", "user": {"domain": {"id": "0fea14887b294ed692d547c4757d030f", "name": "mydomain"}, "id": "b9ff94190b0646a490584aec65c8005e", "name": "myuser"}}}

其中X-Subject-Token就是签名后的token，而返回的body体里面就是这个token的明文。

openstack-keystone api链接：http://developer.openstack.org/api-ref-identity-v3.html