The /etc/[SERVICE_CODENAME]/policy.json controls what users are allowed to do for a given service. For example, /etc/nova/policy.json specifies the access policy for the Compute service, /etc/glance/policy.json specifies the access policy for the Image service, and /etc/keystone/policy.json specifies the access policy for the Identity service.
keystone --token 1234 --endpoint http://192.168.0.169:35357/v2.0 tenant-create --name defaulttenant --description "Default Tenant"
+-------------+----------------------------------+ | Property | Value | +-------------+----------------------------------+ | description | Default Tenant | | enabled | True | | id | d3ab6c32167244aabeb63939ea85245f | | name | defaulttenant | +-------------+----------------------------------+
[root@openstack1 vic]# keystone --token 1234 --endpoint http://192.168.0.169:35357/v2.0 user-create --name admin --pass dingqiqing --tenant-id d3ab6c32167244aabeb63939ea85245f
+----------+-------------------------------------------------------------------------------------------------------------------------+ | Property | Value | +----------+-------------------------------------------------------------------------------------------------------------------------+ | email | | | enabled | True | | id | 784f31ab49214d8e9312f787fdd3bf52 | | name | admin | | password | $6$rounds=40000$2D1AWkK5NZNbxwbe$JSUKUvw3HD/DfJsfH4UiGynIvXFzx9wRvgvjG7Ja1/V9vHwATNV7eNmrsmRvYrS6cKfKJ5cVoDXMfUOPHGNwq. | | tenantId | d3ab6c32167244aabeb63939ea85245f | +----------+-------------------------------------------------------------------------------------------------------------------------+
keystone --token 1234 --endpoint http://192.168.0.169:35357/v2.0 role-create --name Admin keystone --token 1234 --endpoint http://192.168.0.169:35357/v2.0 role-create --name Member
+----------+----------------------------------+ | Property | Value | +----------+----------------------------------+ | id | 5d2559c588f544b4a85ad40c3504f96c | | name | Admin | +----------+----------------------------------+ +----------+----------------------------------+ | Property | Value | +----------+----------------------------------+ | id | 828c45b4c0d24feb820ceb9895978ad3 | | name | Member | +----------+----------------------------------+
keystone --token 1234 --endpoint http://192.168.0.169:35357/v2.0 user-role-add --user-id 784f31ab49214d8e9312f787fdd3bf52 --tenant-id d3ab6c32167244aabeb63939ea85245f --role-id 5d2559c588f544b4a85ad40c3504f96c
keystone --token 1234 --endpoint http://192.168.0.169:35357/v2.0 tenant-create --name service --description "Service Tenant"
+-------------+----------------------------------+ | Property | Value | +-------------+----------------------------------+ | description | Service Tenant | | enabled | True | | id | c34f61b17ba44089b7e7b24840a2e5d0 | | name | service | +-------------+----------------------------------+
should be run for each service we are going to add user: glance
#Create user in the tenant [root@openstack1 vic]# keystone --token 1234 --endpoint http://192.168.0.169:35357/v2.0 user-create --name glance --pass dingqiqing --tenant-id c34f61b17ba44089b7e7b24840a2e5d0 +----------+-------------------------------------------------------------------------------------------------------------------------+ | Property | Value | +----------+-------------------------------------------------------------------------------------------------------------------------+ | email | | | enabled | True | | id | 413e3d4104cf4176ab8e854393314ec3 | | name | glance | | password | $6$rounds=40000$Ohyap0YqW3A5O9gC$ZdsvTAMYpeZNnzis98gmRJE9pMoJJLOrvXU4rIX7ghIR.pGBhierwkO2AXdLwUo8srvpOtDolp4Mc/mKaG3Wu0 | | tenantId | c34f61b17ba44089b7e7b24840a2e5d0 | +----------+-------------------------------------------------------------------------------------------------------------------------+ #Assign role Admin to the newly created user in that tenant keystone --token 1234 --endpoint http://192.168.0.169:35357/v2.0 user-role-add --user-id 413e3d4104cf4176ab8e854393314ec3 --tenant-id c34f61b17ba44089b7e7b24840a2e5d0 --role-id 5d2559c588f544b4a85ad40c3504f96c
user: nova
keystone --token 1234 --endpoint http://192.168.0.169:35357/v2.0 user-create --name nova --pass dingqiqing --tenant-id c34f61b17ba44089b7e7b24840a2e5d0 +----------+-------------------------------------------------------------------------------------------------------------------------+ | Property | Value | +----------+-------------------------------------------------------------------------------------------------------------------------+ | email | | | enabled | True | | id | 2b626bfb635f423aa84b7dadf13c191d | | name | nova | | password | $6$rounds=40000$XFJY6DN6e81V/1kD$V.Z0dPxPi8jXnIcumeI1EB5KUx0WWXm8nE30AR7SzTXsh3/i.zdiykh4rDaAxdD55gzSwxgIo2tdlRnhRxO5N. | | tenantId | c34f61b17ba44089b7e7b24840a2e5d0 | +----------+-------------------------------------------------------------------------------------------------------------------------+ #assign role Admin to user nova keystone --token 1234 --endpoint http://192.168.0.169:35357/v2.0 user-role-add --user-id 2b626bfb635f423aa84b7dadf13c191d --tenant-id c34f61b17ba44089b7e7b24840a2e5d0 --role-id 5d2559c588f544b4a85ad40c3504f96c
user: ec2
keystone --token 1234 --endpoint http://192.168.0.169:35357/v2.0 user-create --name ec2 --pass dingqiqing --tenant-id c34f61b17ba44089b7e7b24840a2e5d0 +----------+-------------------------------------------------------------------------------------------------------------------------+ | Property | Value | +----------+-------------------------------------------------------------------------------------------------------------------------+ | email | | | enabled | True | | id | f77f9cf9e5f64591a332e5ee0294e2e6 | | name | ec2 | | password | $6$rounds=40000$iDzgCvxNp9OOoMIF$Xy5H9XnEOvD44/.83nMYyavE6EkHr3EEiy0ukGcai8AoV13G3Emd1eW7Hr08pRbL.JS1CFu//M39CfcQv75yc/ | | tenantId | c34f61b17ba44089b7e7b24840a2e5d0 | +----------+-------------------------------------------------------------------------------------------------------------------------+ # role assignment keystone --token 1234 --endpoint http://192.168.0.169:35357/v2.0 user-role-add --user-id f77f9cf9e5f64591a332e5ee0294e2e6 --tenant-id c34f61b17ba44089b7e7b24840a2e5d0 --role-id 5d2559c588f544b4a85ad40c3504f96c
user: swift
keystone --token 1234 --endpoint http://192.168.0.169:35357/v2.0 user-create --name swift --pass dingqiqing --tenant-id c34f61b17ba44089b7e7b24840a2e5d0 +----------+-------------------------------------------------------------------------------------------------------------------------+ | Property | Value | +----------+-------------------------------------------------------------------------------------------------------------------------+ | email | | | enabled | True | | id | 2ee34bc27a00432a82661f6fd6cbf126 | | name | swift | | password | $6$rounds=40000$PjY6dpd4bx7N9Uas$umRB6ElRsDlwbORbe9GvrM6rMbJXeNeXc1UeP3Nu7.meYbe6lW4qBi1siRQhdnRcM0pCUIIKJV0mLB5rVn0XM/ | | tenantId | c34f61b17ba44089b7e7b24840a2e5d0 | +----------+-------------------------------------------------------------------------------------------------------------------------+ #role assignment keystone --token 1234 --endpoint http://192.168.0.169:35357/v2.0 user-role-add --user-id 2ee34bc27a00432a82661f6fd6cbf126 --tenant-id c34f61b17ba44089b7e7b24840a2e5d0 --role-id 5d2559c588f544b4a85ad40c3504f96c
The script code from OpenStack community
#!/usr/bin/env bash # Copyright 2013 OpenStack LLC # # Licensed under the Apache License, Version 2.0 (the "License"); you may # not use this file except in compliance with the License. You may obtain # a copy of the License at # # http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, WITHOUT # WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the # License for the specific language governing permissions and limitations # under the License. # Sample initial data for Keystone using python-keystoneclient # # This script is based on the original DevStack keystone_data.sh script. # # It demonstrates how to bootstrap Keystone with an administrative user # using the SERVICE_TOKEN and SERVICE_ENDPOINT environment variables # and the administrative API. It will get the admin_token (SERVICE_TOKEN) # and admin_port from keystone.conf if available. # # Disable creation of endpoints by setting DISABLE_ENDPOINTS environment variable. # Use this with the Catalog Templated backend. # # A EC2-compatible credential is created for the admin user and # placed in etc/ec2rc. # # Tenant User Roles # ------------------------------------------------------- # demo admin admin # service glance admin # service nova admin # service ec2 admin # service swift admin CONTROLLER_PUBLIC_ADDRESS=${CONTROLLER_PUBLIC_ADDRESS:-localhost} CONTROLLER_ADMIN_ADDRESS=${CONTROLLER_ADMIN_ADDRESS:-localhost} CONTROLLER_INTERNAL_ADDRESS=${CONTROLLER_INTERNAL_ADDRESS:-localhost} TOOLS_DIR=$(cd $(dirname "$0") && pwd) KEYSTONE_CONF=${KEYSTONE_CONF:-/etc/keystone/keystone.conf} if [[ -r "$KEYSTONE_CONF" ]]; then EC2RC="$(dirname "$KEYSTONE_CONF")/ec2rc" elif [[ -r "$TOOLS_DIR/../etc/keystone.conf" ]]; then # assume git checkout KEYSTONE_CONF="$TOOLS_DIR/../etc/keystone.conf" EC2RC="$TOOLS_DIR/../etc/ec2rc" else KEYSTONE_CONF="" EC2RC="ec2rc" fi # Extract some info from Keystone's configuration file if [[ -r "$KEYSTONE_CONF" ]]; then CONFIG_SERVICE_TOKEN=$(sed 's/[[:space:]]//g' $KEYSTONE_CONF | grep ^admin_token= | cut -d'=' -f2) CONFIG_ADMIN_PORT=$(sed 's/[[:space:]]//g' $KEYSTONE_CONF | grep ^admin_port= | cut -d'=' -f2) fi export SERVICE_TOKEN=${SERVICE_TOKEN:-$CONFIG_SERVICE_TOKEN} if [[ -z "$SERVICE_TOKEN" ]]; then echo "No service token found." echo "Set SERVICE_TOKEN manually from keystone.conf admin_token." exit 1 fi export SERVICE_ENDPOINT=${SERVICE_ENDPOINT:-http://$CONTROLLER_PUBLIC_ADDRESS:${CONFIG_ADMIN_PORT:-35357}/v2.0} function get_id () { echo `"$@" | grep ' id ' | awk '{print $4}'` } # # Default tenant # DEMO_TENANT=$(get_id keystone tenant-create --name=demo \ --description "Default Tenant") ADMIN_USER=$(get_id keystone user-create --name=admin \ --pass=secrete) ADMIN_ROLE=$(get_id keystone role-create --name=admin) keystone user-role-add --user-id $ADMIN_USER \ --role-id $ADMIN_ROLE \ --tenant-id $DEMO_TENANT # # Service tenant # SERVICE_TENANT=$(get_id keystone tenant-create --name=service \ --description "Service Tenant") GLANCE_USER=$(get_id keystone user-create --name=glance \ --pass=glance) keystone user-role-add --user-id $GLANCE_USER \ --role-id $ADMIN_ROLE \ --tenant-id $SERVICE_TENANT NOVA_USER=$(get_id keystone user-create --name=nova \ --pass=nova \ --tenant-id $SERVICE_TENANT) keystone user-role-add --user-id $NOVA_USER \ --role-id $ADMIN_ROLE \ --tenant-id $SERVICE_TENANT EC2_USER=$(get_id keystone user-create --name=ec2 \ --pass=ec2 \ --tenant-id $SERVICE_TENANT) keystone user-role-add --user-id $EC2_USER \ --role-id $ADMIN_ROLE \ --tenant-id $SERVICE_TENANT SWIFT_USER=$(get_id keystone user-create --name=swift \ --pass=swiftpass \ --tenant-id $SERVICE_TENANT) keystone user-role-add --user-id $SWIFT_USER \ --role-id $ADMIN_ROLE \ --tenant-id $SERVICE_TENANT # # Keystone service # KEYSTONE_SERVICE=$(get_id \ keystone service-create --name=keystone \ --type=identity \ --description="Keystone Identity Service") if [[ -z "$DISABLE_ENDPOINTS" ]]; then keystone endpoint-create --region RegionOne --service-id $KEYSTONE_SERVICE \ --publicurl "http://$CONTROLLER_PUBLIC_ADDRESS:\$(public_port)s/v2.0" \ --adminurl "http://$CONTROLLER_ADMIN_ADDRESS:\$(admin_port)s/v2.0" \ --internalurl "http://$CONTROLLER_INTERNAL_ADDRESS:\$(public_port)s/v2.0" fi # # Nova service # NOVA_SERVICE=$(get_id \ keystone service-create --name=nova \ --type=compute \ --description="Nova Compute Service") if [[ -z "$DISABLE_ENDPOINTS" ]]; then keystone endpoint-create --region RegionOne --service-id $NOVA_SERVICE \ --publicurl "http://$CONTROLLER_PUBLIC_ADDRESS:\$(compute_port)s/v1.1/\$(tenant_id)s" \ --adminurl "http://$CONTROLLER_ADMIN_ADDRESS:\$(compute_port)s/v1.1/\$(tenant_id)s" \ --internalurl "http://$CONTROLLER_INTERNAL_ADDRESS:\$(compute_port)s/v1.1/\$(tenant_id)s" fi # # Volume service # VOLUME_SERVICE=$(get_id \ keystone service-create --name=volume \ --type=volume \ --description="Nova Volume Service") if [[ -z "$DISABLE_ENDPOINTS" ]]; then keystone endpoint-create --region RegionOne --service-id $VOLUME_SERVICE \ --publicurl "http://$CONTROLLER_PUBLIC_ADDRESS:8776/v1/\$(tenant_id)s" \ --adminurl "http://$CONTROLLER_ADMIN_ADDRESS:8776/v1/\$(tenant_id)s" \ --internalurl "http://$CONTROLLER_INTERNAL_ADDRESS:8776/v1/\$(tenant_id)s" fi # # Image service # GLANCE_SERVICE=$(get_id \ keystone service-create --name=glance \ --type=image \ --description="Glance Image Service") if [[ -z "$DISABLE_ENDPOINTS" ]]; then keystone endpoint-create --region RegionOne --service-id $GLANCE_SERVICE \ --publicurl "http://$CONTROLLER_PUBLIC_ADDRESS:9292" \ --adminurl "http://$CONTROLLER_ADMIN_ADDRESS:9292" \ --internalurl "http://$CONTROLLER_INTERNAL_ADDRESS:9292" fi # # EC2 service # EC2_SERVICE=$(get_id \ keystone service-create --name=ec2 \ --type=ec2 \ --description="EC2 Compatibility Layer") if [[ -z "$DISABLE_ENDPOINTS" ]]; then keystone endpoint-create --region RegionOne --service-id $EC2_SERVICE \ --publicurl "http://$CONTROLLER_PUBLIC_ADDRESS:8773/services/Cloud" \ --adminurl "http://$CONTROLLER_ADMIN_ADDRESS:8773/services/Admin" \ --internalurl "http://$CONTROLLER_INTERNAL_ADDRESS:8773/services/Cloud" fi # # Swift service # SWIFT_SERVICE=$(get_id \ keystone service-create --name=swift \ --type="object-store" \ --description="Swift Service") if [[ -z "$DISABLE_ENDPOINTS" ]]; then keystone endpoint-create --region RegionOne --service-id $SWIFT_SERVICE \ --publicurl "http://$CONTROLLER_PUBLIC_ADDRESS:8888/v1/AUTH_\$(tenant_id)s" \ --adminurl "http://$CONTROLLER_ADMIN_ADDRESS:8888/v1" \ --internalurl "http://$CONTROLLER_INTERNAL_ADDRESS:8888/v1/AUTH_\$(tenant_id)s" fi # create ec2 creds and parse the secret and access key returned RESULT=$(keystone ec2-credentials-create --tenant-id=$SERVICE_TENANT --user-id=$ADMIN_USER) ADMIN_ACCESS=`echo "$RESULT" | grep access | awk '{print $4}'` ADMIN_SECRET=`echo "$RESULT" | grep secret | awk '{print $4}'` # write the secret and access to ec2rc cat > $EC2RC <<EOF ADMIN_ACCESS=$ADMIN_ACCESS ADMIN_SECRET=$ADMIN_SECRET EOF
keystone --token 1234 --endpoint http://192.168.0.169:35357/v2.0/ service-create --name=keystone --type=identity --description="Keystone Identity Service"
+-------------+----------------------------------+ | Property | Value | +-------------+----------------------------------+ | description | Keystone Identity Service | | id | ed69115205a949939c49f01a767b2a02 | | name | keystone | | type | identity | +-------------+----------------------------------+
keystone --token 1234 --endpoint http://192.168.0.169:35357/v2.0/ endpoint-create --region RegionOne --service-id=ed69115205a949939c49f01a767b2a02 --publicurl=http://192.168.0.169:5000/v2.0 --internalurl=http://192.168.0.169:5000/v2.0 --adminurl=http://192.168.0.169:35357/v2.0
+-------------+----------------------------------+ | Property | Value | +-------------+----------------------------------+ | adminurl | http://192.168.0.169:35357/v2.0 | | id | 3d045e30678e4d1f8dd9a5917524c724 | | internalurl | http://192.168.0.169:5000/v2.0 | | publicurl | http://192.168.0.169:5000/v2.0 | | region | RegionOne | | service_id | ed69115205a949939c49f01a767b2a02 | +-------------+----------------------------------+
keystone --token 1234 \ --endpoint http://192.168.0.169:35357/v2.0/ \ service-create \ --name=nova \ --type=compute \ --description="Nova Compute Service"
+-------------+----------------------------------+ | Property | Value | +-------------+----------------------------------+ | description | Nova Compute Service | | id | 04ac82f3a2ce4603be9778988aab30b0 | | name | nova | | type | compute | +-------------+----------------------------------+
keystone --token 1234 --endpoint http://192.168.0.169:35357/v2.0/ endpoint-create --region RegionOne --service-id=04ac82f3a2ce4603be9778988aab30b0 --publicurl='http://192.168.0.169:8774/v2/%(tenant_id)s' --internalurl='http://192.168.0.169:8774/v2/%(tenant_id)s' --adminurl='http://192.168.0.169:8774/v2/%(tenant_id)s'
+-------------+--------------------------------------------+ | Property | Value | +-------------+--------------------------------------------+ | adminurl | http://192.168.0.169:8774/v2/%(tenant_id)s | | id | 9c64d765ae564a1bb5d634f8fcca9ea4 | | internalurl | http://192.168.0.169:8774/v2/%(tenant_id)s | | publicurl | http://192.168.0.169:8774/v2/%(tenant_id)s | | region | RegionOne | | service_id | 04ac82f3a2ce4603be9778988aab30b0 | +-------------+--------------------------------------------+