59 lines
2.0 KiB
ReStructuredText
59 lines
2.0 KiB
ReStructuredText
Using Keystone Middleware with Barbican
|
|
========================================
|
|
|
|
Prerequisites
|
|
--------------
|
|
To enable Keystone integration with Barbican you'll need a relatively
|
|
current version of Keystone. If you don't have an instance of Keystone
|
|
available, you can use one of the following ways to setup your own.
|
|
|
|
#. `Simple Dockerized Keystone`_
|
|
#. `Installing Keystone`_
|
|
#. Devstack
|
|
|
|
.. _Simple Dockerized Keystone: https://registry.hub.docker.com/u/
|
|
jmvrbanac/simple-keystone/
|
|
.. _Installing Keystone: http://docs.openstack.org/developer/keystone/
|
|
installing.html
|
|
|
|
|
|
Hooking up Barbican to Keystone
|
|
--------------------------------
|
|
Assuming that you've already setup your Keystone instance, connecting
|
|
Barbican to Keystone is quite simple. When completed, Barbican should
|
|
require a valid X-Auth-Token to be provided with all API calls except
|
|
the get version call.
|
|
|
|
1. Turn off any active instances of Barbican
|
|
2. Edit ``/etc/barbican/barbican-api-paste.ini``
|
|
|
|
1. Change the pipeline ``/v1`` value from unauthenticated ``barbican-api``
|
|
to the authenticated ``barbican-api-keystone``
|
|
|
|
.. code-block:: ini
|
|
|
|
[composite:main]
|
|
use = egg:Paste#urlmap
|
|
/: barbican_version
|
|
/v1: barbican-api-keystone
|
|
|
|
2. Replace ``authtoken`` filter values to match your Keystone
|
|
setup
|
|
|
|
.. code-block:: ini
|
|
|
|
[filter:authtoken]
|
|
paste.filter_factory = keystonemiddleware.auth_token:filter_factory
|
|
signing_dir = /tmp/barbican/cache
|
|
auth_uri = http://{YOUR_KEYSTONE_ENDPOINT}:5000/v3
|
|
auth_url = http://{YOUR_KEYSTONE_ENDPOINT}:35357/v3
|
|
auth_plugin = password
|
|
username = {YOUR_KEYSTONE_USERNAME}
|
|
password = {YOUR_KEYSTONE_PASSWORD}
|
|
user_domain_id = {YOUR_KEYSTONE_USER_DOMAIN}
|
|
project_name = {YOUR_KEYSTONE_PROJECT}
|
|
project_domain_id = {YOUR_KEYSTONE_PROJECT_DOMAIN}
|
|
|
|
3. Start Barbican ``{barbican_home}/bin/barbican.sh start``
|
|
|