Files
devstack/lib/horizon
Brant Knudson 3951a94499 Configurable token hashing algorithm
The Keystone server and auth_token middleware were enhanced to
support a configurable hash algorithm.

With this change, the user can set

 KEYSTONE_TOKEN_HASH_ALGORITHM=sha256

in their localrc to use the SHA256 algorithm rather than the
default md5. Any hash algorithm supported by Python's hashlib can
be used. The MD5 algorithm doesn't provide enough protection from
hash collisions and some security standards mandate a SHA2 hash
algorithm.

Change-Id: I8b373291ceb760a03c4c14aebfeb53d8d0dfbcc1
Closes-Bug: #1174499
2014-09-21 13:55:39 -05:00

196 lines
5.8 KiB
Plaintext

# lib/horizon
# Functions to control the configuration and operation of the horizon service
# Dependencies:
#
# - ``functions`` file
# - ``apache`` file
# - ``SERVICE_{TENANT_NAME|PASSWORD}`` must be defined
# ``stack.sh`` calls the entry points in this order:
#
# - install_horizon
# - configure_horizon
# - init_horizon
# - start_horizon
# - stop_horizon
# - cleanup_horizon
# Save trace setting
XTRACE=$(set +o | grep xtrace)
set +o xtrace
# Defaults
# --------
# Set up default directories
HORIZON_DIR=$DEST/horizon
HORIZONAUTH_DIR=$DEST/django_openstack_auth
# local_settings.py is used to customize Dashboard settings.
# The example file in Horizon repo is used by default.
HORIZON_SETTINGS=${HORIZON_SETTINGS:-$HORIZON_DIR/openstack_dashboard/local/local_settings.py.example}
# Tell Tempest this project is present
TEMPEST_SERVICES+=,horizon
# Functions
# ---------
# utility method of setting python option
function _horizon_config_set {
local file=$1
local section=$2
local option=$3
local value=$4
if [ -z "$section" ]; then
sed -e "/^$option/d" -i $local_settings
echo -e "\n$option=$value" >> $file
elif grep -q "^$section" $file; then
local line=$(sed -ne "/^$section/,/^}/ { /^ *'$option':/ p; }" $file)
if [ -n "$line" ]; then
sed -i -e "/^$section/,/^}/ s/^\( *'$option'\) *:.*$/\1: $value,/" $file
else
sed -i -e "/^$section/a\ '$option': $value," $file
fi
else
echo -e "\n\n$section = {\n '$option': $value,\n}" >> $file
fi
}
# Entry Points
# ------------
# cleanup_horizon() - Remove residual data files, anything left over from previous
# runs that a clean run would need to clean up
function cleanup_horizon {
if [[ is_fedora && $DISTRO =~ (rhel6) ]]; then
# If ``/usr/bin/node`` points into ``$DEST``
# we installed it via ``install_nodejs``
if [[ $(readlink -f /usr/bin/node) =~ ($DEST) ]]; then
sudo rm /usr/bin/node
fi
fi
local horizon_conf=$(apache_site_config_for horizon)
sudo rm -f $horizon_conf
}
# configure_horizon() - Set config files, create data dirs, etc
function configure_horizon {
setup_develop $HORIZON_DIR
}
# init_horizon() - Initialize databases, etc.
function init_horizon {
# ``local_settings.py`` is used to override horizon default settings.
local local_settings=$HORIZON_DIR/openstack_dashboard/local/local_settings.py
cp $HORIZON_SETTINGS $local_settings
if is_service_enabled neutron; then
_horizon_config_set $local_settings OPENSTACK_NEUTRON_NETWORK enable_security_group $Q_USE_SECGROUP
fi
# enable loadbalancer dashboard in case service is enabled
if is_service_enabled q-lbaas; then
_horizon_config_set $local_settings OPENSTACK_NEUTRON_NETWORK enable_lb True
fi
# enable firewall dashboard in case service is enabled
if is_service_enabled q-fwaas; then
_horizon_config_set $local_settings OPENSTACK_NEUTRON_NETWORK enable_firewall True
fi
# enable VPN dashboard in case service is enabled
if is_service_enabled q-vpn; then
_horizon_config_set $local_settings OPENSTACK_NEUTRON_NETWORK enable_vpn True
fi
_horizon_config_set $local_settings "" OPENSTACK_HOST \"${KEYSTONE_SERVICE_HOST}\"
_horizon_config_set $local_settings "" OPENSTACK_KEYSTONE_URL "\"${KEYSTONE_SERVICE_PROTOCOL}://${KEYSTONE_SERVICE_HOST}:${KEYSTONE_SERVICE_PORT}/v2.0\""
if [[ -n "$KEYSTONE_TOKEN_HASH_ALGORITHM" ]]; then
_horizon_config_set $local_settings "" OPENSTACK_TOKEN_HASH_ALGORITHM \""$KEYSTONE_TOKEN_HASH_ALGORITHM"\"
fi
if [ -f $SSL_BUNDLE_FILE ]; then
_horizon_config_set $local_settings "" OPENSTACK_SSL_CACERT \"${SSL_BUNDLE_FILE}\"
fi
# Create an empty directory that apache uses as docroot
sudo mkdir -p $HORIZON_DIR/.blackhole
# Apache 2.4 uses mod_authz_host for access control now (instead of "Allow")
local horizon_require=''
if check_apache_version "2.4" ; then
horizon_require='Require all granted'
fi
local horizon_conf=$(apache_site_config_for horizon)
# Configure apache to run horizon
sudo sh -c "sed -e \"
s,%USER%,$APACHE_USER,g;
s,%GROUP%,$APACHE_GROUP,g;
s,%HORIZON_DIR%,$HORIZON_DIR,g;
s,%APACHE_NAME%,$APACHE_NAME,g;
s,%DEST%,$DEST,g;
s,%HORIZON_REQUIRE%,$horizon_require,g;
\" $FILES/apache-horizon.template >$horizon_conf"
if is_ubuntu; then
disable_apache_site 000-default
sudo touch $horizon_conf
elif is_fedora; then
sudo sed '/^Listen/s/^.*$/Listen 0.0.0.0:80/' -i /etc/httpd/conf/httpd.conf
elif is_suse; then
: # nothing to do
else
exit_distro_not_supported "horizon apache configuration"
fi
enable_apache_site horizon
# Remove old log files that could mess with how devstack detects whether Horizon
# has been successfully started (see start_horizon() and functions::screen_it())
# and run_process
sudo rm -f /var/log/$APACHE_NAME/horizon_*
}
# install_django_openstack_auth() - Collect source and prepare
function install_django_openstack_auth {
git_clone $HORIZONAUTH_REPO $HORIZONAUTH_DIR $HORIZONAUTH_BRANCH
setup_install $HORIZONAUTH_DIR
}
# install_horizon() - Collect source and prepare
function install_horizon {
# Apache installation, because we mark it NOPRIME
install_apache_wsgi
git_clone $HORIZON_REPO $HORIZON_DIR $HORIZON_BRANCH $HORIZON_TAG
}
# start_horizon() - Start running processes, including screen
function start_horizon {
restart_apache_server
tail_log horizon /var/log/$APACHE_NAME/horizon_error.log
}
# stop_horizon() - Stop running processes (non-screen)
function stop_horizon {
stop_apache_server
}
# Restore xtrace
$XTRACE
# Tell emacs to use shell-script-mode
## Local variables:
## mode: shell-script
## End: