Merge "Update docs for legacy keystone extensions"
This commit is contained in:
Jenkins
Gerrit Code Review
commit
239aa0ab75
@ -113,8 +113,8 @@ The primary configuration file is organized into the following sections:
|
||||
* ``[cache]`` - Caching layer configuration
|
||||
* ``[catalog]`` - Service catalog driver configuration
|
||||
* ``[credential]`` - Credential system driver configuration
|
||||
* ``[endpoint_filter]`` - Endpoint filtering extension configuration
|
||||
* ``[endpoint_policy]`` - Endpoint policy extension configuration
|
||||
* ``[endpoint_filter]`` - Endpoint filtering configuration
|
||||
* ``[endpoint_policy]`` - Endpoint policy configuration
|
||||
* ``[eventlet_server]`` - Eventlet server configuration
|
||||
* ``[eventlet_server_ssl]`` - Eventlet server SSL configuration
|
||||
* ``[federation]`` - Federation driver configuration
|
||||
@ -897,6 +897,35 @@ Another such example is `available in devstack
|
||||
(files/default_catalog.templates)
|
||||
<https://git.openstack.org/cgit/openstack-dev/devstack/tree/files/default_catalog.templates>`_.
|
||||
|
||||
Endpoint Filtering enables creation of ad-hoc catalogs for each project-scoped
|
||||
token request.
|
||||
|
||||
Configure the endpoint filter catalog driver in the ``[catalog]`` section.
|
||||
For example:
|
||||
|
||||
.. code-block:: ini
|
||||
|
||||
[catalog]
|
||||
driver = catalog_sql
|
||||
|
||||
In the ``[endpoint_filter]`` section, set ``return_all_endpoints_if_no_filter``
|
||||
to ``False`` to return an empty catalog if no associations are made.
|
||||
For example:
|
||||
|
||||
.. code-block:: ini
|
||||
|
||||
[endpoint_filter]
|
||||
return_all_endpoints_if_no_filter = False
|
||||
|
||||
See `API Specification for Endpoint Filtering <http://specs.openstack.org/
|
||||
openstack/keystone-specs/api/v3/identity-api-v3-os-ep-filter-ext.html>`_ for
|
||||
the details of API definition.
|
||||
|
||||
.. NOTE:: Support status for Endpoint Filtering
|
||||
|
||||
*Experimental* (Icehouse, Juno)
|
||||
*Stable* (Kilo)
|
||||
|
||||
Logging
|
||||
-------
|
||||
|
||||
@ -1053,6 +1082,109 @@ including the following in ``keystone.conf``:
|
||||
[os_inherit]
|
||||
enabled = True
|
||||
|
||||
See `API Specification for Inherit <http://specs.openstack.org/
|
||||
openstack/keystone-specs/api/v3/identity-api-v3-os-inherit-ext.html>`_
|
||||
for the details of API definition.
|
||||
|
||||
|
||||
.. NOTE:: Support status for Inherit Role Assignment
|
||||
|
||||
*Experimental* (Havava, Icehouse)
|
||||
*Stable* (Juno)
|
||||
|
||||
|
||||
Endpoint Policy
|
||||
---------------
|
||||
|
||||
The Endpoint Policy feature provides associations between service endpoints
|
||||
and policies that are already stored in the Identity server and referenced
|
||||
by a policy ID.
|
||||
|
||||
Configure the endpoint policy backend driver in the ``[endpoint_policy]``
|
||||
section. For example:
|
||||
|
||||
.. code-block:: ini
|
||||
|
||||
[endpoint_policy]
|
||||
driver = sql
|
||||
|
||||
See `API Specification for Endpoint Policy <http://specs.openstack.org/
|
||||
openstack/keystone-specs/api/v3/identity-api-v3-os-endpoint-policy.html>`_
|
||||
for the details of API definition.
|
||||
|
||||
.. NOTE:: Support status for Endpoint Policy
|
||||
|
||||
*Experimental* (Juno)
|
||||
*Stable* (Kilo)
|
||||
|
||||
|
||||
OAuth1 1.0a
|
||||
-----------
|
||||
|
||||
The OAuth 1.0a feature provides the ability for Identity users to delegate
|
||||
roles to third party consumers via the OAuth 1.0a specification.
|
||||
|
||||
To enable OAuth1:
|
||||
|
||||
1. Add the oauth1 driver to the ``[oauth1]`` section in ``keystone.conf``.
|
||||
For example:
|
||||
|
||||
.. code-block:: ini
|
||||
|
||||
[oauth1]
|
||||
driver = sql
|
||||
|
||||
2. Add the ``oauth1`` authentication method to the ``[auth]`` section in
|
||||
``keystone.conf``:
|
||||
|
||||
.. code-block:: ini
|
||||
|
||||
[auth]
|
||||
methods = external,password,token,oauth1
|
||||
|
||||
3. Optionally, if deploying under an HTTPD server (i.e. Apache), set the
|
||||
`WSGIPassAuthorization` to allow the OAuth Authorization headers to pass
|
||||
through `mod_wsgi`. For example, add the following to the keystone virtual
|
||||
host file:
|
||||
|
||||
.. code-block:: ini
|
||||
|
||||
WSGIPassAuthorization On
|
||||
|
||||
See `API Specification for OAuth 1.0a <http://specs.openstack.org/openstack/
|
||||
keystone-specs/api/v3/identity-api-v3-os-oauth1-ext.html>`_ for the details of
|
||||
API definition.
|
||||
|
||||
.. NOTE:: Support status for OAuth 1.0a
|
||||
|
||||
*Experimental* (Havana, Icehouse)
|
||||
*Stable* (Juno)
|
||||
|
||||
|
||||
Revocation Events
|
||||
-----------------
|
||||
|
||||
The Revocation Events feature provides a list of token revocations. Each event
|
||||
expresses a set of criteria which describes a set of tokens that are
|
||||
no longer valid.
|
||||
|
||||
Add the revoke backend driver to the ``[revoke]`` section in
|
||||
``keystone.conf``. For example:
|
||||
|
||||
.. code-block:: ini
|
||||
|
||||
[revoke]
|
||||
driver = sql
|
||||
|
||||
See `API Specification for Revocation Events <https://specs.openstack.org/
|
||||
openstack/keystone-specs/api/v3/identity-api-v3-os-revoke-ext.html>`_ for
|
||||
the details of API definition.
|
||||
|
||||
.. NOTE:: Support status for Revocation Events
|
||||
|
||||
*Experimental* (Juno)
|
||||
*Stable* (Kilo)
|
||||
|
||||
|
||||
Token Binding
|
||||
-------------
|
||||
|
||||
@ -43,99 +43,3 @@ Removal Process
|
||||
It is not intended that functionality should stay in experimental for a long
|
||||
period, functionality that stays `experimental` for more than **two** releases
|
||||
would be expected to make a transition to either `stable` or `out-of-tree`.
|
||||
|
||||
Current Extensions
|
||||
==================
|
||||
|
||||
------------------
|
||||
Endpoint Filtering
|
||||
------------------
|
||||
|
||||
The Endpoint Filtering extension enables creation of ad-hoc catalogs for each
|
||||
project-scoped token request.
|
||||
|
||||
.. NOTE:: Support status for Endpoint Filtering
|
||||
|
||||
*Experimental* (Icehouse, Juno)
|
||||
*Stable* (Kilo)
|
||||
|
||||
.. toctree::
|
||||
:maxdepth: 1
|
||||
|
||||
extensions/endpoint_filter.rst
|
||||
|
||||
* `API Specification for Endpoint Filtering <http://specs.openstack.org/openstack/keystone-specs/api/v3/identity-api-v3-os-ep-filter-ext.html>`__
|
||||
|
||||
---------------
|
||||
Endpoint Policy
|
||||
---------------
|
||||
|
||||
The Endpoint Policy extension provides associations between service endpoints
|
||||
and policies that are already stored in the Identity server and referenced by
|
||||
a policy ID.
|
||||
|
||||
.. NOTE:: Support status for Endpoint Policy
|
||||
|
||||
*Experimental* (Juno)
|
||||
*Stable* (Kilo)
|
||||
|
||||
.. toctree::
|
||||
:maxdepth: 1
|
||||
|
||||
extensions/endpoint_policy.rst
|
||||
|
||||
* `API Specification for Endpoint Policy <http://specs.openstack.org/openstack/keystone-specs/api/v3/identity-api-v3-os-endpoint-policy.html>`__
|
||||
|
||||
-------
|
||||
Inherit
|
||||
-------
|
||||
|
||||
The Inherit extension provides the ability for projects to inherit role
|
||||
assignments from their owning domain, or from projects higher in the
|
||||
hierarchy.
|
||||
|
||||
.. NOTE:: Support status for Inherit
|
||||
|
||||
*Experimental* (Havava, Icehouse)
|
||||
*Stable* (Juno)
|
||||
|
||||
* `API Specification for Inherit <http://specs.openstack.org/openstack/keystone-specs/api/v3/identity-api-v3-os-inherit-ext.html>`__
|
||||
|
||||
----------
|
||||
OAuth 1.0a
|
||||
----------
|
||||
|
||||
The OAuth 1.0a extension provides the ability for Identity users to delegate
|
||||
roles to third party consumers via the OAuth 1.0a specification.
|
||||
|
||||
.. NOTE:: Support status for OAuth 1.0a
|
||||
|
||||
*Experimental* (Havana, Icehouse)
|
||||
*Stable* (Juno)
|
||||
|
||||
.. toctree::
|
||||
:maxdepth: 1
|
||||
|
||||
extensions/oauth1.rst
|
||||
|
||||
* `API Specification for OAuth 1.0a <http://specs.openstack.org/openstack/keystone-specs/api/v3/identity-api-v3-os-oauth1-ext.html>`__
|
||||
|
||||
-----------------
|
||||
Revocation Events
|
||||
-----------------
|
||||
|
||||
The Revocation Events extension provides a list of token revocations. Each
|
||||
event expresses a set of criteria which describes a set of tokens that are
|
||||
no longer valid.
|
||||
|
||||
.. NOTE:: Support status for Revocation Events
|
||||
|
||||
*Experimental* (Juno)
|
||||
*Stable* (Kilo)
|
||||
|
||||
.. toctree::
|
||||
:maxdepth: 1
|
||||
|
||||
extensions/revoke.rst
|
||||
|
||||
* `API Specification for Revocation Events <http://specs.openstack.org/openstack/keystone-specs/api/v3/identity-api-v3-os-revoke-ext.html>`__
|
||||
|
||||
@ -1,44 +0,0 @@
|
||||
..
|
||||
Copyright 2011-2013 OpenStack, Foundation
|
||||
All Rights Reserved.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
not use this file except in compliance with the License. You may obtain
|
||||
a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
||||
WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
|
||||
License for the specific language governing permissions and limitations
|
||||
under the License.
|
||||
|
||||
======================================
|
||||
Enabling the Endpoint Filter Extension
|
||||
======================================
|
||||
|
||||
To enable the endpoint filter extension:
|
||||
|
||||
1. Add the endpoint filter extension catalog driver to the ``[catalog]`` section
|
||||
in ``keystone.conf``. For example::
|
||||
|
||||
[catalog]
|
||||
driver = catalog_sql
|
||||
|
||||
2. Add the ``endpoint_filter_extension`` filter to the ``api_v3`` pipeline in
|
||||
``keystone-paste.ini``. This must be added after ``json_body`` and before
|
||||
the last entry in the pipeline. For example::
|
||||
|
||||
[pipeline:api_v3]
|
||||
pipeline = sizelimit url_normalize build_auth_context token_auth admin_token_auth json_body ec2_extension_v3 s3_extension simple_cert_extension revoke_extension endpoint_filter_extension service_v3
|
||||
|
||||
3. Create the endpoint filter extension tables if using the provided sql backend. For example::
|
||||
|
||||
./bin/keystone-manage db_sync --extension endpoint_filter
|
||||
|
||||
4. Optionally, change ``return_all_endpoints_if_no_filter`` the ``[endpoint_filter]`` section
|
||||
in ``keystone.conf`` to return an empty catalog if no associations are made. For example::
|
||||
|
||||
[endpoint_filter]
|
||||
return_all_endpoints_if_no_filter = False
|
||||
@ -1,35 +0,0 @@
|
||||
..
|
||||
Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
not use this file except in compliance with the License. You may obtain
|
||||
a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
||||
WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
|
||||
License for the specific language governing permissions and limitations
|
||||
under the License.
|
||||
|
||||
======================================
|
||||
Enabling the Endpoint Policy Extension
|
||||
======================================
|
||||
|
||||
To enable the endpoint policy extension:
|
||||
|
||||
1. Optionally, add the endpoint policy extension driver to the
|
||||
``[endpoint_policy]`` section in ``keystone.conf``. For example::
|
||||
|
||||
[endpoint_policy]
|
||||
driver = sql
|
||||
|
||||
2. Add the ``endpoint_policy_extension`` policy to the ``api_v3`` pipeline in
|
||||
``keystone-paste.ini``. This must be added after ``json_body`` and before
|
||||
the last entry in the pipeline. For example::
|
||||
|
||||
[pipeline:api_v3]
|
||||
pipeline = sizelimit url_normalize build_auth_context token_auth admin_token_auth json_body ec2_extension_v3 s3_extension simple_cert_extension revoke_extension service_v3 endpoint_policy_extension service_v3
|
||||
|
||||
3. Create the endpoint policy extension tables if using the provided SQL backend. For example::
|
||||
|
||||
./bin/keystone-manage db_sync --extension endpoint_policy
|
||||
@ -1,49 +0,0 @@
|
||||
..
|
||||
Copyright 2011-2013 OpenStack, Foundation
|
||||
All Rights Reserved.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
not use this file except in compliance with the License. You may obtain
|
||||
a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
||||
WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
|
||||
License for the specific language governing permissions and limitations
|
||||
under the License.
|
||||
|
||||
=============================
|
||||
Enabling the OAuth1 Extension
|
||||
=============================
|
||||
|
||||
To enable the OAuth1 extension:
|
||||
|
||||
1. Optionally, add the oauth1 extension driver to the ``[oauth1]`` section in ``keystone.conf``. For example::
|
||||
|
||||
[oauth1]
|
||||
driver = sql
|
||||
|
||||
2. Add the ``oauth1`` authentication method to the ``[auth]`` section in ``keystone.conf``::
|
||||
|
||||
[auth]
|
||||
methods = external,password,token,oauth1
|
||||
|
||||
3. Add the ``oauth1_extension`` filter to the ``api_v3`` pipeline in
|
||||
``keystone-paste.ini``. This must be added after ``json_body`` and before
|
||||
the last entry in the pipeline. For example::
|
||||
|
||||
[pipeline:api_v3]
|
||||
pipeline = sizelimit url_normalize build_auth_context token_auth admin_token_auth json_body ec2_extension_v3 s3_extension simple_cert_extension revoke_extension oauth1_extension service_v3
|
||||
|
||||
4. Create the OAuth1 extension tables if using the provided SQL backend. For example::
|
||||
|
||||
./bin/keystone-manage db_sync --extension oauth1
|
||||
|
||||
5. Optionally, if deploying under an HTTPD server (i.e. Apache), set the
|
||||
`WSGIPassAuthorization` to allow the OAuth Authorization headers to
|
||||
pass through `mod_wsgi`. For example, add the following to the Keystone
|
||||
virtual host file::
|
||||
|
||||
WSGIPassAuthorization On
|
||||
@ -1,45 +0,0 @@
|
||||
..
|
||||
Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||
not use this file except in compliance with the License. You may obtain
|
||||
a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
||||
WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
|
||||
License for the specific language governing permissions and limitations
|
||||
under the License.
|
||||
|
||||
=================================
|
||||
Enabling the Revocation Extension
|
||||
=================================
|
||||
|
||||
.. NOTE::
|
||||
|
||||
As of the Juno release, the example configuration files will have the
|
||||
``OS-REVOKE`` extension enabled by default, thus it is not necessary to
|
||||
perform steps 1 and 2.
|
||||
Also, for new installations, the revocation extension tables are already
|
||||
migrated, thus it is not necessary to perform steps 3.
|
||||
|
||||
1. Optionally, add the revoke extension driver to the ``[revoke]`` section
|
||||
in ``keystone.conf``. For example::
|
||||
|
||||
[revoke]
|
||||
driver = sql
|
||||
|
||||
2. Add the required ``filter`` to the ``pipeline`` in ``keystone-paste.ini``.
|
||||
This must be added after ``json_body`` and before the last entry in the
|
||||
pipeline. For example::
|
||||
|
||||
[filter:revoke_extension]
|
||||
paste.filter_factory = keystone.contrib.revoke.routers:RevokeExtension.factory
|
||||
|
||||
[pipeline:api_v3]
|
||||
pipeline = sizelimit url_normalize build_auth_context token_auth admin_token_auth json_body ec2_extension_v3 s3_extension simple_cert_extension revoke_extension service_v3
|
||||
|
||||
3. Create the revocation extension tables if using the provided SQL backend.
|
||||
For example::
|
||||
|
||||
./bin/keystone-manage db_sync --extension revoke
|
||||
Loading…
Reference in New Issue
Block a user