ed8fd1c397
This new chapter is taken from the common/ section, and explains how to install clients on machines outside the OpenStack cluster. The install guide can be misleading about how to use clients to administrate the cloud, adding this section will hopefully help clarifying this. pom.xml is modified to add an audience target (installer), used to build specific parts of the common files. backport: none Change-Id: Ib4187d86bb2e3d7d9a26df426e17b4f4039a90fa
89 lines
4.4 KiB
XML
89 lines
4.4 KiB
XML
<?xml version="1.0" encoding="UTF-8"?>
|
|
<section xml:id="keystone-verify"
|
|
xmlns="http://docbook.org/ns/docbook"
|
|
xmlns:xi="http://www.w3.org/2001/XInclude"
|
|
xmlns:xlink="http://www.w3.org/1999/xlink" version="5.0">
|
|
<title>Verify the Identity Service installation</title>
|
|
<procedure>
|
|
<step>
|
|
<para>To verify that the Identity Service is installed and
|
|
configured correctly, clear the values in the
|
|
<envar>OS_SERVICE_TOKEN</envar> and
|
|
<envar>OS_SERVICE_ENDPOINT</envar> environment
|
|
variables:</para>
|
|
<screen><prompt>#</prompt> <userinput>unset OS_SERVICE_TOKEN OS_SERVICE_ENDPOINT</userinput></screen>
|
|
<para>These variables, which were used to bootstrap the
|
|
administrative user and register the Identity Service, are no
|
|
longer needed.</para>
|
|
</step>
|
|
<step>
|
|
<para>You can now use regular user name-based
|
|
authentication.</para>
|
|
<para>Request a authentication token by using the
|
|
<literal>admin</literal> user and the password you chose for
|
|
that user:</para>
|
|
<screen><prompt>#</prompt> <userinput>keystone --os-username=admin --os-password=<replaceable>ADMIN_PASS</replaceable> \
|
|
--os-auth-url=http://controller:35357/v2.0 token-get</userinput></screen>
|
|
<para>In response, you receive a token paired with your user ID.
|
|
This verifies that the Identity Service is running on the
|
|
expected endpoint and that your user account is established
|
|
with the expected credentials.</para>
|
|
</step>
|
|
<step>
|
|
<para>Verify that authorization behaves as expected. To do so,
|
|
request authorization on a tenant:</para>
|
|
<screen><prompt>#</prompt> <userinput>keystone --os-username=admin --os-password=<replaceable>ADMIN_PASS</replaceable> \
|
|
--os-tenant-name=admin --os-auth-url=http://controller:35357/v2.0 token-get</userinput></screen>
|
|
<para>In response, you receive a token that includes the ID of
|
|
the tenant that you specified. This verifies that your user
|
|
account has an explicitly defined role on the specified tenant
|
|
and the tenant exists as expected.</para>
|
|
</step>
|
|
<step>
|
|
<para>You can also set your <literal>--os-*</literal> variables
|
|
in your environment to simplify command-line usage. Set up a
|
|
<filename>openrc.sh</filename> file with the admin
|
|
credentials and admin endpoint:</para>
|
|
<programlisting language="bash">export OS_USERNAME=admin
|
|
export OS_PASSWORD=<replaceable>ADMIN_PASS</replaceable>
|
|
export OS_TENANT_NAME=admin
|
|
export OS_AUTH_URL=http://controller:35357/v2.0</programlisting>
|
|
</step>
|
|
<step>
|
|
<para>Source this file to read in the environment
|
|
variables:</para>
|
|
<screen><prompt>#</prompt> <userinput>source openrc.sh</userinput></screen>
|
|
</step>
|
|
<step>
|
|
<para>Verify that your <filename>openrc.sh</filename> file is
|
|
configured correctly. Run the same command without the
|
|
<literal>--os-*</literal> arguments:</para>
|
|
<screen><prompt>$</prompt> <userinput>keystone token-get</userinput></screen>
|
|
<para>The command returns a token and the ID of the specified
|
|
tenant. This verifies that you have configured your
|
|
environment variables correctly.</para>
|
|
</step>
|
|
<step>
|
|
<para>Verify that your admin account has authorization to
|
|
perform administrative commands:</para>
|
|
<screen><prompt>#</prompt> <userinput>keystone user-list</userinput>
|
|
<computeroutput>+----------------------------------+---------+--------------------+--------+
|
|
| id | enabled | email | name |
|
|
+----------------------------------+---------+--------------------+--------+
|
|
| a4c2d43f80a549a19864c89d759bb3fe | True | admin@example.com | admin |
|
|
+----------------------------------+---------+--------------------+--------+</computeroutput></screen>
|
|
<para>This verifies that your user account has the
|
|
<literal>admin</literal> role, which matches the role used
|
|
in the Identity Service <filename>policy.json</filename>
|
|
file.</para>
|
|
<note>
|
|
<para>As long as you define your credentials and the Identity
|
|
Service endpoint through the command line or environment
|
|
variables, you can run all OpenStack client commands from
|
|
any machine. For details, see <xref linkend="ch_clients"
|
|
/>.</para>
|
|
</note>
|
|
</step>
|
|
</procedure>
|
|
</section>
|