bcf5a7cb3a
This adds a small glossary to the Install Guide. The glossary is produced from all entries that use <firstterm> or <glossterm> and which are in the global glossary (see file glossary/gloss-terms.xml). I (dcramer) have patched this to work if built against https://review.openstack.org/68416, which fixes the problem where the glossary wasn't populated in the pdf. Updates to clouddocs-maven-plugin 1.13.0 that has dcramer's fix. Change-Id: I357265ea99a7e9b0f4004ef529a2043605e8b2ec
59 lines
3.0 KiB
XML
59 lines
3.0 KiB
XML
<section xmlns="http://docbook.org/ns/docbook"
|
|
xmlns:xlink="http://www.w3.org/1999/xlink"
|
|
version="5.0"
|
|
xml:id="keystone-users" os="rhel;centos;fedora;opensuse;sles;ubuntu">
|
|
<title>Define users, tenants, and roles</title>
|
|
|
|
<para>After you install the Identity Service, set up
|
|
<glossterm baseform="user">users</glossterm>,
|
|
<glossterm baseform="tenant">tenants</glossterm>, and roles to authenticate
|
|
against. These are used to allow access to
|
|
services and <glossterm baseform="endpoint">endpoints</glossterm>, described
|
|
in the next section.</para>
|
|
|
|
<para>Typically, you would indicate a user and password to
|
|
authenticate with the Identity Service. At this point, however, we
|
|
have not created any users, so we have to use the authorization
|
|
token created in the previous section. You can pass this with the
|
|
<option>--os-token</option> option to the
|
|
<command>keystone</command> command or set the
|
|
<envar>OS_SERVICE_TOKEN</envar> environment variable. We'll set
|
|
<envar>OS_SERVICE_TOKEN</envar>, as well as
|
|
<envar>OS_SERVICE_ENDPOINT</envar> to specify where the Identity
|
|
Service is running. Replace
|
|
<userinput><replaceable>FCAF3E...</replaceable></userinput>
|
|
with your authorization token.</para>
|
|
|
|
<screen><prompt>#</prompt> <userinput>export OS_SERVICE_TOKEN=<replaceable>FCAF3E...</replaceable></userinput>
|
|
<prompt>#</prompt> <userinput>export OS_SERVICE_ENDPOINT=http://controller:35357/v2.0</userinput></screen>
|
|
|
|
<para>First, create a tenant for an administrative user and a tenant
|
|
for other OpenStack services to use.</para>
|
|
|
|
<screen><prompt>#</prompt> <userinput>keystone tenant-create --name=admin --description="Admin Tenant"</userinput>
|
|
<prompt>#</prompt> <userinput>keystone tenant-create --name=service --description="Service Tenant"</userinput></screen>
|
|
|
|
<para>Next, create an administrative user called <literal>admin</literal>.
|
|
Choose a password for the <literal>admin</literal> user and specify an
|
|
email address for the account.</para>
|
|
|
|
<screen><prompt>#</prompt> <userinput>keystone user-create --name=admin --pass=<replaceable>ADMIN_PASS</replaceable> \
|
|
--email=<replaceable>admin@example.com</replaceable></userinput></screen>
|
|
|
|
<para>Create a role for administrative tasks called <literal>admin</literal>.
|
|
Any roles you create should map to roles specified in the
|
|
<filename>policy.json</filename> files of the various OpenStack services.
|
|
The default policy files use the <literal>admin</literal> role to allow
|
|
access to most services.</para>
|
|
|
|
<screen><prompt>#</prompt> <userinput>keystone role-create --name=admin</userinput></screen>
|
|
|
|
<para>Finally, you have to add roles to users. Users always log in with
|
|
a tenant, and roles are assigned to users within tenants. Add the
|
|
<literal>admin</literal> role to the <literal>admin</literal> user when
|
|
logging in with the <literal>admin</literal> tenant.</para>
|
|
|
|
<screen><prompt>#</prompt> <userinput>keystone user-role-add --user=admin --tenant=admin --role=admin</userinput></screen>
|
|
|
|
</section>
|