Adding Users, Tenants, and Roles with python-keystoneclient Token Auth Method Password Auth Method

小鱼儿 2021-11-17 01:52 251阅读 0赞

##  Adding Users, Tenants, and Roles with python-keystoneclient ##

[Token Auth Method][] [Password Auth Method][] [Using API v3 instead of API v2.0][] [Example usage][] [Tenants][] [Users][] [Roles][] [Services][]

Only users with admin credentials can administer users, tenants and roles. You can configure the python-keystoneclient with admin credentials through either the authentication token, or the username and password method.

###  Token Auth Method ###

To use keystone client using token auth, set the following flags:

*  `--endpoint SERVICE_ENDPOINT`. The keystone endpoint to communicate with. The default endpoint is [http://localhost:35357/v2.0'][http_localhost_35357_v2.0].
 *  `--token SERVICE_TOKEN`. The administrator service token.

###  Password Auth Method ###

*  `--username OS_USERNAME`. The administrator username.
 *  `--password OS_PASSWORD`. The administrator password
 *  `--tenant_name OS_TENANT_NAME`. The tenant name.
 *  `--auth_url OS_AUTH_URL`. The URL of the keystone auth server, for example [http://localhost:5000/v2.0'][http_localhost_5000_v2.0].

###  Using API v3 instead of API v2.0 ###

Use the following keystone parameters, in combination, to specify the version of the API to use:

*  *`--os-endpoint`*. The `keystone` client detects the version of the API from this parameter.
 *  *`--os-url`*. Specifies the service URL from the service catalog lookup.
 *  *`--os-identity-api-version`*. Specifies the Identity Service API version.

For example, the following parameters indicate the use of API v3:

--os-url "http://15.253.57.115:35357/v3" --os-identity-api-version 3

The following parameters indicate the use of API v2.0:

--os-url "http://15.253.57.115:35357/v2.0" --os-identity-api-version 2.0

###  Example usage ###

The `keystone` client is set up to expect commands in the general form of `keystone` `command` `argument`, followed by flag-like keyword arguments to provide additional (often optional) information. For example, the command `user-list` and `tenant-create` can be invoked as follows:

# Using token auth env variables
    export SERVICE_ENDPOINT=http://127.0.0.1:5000/v2.0/
    export SERVICE_TOKEN=secrete_token
    keystone user-list
    keystone tenant-create --name=demo
    
    # Using token auth flags
    keystone --token=secrete --endpoint=http://127.0.0.1:5000/v2.0/ user-list
    keystone --token=secrete --endpoint=http://127.0.0.1:5000/v2.0/ tenant-create --name=demo
    
    # Using user + password + tenant_name env variables
    export OS_USERNAME=admin
    export OS_PASSWORD=secrete
    export OS_TENANT_NAME=admin
    keystone user-list
    keystone tenant-create --name=demo
    
    # Using user + password + tenant_name flags
    keystone --username=admin --password=secrete --tenant_name=admin user-list
    keystone --username=admin --password=secrete --tenant_name=admin tenant-create --name=demo

###  Tenants ###

[`tenant-create`][tenant-create] [`tenant-delete`][tenant-delete] [`tenant-enable`][tenant-enable] [`tenant-disable`][tenant-disable]

A tenant is a group of zero or more users. In nova, a tenant owns virtual machines. In swift, a tenant owns containers. Users can be associated with more than one tenant. Each tenant and user pairing can have a role associated with it.

####  `tenant-create` ####

keyword arguments

*  name
 *  description (optional, defaults to None)
 *  enabled (optional, defaults to True)

The following command creates a tenant named demo:

keystone tenant-create --name=demo

####  `tenant-delete` ####

arguments

*  tenant\_id

example:

keystone tenant-delete f2b7b39c860840dfa47d9ee4adffa0b3

####  `tenant-enable` ####

arguments

*  tenant\_id

example:

keystone tenant-enable f2b7b39c860840dfa47d9ee4adffa0b3

####  `tenant-disable` ####

arguments

*  tenant\_id

example:

keystone tenant-disable f2b7b39c860840dfa47d9ee4adffa0b3

###  Users ###

[`user-create`][user-create] [`user-delete`][user-delete] [`user-list`][user-list] [`user-update --email`][user-update --email] [`user-enable`][user-enable] [`user-disable`][user-disable] [`user-update --password`][user-update --password]

####  `user-create` ####

keyword arguments:

*  name
 *  pass
 *  email
 *  default\_tenant (optional, defaults to None)
 *  enabled (optional, defaults to True)

example:

keystone user-create
    --name=admin \
    --pass=secrete \
    --email=admin@example.com

####  `user-delete` ####

keyword arguments:

*  user

example:

keystone user-delete f2b7b39c860840dfa47d9ee4adffa0b3

####  `user-list` ####

list users in the system, optionally by a specific tenant (identified by tenant\_id)

arguments

*  tenant\_id (optional, defaults to None)

example:

keystone user-list

####  `user-update --email` ####

arguments

*  user\_id
 *  email

example:

keystone user-update --email 03c84b51574841ba9a0d8db7882ac645 "someone@somewhere.com"

####  `user-enable` ####

arguments

*  user\_id

example:

keystone user-enable 03c84b51574841ba9a0d8db7882ac645

####  `user-disable` ####

arguments

*  user\_id

example:

keystone user-disable 03c84b51574841ba9a0d8db7882ac645

####  `user-update --password` ####

arguments

*  user\_id
 *  password

example:

keystone user-update --password 03c84b51574841ba9a0d8db7882ac645 foo

###  Roles ###

[`role-create`][role-create] [`role-delete`][role-delete] [`role-list`][role-list] [`role-get`][role-get] [`add-user-role`][add-user-role] [`remove-user-role`][remove-user-role]

####  `role-create` ####

arguments

*  name

example:

keystone role-create --name=demo

####  `role-delete` ####

arguments

*  role\_id

example:

keystone role-delete 19d1d3344873464d819c45f521ff9890

####  `role-list` ####

example:

keystone role-list

####  `role-get` ####

arguments

*  role\_id

example:

keystone role-get role=19d1d3344873464d819c45f521ff9890

####  `add-user-role` ####

arguments

*  role\_id
 *  user\_id
 *  tenant\_id

example:

keystone add-user-role \
    3a751f78ef4c412b827540b829e2d7dd \
    03c84b51574841ba9a0d8db7882ac645 \
    20601a7f1d94447daa4dff438cb1c209

####  `remove-user-role` ####

arguments

*  role\_id
 *  user\_id
 *  tenant\_id

example:

keystone remove-user-role \
    19d1d3344873464d819c45f521ff9890 \
    08741d8ed88242ca88d1f61484a0fe3b \
    20601a7f1d94447daa4dff438cb1c209

###  Services ###

[`service-create`][service-create] [`service-list`][service-list] [`service-get`][service-get] [`service-delete`][service-delete]

####  `service-create` ####

keyword arguments

*  name
 *  type
 *  description

example:

keystone service create \
    --name=nova \
    --type=compute \
    --description="Nova Compute Service"

####  `service-list` ####

arguments

*  service\_id

example:

keystone service-list

####  `service-get` ####

arguments

*  service\_id

example:

keystone service-get 08741d8ed88242ca88d1f61484a0fe3b

####  `service-delete` ####

arguments

*  service\_id

example:

keystone service-delete 08741d8ed88242ca88d1f61484a0fe3b

[Token Auth Method]: http://docs.openstack.org/trunk/openstack-compute/admin/content/adding-users-tenants-and-roles-with-python-keystoneclient.html#token-auth-method
[Password Auth Method]: http://docs.openstack.org/trunk/openstack-compute/admin/content/adding-users-tenants-and-roles-with-python-keystoneclient.html#password-auth-method
[Using API v3 instead of API v2.0]: http://docs.openstack.org/trunk/openstack-compute/admin/content/adding-users-tenants-and-roles-with-python-keystoneclient.html#use-v3-instead-of-default-v2
[Example usage]: http://docs.openstack.org/trunk/openstack-compute/admin/content/adding-users-tenants-and-roles-with-python-keystoneclient.html#example-usage
[Tenants]: http://docs.openstack.org/trunk/openstack-compute/admin/content/adding-users-tenants-and-roles-with-python-keystoneclient.html#tenants
[Users]: http://docs.openstack.org/trunk/openstack-compute/admin/content/adding-users-tenants-and-roles-with-python-keystoneclient.html#users
[Roles]: http://docs.openstack.org/trunk/openstack-compute/admin/content/adding-users-tenants-and-roles-with-python-keystoneclient.html#roles
[Services]: http://docs.openstack.org/trunk/openstack-compute/admin/content/adding-users-tenants-and-roles-with-python-keystoneclient.html#services
[http_localhost_35357_v2.0]: http://localhost:35357/v2.0'%20rel=
[http_localhost_5000_v2.0]: http://localhost:5000/v2.0'%20rel=
[tenant-create]: http://docs.openstack.org/trunk/openstack-compute/admin/content/adding-users-tenants-and-roles-with-python-keystoneclient.html#tenant-create
[tenant-delete]: http://docs.openstack.org/trunk/openstack-compute/admin/content/adding-users-tenants-and-roles-with-python-keystoneclient.html#tenant-delete
[tenant-enable]: http://docs.openstack.org/trunk/openstack-compute/admin/content/adding-users-tenants-and-roles-with-python-keystoneclient.html#tenant-enable
[tenant-disable]: http://docs.openstack.org/trunk/openstack-compute/admin/content/adding-users-tenants-and-roles-with-python-keystoneclient.html#tenant-disable
[user-create]: http://docs.openstack.org/trunk/openstack-compute/admin/content/adding-users-tenants-and-roles-with-python-keystoneclient.html#user-create
[user-delete]: http://docs.openstack.org/trunk/openstack-compute/admin/content/adding-users-tenants-and-roles-with-python-keystoneclient.html#user-delete
[user-list]: http://docs.openstack.org/trunk/openstack-compute/admin/content/adding-users-tenants-and-roles-with-python-keystoneclient.html#user-list
[user-update --email]: http://docs.openstack.org/trunk/openstack-compute/admin/content/adding-users-tenants-and-roles-with-python-keystoneclient.html#user-update-email
[user-enable]: http://docs.openstack.org/trunk/openstack-compute/admin/content/adding-users-tenants-and-roles-with-python-keystoneclient.html#user-enable
[user-disable]: http://docs.openstack.org/trunk/openstack-compute/admin/content/adding-users-tenants-and-roles-with-python-keystoneclient.html#user-disable
[user-update --password]: http://docs.openstack.org/trunk/openstack-compute/admin/content/adding-users-tenants-and-roles-with-python-keystoneclient.html#user-update-password
[role-create]: http://docs.openstack.org/trunk/openstack-compute/admin/content/adding-users-tenants-and-roles-with-python-keystoneclient.html#role-create
[role-delete]: http://docs.openstack.org/trunk/openstack-compute/admin/content/adding-users-tenants-and-roles-with-python-keystoneclient.html#role-delete
[role-list]: http://docs.openstack.org/trunk/openstack-compute/admin/content/adding-users-tenants-and-roles-with-python-keystoneclient.html#role-list
[role-get]: http://docs.openstack.org/trunk/openstack-compute/admin/content/adding-users-tenants-and-roles-with-python-keystoneclient.html#role-get
[add-user-role]: http://docs.openstack.org/trunk/openstack-compute/admin/content/adding-users-tenants-and-roles-with-python-keystoneclient.html#add-user-role
[remove-user-role]: http://docs.openstack.org/trunk/openstack-compute/admin/content/adding-users-tenants-and-roles-with-python-keystoneclient.html#remove-user-role
[service-create]: http://docs.openstack.org/trunk/openstack-compute/admin/content/adding-users-tenants-and-roles-with-python-keystoneclient.html#service-create
[service-list]: http://docs.openstack.org/trunk/openstack-compute/admin/content/adding-users-tenants-and-roles-with-python-keystoneclient.html#service-list
[service-get]: http://docs.openstack.org/trunk/openstack-compute/admin/content/adding-users-tenants-and-roles-with-python-keystoneclient.html#service-get
[service-delete]: http://docs.openstack.org/trunk/openstack-compute/admin/content/adding-users-tenants-and-roles-with-python-keystoneclient.html#service-delete