了解和使用keystone（五）获取token

获取token

创建一个json文件，作为HTTP消息的内容

$ cat token-request.json
{
"auth": {
"identity": {
"methods": [
"password"
],
"password": {
"user": {
"domain":{
"name":"demo-domain"
},
"name": "userA2",
"password": "123456"
}
}
},
"scope": {
"project": {
"domain":{
"name":"demo-domain"
},
"name": "project-A"
}
}
}
}

向keystone请求token。-si是返回消息头。token信息位于消息头的X-Subject-Token字段

curl -si  -d @token-request.json -H "Content-type: application/json" http://localhost:35357/v3/auth/tokens HTTP/1.1 201 Created
X-Subject-Token: ea480e2f70414176b43480cfa6b22a2b
Vary: X-Auth-Token
X-Distribution: Ubuntu
Content-Type: application/json
Content-Length: 557
X-Openstack-Request-Id: req-63f66227-1232-429a-8c80-b644050887be
Date: Mon, 05 Sep 2016 09:44:11 GMT

{"token": {"methods": ["password"], "roles": [{"id": "6abf3532fce440148a7f29abc7685142", "name": "demo-role"}],
"expires_at": "2016-09-05T10:44:11.422204Z", "project": {"domain": {"id": "32b54ffdebe84eba9cd10a8dbe647b70",
"name": "demo-domain"}, "id": "b65e9985801f4481bce7ba885b68cac3", "name": "project-A"},
"catalog": [], "user": {"domain": {"id": "32b54ffdebe84eba9cd10a8dbe647b70", "name": "demo-domain"}, "id":
"459c2cc894844396bec6c16fbc28da87", "name": "userA2"}, "audit_ids":
["0mgrffReTNWGCNz2WflPSQ"], "issued_at": "2016-09-05T09:44:11.422251Z"}}

从上面可以看到，token=ea480e2f70414176b43480cfa6b22a2b,我们将其获取，并存放在USER_TOKEN的环境变量中。也可以直接用以下面的方式。

$ export USER_TOKEN=`curl -si -d @token-request.json -H "Content-type: application/json" http://localhost:35357/v3/auth/tokens | awk '/X-Subject-Token/ {print $2}'`

$ echo $USER_TOKEN
2d2f89d63a024f45bd95e8d98ec4ae44 （每次获取会修改token的）

利用token查看用户信息

如果权限出现问题，请修改/etc/keystone/policy.json，确保owner获取相关权限。"identity:get_user": "rule:admin_or_owner"

$ curl  -H "X-Auth-Token:$USER_TOKEN"  -H "Content-type: application/json" http://localhost:35357/v3/users/459c2cc894844396bec6c16fbc28da87 | python -mjson.tool
% Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
Dload  Upload   Total   Spent    Left  Speed
100   290  100   290    0     0   2329      0 --:--:-- --:--:-- --:--:--  2357
{
"user": {
"domain_id": "32b54ffdebe84eba9cd10a8dbe647b70",
"email": "test@hello.com",
"enabled": true,
"id": "459c2cc894844396bec6c16fbc28da87",
"links": {
"self": "http://localhost:35357/v3/users/459c2cc894844396bec6c16fbc28da87"
},
"name": "userA2",
"param1": "value1",
"param2": "value2"
}
}

利用token查看project信息

$ curl  -H "X-Auth-Token:$USER_TOKEN"  -H "Content-type: application/json" http://localhost:35357/v3/projects/b65e9985801f4481bce7ba885b68cac3 | python -mjson.tool
% Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
Dload  Upload   Total   Spent    Left  Speed
100   389  100   389    0     0   4467      0 --:--:-- --:--:-- --:--:--  4523
{
"project": {
"description": "Project A",
"domain_id": "32b54ffdebe84eba9cd10a8dbe647b70",
"enabled": true,
"id": "b65e9985801f4481bce7ba885b68cac3",
"is_domain": false,
"links": {
"self": "http://localhost:35357/v3/projects/b65e9985801f4481bce7ba885b68cac3"
},
"name": "project-A",
"parent_id": "32b54ffdebe84eba9cd10a8dbe647b70",
"project_A_param1": "value1",
"project_A_param2": "value2"
}
}

其他模块验证该token是否正确

场景：模块A是keystone的一个user，模块B为keystone提供摸个功能（service）。模块A向模块B发送一个Restful的消息，将携带token信息，模块B向keystone验证这个token是否正确。

用户发出请求时，在消息头中携带token，其他模块收到消息后，向keystone发起验证请求。通过则返回信息，不通过则返回4xx错误。

$ curl  -H "X-Auth-Token:$USER_TOKEN" -H "X-Subject-Token:$USER_TOKEN" -H "Content-type: application/json" http://localhost:35357/v3/auth/tokens | python -mjson.tool
% Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
Dload  Upload   Total   Spent    Left  Speed
100   557  100   557    0     0   3839      0 --:--:-- --:--:-- --:--:--  3841
{
"token": {
"audit_ids": [
"Bi9Z3vCmSLCJ6EXYh-qEbA"
],
"catalog": [],
"expires_at": "2016-09-05T10:44:51.187971Z",
"issued_at": "2016-09-05T09:44:51.188016Z",
"methods": [
"password"
],
"project": {
"domain": {
"id": "32b54ffdebe84eba9cd10a8dbe647b70",
"name": "demo-domain"
},
"id": "b65e9985801f4481bce7ba885b68cac3",
"name": "project-A"
},
"roles": [
{
"id": "6abf3532fce440148a7f29abc7685142",
"name": "demo-role"
}
],
"user": {
"domain": {
"id": "32b54ffdebe84eba9cd10a8dbe647b70",
"name": "demo-domain"
},
"id": "459c2cc894844396bec6c16fbc28da87",
"name": "userA2"
}
}
}