獲取token

建立一個json檔案，作為HTTP訊息的內容

$ cat token-request.json
 {
    "auth": {
        "identity": {
            "methods": [
                "password"
            ],
            "password": {
                "user": {
                        "domain":{
                                "name":"demo-domain"
                        },
                        "name": "userA2",
                        "password": "123456"
                }
            }
        },
        "scope": {
            "project": {
                "domain":{
                        "name":"demo-domain"
                },
                "name": "project-A"
            }
        }
    }
 }
 

向keystone請求token。-si是返回訊息頭。token資訊位於訊息頭的X-Subject-Token欄位

curl -si  -d @token-request.json -H "Content-type: application/json" http://localhost:35357/v3/auth/tokens
 HTTP/1.1 201 Created
 X-Subject-Token: ea480e2f70414176b43480cfa6b22a2b
 Vary: X-Auth-Token
 X-Distribution: Ubuntu
 Content-Type: application/json
 Content-Length: 557
 X-Openstack-Request-Id: req-63f66227-1232-429a-8c80-b644050887be
 Date: Mon, 05 Sep 2016 09:44:11 GMT

 {"token": {"methods": ["password"], "roles": [{"id": "6abf3532fce440148a7f29abc7685142", "name": "demo-role"}], 
"expires_at": "2016-09-05T10:44:11.422204Z", "project": {"domain": {"id": "32b54ffdebe84eba9cd10a8dbe647b70", 
"name": "demo-domain"}, "id": "b65e9985801f4481bce7ba885b68cac3", "name": "project-A"}, 
"catalog": [], "user": {"domain": {"id": "32b54ffdebe84eba9cd10a8dbe647b70", "name": "demo-domain"}, "id": 
"459c2cc894844396bec6c16fbc28da87", "name": "userA2"}, "audit_ids": 
["0mgrffReTNWGCNz2WflPSQ"], "issued_at": "2016-09-05T09:44:11.422251Z"}}
 

從上面可以看到，token=ea480e2f70414176b43480cfa6b22a2b,我們將其獲取，並存放在USER_TOKEN的環境變數中。也可以直接用以下面的方式。

$ export USER_TOKEN=`curl -si -d @token-request.json -H "Content-type: application/json" http://localhost:35357/v3/auth/tokens | awk '/X-Subject-Token/ {print $2}'`

$ echo $USER_TOKEN
2d2f89d63a024f45bd95e8d98ec4ae44 （每次獲取會修改token的）
 

利用token檢視使用者資訊

如果許可權出現問題，請修改/etc/keystone/policy.json，確保owner獲取相關許可權。"identity:get_user": "rule:admin_or_owner"

$ curl  -H "X-Auth-Token:$USER_TOKEN"  -H "Content-type: application/json" http://localhost:35357/v3/users/459c2cc894844396bec6c16fbc28da87 | python -mjson.tool
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100   290  100   290    0     0   2329      0 --:--:-- --:--:-- --:--:--  2357
{
    "user": {
        "domain_id": "32b54ffdebe84eba9cd10a8dbe647b70",
        "email": "[email protected]",
        "enabled": true,
        "id": "459c2cc894844396bec6c16fbc28da87",
        "links": {
            "self": "http://localhost:35357/v3/users/459c2cc894844396bec6c16fbc28da87"
        },
        "name": "userA2",
        "param1": "value1",
        "param2": "value2"
    }
}

利用token檢視project資訊

$ curl  -H "X-Auth-Token:$USER_TOKEN"  -H "Content-type: application/json" http://localhost:35357/v3/projects/b65e9985801f4481bce7ba885b68cac3 | python -mjson.tool
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
 100   389  100   389    0     0   4467      0 --:--:-- --:--:-- --:--:--  4523
 {
    "project": {
        "description": "Project A",
        "domain_id": "32b54ffdebe84eba9cd10a8dbe647b70",
        "enabled": true,
        "id": "b65e9985801f4481bce7ba885b68cac3",
        "is_domain": false,
        "links": {
            "self": "http://localhost:35357/v3/projects/b65e9985801f4481bce7ba885b68cac3"
        },
        "name": "project-A",
        "parent_id": "32b54ffdebe84eba9cd10a8dbe647b70",
        "project_A_param1": "value1",
        "project_A_param2": "value2"
    }
 }

其他模組驗證該token是否正確

場景：模組A是keystone的一個user，模組B為keystone提供摸個功能（service）。模組A向模組B傳送一個Restful的訊息，將攜帶token資訊，模組B向keystone驗證這個token是否正確。

使用者發出請求時，在訊息頭中攜帶token，其他模組收到訊息後，向keystone發起驗證請求。通過則返回資訊，不通過則返回4xx錯誤。

$ curl  -H "X-Auth-Token:$USER_TOKEN" -H "X-Subject-Token:$USER_TOKEN" -H "Content-type: application/json" http://localhost:35357/v3/auth/tokens | python -mjson.tool
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
 100   557  100   557    0     0   3839      0 --:--:-- --:--:-- --:--:--  3841
 {
    "token": {
        "audit_ids": [
            "Bi9Z3vCmSLCJ6EXYh-qEbA"
        ],
        "catalog": [],
        "expires_at": "2016-09-05T10:44:51.187971Z",
        "issued_at": "2016-09-05T09:44:51.188016Z",
        "methods": [
            "password"
        ],
        "project": {
            "domain": {
                "id": "32b54ffdebe84eba9cd10a8dbe647b70",
                "name": "demo-domain"
            },
            "id": "b65e9985801f4481bce7ba885b68cac3",
            "name": "project-A"
        },
        "roles": [
            {
                "id": "6abf3532fce440148a7f29abc7685142",
                "name": "demo-role"
            }
        ],
        "user": {
            "domain": {
                "id": "32b54ffdebe84eba9cd10a8dbe647b70",
                "name": "demo-domain"
            },
            "id": "459c2cc894844396bec6c16fbc28da87",
            "name": "userA2"
        }
    }
 }