<div dir="ltr">Thanks a lot John for your response.<div>The issue was were working with keystone server which is SSL enabled and we need to configure Barbican to provide clients side certificate.</div><div><br></div><div>Thanks and Regards,</div><div>Asha Seshagiri<br><div class="gmail_extra"><br><div class="gmail_quote">On Tue, Apr 7, 2015 at 6:26 PM, John Wood <span dir="ltr"><<a href="mailto:john.wood@rackspace.com" target="_blank">john.wood@rackspace.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div style="word-wrap:break-word;color:rgb(0,0,255);font-size:14px;font-family:Calibri,sans-serif">
<div>Hello Asha,</div>
<div><br>
</div>
<div>Please following the steps in the pending CR [1]. That configures v3 usage with Keystone, and if you use the Docker Keystone instance mentioned, it syncs the passwords with it as well. Note the need to execute the setup script noted to configure Keystone
properly as well.</div>
<div><br>
</div>
<div>Thanks,</div>
<div>John</div>
<div><br>
</div>
<div>[1] <a href="https://review.openstack.org/#/c/169114/2/doc/source/setup/keystone.rst" target="_blank">https://review.openstack.org/#/c/169114/2/doc/source/setup/keystone.rst</a></div>
<div><br>
</div>
<span>
<div style="font-family:Calibri;font-size:11pt;text-align:left;color:black;BORDER-BOTTOM:medium none;BORDER-LEFT:medium none;PADDING-BOTTOM:0in;PADDING-LEFT:0in;PADDING-RIGHT:0in;BORDER-TOP:#b5c4df 1pt solid;BORDER-RIGHT:medium none;PADDING-TOP:3pt">
<span style="font-weight:bold">From: </span>Asha Seshagiri <<a href="mailto:asha.seshagiri@gmail.com" target="_blank">asha.seshagiri@gmail.com</a>><br>
<span style="font-weight:bold">Date: </span>Tuesday, April 7, 2015 at 2:49 PM<br>
<span style="font-weight:bold">To: </span>John Wood <<a href="mailto:john.wood@rackspace.com" target="_blank">john.wood@rackspace.com</a>><br>
<span style="font-weight:bold">Cc: </span>openstack-dev <<a href="mailto:openstack-dev@lists.openstack.org" target="_blank">openstack-dev@lists.openstack.org</a>>, "Reller, Nathan S." <<a href="mailto:Nathan.Reller@jhuapl.edu" target="_blank">Nathan.Reller@jhuapl.edu</a>>, Douglas Mendizabal
<<a href="mailto:douglas.mendizabal@RACKSPACE.COM" target="_blank">douglas.mendizabal@RACKSPACE.COM</a>>, "<a href="mailto:alee@redhat.com" target="_blank">alee@redhat.com</a>" <<a href="mailto:alee@redhat.com" target="_blank">alee@redhat.com</a>>, Paul Kehrer <<a href="mailto:paul.kehrer@RACKSPACE.COM" target="_blank">paul.kehrer@RACKSPACE.COM</a>>,
Adam Harwell <<a href="mailto:adam.harwell@RACKSPACE.COM" target="_blank">adam.harwell@RACKSPACE.COM</a>>, Alexis Lee <<a href="mailto:alexisl@hp.com" target="_blank">alexisl@hp.com</a>><br>
<span style="font-weight:bold">Subject: </span>Re: Barbican : Unable to authenticate with keystone V3 for Barbican curl command<br>
</div><div><div class="h5">
<div><br>
</div>
<div>
<div>
<div dir="ltr">Thanks a lot John for your help and response.
<div><br>
</div>
<div>I had followed the same set of instructions as given in the link 1 initially changing the version to v3 , it did not work and hence followed with link 2 and is not working though.<br>
<div><br>
</div>
<div>The link 1 provided below points to keystone v2 changes with barbican and not v3</div>
<div><span style="color:rgb(0,0,255);font-family:Calibri,sans-serif;font-size:14px">[1] </span><a href="http://docs.openstack.org/developer/barbican/setup/keystone.html" style="font-family:Calibri,sans-serif;font-size:14px" target="_blank">http://docs.openstack.org/developer/barbican/setup/keystone.html</a> . </div>
<div>But in this link 2 for Integration keystone V3 with barbican we have to modify both the configuriation files <br>
</div>
<div><span style="font-size:12.8000001907349px"> <b>barbican-api-paste.ini and barbican-admin-paste.ini</b> files . There are some changes in the filter and pipline names names tied with v3 </span><br>
</div>
<div><span style="font-size:12.8000001907349px"><br>
</span></div>
<div>
<pre style="overflow:auto;font-family:Consolas,'Liberation Mono',Menlo,Courier,monospace;font-size:13.6000003814697px;margin-top:0px;margin-bottom:16px;font-stretch:normal;line-height:1.45;padding:16px;border-radius:3px;word-wrap:normal;color:rgb(51,51,51);background-color:rgb(247,247,247)"><code style="font-family:Consolas,'Liberation Mono',Menlo,Courier,monospace;font-size:13.6000003814697px;padding:0px;margin:0px;border-radius:3px;word-break:normal;border:0px;display:inline;max-width:initial;overflow:initial;line-height:inherit;word-wrap:normal;background:transparent">pipeline = keystone_v3_authtoken context apiapp
.....
[filter:keystone_v3_authtoken]</code></pre>
</div>
<div>[2] <a href="https://github.com/cloudkeep/barbican/wiki/Integration-with-Keystone-V3-API" style="font-size:12.8000001907349px" target="_blank">https://github.com/cloudkeep/barbican/wiki/Integration-with-Keystone-V3-API</a><span style="font-size:12.8000001907349px"><br>
</span></div>
<div><br>
</div>
<div>Could you please confirm that we need to follow the link 1 changing the version from v2 to v3 with only modification in <b style="font-size:12.8000001907349px">barbican-api-paste.ini file and not </b><b style="font-size:12.8000001907349px">barbican-admin-paste.ini
so that I can start looking into the issue with the changes mentioned in link1 alone.</b></div>
</div>
<div><b style="font-size:12.8000001907349px"><br>
</b></div>
<div><span style="font-size:12.8000001907349px">Thanks and Regards,</span></div>
<div><span style="font-size:12.8000001907349px">Asha Seshagiri</span></div>
<div class="gmail_extra"><br>
<div class="gmail_quote">On Tue, Apr 7, 2015 at 2:08 PM, John Wood <span dir="ltr">
<<a href="mailto:john.wood@rackspace.com" target="_blank">john.wood@rackspace.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div style="word-wrap:break-word;color:rgb(0,0,255);font-size:14px;font-family:Calibri,sans-serif">
<div>Hello Asha,</div>
<div><br>
</div>
<div>We are in the process of migrating our documentation to Sphinx, so I’d suggest following this link for Keystone configuration options [1].</div>
<div><br>
</div>
<div>I’d also note that a CR is pending with a bit more details to setup via a Docker Keystone here [2].</div>
<div><br>
</div>
<div>Thanks,</div>
<div>John</div>
<div><br>
</div>
<div><br>
</div>
<div>[1] <a href="http://docs.openstack.org/developer/barbican/setup/keystone.html" target="_blank">http://docs.openstack.org/developer/barbican/setup/keystone.html</a></div>
<div>[2] <a href="https://review.openstack.org/#/c/169114/" target="_blank">https://review.openstack.org/#/c/169114/</a></div>
<div><br>
</div>
<span>
<div style="font-family:Calibri;font-size:11pt;text-align:left;color:black;BORDER-BOTTOM:medium none;BORDER-LEFT:medium none;PADDING-BOTTOM:0in;PADDING-LEFT:0in;PADDING-RIGHT:0in;BORDER-TOP:#b5c4df 1pt solid;BORDER-RIGHT:medium none;PADDING-TOP:3pt">
<span style="font-weight:bold">From: </span>Asha Seshagiri <<a href="mailto:asha.seshagiri@gmail.com" target="_blank">asha.seshagiri@gmail.com</a>><br>
<span style="font-weight:bold">Date: </span>Tuesday, April 7, 2015 at 1:34 PM<br>
<span style="font-weight:bold">To: </span>openstack-dev <<a href="mailto:openstack-dev@lists.openstack.org" target="_blank">openstack-dev@lists.openstack.org</a>><br>
<span style="font-weight:bold">Cc: </span>John Wood <<a href="mailto:john.wood@rackspace.com" target="_blank">john.wood@rackspace.com</a>>, "Reller, Nathan S." <<a href="mailto:Nathan.Reller@jhuapl.edu" target="_blank">Nathan.Reller@jhuapl.edu</a>>, Douglas
Mendizabal <<a href="mailto:douglas.mendizabal@RACKSPACE.COM" target="_blank">douglas.mendizabal@RACKSPACE.COM</a>>, "<a href="mailto:alee@redhat.com" target="_blank">alee@redhat.com</a>" <<a href="mailto:alee@redhat.com" target="_blank">alee@redhat.com</a>>,
Paul Kehrer <<a href="mailto:paul.kehrer@RACKSPACE.COM" target="_blank">paul.kehrer@RACKSPACE.COM</a>>, Adam Harwell <<a href="mailto:adam.harwell@RACKSPACE.COM" target="_blank">adam.harwell@RACKSPACE.COM</a>>, Alexis Lee <<a href="mailto:alexisl@hp.com" target="_blank">alexisl@hp.com</a>><br>
<span style="font-weight:bold">Subject: </span>Barbican : Unable to authenticate with keystone V3 for Barbican curl command<br>
</div>
<div>
<div>
<div><br>
</div>
<div>
<div>
<div dir="ltr">Hi All ,
<div><br>
</div>
<div>Could anyone please help me on this integration issue.</div>
<div>I am unable to authenticate with keystone V3 for Barbican curl command .I have followed the procedure given in the following link :</div>
<div><br>
</div>
<div><a href="https://github.com/cloudkeep/barbican/wiki/Integration-with-Keystone-V3-API" target="_blank">https://github.com/cloudkeep/barbican/wiki/Integration-with-Keystone-V3-API</a></div>
<div><br>
</div>
<div>I was unable to authenticate with the keystone V3 even though the right token was provided in the curl command </div>
<div>Please find the command to get the token and the curl command to post the secret .</div>
<div><br>
</div>
<div>[root@keystone-versiontest ~]# openstack --insecure token issue <b>(Command to get token from keystone v3)</b></div>
<div>
<div>+------------+----------------------------------+</div>
<div>| Field | Value |</div>
<div>+------------+----------------------------------+</div>
<div>| expires | 2015-04-07T18:26:13.835641Z |</div>
<div>|<b> id | f28b93f27cce4bc09f9ac50d84bde736 |</b></div>
<div>| project_id | 9d37f9ecc481422aa8ab53674cb82410 |</div>
<div>| user_id | e7d02ed8e7e64b01a1d66bb86ffa90d8 |</div>
<div>+------------+----------------------------------+</div>
<div><br>
</div>
<div>[root@keystone-versiontest ~]# curl -X POST -H 'content-type:application/json' -H 'X-Project-Id:12345' \</div>
<div>> -H "X-Auth-Token:<b>f28b93f27cce4bc09f9ac50d84bde736</b>" -d '{"payload": "my-secret-here", "payload_content_type": "text/plain"}'
<a href="http://localhost:9311/v1/secrets" target="_blank">http://localhost:9311/v1/secrets</a></div>
<div><b>Authentication required</b>[root@keystone-versiontest ~]#</div>
</div>
<div><br>
</div>
<div>The contents of the admin.opensrc file is as given below :</div>
<div><br>
</div>
<div>
<div>[root@keystone-versiontest ~]# cat admin.openrc</div>
<div>export OS_USERNAME=admin</div>
<div>export OS_TENANT_NAME=admin</div>
<div>export OS_PASSWORD=admin</div>
<div>export OS_AUTH_URL=<a href="https://169.54.204.69:35357/v3" target="_blank">https://169.54.204.69:35357/v3</a></div>
<div>export OS_REGION_NAME=RegionOne</div>
<div>export OS_IDENTITY_API_VERSION=3</div>
<div>export OS_USER_DOMAIN_ID=default</div>
<div>export OS_PROJECT_DOMAIN_ID=default</div>
<div><br>
</div>
</div>
<div><br>
</div>
<div>And also I have attached the barbican-api-paste.ini and barbican-admin-paste.ini files.</div>
<div><br>
</div>
<div>I would like to know why the curl command for posting the secret is not geting authenticated with Keystone V3</div>
<div><br>
</div>
<div>Any help would highly be appreciated. </div>
<div>-- <br>
</div>
<div>
<div>
<div><em>Thanks and Regards,</em></div>
<div><em>Asha Seshagiri</em></div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</span></div>
</blockquote>
</div>
<br>
<br clear="all">
<div><br>
</div>
-- <br>
<div>
<div><em>Thanks and Regards,</em></div>
<div><em>Asha Seshagiri</em></div>
</div>
</div>
</div>
</div>
</div>
</div></div></span>
</div>
</blockquote></div><br><br clear="all"><div><br></div>-- <br><div class="gmail_signature"><div><em>Thanks and Regards,</em></div>
<div><em>Asha Seshagiri</em></div></div>
</div></div></div>