<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 12pt;
font-family:΢ÈíÑźÚ
}
--></style></head>
<body class='hmmessage'><div dir='ltr'>Hi All,<BR> <BR>Really thanks all of you disscussing this topic, I believe I got several important clues from your disscussion.<BR>------------------------------<br><br>Message: 11<br>Date: Mon, 28 Sep 2015 15:31:54 -0400<br>From: Adam Young <ayoung@redhat.com><br>To: openstack-operators@lists.openstack.org<br>Subject: Re: [Openstack-operators] "Master" keystone and "sub"<br> keystone<br>Message-ID: <560995AA.5040808@redhat.com><br>Content-Type: text/plain; charset="utf-8"; Format="flowed"<br><br>On 09/26/2015 11:19 PM, RunnerCheng wrote:<br>> Hi All,<br>> I'm a newbie of keystone, and I'm doing some research about it <br>> recently. I have a question about how to deploy it. The scenario is on <br>> below:<br>><br>> One comany has one headquarter dc and 5 sub dc locate in different <br>> cities. We want to deploy separate OpenStack with "sub" keystone at <br>> the sub dc, and want to deploy one "master" keystone at headquarter <br>> dc. We want to manage all users, roles and tenants etc on the "master" <br>> keystone, however we want the end-user can authenticate with the "sub" <br>> keystone where he or she is locate.<br><br><br>Use LDAP for the users, don't keep them in Keystone.<br><br>Replicate roles, projects etc from master to sub.<br><br>Use Fernet tokens. Replicate revocation events both ways.<br><br><br>><br>> Is anyone understant this scenario? How to realize it without <br>> additionaly development?<br>><br>> Thanks in advance!<br>><br>> Sam Cheng<br>><br>><br>> _______________________________________________<br>> OpenStack-operators mailing list<br>> OpenStack-operators@lists.openstack.org<br>> <a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-operators" target="_blank"><font color="#0068cf">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-operators</font></a><br><br>-------------- next part --------------<br>An HTML attachment was scrubbed...<br>URL: <<a href="http://lists.openstack.org/pipermail/openstack-operators/attachments/20150928/7a0c57c4/attachment-0001.html" target="_blank"><font color="#0068cf">http://lists.openstack.org/pipermail/openstack-operators/attachments/20150928/7a0c57c4/attachment-0001.html</font></a>><br><br>------------------------------<br><br>Message: 12<br>Date: Mon, 28 Sep 2015 15:46:50 -0400<br>From: Jonathan Proulx <jon@csail.mit.edu><br>To: Adam Young <ayoung@redhat.com><br>Cc: openstack-operators@lists.openstack.org<br>Subject: Re: [Openstack-operators] "Master" keystone and "sub"<br> keystone<br>Message-ID: <20150928194650.GO24467@csail.mit.edu><br>Content-Type: text/plain; charset=us-ascii<br><br>On Mon, Sep 28, 2015 at 03:31:54PM -0400, Adam Young wrote:<br>:On 09/26/2015 11:19 PM, RunnerCheng wrote:<br>:>Hi All,<br>:>I'm a newbie of keystone, and I'm doing some research about it<br>:>recently. I have a question about how to deploy it. The scenario is<br>:>on below:<br>:><br>:>One comany has one headquarter dc and 5 sub dc locate in different<br>:>cities. We want to deploy separate OpenStack with "sub" keystone at<br>:>the sub dc, and want to deploy one "master" keystone at headquarter<br>:>dc. We want to manage all users, roles and tenants etc on the<br>:>"master" keystone, however we want the end-user can authenticate<br>:>with the "sub" keystone where he or she is locate.<br>:<br>:<br>:Use LDAP for the users, don't keep them in Keystone.<br>:<br>:Replicate roles, projects etc from master to sub.<br>:<br>:Use Fernet tokens. Replicate revocation events both ways.<br><br>I'm hearing conflicting advice about the suitibility of Fernet tokens<br>for production use.<br><br>I like the idea. I did get them to work in kilo trivially for CLI, but<br>Horizon was unhappy for reasons I didn't fully investigate as I heard<br>they 'weren't quite ready in kilo' so I defered further investigation<br>to next cycle.<br><br>Though honestly if you're building somthing new right now starting<br>with Liberty is probably the right thing anyway by the time you're<br>done PoC it will be released.<br><br>-Jon<br><br><br><br>------------------------------<br><br>Message: 13<br>Date: Mon, 28 Sep 2015 14:06:00 -0600<br>From: Matt Fischer <matt@mattfischer.com><br>To: Jonathan Proulx <jon@csail.mit.edu><br>Cc: openstack-operators@lists.openstack.org<br>Subject: Re: [Openstack-operators] "Master" keystone and "sub"<br> keystone<br>Message-ID:<br> <CAHr1CO9sSjwb6ug-9D9K2Zt8Y6WWxQON1ZPecWojqZkMstPV+A@mail.gmail.com><br>Content-Type: text/plain; charset="utf-8"<br><br>On Mon, Sep 28, 2015 at 1:46 PM, Jonathan Proulx <jon@csail.mit.edu> wrote:<br><br>> On Mon, Sep 28, 2015 at 03:31:54PM -0400, Adam Young wrote:<br>> :On 09/26/2015 11:19 PM, RunnerCheng wrote:<br>> :>Hi All,<br>> :>I'm a newbie of keystone, and I'm doing some research about it<br>> :>recently. I have a question about how to deploy it. The scenario is<br>> :>on below:<br>> :><br>> :>One comany has one headquarter dc and 5 sub dc locate in different<br>> :>cities. We want to deploy separate OpenStack with "sub" keystone at<br>> :>the sub dc, and want to deploy one "master" keystone at headquarter<br>> :>dc. We want to manage all users, roles and tenants etc on the<br>> :>"master" keystone, however we want the end-user can authenticate<br>> :>with the "sub" keystone where he or she is locate.<br>> :<br>> :<br>> :Use LDAP for the users, don't keep them in Keystone.<br>> :<br>> :Replicate roles, projects etc from master to sub.<br>> :<br>> :Use Fernet tokens. Replicate revocation events both ways.<br>><br>> I'm hearing conflicting advice about the suitibility of Fernet tokens<br>> for production use.<br>><br>> I like the idea. I did get them to work in kilo trivially for CLI, but<br>> Horizon was unhappy for reasons I didn't fully investigate as I heard<br>> they 'weren't quite ready in kilo' so I defered further investigation<br>> to next cycle.<br>><br>> Though honestly if you're building somthing new right now starting<br>> with Liberty is probably the right thing anyway by the time you're<br>> done PoC it will be released.<br>><br>> -Jon<br><br><br>We're using them in prod, generally happy except with Validation<br>performance. For Horizon we run off of master anyway but you have to pull<br>in some code from Liberty or it won't work.<br>-------------- next part --------------<br>An HTML attachment was scrubbed...<br>URL: <<a href="http://lists.openstack.org/pipermail/openstack-operators/attachments/20150928/e3e01f80/attachment-0001.html" target="_blank"><font color="#0068cf">http://lists.openstack.org/pipermail/openstack-operators/attachments/20150928/e3e01f80/attachment-0001.html</font></a>><br><br>------------------------------<br><br>Message: 14<br>Date: Mon, 28 Sep 2015 16:20:56 -0400<br>From: Jonathan Proulx <jon@csail.mit.edu><br>To: Matt Fischer <matt@mattfischer.com><br>Cc: openstack-operators@lists.openstack.org<br>Subject: Re: [Openstack-operators] "Master" keystone and "sub"<br> keystone<br>Message-ID: <20150928202056.GP24467@csail.mit.edu><br>Content-Type: text/plain; charset=us-ascii<br><br>On Mon, Sep 28, 2015 at 02:06:00PM -0600, Matt Fischer wrote:<br>:On Mon, Sep 28, 2015 at 1:46 PM, Jonathan Proulx <jon@csail.mit.edu> wrote:<br><br>:> I'm hearing conflicting advice about the suitibility of Fernet tokens<br>:> for production use.<br>:><br>:> I like the idea. I did get them to work in kilo trivially for CLI, but<br>:> Horizon was unhappy for reasons I didn't fully investigate as I heard<br>:> they 'weren't quite ready in kilo' so I defered further investigation<br>:> to next cycle.<br>:><br>:> Though honestly if you're building somthing new right now starting<br>:> with Liberty is probably the right thing anyway by the time you're<br>:> done PoC it will be released.<br>:><br>:> -Jon<br>:<br>:<br>:We're using them in prod, generally happy except with Validation<br>:performance. For Horizon we run off of master anyway but you have to pull<br>:in some code from Liberty or it won't work.<br><br>Thanks that's actually very good to know. I have a recent master<br>version of Horizon that I hope to move to production soon, so if it's<br>all Horizon issues I may make the move to Fernet in production sooner<br>rather than later.<br><br>-Jon<br><br><br><br>------------------------------<br><BR> </div></body>
</html>