<div dir="ltr"><div style="font-family:arial,sans-serif;font-size:13px"><br></div><div style="font-family:arial,sans-serif;font-size:13px">I tried setting up httpd fronting keystone but wasn't able to figure out how to get it to work. I configured Apache to require LDAP authentication for keystone tokens. One problem is that keystone clients today aren't doing http basic authentication. e.g., if you run "nova --os-username=admin --os-password=whatever list" it doesn't do http basic auth, it does keystone auth where it sends the username/password in the post data.</div>
<div style="font-family:arial,sans-serif;font-size:13px"><br></div><div style="font-family:arial,sans-serif;font-size:13px">Here's the apache config file that I tried to use for keystone token auth, in case anyone finds it interesting (note that it "worked" as far as you can get a token using curl):</div>
<div style="font-family:arial,sans-serif;font-size:13px"><br></div><div style="font-family:arial,sans-serif;font-size:13px"><div>-------------------</div><div><br></div><div>Listen 35357</div><div><br></div><div><VirtualHost *:35357></div>
<div> WSGIScriptAlias / /opt/stack/keystone/httpd/admin</div><div> <Location /v2.0/tokens></div><div> AuthType Basic</div><div> AuthName OpenStack</div><div> AuthBasicProvider ldap</div><div> AuthLDAPURL ldap://localhost/ou=Users,ou=OpenStack,dc=openstack,dc=org?cn?one</div>
<div> Require valid-user</div><div> </Location></div><div></VirtualHost></div><div><br></div><div>Listen 5000</div><div><br></div><div><VirtualHost *:5000></div><div> WSGIScriptAlias / /opt/stack/keystone/httpd/main</div>
<div> <Location /v2.0/tokens></div><div> AuthType Basic</div><div> AuthName OpenStack</div><div> AuthBasicProvider ldap</div><div> AuthLDAPURL ldap://localhost/ou=Users,ou=OpenStack,dc=openstack,dc=org?cn?one</div>
<div> Require valid-user</div><div> </Location></div><div></VirtualHost></div><div><br></div><div>-------------------</div><div><br></div><div>I think a problem with this config is that it should require basic auth only when doing a POST /v2.0/tokens request, and not require auth for GET.</div>
<div><br></div><div>Here's the curl command to get a token, which worked with this config:</div></div><div style="font-family:arial,sans-serif;font-size:13px"><div><br></div><div>$ curl --user admin:adminpwd \</div><div>
-H "Content-Type: application/json" \</div><div> -d '{"auth": {}}' \</div><div> <a href="http://localhost:35357/v2.0/tokens" target="_blank">http://localhost:35357/v2.0/tokens</a></div></div><div class="gmail_extra">
<br><br><div class="gmail_quote">On Thu, Feb 28, 2013 at 2:25 AM, Alvaro Lopez <span dir="ltr"><<a href="mailto:aloga@ifca.unican.es" target="_blank">aloga@ifca.unican.es</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div class="im">On Tue 26 Feb 2013 (13:41), Joshua wrote:<br>
> Matt at this point I am just trying to log into keystone using users I<br>
> created on the Unix system.<br>
<br>
</div>You mean authenticate against keystone using your system users?<br>
<br>
You should be able to do so by running keystone as a WSGI behind an<br>
Apache http server that will make the authentication (PAM in this case,<br>
but can be any auth method supported by apache) and then using the<br>
external authentication method [1].<br>
<br>
[1] <a href="http://docs.openstack.org/developer/keystone/external-auth.html#using-httpd-authentication" target="_blank">http://docs.openstack.org/developer/keystone/external-auth.html#using-httpd-authentication</a><br>
<br>
Regards,<br>
<span class="HOEnZb"><font color="#888888">--<br>
Álvaro López García <a href="mailto:aloga@ifca.unican.es">aloga@ifca.unican.es</a><br>
Instituto de Física de Cantabria <a href="http://devel.ifca.es/~aloga/" target="_blank">http://devel.ifca.es/~aloga/</a><br>
Ed. Juan Jordá, Campus UC tel: <a href="tel:%28%2B34%29%20942%20200%20969" value="+34942200969">(+34) 942 200 969</a><br>
Avda. de los Castros s/n<br>
39005 Santander (SPAIN)<br>
_____________________________________________________________________<br>
"Premature optimization is the root of all evil (or at least most of it)<br>
in programming." -- Donald Knuth<br>
</font></span><div class="HOEnZb"><div class="h5"><br>
<br>
<br>
_______________________________________________<br>
Mailing list: <a href="https://launchpad.net/~openstack" target="_blank">https://launchpad.net/~openstack</a><br>
Post to : <a href="mailto:openstack@lists.launchpad.net">openstack@lists.launchpad.net</a><br>
Unsubscribe : <a href="https://launchpad.net/~openstack" target="_blank">https://launchpad.net/~openstack</a><br>
More help : <a href="https://help.launchpad.net/ListHelp" target="_blank">https://help.launchpad.net/ListHelp</a><br>
</div></div></blockquote></div><br></div></div>