<div dir="ltr">The token may not be (is probably not) deterministicly created. You give a username and password to the auth system - and it returns the token for you to associate with future requests.<br><br>The request for the token (the auth request) seems to be missing some headers:<br>
<br>curl -i <a href="http://ictp-R2C4-Controller21.ict.englab.netapp.com/auth">http://ictp-R2C4-Controller21.ict.englab.netapp.com/auth</a> -X GET<br><br>Should probably be:<br><br>curl -i <a href="http://ictp-R2C4-Controller21.ict.englab.netapp.com/auth">http://ictp-R2C4-Controller21.ict.englab.netapp.com/auth</a> -X GET -H "X-Auth-User: rados:swift" -H "X-Auth-Key: 77iJvemrxWvYk47HW7pxsL+eHdA53AtLl2T0OyuG"<br>
<br>More information can be found here:<br><br><a href="http://docs.openstack.org/developer/swift/overview_auth.html">http://docs.openstack.org/developer/swift/overview_auth.html</a><br><br>^ it's a little down in the weeds, but it does sorta cover the gist of it - there's lots of ways to do auth with Swift.<br>
<div><br></div><div>-Clay</div></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Mon, Oct 7, 2013 at 7:32 AM, Snider, Tim <span dir="ltr"><<a href="mailto:Tim.Snider@netapp.com" target="_blank">Tim.Snider@netapp.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div lang="EN-US" link="blue" vlink="purple">
<div>
<p class="MsoNormal">I'd like to use curl to access a Ceph cluster. The swift API works and I thought I could use the debug option to look at the curl commands generated for access.
<u></u><u></u></p>
<p class="MsoNormal">Does the --debug option of swift print the entire command for all curl commands during execution?<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Debug output from the 2nd curl command in the example below doesn't seem to show all the headers -- authentication header(s) specifically.<u></u><u></u></p>
<p class="MsoNormal">Entering the command by hand results in a 403 response.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">I'd like to understand how the authentiation token is generated from the tenant (rados) user (swift) and the swift secret_key.<u></u><u></u></p>
<p class="MsoNormal">The following token is generated:<u></u><u></u></p>
<p class="MsoNormal"> "AUTH_rgwtk0b0000007261646f733a7377696674046eff2c9ac6a5041b00545248a7893b900677683adaaca1095128b6edf8fc378d7d49d8"<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">The first part looks like a header: 'AUTH_rgwtk', (rados gateway token) a length == 11 and a prefix == rados:swift<u></u><u></u></p>
<p class="MsoNormal"> AUTH_rgwtk 0b 00000072 61 64 6f 73 3a <a href="tel:73%2077%2069%2066%2074" value="+17377696674" target="_blank">73 77 69 66 74</a><u></u><u></u></p>
<p class="MsoNormal">length = 0xb r a d o s : s w i f t<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">How is the remainder of the token generated? It doesn't appear to be unencoded or a plain hex/ascii translatation of the ceph keys shown by the radowgw-admin command.<u></u><u></u></p>
<p class="MsoNormal">046eff2c 9ac6a504 1b00545 248a7893 b9006776 83adaaca 1095128 b6edf8fc 378d7d49 d8<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Get the ceph user information:<u></u><u></u></p>
<p class="MsoNormal"> root@controller21:~/ssbench-0.2.16# radosgw-admin user info --uid=rados<u></u><u></u></p>
<p class="MsoNormal"> 2013-10-07 05:55:34.804639 7ff1c3f6c780 0 WARNING: cannot read region map<u></u><u></u></p>
<p class="MsoNormal"> { "user_id": "rados",<u></u><u></u></p>
<p class="MsoNormal"> "display_name": "rados",<u></u><u></u></p>
<p class="MsoNormal"> "email": "<a href="mailto:non@none.com" target="_blank">non@none.com</a>",<u></u><u></u></p>
<p class="MsoNormal"> "suspended": 0,<u></u><u></u></p>
<p class="MsoNormal"> "max_buckets": 1000,<u></u><u></u></p>
<p class="MsoNormal"> "auid": 0,<u></u><u></u></p>
<p class="MsoNormal"> "subusers": [<u></u><u></u></p>
<p class="MsoNormal">{ "id": "rados:swift",<u></u><u></u></p>
<p class="MsoNormal"> "permissions": "full-control"},<u></u><u></u></p>
<p class="MsoNormal">{ "id": "rados:swift1",<u></u><u></u></p>
<p class="MsoNormal"> "permissions": "full-control"}],<u></u><u></u></p>
<p class="MsoNormal"> "keys": [<u></u><u></u></p>
<p class="MsoNormal">{ "user": "rados",<u></u><u></u></p>
<p class="MsoNormal"> "access_key": "R5F0D2UCSK3618DJ829A",<u></u><u></u></p>
<p class="MsoNormal"> "secret_key": "PJR1rvV2+Xrzlwo+AZZKXextsDl45EaLljzopgjD"}],<u></u><u></u></p>
<p class="MsoNormal"> "swift_keys": [<u></u><u></u></p>
<p class="MsoNormal">{ "user": "rados:swift",<u></u><u></u></p>
<p class="MsoNormal"> "secret_key": "77iJvemrxWvYk47HW7pxsL+eHdA53AtLl2T0OyuG"},<u></u><u></u></p>
<p class="MsoNormal">{ "user": "rados:swift1",<u></u><u></u></p>
<p class="MsoNormal"> "secret_key": "l9Xlg66JvbNvMmZAj91AeQByEiP8R8sBahCJeqAG"}],<u></u><u></u></p>
<p class="MsoNormal"> "caps": [],<u></u><u></u></p>
<p class="MsoNormal"> "op_mask": "read, write, delete",<u></u><u></u></p>
<p class="MsoNormal"> "default_placement": "",<u></u><u></u></p>
<p class="MsoNormal"> "placement_tags": []}<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Use the debug option in swift to look at the curl commands generated:<u></u><u></u></p>
<p class="MsoNormal"> swift --debug -V 1.0 -A <a href="http://ictp-R2C4-Controller21.ict.englab.netapp.com/auth" target="_blank">http://ictp-R2C4-Controller21.ict.englab.netapp.com/auth</a> -U rados:swift -K "77iJvemrxWvYk47HW7pxsL+eHdA53AtLl2T0OyuG" list<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">This one appears to be incomplete:<u></u><u></u></p>
<p class="MsoNormal">DEBUG:swiftclient:REQ: curl -i <a href="http://ictp-R2C4-Controller21.ict.englab.netapp.com/auth" target="_blank">http://ictp-R2C4-Controller21.ict.englab.netapp.com/auth</a> -X GET<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">DEBUG:swiftclient:RESP STATUS: 204<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Want to understand how this key was generated:<u></u><u></u></p>
<p class="MsoNormal"> DEBUG:swiftclient:REQ: curl -i <a href="http://ictp-R2C4-Controller21.ict.englab.netapp.com/swift/v1?format=json" target="_blank">http://ictp-R2C4-Controller21.ict.englab.netapp.com/swift/v1?format=json</a> -X GET -H"X-Auth-Token: AUTH_rgwtk0b0000007261646f733a7377696674046eff2c9ac6a5041b00545248a7893b900677683adaaca1095128b6edf8fc378d7d49d8"
<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">The swift command works:<u></u><u></u></p>
<p class="MsoNormal">DEBUG:swiftclient:RESP STATUS: 200<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">DEBUG:swiftclient:RESP BODY: [{"name":"ssbench_000000","count":832,"bytes":85196800},...{"name":"xxx","count":1,"bytes":604}]<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">ssbench_000000<u></u><u></u></p>
<p class="MsoNormal">ssbench_000099<u></u><u></u></p>
<p class="MsoNormal">xxx<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"> DEBUG:swiftclient:REQ: curl -i <a href="http://ictp-R2C4-Controller21.ict.englab.netapp.com/swift/v1?format=json&marker=xxx" target="_blank">http://ictp-R2C4-Controller21.ict.englab.netapp.com/swift/v1?format=json&marker=xxx</a> -X GET -H "X-Auth-Token: AUTH_rgwtk0b0000007261646f733a7377696674046eff2c9ac6a5041b00545248a7893b900677683adaaca1095128b6edf8fc378d7d49d8"<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">DEBUG:swiftclient:RESP STATUS: 200<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"> DEBUG:swiftclient:RESP BODY: []<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Entering the 2nd curl command by hand fails:<u></u><u></u></p>
<p class="MsoNormal"> root@controller21:~/ssbench-0.2.16# curl -i <a href="http://ictp-R2C4-Controller21.ict.englab.netapp.com/auth" target="_blank">http://ictp-R2C4-Controller21.ict.englab.netapp.com/auth</a> -X GET<u></u><u></u></p>
<p class="MsoNormal"> HTTP/1.1 403 Forbidden<u></u><u></u></p>
<p class="MsoNormal"> Date: Mon, 07 Oct 2013 14:06:30 GMT<u></u><u></u></p>
<p class="MsoNormal"> Server: Apache/2.2.22 (Ubuntu)<u></u><u></u></p>
<p class="MsoNormal"> Accept-Ranges: bytes<u></u><u></u></p>
<p class="MsoNormal"> Content-Length: 23<u></u><u></u></p>
<p class="MsoNormal"> Content-Type: application/json<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Thanks,<u></u><u></u></p>
<p class="MsoNormal">Tim<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
</div>
<br>_______________________________________________<br>
Mailing list: <a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack</a><br>
Post to : <a href="mailto:openstack@lists.openstack.org">openstack@lists.openstack.org</a><br>
Unsubscribe : <a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack</a><br>
<br></blockquote></div><br></div>