Open Stack

I know there is a middleware piece: https://github.com/rackspace/keystone/blob/master/keystone/middleware/swift_auth.py

I'll defer to the swift folks on the other parts…

From: "Khandeshi, Divyesh" <divyesh.khandeshi at hp.com<mailto:divyesh.khandeshi at hp.com>>
Date: Mon, 18 Jul 2011 15:47:31 +0100
To: Ziad Sawalha <ziad.sawalha at rackspace.com<mailto:ziad.sawalha at rackspace.com>>, "'openstack at lists.launchpad.net<mailto:'openstack at lists.launchpad.net>'" <openstack at lists.launchpad.net<mailto:openstack at lists.launchpad.net>>
Subject: RE: [Openstack] [Keystone] [Swift] Keystone Tenant vs Swift Account

Ziad,


1.  You mention that Nova has a shim for lazy syncing of accounts with Keystone. What about Swift? Or the account_autocreate (in proxy-server.conf) the only option to achieve this?

2.  As to the Rackspace dashboard, what API does it use for provisioning? Is it a Rackspace-only API or some undocumented/unexposed Account management API in Swift?

Thanks

Divyesh


From: openstack-bounces+divyesh.khandeshi=hp.com at lists.launchpad.net<mailto:openstack-bounces+divyesh.khandeshi=hp.com at lists.launchpad.net> [mailto:openstack-bounces+divyesh.khandeshi=hp.com at lists.launchpad.net] On Behalf Of Ziad Sawalha
Sent: Saturday, July 16, 2011 3:30 PM
To: Nguyen, Liem Manh; 'openstack at lists.launchpad.net<mailto:'openstack at lists.launchpad.net>'
Subject: Re: [Openstack] [Keystone] [Swift] Keystone Tenant vs Swift Account

Swift account and tenant should be the same. This does not prescribe that Swift not store them locally (Nova still stores projects).

The synchronization can be lazy (Nova does this with a shim in Keystone. If a request is authorized by Keystone on a tenant that does not have a corresponding project, it creates it right there and then). Or it can be proactive (as opposed to lazy).

For proactive provisioning (where accounts would be synched to swift when they are created.

Summarizing:
Lazy provisioning: Users and tenants are created as authenticated requests come in to the openstack service for the first time.
Proactive provisioning: Users and tenants are created in all services as they are created in Keystone.
,Ote: my personal preference is for lazy provisioning.

For proactive provisioning, we would need a service to own orchestration (or provisioning or order fullfilment - pick your model). We don't have one today. The Dashboard does some of that. Rackspace does it using non-openstack components which contain Rackspace business logic.
Will this ever become an OpenStack project or wiL this always live in the business systems of the operator (an enterprise deploying and operating openstack)...

Z

From: Nguyen, Liem Manh [mailto:liem_m_nguyen at hp.com]
Sent: Friday, July 15, 2011 05:56 PM
To: openstack at lists.launchpad.net<mailto:openstack at lists.launchpad.net> <openstack at lists.launchpad.net<mailto:openstack at lists.launchpad.net>>
Subject: [Openstack] [Keystone] [Swift] Keystone Tenant vs Swift Account

Hi,

For Nova, the Keystone Tenant maps to a Nova project, and according to the “Finalize Auth integration” blueprint, the Nova project is going away (“no more project/roleuser info in nova”).

What about Swift’s account?  I assume the Keystone tenant would map to a Swift account.  How would this mapping occur?  Would Swift still maintain account information in the db and these will get synchronized with Keystone tenant information (i.e., auto-create accounts), or would Swift get rid of the account concept and have a mapping between tenant and containers instead?  If there is any existing blue-print/docs on Keystone/Swift integration plan for Diablo, that would be greatly appreciated.

Thanks,
Liem
This email may include confidential information. If you received it in error, please delete it.


Confidentiality Notice: This e-mail message (including any attached or
embedded documents) is intended for the exclusive and confidential use of the
individual or entity to which this message is addressed, and unless otherwise
expressly indicated, is confidential and privileged information of Rackspace.
Any dissemination, distribution or copying of the enclosed material is prohibited.
If you receive this transmission in error, please notify us immediately by e-mail
at abuse at rackspace.com, and delete the original message.
Your cooperation is appreciated.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openstack.org/pipermail/openstack/attachments/20110718/91124a01/attachment.html>