了解和使用keystone（五）获取token

获取token

创建一个json文件，作为HTTP消息的内容

$ cat token-request.json
 {
    "auth": {
        "identity": {
            "methods": [
                "password"
            ],
            "password": {
                "user": {
                        "domain":{
                                "name":"demo-domain"
                        },
                        "name": "userA2",
                        "password": "123456"
                }
            }
        },
        "scope": {
            "project": {
                "domain":{
                        "name":"demo-domain"
                },
                "name": "project-A"
            }
        }
    }
 }

向keystone请求token。-si是返回消息头。token信息位于消息头的X-Subject-Token字段

curl -si  -d @token-request.json -H "Content-type: application/json" http://localhost:35357/v3/auth/tokens
 HTTP/1.1 201 Created
 X-Subject-Token: ea480e2f70414176b43480cfa6b22a2b
 Vary: X-Auth-Token
 X-Distribution: Ubuntu
 Content-Type: application/json
 Content-Length: 557
 X-Openstack-Request-Id: req-63f66227-1232-429a-8c80-b644050887be
 Date: Mon, 05 Sep 2016 09:44:11 GMT

 {"token": {"methods": ["password"], "roles": [{"id": "6abf3532fce440148a7f29abc7685142", "name": "demo-role"}], 
"expires_at": "2016-09-05T10:44:11.422204Z", "project": {"domain": {"id": "32b54ffdebe84eba9cd10a8dbe647b70", 
"name": "demo-domain"}, "id": "b65e9985801f4481bce7ba885b68cac3", "name": "project-A"}, 
"catalog": [], "user": {"domain": {"id": "32b54ffdebe84eba9cd10a8dbe647b70", "name": "demo-domain"}, "id": 
"459c2cc894844396bec6c16fbc28da87", "name": "userA2"}, "audit_ids": 
["0mgrffReTNWGCNz2WflPSQ"], "issued_at": "2016-09-05T09:44:11.422251Z"}}

从上面可以看到，token=ea480e2f70414176b43480cfa6b22a2b,我们将其获取，并存放在USER_TOKEN的环境变量中。也可以直接用以下面的方式。

$ export USER_TOKEN=`curl -si -d @token-request.json -H "Content-type: application/json" http://localhost:35357/v3/auth/tokens | awk '/X-Subject-Token/ {print $2}'`

$ echo $USER_TOKEN
2d2f89d63a024f45bd95e8d98ec4ae44 （每次获取会修改token的）

利用token查看用户信息

如果权限出现问题，请修改/etc/keystone/policy.json，确保owner获取相关权限。"identity:get_user": "rule:admin_or_owner"

$ curl  -H "X-Auth-Token:$USER_TOKEN"  -H "Content-type: application/json" http://localhost:35357/v3/users/459c2cc894844396bec6c16fbc28da87 | python -mjson.tool
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100   290  100   290    0     0   2329      0 --:--:-- --:--:-- --:--:--  2357
{
    "user": {
        "domain_id": "32b54ffdebe84eba9cd10a8dbe647b70",
        "email": "[email protected]",
        "enabled": true,
        "id": "459c2cc894844396bec6c16fbc28da87",
        "links": {
            "self": "http://localhost:35357/v3/users/459c2cc894844396bec6c16fbc28da87"
        },
        "name": "userA2",
        "param1": "value1",
        "param2": "value2"
    }
}

利用token查看project信息

$ curl  -H "X-Auth-Token:$USER_TOKEN"  -H "Content-type: application/json" http://localhost:35357/v3/projects/b65e9985801f4481bce7ba885b68cac3 | python -mjson.tool
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
 100   389  100   389    0     0   4467      0 --:--:-- --:--:-- --:--:--  4523
 {
    "project": {
        "description": "Project A",
        "domain_id": "32b54ffdebe84eba9cd10a8dbe647b70",
        "enabled": true,
        "id": "b65e9985801f4481bce7ba885b68cac3",
        "is_domain": false,
        "links": {
            "self": "http://localhost:35357/v3/projects/b65e9985801f4481bce7ba885b68cac3"
        },
        "name": "project-A",
        "parent_id": "32b54ffdebe84eba9cd10a8dbe647b70",
        "project_A_param1": "value1",
        "project_A_param2": "value2"
    }
 }

其他模块验证该token是否正确

场景：模块A是keystone的一个user，模块B为keystone提供摸个功能（service）。模块A向模块B发送一个Restful的消息，将携带token信息，模块B向keystone验证这个token是否正确。

用户发出请求时，在消息头中携带token，其他模块收到消息后，向keystone发起验证请求。通过则返回信息，不通过则返回4xx错误。

$ curl  -H "X-Auth-Token:$USER_TOKEN" -H "X-Subject-Token:$USER_TOKEN" -H "Content-type: application/json" http://localhost:35357/v3/auth/tokens | python -mjson.tool
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
 100   557  100   557    0     0   3839      0 --:--:-- --:--:-- --:--:--  3841
 {
    "token": {
        "audit_ids": [
            "Bi9Z3vCmSLCJ6EXYh-qEbA"
        ],
        "catalog": [],
        "expires_at": "2016-09-05T10:44:51.187971Z",
        "issued_at": "2016-09-05T09:44:51.188016Z",
        "methods": [
            "password"
        ],
        "project": {
            "domain": {
                "id": "32b54ffdebe84eba9cd10a8dbe647b70",
                "name": "demo-domain"
            },
            "id": "b65e9985801f4481bce7ba885b68cac3",
            "name": "project-A"
        },
        "roles": [
            {
                "id": "6abf3532fce440148a7f29abc7685142",
                "name": "demo-role"
            }
        ],
        "user": {
            "domain": {
                "id": "32b54ffdebe84eba9cd10a8dbe647b70",
                "name": "demo-domain"
            },
            "id": "459c2cc894844396bec6c16fbc28da87",
            "name": "userA2"
        }
    }
 }