How to test user authentication with openstack_auth and keystoneclient modules

##Activate virtual environment and goto the horizon directory

##Goto django console
python manage.py shell

##import django settings
from django.conf import settings
dir(settings)
vars(settings)
getattr(settings, 'OPENSTACK_API_VERSIONS', {})

##Imports
from openstack_auth import utils as auth_utils
from openstack_auth.user import Token
from openstack_auth.utils import check_token_expiration
dir(auth_utils)

##site-packages/openstack_auth/backend.py
##client
auth_utils.get_keystone_version()
keystone_client = auth_utils.get_keystone_client()
region_or_auth_url = "http://192.168.56.101:5000/v3"
##User authentication on a domain (Default domain) with username and password
client = keystone_client.Client(
                user_domain_name="Default",
                username="admin",
                password="password",
                auth_url=region_or_auth_url,
                insecure=False,
                debug=True)

##Token
unscoped_auth_ref = client.auth_ref
unscoped_auth_ref.auth_token
##Get token object
unscoped_token = Token(auth_ref=unscoped_auth_ref)
check_token_expiration(unscoped_auth_ref)##False means expired

##Get all projects, keystone version 3
client.management_url = region_or_auth_url
projects = client.projects.list(user=unscoped_auth_ref.user_id)

#### Working Example ####
##Create new project and user , then grant permission ###

a)
OpenStack How to Configure Horizon to use keystone API v3
http://fosshelp.blogspot.com/2014/01/openstack-configure-horizon-keystone-v3.html

b)
Activate virtual environment and goto the horizon directory

c)
Goto django console
python manage.py shell

d)
from openstack_auth import utils as auth_utils
 
keystone_client = auth_utils.get_keystone_client()
 
region_or_auth_url = "http://192.168.56.101:5000/v3"

client = keystone_client.Client(
                user_domain_name="Default",
                username="manu",
                password="manu",
                auth_url=region_or_auth_url,
                insecure=False,
                debug=True)

client.management_url = region_or_auth_url

##worked
#Create new project under the default domain
p = client.projects.create("ppp1", "Default")
#Create new user
u = client.users.create("uppp1", password="uppp1", project=p.id)
#Get member role object
r = [x for x in client.roles.list() if x.name in ["Member"]]
#Grant member role for user on project
client.roles.grant(r[0], user=u.id, project=p.id)

Openstack Project Python Keystoneclient Unit Test Tutorial Part2

1)
First go through following Doc
https://github.com/gabrielfalcao/HTTPretty

Try to understand following things
a)
@httpretty.activate
b)
httpretty.register_uri()
c)
requests.get()
requests.post()
d)
response.text
response.json()
e)
httpretty.last_request()

2)
Check the Output of following httpretty example Programs

import requests
import httpretty

a)
def test_one():
    httpretty.enable()
    test_url = "http://192.168.56.101:5000/v3/"
    httpretty.register_uri(httpretty.GET, test_url,
                           body='{"success":"true"}',
                           content_type='text/json')
    response = requests.get(test_url)
    print "\n===response===", response
    print "\n====response.json()========", response.json()
    print "\n====response.text========", response.text
    last_req = httpretty.last_request()
    print "\n===last_req===", last_req
    httpretty.disable()

OutPut
=======
===response===
====response.json()======== {u'success': u'true'}
====response.text======== {"success":"true"}
===last_req===

b)
def test_two():
    httpretty.enable()
    test_url = "http://192.168.56.101:5000/v3/"
    httpretty.register_uri(httpretty.POST, test_url,
                           body='{"success":"true"}',
                           content_type='text/json')
    response = requests.post(test_url, data={1:1}, headers={'content-type': 'text/json'})
    print "\n===response===", response
    print "\n====response.json()========", response.json()
    print "\n====response.text========", response.text
    last_req = httpretty.last_request()
    print "\n===last_req===", last_req.body
    httpretty.disable()

OutPut
=======
===response===
====response.json()======== {u'success': u'true'}
====response.text======== {"success":"true"}
===last_req=== 1=1

3)
Compare example httpretty Programs with keystoneclient test util

a)
Example of httpretty Program

@httpretty.activate
def test_two():
    test_url = "http://192.168.56.101:5000/v3/"
    httpretty.register_uri(httpretty.POST, test_url,
                           body='{"success":"true"}',
                           content_type='text/json')
    response = requests.post(test_url, data={1:1}, headers={'content-type': 'text/json'})
    last_req = httpretty.last_request()

b)
Example from keystoneclient test util
python-keystoneclient/keystoneclient/tests/v3/utils.py
 
@httpretty.activate
    def test_create(self, ref=None, req_ref=None):
    ###Similar to###httpretty.register_uri
    self.stub_entity(httpretty.POST, entity=req_ref, status=201)
    ###Similar to###response = requests.post() OR response = requests.get()
    returned = self.manager.create(**parameterize(manager_ref))
    ###Similar to###last_req = httpretty.last_request()
    self.assertEntityRequestBodyIs(req_ref)

4)
Important Methods from keystoneclient test util

a)
python-keystoneclient/keystoneclient/tests/utils.py

    def assertRequestBodyIs(self, body=None, json=None):
        if json:
            val = jsonutils.loads(httpretty.last_request().body)
            self.assertEqual(json, val)
        elif body:
            self.assertEqual(body, httpretty.last_request().body)

b)
python-keystoneclient/keystoneclient/tests/v3/utils.py

    def stub_entity(self, method, parts=None, entity=None, id=None, **kwargs):
        if entity:
            entity = self.encode(entity)
            kwargs['json'] = entity

        if not parts:
            parts = [self.collection_key]

            if self.path_prefix:
                parts.insert(0, self.path_prefix)

        if id:
            if not parts:
                parts = []

            parts.append(id)

        self.stub_url(method, parts=parts, **kwargs)

c)
/python-keystoneclient/keystoneclient/tests/utils.py

    def stub_url(self, method, parts=None, base_url=None, json=None, **kwargs):
        if not base_url:
            base_url = self.TEST_URL

        if json:
            kwargs['body'] = jsonutils.dumps(json)
            kwargs['content_type'] = 'application/json'

        if parts:
            url = '/'.join([p.strip('/') for p in [base_url] + parts])
        else:
            url = base_url

        httpretty.register_uri(method, url, **kwargs)

d)
python-keystoneclient/keystoneclient/tests/v3/utils.py

@httpretty.activate
    def test_create(self, ref=None, req_ref=None):
    self.stub_entity(httpretty.POST, entity=req_ref, status=201)
    returned = self.manager.create(**parameterize(manager_ref))
    self.assertEntityRequestBodyIs(req_ref)


Part 1 .....

How To Checkout From review.openstack.org And Push Changes Back Again For Review

1)
#git fetch ssh://sajuptpm@review.openstack.org:29418/openstack/python-keystoneclient refs/changes/81/65381/2 && git checkout FETCH_HEAD -b test_branch
From ssh://review.openstack.org:29418/openstack/python-keystoneclient
 * branch            refs/changes/81/65381/2 -> FETCH_HEAD
Switched to a new branch 'test_branch'


2)
#git branch
  master
* test_branch

3)
#git remote -v
origin    https://github.com/openstack/python-keystoneclient.git (fetch)
origin    https://github.com/openstack/python-keystoneclient.git (push)

4)
#git review -s
Could not connect to gerrit.
Enter your gerrit username: sajuptpm
Trying again with ssh://sajuptpm@review.openstack.org:29418/openstack/python-keystoneclient.git
Creating a git remote called "gerrit" that maps to:
    ssh://sajuptpm@review.openstack.org:29418/openstack/python-keystoneclient.git

This repository is now set up for use with git-review.
You can set the default username for future repositories with:
  git config --global --add gitreview.username "sajuptpm"

5)
#git remote -v
gerrit    ssh://sajuptpm@review.openstack.org:29418/openstack/python-keystoneclient.git (fetch)
gerrit    ssh://sajuptpm@review.openstack.org:29418/openstack/python-keystoneclient.git (push)
origin    https://github.com/openstack/python-keystoneclient.git (fetch)
origin    https://github.com/openstack/python-keystoneclient.git (push)

6)
#git remote update
Fetching origin
Fetching gerrit

7)
#git branch
  master
* test_branch

8)
#git checkout master
Switched to branch 'master'

9)
#git branch
* master
  test_branch

10)
#git pull --ff-only origin master
From https://github.com/openstack/python-keystoneclient
 * branch            master     -> FETCH_HEAD
Already up-to-date.

11)
#git branch
* master
  test_branch

12)
#git remote -v
gerrit    ssh://sajuptpm@review.openstack.org:29418/openstack/python-keystoneclient.git (fetch)
gerrit    ssh://sajuptpm@review.openstack.org:29418/openstack/python-keystoneclient.git (push)
origin    https://github.com/openstack/python-keystoneclient.git (fetch)
origin    https://github.com/openstack/python-keystoneclient.git (push)

13)
#git checkout test_branch
Switched to branch 'test_branch'

14)
#git branch
  master
* test_branch

15)
#git diff

16)
*See comment and diff of last commit
#git show

17)
Make your changes

18)
a)
*If you want to save your changes as new commit
#git commit -a

b)
*If you want to append your changes to last commit
#git commit --amend

19)
*Push your Changes to https://review.openstack.org
#git review

20)
Goto https://review.openstack.org

Openstack Project Python Keystoneclient Unit Test Tutorial Part1

1)
First go through following Doc
https://github.com/gabrielfalcao/HTTPretty

Try to understand following things
a)
@httpretty.activate
b)
httpretty.register_uri()
c)
requests.get()
requests.post()
d)
response.text
response.json()
e)
httpretty.last_request()


2)
Important Files

A)
./keystoneclient/tests/utils.py

import testtools

class TestCase(testtools.TestCase):
    TEST_DOMAIN_ID = '1'
    TEST_DOMAIN_NAME = 'aDomain'
    TEST_TENANT_ID = '1'
    TEST_TENANT_NAME = 'aTenant'
    TEST_TOKEN = 'aToken'
    TEST_TRUST_ID = 'aTrust'
    TEST_USER = 'test'
    TEST_ROOT_URL = 'http://127.0.0.1:5000/'

    def setUp(self):
        super(TestCase, self).setUp()

    def tearDown(self):
        super(TestCase, self).tearDown()

    def stub_url(self, method, parts=None, base_url=None, json=None, **kwargs):
    httpretty.register_uri(method, url, **kwargs)

    def assertRequestBodyIs(self, body=None, json=None):

    def assertRequestHeaderEqual(self, name, val):

B)
./keystoneclient/tests/v3/utils.py

from keystoneclient.tests import utils
from keystoneclient.v3 import client

class UnauthenticatedTestCase(utils.TestCase):
    """Class used as base for unauthenticated calls."""
    TEST_ROOT_URL = 'http://127.0.0.1:5000/'
    TEST_URL = '%s%s' % (TEST_ROOT_URL, 'v3')
    TEST_ROOT_ADMIN_URL = 'http://127.0.0.1:35357/'
    TEST_ADMIN_URL = '%s%s' % (TEST_ROOT_ADMIN_URL, 'v3')

class TestCase(UnauthenticatedTestCase):
    TEST_ADMIN_IDENTITY_ENDPOINT = "http://127.0.0.1:35357/v3"

    def setUp(self):
        super(TestCase, self).setUp()
        self.client = client.Client(username=self.TEST_USER,
                                    token=self.TEST_TOKEN,
                                    tenant_name=self.TEST_TENANT_NAME,
                                    auth_url=self.TEST_URL,
                                    endpoint=self.TEST_URL)

    def stub_auth(self, subject_token=None, **kwargs):
        if not subject_token:
            subject_token = self.TEST_TOKEN
        self.stub_url(httpretty.POST, ['auth', 'tokens'],
                      X_Subject_Token=subject_token, **kwargs)


class CrudTests(object):
    key = None
    collection_key = None
    model = None
    manager = None
    path_prefix = None

    def new_ref(self, **kwargs):
        kwargs.setdefault('id', uuid.uuid4().hex)
        return kwargs

    def stub_entity(self, method, parts=None, entity=None, id=None, **kwargs):
        if entity:
            entity = self.encode(entity)
            kwargs['json'] = entity

        if not parts:
            parts = [self.collection_key]

            if self.path_prefix:
                parts.insert(0, self.path_prefix)

        if id:
            if not parts:
                parts = []

            parts.append(id)

        self.stub_url(method, parts=parts, **kwargs)

    @httpretty.activate
    def test_create(self, ref=None, req_ref=None):
        ref = ref or self.new_ref()
        manager_ref = ref.copy()
        manager_ref.pop('id')

        # req_ref argument allows you to specify a different
        # signature for the request when the manager does some
        # conversion before doing the request (e.g converting
        # from datetime object to timestamp string)
        req_ref = req_ref or ref.copy()
        req_ref.pop('id')

        self.stub_entity(httpretty.POST, entity=req_ref, status=201)

        returned = self.manager.create(**parameterize(manager_ref))
        self.assertTrue(isinstance(returned, self.model))
        for attr in req_ref:
            self.assertEqual(
                getattr(returned, attr),
                req_ref[attr],
                'Expected different %s' % attr)
        self.assertEntityRequestBodyIs(req_ref)

C)
./keystoneclient/tests/v3/test_users.py

from keystoneclient.v3 import users
from keystoneclient.tests.v3 import utils

class UserTests(utils.TestCase, utils.CrudTests):
    def setUp(self):
        super(UserTests, self).setUp()
        self.key = 'user'
        self.collection_key = 'users'
        self.model = users.User
        self.manager = self.client.users

    def new_ref(self, **kwargs):
        kwargs = super(UserTests, self).new_ref(**kwargs)
        kwargs.setdefault('description', uuid.uuid4().hex)
        kwargs.setdefault('domain_id', uuid.uuid4().hex)
        kwargs.setdefault('enabled', True)
        kwargs.setdefault('name', uuid.uuid4().hex)
        kwargs.setdefault('default_project_id', uuid.uuid4().hex)
        return kwargs

    @httpretty.activate
    def test_add_user_to_group(self):
        group_id = uuid.uuid4().hex
        ref = self.new_ref()
        self.stub_url(httpretty.PUT,
                      ['groups', group_id, self.collection_key, ref['id']],
                      status=204)

        self.manager.add_to_group(user=ref['id'], group=group_id)
        self.assertRaises(exceptions.ValidationError,
                          self.manager.remove_from_group,
                          user=ref['id'],
                          group=None)

Part 2 ....

Howto Setup OpenStack Keystoneclient Development Environment (Method One)

Howto Setup OpenStack python-keystoneclient Development Environment

import os
import sys
this_dir = os.path.dirname(os.path.realpath(__file__))
prev_dir = os.path.dirname(this_dir)
print prev_dir
###Required to import keystoneclient
sys.path.append(prev_dir)

###test keystoneclient import
import keystoneclient

from keystoneclient.v3 import client
keystone = client.Client(token="tokentoken", endpoint="http://192.168.56.101:35357/v3")
#print "====",keystone.users.list()
#print keystone.projects.list()

OpenStack Horizon Keystone Howto Create New User And Give Permission To Create More New users

1)Goto Horizon and login as Admin

2)
* Create a new role named "create_user_role"
* Create a new user "saju1" with role "create_user_role" and project "any_project"

3)
* Logout from horizon
* Try to login as "saju1". That will not work.



4)
Goto any restclient. I am using "advanced rest client" extension of google chrome.

5)
User Authentication With Scope and get token
URL: http://192.168.56.102:5000/v3/auth/tokens
Method: POST
Request Headers:
Content-type : application/json
Request Body:

{
    "auth": {
        "identity": {
            "methods": [
                "password"
            ],
            "password": {
                "user": {
                    "name": "saju1",
                    "password": "saju1",
                    "domain": {
                               "name":"Default"
                            }

                }
            }
        },
    "scope": {
        "project": {
            "domain": {
                "name": "Default"
                },
            "name": "project_name_of_saju1_selected_in_step_2"
            }
        }
    }
}


6)
Create a user
URL: http://192.168.56.102:5000/v3/users
Method: POST
Request Headers:
Content-type : application/json
X-Auth-Token : c999bef3667c48739e39deca2f3dc6c7
Request Body:
{
    "user": {
        "default_project_id": "",
        "description": "new user",
        "domain_id": "default",
        "email": "sam@ss.com",
        "enabled": true,
        "name": "saju2",
        "password": "saju2"
    }
}


7)
* Step-6 should fail, since we haven't edit /etc/keystone/policy.json file.
* Goto /etc/keystone/policy.json and make following changes
##Add new rule "create_user_rule"
"create_user_rule": [["role:create_user_role"]],
##Apply the new rule "create_user_rule" to action create_user.
##So users belong to the role "create_user_role" can do "create_user" action.
"identity:create_user": [["rule:admin_required"], ["rule:create_user_rule"]],
##Apply the new rule "create_user_rule" to action list_projects
##So users belong to the role "create_user_role" can do "list_projects" action.
"identity:list_projects": [["rule:admin_required"], ["rule:create_user_rule"]],
##Apply the new rule "create_user_rule" to action list_roles
##So users belong to the role "create_user_role" can do "list_roles" action.
"identity:list_roles": [["rule:admin_required"],  ["rule:create_user_rule"]],
##Apply the new rule "create_user_rule" to action create_grant
##So users belong to the role "create_user_role" can do "create_grant" action.
"identity:create_grant": [["rule:admin_required"], ["rule:create_user_rule"]],

8)
Repeat the step-6 again and copy the id of new user "saju2"

9)
Find id of project "project_name_of_saju1_selected_in_step_2" and id of role "Member" with following API requests.
http://192.168.56.102:5000/v3/projects/
http://192.168.56.102:5000/v3/roles/

10)
Grant role to user on project:
PUT /projects/{project_id}/users/{user_id}/roles/{role_id}
Method: PUT
URL: http://192.168.56.102:5000/v3/projects/b831390e0cb04f1eafbdd39bfddb7bd6/users/57bcea432f824f11b7daf2b287adad55/roles/5ef7a5ed13e843358655c1f7568144cd
Request Headers:
X-Auth-Token : c999bef3667c48739e39deca2f3dc6c7

11)
Goto horizon and login as saju2 and provision a VM. :) :) :)

Ref Sites:
http://adam.younglogic.com/2013/09/keystone-v3-api-examples/
https://github.com/openstack/identity-api/blob/master/openstack-identity-api/v3/src/markdown/identity-api-v3.md <== API

OpenStack How to Customize Authorization (Policies, Policy.json)

Customizing Authorization

The default authorization settings only allow administrative users to create resources on behalf of a different project. OpenStack handles two kind of authorization policies:

• Operation-based: policies specify access criteria for specific operations, possibly with fine-grained control over specific attributes.
• Resource-based: whether access to a specific resource might be granted or not according to the permissions configured for the resource (currently available only for the network resource). The actual authorization policies enforced in an OpenStack service vary from deployment to deployment.

The policy engine reads entries from the policy.json file. The actual location of this file might vary from distribution to distribution, for nova it is typically in /etc/nova/policy.json. You can update entries while the system is running, and you do not have to restart services. Currently the only way of updating such policies is to edit the policy file.
The OpenStack service's policy engine matches a policy directly. A rule indicates evaluation of the elements of such policies. For instance, in a compute:create: [["rule:admin_or_owner"]] statement, the policy is compute:create, and the rule is admin_or_owner.
Policies are triggered by an OpenStack policy engine whenever one of them matches an OpenStack API operation or a specific attribute being used in a given operation. For instance, the engine tests the create:compute policy every time a user sends a POST /v2/{tenant_id}servers request to the OpenStack Compute API server. Policies can be also related to specific API extensions. For instance, if a user needs an extension like compute_extension:rescue the attributes defined by the provider extensions trigger the rule test for that operation.
An authorization policy can be composed by one or more rules. If more rules are specified, evaluation policy will be successful if any of the rules evaluates successfully; if an API operation matches multiple policies, then all the policies must evaluate successfully. Also, authorization rules are recursive. Once a rule is matched, the rule(s) can be resolved to another rule, until a terminal rule is reached. These are the rules defined:

• Role-based rules: evaluate successfully if the user submitting the request has the specified role. For instance "role:admin" is successful if the user submitting the request is an administrator.
• Field-based rules: evaluate successfully if a field of the resource specified in the current request matches a specific value. For instance "field:networks:shared=True" is successful if the attribute shared of the network resource is set to true.
• Generic rules: compare an attribute in the resource with an attribute extracted from the user's security credentials and evaluates successfully if the comparison is successful. For instance "tenant_id:%(tenant_id)s" is successful if the tenant identifier in the resource is equal to the tenant identifier of the user submitting the request.

Here are snippets of the default nova policy.json file:

{
 "context_is_admin":  [["role:admin"]],
 "admin_or_owner":  [["is_admin:True"], ["project_id:%(project_id)s"]], [1]
 "default": [["rule:admin_or_owner"]], [2]
 "compute:create": [],
 "compute:create:attach_network": [],
 "compute:create:attach_volume": [],
 "compute:get_all": [],
    "admin_api": [["is_admin:True"]],
 "compute_extension:accounts": [["rule:admin_api"]],
 "compute_extension:admin_actions": [["rule:admin_api"]],
 "compute_extension:admin_actions:pause": [["rule:admin_or_owner"]],
 "compute_extension:admin_actions:unpause": [["rule:admin_or_owner"]],
 "compute_extension:admin_actions:suspend": [["rule:admin_or_owner"]],
 "compute_extension:admin_actions:resume": [["rule:admin_or_owner"]],
 ...
 "compute_extension:admin_actions:migrate": [["rule:admin_api"]],
 "compute_extension:aggregates": [["rule:admin_api"]],
 "compute_extension:certificates": [],
 "compute_extension:cloudpipe": [["rule:admin_api"]],
 ...
 "compute_extension:flavorextraspecs": [],
 "compute_extension:flavormanage": [["rule:admin_api"]],  [3]
 }
 

[1] Shows a rule which evaluates successfully if the current user is an administrator or the owner of the resource specified in the request (tenant identifier is equal).
[2] Shows the default policy which is always evaluated if an API operation does not match any of the policies in policy.json.
[3] Shows a policy restricting the ability of manipulating flavors to administrators using the Admin API only.
In some cases, some operations should be restricted to administrators only. Therefore, as a further example, let us consider how this sample policy file could be modified in a scenario where we enable users to create their own flavors:

"compute_extension:flavormanage": [ ],

Copied From :
http://docs.openstack.org/trunk/openstack-ops/content/customize_auth.html

Ref Sites:
https://ask.openstack.org/en/question/2032/create-admin-user-within-single-tenant/
http://docs.openstack.org/trunk/openstack-ops/content/projects_users.html
http://docs.openstack.org/developer/keystone/architecture.html#approach-to-authorization-policy
http://knowledgestack.wordpress.com/2012/01/27/rbac-keystone-and-openstack/ <=== IMP

Fav Sites:
http://prosuncsedu.wordpress.com/2013/10/01/adding-enforcing-policy-in-openstack-nova-code/
http://prosuncsedu.wordpress.com/2013/09/28/policy-administration-for-openstack-nova/
http://prosuncsedu.wordpress.com/2013/09/18/change-policy-to-add-permission-to-an-existing-nova-command/
http://prosuncsedu.wordpress.com/tag/policy/

How to Test OpenStack Keystone API using RESTClient Firefox Chrome

http://adam.younglogic.com/2013/09/keystone-v3-api-examples/
https://github.com/openstack/identity-api/blob/master/openstack-identity-api/v3/src/markdown/identity-api-v3.md <== API

Core API
###############

a)
*List All API Versions
*https://github.com/openstack/identity-api/blob/master/openstack-identity-api/v3/src/markdown/identity-api-v3.md#list-versions-get-
*URL: http://192.168.56.101:5000/
*Method: GET



b)
*Authenticate
*https://github.com/openstack/identity-api/blob/master/openstack-identity-api/v3/src/markdown/identity-api-v3.md#authenticate-post-authtokens
*URL: http://192.168.56.101:5000/v3/auth/tokens
*Method: POST
*Request Headers:
Content-type : application/json
*Request Body:
Login as admin using the method password.
-----
{
    "auth": {
        "identity": {
            "methods": [
                "password"
            ],
            "password": {
                "user": {
                    "name": "admin",
                    "password": "password",
                    "domain": {
                               "name":"Default"
                            }

                }
            }
        }
    }
}

*You can find the "X-Subject-Token" from the response header of this request.
X-Subject-Token: 6f9723ef28de4cdaaa72327ad3ab3e0d

c)
*Validate Token
*https://github.com/openstack/identity-api/blob/master/openstack-identity-api/v3/src/markdown/identity-api-v3.md#validate-token-get-authtokens
*URL: http://192.168.56.101:5000/v3/auth/tokens
*Method: GET
*Request Headers:
X-Auth-Token: tokentoken
X-Subject-Token: 6f9723ef28de4cdaaa72327ad3ab3e0d

d)
*Check Token
*https://github.com/openstack/identity-api/blob/master/openstack-identity-api/v3/src/markdown/identity-api-v3.md#check-token-head-authtokens
*URL: http://192.168.56.101:5000/v3/auth/tokens
*Method: HEAD
*Request Headers:
X-Auth-Token: tokentoken
X-Subject-Token: c675805436575fs5dvt2sd32f

e)
*Revoke/Delete Token
*https://github.com/openstack/identity-api/blob/master/openstack-identity-api/v3/src/markdown/identity-api-v3.md#revoke-token-delete-authtokens
*URL: http://192.168.56.101:5000/v3/auth/tokens
*Method: DELETE
*Request Headers:
X-Auth-Token: tokentoken
X-Subject-Token: c675805436575fs5dvt2sd32f

Projects
#############

a)
*Create Projects
*https://github.com/openstack/identity-api/blob/master/openstack-identity-api/v3/src/markdown/identity-api-v3.md#create-project-post-projects
*URL: http://192.168.56.101:5000/v3/projects
*Method: POST
*Request Headers:
X-Auth-Token: tokentoken
Content-type : application/json
*Request Body:
{
    "project": {
        "description": "description1",
        "domain_id": "default",
        "enabled": true,
        "name": "MyProject1"
    }
}


b)
*List Projects
*https://github.com/openstack/identity-api/blob/master/openstack-identity-api/v3/src/markdown/identity-api-v3.md#list-projects-get-projects
*URL: http://192.168.56.101:5000/v3/projects
*Method: GET
*Request Headers:
X-Auth-Token: tokentoken

c)
*Get Project
*https://github.com/openstack/identity-api/blob/master/openstack-identity-api/v3/src/markdown/identity-api-v3.md#get-project-get-projectsproject_id
*URL: http://192.168.56.101:5000/v3/projects/a265e326b5f243f5bccdf5fdc537b8f2
*Method: GET
*Request Headers:
X-Auth-Token: tokentoken

d)
*Update Project
*https://github.com/openstack/identity-api/blob/master/openstack-identity-api/v3/src/markdown/identity-api-v3.md#update-project-patch-projectsproject_id
*URL: http://192.168.56.101:5000/v3/projects/a265e326b5f243f5bccdf5fdc537b8f2
*Method: PATCH
*Request Headers:
X-Auth-Token: tokentoken
Content-type : application/json
*Request Body:
{
    "project": {
        "description": "description2",
        "domain_id": "default",
        "enabled": true,
        "name": "MyProject_new_name"
    }
}

*I could not find the request method "PATCH" in restclient firefox Addon.
*Note: Use Google chrome browser with "Advanced Rest Client" extension for PATCH option (Works).

e)
*Delete Project
*https://github.com/openstack/identity-api/blob/master/openstack-identity-api/v3/src/markdown/identity-api-v3.md#get-project-get-projectsproject_id
*URL: http://192.168.56.101:5000/v3/projects/a265e326b5f243f5bccdf5fdc537b8f2
*Method: DELETE
*Request Headers:
X-Auth-Token: tokentoken

Openstack Keystone How to use RESTClient Plugin Firefox Google Chrome

Openstack Keystone How to use RESTClient Plugin Firefox Google Chrome

http://adam.younglogic.com/2013/09/keystone-v3-api-examples/
https://github.com/openstack/identity-api/blob/master/openstack-identity-api/v3/src/markdown/identity-api-v3.md

URL
===
http://192.168.56.101:5000/v3

Request Headers
================
1)
X-Auth-Token : tokentoken

* You can find the your admin token from /etc/keystone/keystone.conf
admin_token = tokentoken

2)
Content-type : application/json

3)
X-Subject-Token: 0a182214a5204e1a9d63185362b611a8


Examples
========

1)
url
----
http://192.168.56.101:5000/v3/auth/tokens

headers
-------
Content-type : application/json

method
------
POST

body
-----
{
    "auth": {
        "identity": {
            "methods": [
                "password"
            ],
            "password": {
                "user": {
                    "name": "admin",
                    "password": "password",
                    "domain": {
                               "name":"Default"
                            }

                }
            }
        }
    }
}


2)
https://github.com/openstack/identity-api/blob/master/openstack-identity-api/v3/src/markdown/identity-api-v3.md#validate-token-get-authtokens

How to Openstack Devstack Switch git Branch (Keystone)

1)
saju@saju-VirtualBox:/opt/stack/keystone$
saju@saju-VirtualBox:/opt/stack/keystone$ git remote add sajucld https://github.com/kwss/keystone.git
saju@saju-VirtualBox:/opt/stack/keystone$

2)
saju@saju-VirtualBox:/opt/stack/keystone$ git remote -v
sajucld    https://github.com/kwss/keystone.git (fetch)
sajucld    https://github.com/kwss/keystone.git (push)
origin    https://github.com/openstack/keystone.git (fetch)
origin    https://github.com/openstack/keystone.git (push)
saju@saju-VirtualBox:/opt/stack/keystone$

3)
saju@saju-VirtualBox:/opt/stack/keystone$ git fetch sajucld
remote: Counting objects: 1172, done.
remote: Compressing objects: 100% (512/512), done.
remote: Total 914 (delta 578), reused 724 (delta 398)
Receiving objects: 100% (914/914), 316.91 KiB | 27.00 KiB/s, done.
Resolving deltas: 100% (578/578), completed with 93 local objects.
From https://github.com/kwss/keystone
 * [new branch]      bp/role-mapping-service-keystone -> sajucld/bp/role-mapping-service-keystone
 * [new branch]      feature/keystone-v3 -> sajucld/feature/keystone-v3
 * [new branch]      fed-plugin-moonshot -> sajucld/fed-plugin-moonshot
 * [new branch]      federated_auth_plugin -> sajucld/federated_auth_plugin
 * [new branch]      idp-service -> sajucld/idp-service
 * [new branch]      kent-federated-april -> sajucld/kent-federated-april
 * [new branch]      master     -> sajucld/master
 * [new branch]      role-mapping -> sajucld/role-mapping
 * [new branch]      stable/diablo -> sajucld/stable/diablo
 * [new branch]      stable/essex -> sajucld/stable/essex
 * [new branch]      stable/folsom -> sajucld/stable/folsom
saju@saju-VirtualBox:/opt/stack/keystone$

4)
saju@saju-VirtualBox:/opt/stack/keystone$ git checkout --track sajucld/feature/keystone-v3
Branch feature/keystone-v3 set up to track remote branch feature/keystone-v3 from sajucld.
Switched to a new branch 'feature/keystone-v3'
saju@saju-VirtualBox:/opt/stack/keystone$

5)
saju@saju-VirtualBox:/opt/stack/keystone$ git branch
* feature/keystone-v3
  master
saju@saju-VirtualBox:/opt/stack/keystone$

6)
Switch to working devstack branch
#git checkout mater

Goto devstack screen
#screen -x
* Press "Ctrl +  a + 1", to goto keystone log
* Press "Ctrl + c" to stop keystone service
* Press Up arrow and press Enter to Start keystone service again

7)
Switch to dev/testing branch
#git checkout feature/keystone-v3

Goto devstack screen
#screen -x
* Press "Ctrl +  a + 1", to goto keystone log
* Press "Ctrl + c" to stop keystone service
* Press Up arrow and press Enter to Start keystone service again

Openstack Keystone API V3 Python Keystoneclient Example

>>>
>>> from keystoneclient.v3 import client
>>>
>>> keystone = client.Client(token="tokentoken", endpoint="http://192.168.56.101:35357/v3")
>>>
>>> keystone.users.list()
>>>
>>> keystone.projects.list()
>>>
>>> keystone.domains.list()
>>>
>>> keystone.roles.list()
>>>

Working of Openstack Keystone Service

A)
Simple example : How to serve an app using python paste
################################################

1)
* config.ini
[app:main]
paste.app_factory = service_app:app_factory

2)
* deploy.py
from paste import httpserver
from paste.deploy import loadapp
app = loadapp('config:config.ini', relative_to='.')
httpserver.serve(app, host='127.0.0.1', port='8080')

3)
* service_app.py
def application(environ, start_response):
    """Simple WSGI application"""
    response_headers = [('Content-type','text/plain')]
    status = '200 OK'
    start_response(status, response_headers)
    if environ['PATH_INFO'] == '/login':
    #http://pythonpaste.org/modules/recursive.html
        return ["login page"]
    else:
        return ['Hello world']

def app_factory(global_config, **local_config):
    """This function wraps our simple WSGI app so it
    can be used with paste.deploy"""
    return application

4)
How to run
#python deploy.py
serving on http://127.0.0.1:8080

5)
goto the urls
http://127.0.0.1:8080
http://127.0.0.1:8080/login

B)
Keystone files
################
1)
vim /opt/stack/keystone/bin/keystone-all

def create_server(conf, name, host, port):
    app = deploy.loadapp('config:%s' % conf, name=name)
    server = environment.Server(app, host=host, port=port)
    return name, server

def serve(*servers):
    for name, server in servers:
        server.start()

2)
vim /opt/stack/keystone/keystone/common/environment/__init__.py

Server = eventlet_server.Server

3)
vim /opt/stack/keystone/keystone/common/environment/eventlet_server.py

class Server(object):
    def start(self, key=None, backlog=128):

4)
vim /opt/stack/keystone/etc/keystone-paste.ini

[filter:access_log]
paste.filter_factory = keystone.contrib.access:AccessLogMiddleware.factory

[app:public_service]
paste.app_factory = keystone.service:public_app_factory

[app:service_v3]
paste.app_factory = keystone.service:v3_app_factory

[app:admin_service]
paste.app_factory = keystone.service:admin_app_factory

How to keystone API update user details

0)
Set Host
#OPSENSTACK_HOST="192.168.56.101"

1)
#### Get token ####
#export TOKEN=`curl -si -d @keystone_auth_admin_cred.json -H "Content-type: application/json" http://$OPSENSTACK_HOST:35357/v3/auth/tokens | awk '/X-Subject-Token/ {print $2}'`

#### keystone_auth_admin_cred.json ####
{
            "auth": {
                "identity": {
                    "methods": [
                "password"
                    ],
                    "password": {
                        "user": {
                            "domain": {
                                "name": "Default"
                            },
                            "name": "admin",
                            "password": "password"
                        }
                    }
                },
                "scope": {
                    "project": {
                        "domain": {
                            "name": "Default"
                        },
                        "name": "demo"
                    }
                }
            }
        }



2)
#### Check token ####
#echo $TOKEN

3)
#### List all users ####
##Port 35357
#curl -si -H "X-Auth-Token:$TOKEN" -H "Content-type: application/json" http://$OPSENSTACK_HOST:35357/v3/users

4)
Update user details (change email and set enabled flag to true)
#curl -si -X "PATCH" -H "X-Auth-Token:$TOKEN" -H "Content-type: application/json" http://$OPSENSTACK_HOST:35357/v3/users/ec11454782cd4703b618e106d18326fe -d @keystone_update_user_cred.json

######### keystone_update_user_cred.json #########

{
    "user": {
                "email":"cc@cc.com",
                "enabled":true
            }

}

5)
Ref
https://github.com/openstack/identity-api/blob/master/openstack-identity-api/v3/src/markdown/identity-api-v3.md

How to use Keystone API Version 3

http://adam.younglogic.com/2013/09/keystone-v3-api-examples/
https://github.com/openstack/identity-api/blob/master/openstack-identity-api/v3/src/markdown/identity-api-v3.md

a)
Export the IP of OpenStack host
OPSENSTACK_HOST="192.168.56.101"

b)
#### Get token ####
#export TOKEN=`curl -si -d @keystone_auth_admin_cred.json -H "Content-type: application/json" http://$OPSENSTACK_HOST:35357/v3/auth/tokens | awk '/X-Subject-Token/ {print $2}'`

#### keystone_auth_admin_cred.json ####
{
            "auth": {
                "identity": {
                    "methods": [
                "password"
                    ],
                    "password": {
                        "user": {
                            "domain": {
                                "name": "Default"
                            },
                            "name": "admin",
                            "password": "password"
                        }
                    }
                },
                "scope": {
                    "project": {
                        "domain": {
                            "name": "Default"
                        },
                        "name": "demo"
                    }
                }
            }
        }

b)
#### Check token ####
#echo $TOKEN

c)
#### List all users ####
##Port 35357
#curl -si -H"X-Auth-Token:$TOKEN" -H "Content-type: application/json" http://$OPSENSTACK_HOST:35357/v3/users
or
##Port 5000
#curl -si -H"X-Auth-Token:$TOKEN" -H "Content-type: application/json" http://$OPSENSTACK_HOST:5000/v3/users

d)
##Get all projects
#curl -si -H"X-Auth-Token:$TOKEN" -H "Content-type: application/json" http://$OPSENSTACK_HOST:5000/v3/projects
e)
##Get all domains
#curl -si -H"X-Auth-Token:$TOKEN" -H "Content-type: application/json" http://$OPSENSTACK_HOST:5000/v3/domains

f)
##Get all roles
#curl -si -H"X-Auth-Token:$TOKEN" -H "Content-type: application/json" http://$OPSENSTACK_HOST:5000/v3/roles

g)
Create User
#curl -si -H"X-Auth-Token:$TOKEN" -H "Content-type: application/json" http://$OPSENSTACK_HOST:35357/v3/users -d @keystone_create_user_cred.json

h)
Grant role to user on domain
#curl -si -X "PUT" -H"X-Auth-Token:$TOKEN" -H "Content-type: application/json" http://$OPSENSTACK_HOST:35357/v3/domains/default/users/a007766b3e1747f89548bf5bf517f05c/roles/b4a1700504ef4250af9feed3d892aba1

i)
Grant role to user on project.
* After this we will not get the error "You are not authorized for any projects" while login.
#curl -si -X "PUT"  -H"X-Auth-Token:$TOKEN" -H "Content-type: application/json" http://$OPSENSTACK_HOST:35357/v3/projects/18dc2ae781034460a683eb9ca68a7b9c/users/a007766b3e1747f89548bf5bf517f05c/roles/b4a1700504ef4250af9feed3d892aba1

j)
mysql> use keystone
mysql> select id, name from project;
mysql> select id, name from domain;
mysql> select id, name from role;
mysql> select id, name from group;

How to call keystone API from Horizon

How to call keystone API from Horizon

* Location of Keystone API in Horizon
./horizon/openstack_dashboard/api/keystone.py

a)
* Get endpoing url
def _get_endpoint_url(request, endpoint_type, catalog=None):
    auth_url = getattr(settings, 'OPENSTACK_KEYSTONE_URL')
    return url

b)
* Get a client connected to the Keystone backend
def keystoneclient(request, admin=False):
    api_version = VERSIONS.get_active_version()
    cache_attr = "_keystoneclient_admin" if admin else backend.KEYSTONE_CLIENT_ATTR
    endpoint = _get_endpoint_url(request, endpoint_type)
        conn = api_version['client'].Client(token=user.token.id,
                                            endpoint=endpoint)
        setattr(request, cache_attr, conn)
        return conn

c)
* Create User
def user_create(request, name=None, email=None, password=None, project=None, enabled=None, domain=None):
    ###Get a client connected to the Keystone backend
    manager = keystoneclient(request, admin=True).users
    if VERSIONS.active < 3:
    ###Make API call
        user = manager.create(name, password, email, project, enabled)
        return VERSIONS.upgrade_v2_user(user)
    else:
    ###Make API call
        return manager.create(name, password=password, email=email, project=project, enabled=enabled, domain=domain)

d)
VERSIONS = IdentityAPIVersionManager("identity", preferred_version=3)

e)
# Set up our data structure for managing Identity API versions, and
# add a couple utility methods to it.
class IdentityAPIVersionManager(base.APIVersionManager):
    def upgrade_v2_user(self, user):
        if getattr(user, "project_id", None) is None:
            user.project_id = getattr(user, "tenantId", None)
        return user

    def get_project_manager(self, *args, **kwargs):
        if VERSIONS.active < 3:
            manager = keystoneclient(*args, **kwargs).tenants
        else:
            manager = keystoneclient(*args, **kwargs).projects
        return manager

f)
./horizon/openstack_dashboard/api/base.py
class APIVersionManager(object):