Openstack Keystone OTP

我需要为Keystone编写一个TOTP插件。现在我遵循本指南http://docs.openstack.org/developer/keystone/auth-totp.html Openstack Keystone OTP

但我无法通过第一步并创建TOTP凭据。

我得到了以下错误。

{"error": {"message": "The request you have made requires authentication.", "code": 401, "title": "Unauthorized"}}

调试：

sudo tail -n 50 /var/log/httpd/keystone.log 
2016-03-09 12:04:55.808 1181 DEBUG keystone.middleware.auth [req-c8f883dd-cdb1-46fc-bca3-70ea60285050 - - - - -] There is either no auth token in the request or the certificate issuer is not trusted. No auth context will be set. 2016-03-09 12:04:55.808 process_request /opt/stack/keystone/keystone/middleware/auth.py:171 
2016-03-09 12:04:55.814 1181 INFO keystone.common.wsgi [req-c8f883dd-cdb1-46fc-bca3-70ea60285050 - - - - -] POST http://localhost:5000/v3/credentials 
2016-03-09 12:04:55.815 1181 DEBUG keystone.common.controller [req-c8f883dd-cdb1-46fc-bca3-70ea60285050 - - - - -] RBAC: Authorizing identity:create_credential(credential={u'user_id': u'4725c2a6592c46b89bbd42da1731d5ed', u'type': u'totp', u'blob': u'OBQXG43XN5ZGI'}) 2016-03-09 12:04:55.815 _build_policy_check_credentials /opt/stack/keystone/keystone/common/controller.py:80 
2016-03-09 12:04:55.816 1181 DEBUG keystone.common.controller [req-c8f883dd-cdb1-46fc-bca3-70ea60285050 - - - - -] RBAC: building auth context from the incoming auth token 2016-03-09 12:04:55.816 _build_policy_check_credentials /opt/stack/keystone/keystone/common/controller.py:92 
2016-03-09 12:04:55.817 1181 DEBUG oslo.cache._memcache_pool [req-c8f883dd-cdb1-46fc-bca3-70ea60285050 - - - - -] Memcached pool 140351135589296, thread 140351402075904: Acquiring connection 2016-03-09 12:04:55.817 _debug_logger /usr/lib/python2.7/site-packages/oslo_cache/_memcache_pool.py:116 
2016-03-09 12:04:55.817 1181 DEBUG oslo.cache._memcache_pool [req-c8f883dd-cdb1-46fc-bca3-70ea60285050 - - - - -] Memcached pool 140351135589296, thread 140351402075904: Acquired connection 140351418931208 2016-03-09 12:04:55.817 _debug_logger /usr/lib/python2.7/site-packages/oslo_cache/_memcache_pool.py:116 
2016-03-09 12:04:55.818 1181 DEBUG oslo.cache._memcache_pool [req-c8f883dd-cdb1-46fc-bca3-70ea60285050 - - - - -] Memcached pool 1 
40351135589296, thread 140351402075904: Releasing connection 140351418931208 2016-03-09 12:04:55.818 _debug_logger /usr/lib/python2.7/site-packages/oslo_cache/_memcache_pool.py:116 
2016-03-09 12:04:55.819 1181 DEBUG oslo.cache._memcache_pool [req-c8f883dd-cdb1-46fc-bca3-70ea60285050 - - - - -] Memcached pool 140351135589296, thread 140351402075904: Acquiring connection 2016-03-09 12:04:55.819 _debug_logger /usr/lib/python2.7/site-packages/oslo_cache/_memcache_pool.py:116 
2016-03-09 12:04:55.819 1181 DEBUG oslo.cache._memcache_pool [req-c8f883dd-cdb1-46fc-bca3-70ea60285050 - - - - -] Memcached pool 140351135589296, thread 140351402075904: Acquired connection 140351418931208 2016-03-09 12:04:55.819 _debug_logger /usr/lib/python2.7/site-packages/oslo_cache/_memcache_pool.py:116 
2016-03-09 12:04:55.820 1181 DEBUG oslo.cache._memcache_pool [req-c8f883dd-cdb1-46fc-bca3-70ea60285050 - - - - -] Memcached pool 140351135589296, thread 140351402075904: Releasing connection 140351418931208 2016-03-09 12:04:55.820 _debug_logger /usr/lib/python2.7/site-packages/oslo_cache/_memcache_pool.py:116 
2016-03-09 12:04:55.821 1181 WARNING keystone.common.controller [req-c8f883dd-cdb1-46fc-bca3-70ea60285050 - - - - -] RBAC: Invalid token 
2016-03-09 12:04:55.823 1181 WARNING keystone.common.wsgi [req-c8f883dd-cdb1-46fc-bca3-70ea60285050 - - - - -] Authorization failed. The request you have made requires authentication. from ::1

我的脚本。

编码TOTP秘密：

cat base32_str_encoding.py 
#!/usr/bin/python 
import base64 
secret = 'password' 
print base64.b32encode(secret).rstrip('=') 

./base32_str_encoding.py 
OBQXG43XN5ZGI

创建TOTP凭据：

cat create_totp_credential.sh 
#!/usr/bin/bash 
USER_ID=4725c2a6592c46b89bbd42da1731d5ed 
SECRET=OBQXG43XN5ZGI 

curl -i \ 
    -H "Content-Type: application/json" \ 
    -d ' 
{ 
    "credential": { 
     "blob": "'$SECRET'", 
     "type": "totp", 
     "user_id": "'$USER_ID'" 
    } 
}' \ 
    http://localhost:5000/v3/credentials ; echo

梯形的用户数据库。

mysql -uuser -h localhost -ppassword -Bse 'use keystone; select * from user where name="trex";' 

| id        | name  | extra             | password                            | enabled | domain_id | default_project_id    | 
    4725c2a6592c46b89bbd42da1731d5ed  trex {"description": "Test user", "email": "[email protected]"} $6$rounds=10000$GfVY/Ws6cxS43fVC$p.44zK6gskY9Y3Aa8MwMCpeIfmKaZVlpB2niv2ewDeQbCyuqBhwOuMwfHLY5Kl67I/QsQUmG5BuK5BB6UtaKe/ 1  default d2c1b6084c5a41ceb5582c736e3f03f8

来源

2016-03-09 trex

好吧，我想我必须在配置无令牌授权。 [链接]（http：// docs.openstack.org/developer/keystone/configure_tokenless_x509.html'）http://docs.openstack.org/developer/keystone/configure_tokenless_x509.html – trex

我不这么认为。无令牌认证是基于SSL客户端证书的认证。看起来你的凭证有问题。 – cornelinux

curl -i \ 
-H "X-Auth-Token: $OS_TOKEN" \ ###########INSERT YOUR TOKEN############ 
-H "Content-Type: application/json" \ 
-d ' 
{ 
    "credential": { 
     "blob": "'$SECRET'", 
     "type": "totp", 
     "user_id": "'$USER_ID'" 
    } 
}' \ 
http://localhost:5000/v3/credentials ; echo

来源

2017-05-09 22:21:18 Ihor

Openstack Keystone OTP

回答

相关问题