135 lines
4.7 KiB
ReStructuredText
135 lines
4.7 KiB
ReStructuredText
.. -*- rst -*-
|
|
|
|
Create a domain, projects, users, and roles
|
|
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
|
|
|
The Identity service provides authentication services for each OpenStack
|
|
service. The authentication service uses a combination of domains,
|
|
projects, users, and roles.
|
|
|
|
#. Although the "default" domain already exists from the `keystone-manage
|
|
bootstrap` step in this guide, a formal way to create a new domain would be:
|
|
|
|
.. code-block:: console
|
|
|
|
$ openstack domain create --description "An Example Domain" example
|
|
|
|
+-------------+----------------------------------+
|
|
| Field | Value |
|
|
+-------------+----------------------------------+
|
|
| description | An Example Domain |
|
|
| enabled | True |
|
|
| id | 2f4f80574fd84fe6ba9067228ae0a50c |
|
|
| name | example |
|
|
+-------------+----------------------------------+
|
|
|
|
.. end
|
|
|
|
#. This guide uses a service project that contains a unique user for each
|
|
service that you add to your environment. Create the ``service``
|
|
project:
|
|
|
|
.. code-block:: console
|
|
|
|
$ openstack project create --domain default \
|
|
--description "Service Project" service
|
|
|
|
+-------------+----------------------------------+
|
|
| Field | Value |
|
|
+-------------+----------------------------------+
|
|
| description | Service Project |
|
|
| domain_id | default |
|
|
| enabled | True |
|
|
| id | 24ac7f19cd944f4cba1d77469b2a73ed |
|
|
| is_domain | False |
|
|
| name | service |
|
|
| parent_id | default |
|
|
+-------------+----------------------------------+
|
|
|
|
.. end
|
|
|
|
#. Regular (non-admin) tasks should use an unprivileged project and user.
|
|
As an example, this guide creates the ``myproject`` project and ``myuser``
|
|
user.
|
|
|
|
* Create the ``myproject`` project:
|
|
|
|
.. code-block:: console
|
|
|
|
$ openstack project create --domain default \
|
|
--description "Demo Project" myproject
|
|
|
|
+-------------+----------------------------------+
|
|
| Field | Value |
|
|
+-------------+----------------------------------+
|
|
| description | Demo Project |
|
|
| domain_id | default |
|
|
| enabled | True |
|
|
| id | 231ad6e7ebba47d6a1e57e1cc07ae446 |
|
|
| is_domain | False |
|
|
| name | myproject |
|
|
| parent_id | default |
|
|
+-------------+----------------------------------+
|
|
|
|
.. end
|
|
|
|
.. note::
|
|
|
|
Do not repeat this step when creating additional users for this
|
|
project.
|
|
|
|
* Create the ``myuser`` user:
|
|
|
|
.. code-block:: console
|
|
|
|
$ openstack user create --domain default \
|
|
--password-prompt myuser
|
|
|
|
User Password:
|
|
Repeat User Password:
|
|
+---------------------+----------------------------------+
|
|
| Field | Value |
|
|
+---------------------+----------------------------------+
|
|
| domain_id | default |
|
|
| enabled | True |
|
|
| id | aeda23aa78f44e859900e22c24817832 |
|
|
| name | myuser |
|
|
| options | {} |
|
|
| password_expires_at | None |
|
|
+---------------------+----------------------------------+
|
|
|
|
.. end
|
|
|
|
* Create the ``myrole`` role:
|
|
|
|
.. code-block:: console
|
|
|
|
$ openstack role create myrole
|
|
|
|
+-----------+----------------------------------+
|
|
| Field | Value |
|
|
+-----------+----------------------------------+
|
|
| domain_id | None |
|
|
| id | 997ce8d05fc143ac97d83fdfb5998552 |
|
|
| name | myrole |
|
|
+-----------+----------------------------------+
|
|
|
|
.. end
|
|
|
|
* Add the ``myrole`` role to the ``myproject`` project and ``myuser`` user:
|
|
|
|
.. code-block:: console
|
|
|
|
$ openstack role add --project myproject --user myuser myrole
|
|
|
|
.. end
|
|
|
|
.. note::
|
|
|
|
This command provides no output.
|
|
|
|
.. note::
|
|
|
|
You can repeat this procedure to create additional projects and
|
|
users.
|