安裝和配置認證服務(wù)

2.2.1安裝和配置認證服務(wù)目錄1.安裝認證服務(wù)3.定義授權(quán)令牌2.配置數(shù)據(jù)庫連接231.安裝認證服務(wù)運行以下命令安裝keystone和python-keystoneclient[root@controller~]#yuminstallopenstack-keystonepython-keystoneclient42.配置數(shù)據(jù)庫連接需要在keystone的配置文件中指定數(shù)據(jù)庫的位置，使用控制節(jié)點上的MySQL數(shù)據(jù)庫，數(shù)據(jù)庫用戶名為keystone，密碼為000000。[root@controller~]#openstack-config--set/etc/keystone/keystone.confdatabaseconnectionmysql://keystone:000000@controller/keystone52.配置數(shù)據(jù)庫連接（1）創(chuàng)建數(shù)據(jù)庫用戶keystone，密碼為000000。[root@controller~]#mysql-uroot-pEnterpassword: #輸入MySQL的root用戶的密碼000000。mysql>CREATEDATABASEkeystone;mysql>GRANTALLPRIVILEGESONkeystone.*TO'keystone'@'localhost'IDENTIFIEDBY'000000';mysql>GRANTALLPRIVILEGESONkeystone.*TO'keystone'@'%'IDENTIFIEDBY'000000‘;mysql>exit62.配置數(shù)據(jù)庫連接（2）為認證服務(wù)創(chuàng)建數(shù)據(jù)庫表[root@controller~]#su-s/bin/sh-c"keystone-managedb_sync"keystone73.定義授權(quán)令牌用openssl創(chuàng)建隨機令牌，把它存儲在配置文件中[root@controller~]#ADMIN_TOKEN=$(opensslrand-hex10)[root@controller~]#openstack-config--set/etc/keystone/keystone.confDEFAULTadmin_token$ADMIN_TOKEN83.定義授權(quán)令牌（1）創(chuàng)建簽名密鑰和數(shù)字證書并限制權(quán)限[root@controller~]#keystone-managepki_setup--keystone-userkeystone--keystone-groupkeystone（2）啟動認證服務(wù)并將其配置為開機自動啟動[root@controller~]#serviceopenstack-keystonestart[root@controller~]#chkconfigopenstack-keystoneon3.定義授權(quán)令牌（3）創(chuàng)建計劃任務(wù)，定期清空過期的令牌[root@controller~]#(crontab-l-ukeystone2>&1|grep-qtoken_flush)||echo'@hourly/usr/bin/keystone-managetoken_flush>/var/log/keystone/keystone-tokenflush.log2>&1'>>/var/spool/cron/keystone檢查計劃任務(wù)配置：[root@controller~]#crontab-l-ukeystone@hourly/usr/bin