Openstack Keystone OTP

Question

我需要为Keystone写一个TOTP插件。现在我遵循这个指南http://docs.openstack.org/developer/keystone/auth-totp.html

但我不能通过第一步并创建TOTP证书。

我得到了以下错误。

{"error": {"message": "The request you have made requires authentication.", "code": 401, "title": "Unauthorized"}}

调试：

sudo tail -n 50 /var/log/httpd/keystone.log
2016-03-09 12:04:55.808 1181 DEBUG keystone.middleware.auth [req-c8f883dd-cdb1-46fc-bca3-70ea60285050 - - - - -] There is either no auth token in the request or the certificate issuer is not trusted. No auth context will be set. 2016-03-09 12:04:55.808 process_request /opt/stack/keystone/keystone/middleware/auth.py:171
2016-03-09 12:04:55.814 1181 INFO keystone.common.wsgi [req-c8f883dd-cdb1-46fc-bca3-70ea60285050 - - - - -] POST http://localhost:5000/v3/credentials
2016-03-09 12:04:55.815 1181 DEBUG keystone.common.controller [req-c8f883dd-cdb1-46fc-bca3-70ea60285050 - - - - -] RBAC: Authorizing identity:create_credential(credential={u'user_id': u'4725c2a6592c46b89bbd42da1731d5ed', u'type': u'totp', u'blob': u'OBQXG43XN5ZGI'}) 2016-03-09 12:04:55.815 _build_policy_check_credentials /opt/stack/keystone/keystone/common/controller.py:80
2016-03-09 12:04:55.816 1181 DEBUG keystone.common.controller [req-c8f883dd-cdb1-46fc-bca3-70ea60285050 - - - - -] RBAC: building auth context from the incoming auth token 2016-03-09 12:04:55.816 _build_policy_check_credentials /opt/stack/keystone/keystone/common/controller.py:92
2016-03-09 12:04:55.817 1181 DEBUG oslo.cache._memcache_pool [req-c8f883dd-cdb1-46fc-bca3-70ea60285050 - - - - -] Memcached pool 140351135589296, thread 140351402075904: Acquiring connection 2016-03-09 12:04:55.817 _debug_logger /usr/lib/python2.7/site-packages/oslo_cache/_memcache_pool.py:116
2016-03-09 12:04:55.817 1181 DEBUG oslo.cache._memcache_pool [req-c8f883dd-cdb1-46fc-bca3-70ea60285050 - - - - -] Memcached pool 140351135589296, thread 140351402075904: Acquired connection 140351418931208 2016-03-09 12:04:55.817 _debug_logger /usr/lib/python2.7/site-packages/oslo_cache/_memcache_pool.py:116
2016-03-09 12:04:55.818 1181 DEBUG oslo.cache._memcache_pool [req-c8f883dd-cdb1-46fc-bca3-70ea60285050 - - - - -] Memcached pool 1
40351135589296, thread 140351402075904: Releasing connection 140351418931208 2016-03-09 12:04:55.818 _debug_logger /usr/lib/python2.7/site-packages/oslo_cache/_memcache_pool.py:116
2016-03-09 12:04:55.819 1181 DEBUG oslo.cache._memcache_pool [req-c8f883dd-cdb1-46fc-bca3-70ea60285050 - - - - -] Memcached pool 140351135589296, thread 140351402075904: Acquiring connection 2016-03-09 12:04:55.819 _debug_logger /usr/lib/python2.7/site-packages/oslo_cache/_memcache_pool.py:116
2016-03-09 12:04:55.819 1181 DEBUG oslo.cache._memcache_pool [req-c8f883dd-cdb1-46fc-bca3-70ea60285050 - - - - -] Memcached pool 140351135589296, thread 140351402075904: Acquired connection 140351418931208 2016-03-09 12:04:55.819 _debug_logger /usr/lib/python2.7/site-packages/oslo_cache/_memcache_pool.py:116
2016-03-09 12:04:55.820 1181 DEBUG oslo.cache._memcache_pool [req-c8f883dd-cdb1-46fc-bca3-70ea60285050 - - - - -] Memcached pool 140351135589296, thread 140351402075904: Releasing connection 140351418931208 2016-03-09 12:04:55.820 _debug_logger /usr/lib/python2.7/site-packages/oslo_cache/_memcache_pool.py:116
2016-03-09 12:04:55.821 1181 WARNING keystone.common.controller [req-c8f883dd-cdb1-46fc-bca3-70ea60285050 - - - - -] RBAC: Invalid token
2016-03-09 12:04:55.823 1181 WARNING keystone.common.wsgi [req-c8f883dd-cdb1-46fc-bca3-70ea60285050 - - - - -] Authorization failed. The request you have made requires authentication. from ::1

我的剧本。

对TOTP秘密进行编码：

cat base32_str_encoding.py 
#!/usr/bin/python
import base64
secret = 'password'
print base64.b32encode(secret).rstrip('=')

./base32_str_encoding.py 
OBQXG43XN5ZGI

创建TOTP凭据：

cat create_totp_credential.sh 
#!/usr/bin/bash
USER_ID=4725c2a6592c46b89bbd42da1731d5ed
SECRET=OBQXG43XN5ZGI

curl -i \
  -H "Content-Type: application/json" \
  -d '
{
    "credential": {
        "blob": "'$SECRET'",
        "type": "totp",
        "user_id": "'$USER_ID'"
    }
}' \
  http://localhost:5000/v3/credentials ; echo

关键用户数据库。

mysql -uuser -h localhost -ppassword -Bse 'use keystone; select * from user where name="trex";'

| id                               | name     | extra                                                  | password                                                                                                                | enabled | domain_id | default_project_id               |
     4725c2a6592c46b89bbd42da1731d5ed        trex    {"description": "Test user", "email": "trex@trex.com"}  $6$rounds=10000$GfVY/Ws6cxS43fVC$p.44zK6gskY9Y3Aa8MwMCpeIfmKaZVlpB2niv2ewDeQbCyuqBhwOuMwfHLY5Kl67I/QsQUmG5BuK5BB6UtaKe/   1       default d2c1b6084c5a41ceb5582c736e3f03f8

Answer 1

curl -i \
-H "X-Auth-Token: $OS_TOKEN" \   ###########INSERT YOUR TOKEN############
-H "Content-Type: application/json" \
-d '
{
  "credential": {
      "blob": "'$SECRET'",
      "type": "totp",
      "user_id": "'$USER_ID'"
  }
}' \
http://localhost:5000/v3/credentials ; echo