Package: keystone-rxt
Keystone-RXT Authentication PluginThis repo is a simple authentication plugin for Rackspace Global Auth that will allow an OpenStack environment to use
Rackspace Global Auth as an IDP.When the plugin is installed thepasswordauthentication method is required, and the plugin value needs to be be set
torxt. Once activated, the plugin will run normally allowing both local users and remote users to authenticate to
the cloud. The RXT authentication plugin presents a federated token and conforms to the mapping authentication driver.Why?The answer is quite simple, Rackspace Public Cloud Identity provides a powerful set of tools which can allow folks
to make use of their existing users within an OpenStack environment; additionally, this setup allows us to use
OpenStack natively.How?To bridge the authentication gap between Keystone and Rackspace Identity the keystone-rxt authentication driver
effectively acts as areverse proxyto Rackspace Identity and
then presents the returned data as a federated token.HistoryThis plugin was inspired by theCapstoneproject. Process wise, Capstone
and Keystone-RXT perform similar actions using Rackspace Identity as an IDP compatible with OpenStack. While
Keystone-RXT was inspired by Capstone, the two projects serve different purposes.MappingWithin this repository is an example mapping filemapping.jsonwhich will create different users based on the roles
a user has within Rackspace Identity. This file is just an example and can be customized to meet the demands of the
OpenStack environment following the typical mapping setup. See more about Keystone Mapping and Federationhere.Deploying thekeystone-rxtplugin.Before we can do anything you need to install the plugin within your keystone environment, for development purposes
the example here is usingpip.pipinstall--force--upgradegit+https://github.com/rackerlabs/keystone-rxtThis plugin is not yet on PyPi, but that will change with time.Setup your environmentOnce the authentication plugin is installed, update yourkeystone.confto use the new password plugin namedrxt.The configuration file entry will look something like this[auth]
methods = password,token,application_credential
password = rxtTake note that thepasswordmethod is defined and that the password plugin is set to userxt.If you have multifactor auth enabled, and want to support users that are running work loads with it
the plugin also supports TOTP. To enable TOPT make suretotpis in your allowed authentication
methods and that thetotpplugin is using therxtplugin.[auth]
methods = password,token,application_credential,totp
password = rxt
totp = rxtYes, effectively one line is all that's required in config (maybe two with totp support). After the
configuration edit, be sure to restart keystone.Identity mapping, project, and domain setupOnce the plugin is setup and running, everything will be operating normally. The plugin is passive until
the Keystone is informed about the identity provider and we have therackspace_cloud_domaincreated.Craete the domainopenstackdomaincreaterackspace_cloud_domainCreate the identity provideropenstackidentityprovidercreate--remote-idrackspace--domainrackspace_cloud_domainrackspaceCreate the mapping for our identity provideropenstackmappingcreate--rulesfiles/mapping.jsonrackspace_mappingCreate the federation protocolopenstackfederationprotocolcreaterackspace--mappingrackspace_mapping--identity-providerrackspaceUsing The RXT Authentication PluginUsing the plugin is no different that a typical day in the cloud. Simply authenticate using your favorite method,
just make sure you include therackspace_cloud_domaindomain.Authentication usingopenstacksdkThis setup requires a federated token to work. The clouds yaml will not pull a token by default.clouds:local:auth:auth_url:http://localhost:5000/v3project_name:67890_Developmentproject_domain_name:rackspace_cloud_domainusername:testpassword:secreteuser_domain_name:rackspace_cloud_domainregion_name:RegionOneinterface:internalidentity_api_version:"3"If you're running the CLI tools with a TOTP enabled user and you don't want to use your API key,
setup yourclouds.yamlwith the following options so that it knows to run withpasswordandtotp.clouds:rxt-local-mfa:auth_type:"v3multifactor"auth_methods:-v3password-v3totpauth:auth_url:http://localhost:5000/v3project_name:67890_Developmentproject_domain_name:rackspace_cloud_domainusername:testpassword:secreteuser_domain_name:rackspace_cloud_domainregion_name:RegionOneinterface:internalidentity_api_version:"3"Enabling TOTP will require you to use your one time token to run commands, this token can be
defined on the CLI with the--os-passcodeflag; for example the simple image list would look
like soopenstack --os-cloud local --os-passcode 123456 image listOnce you have the clouds CLI setup, run commands normally.openstack--os-cloudlocalimagelist
+--------------------------------------+-------------------------------------------------+--------+|ID|Name|Status|+--------------------------------------+-------------------------------------------------+--------+|6af793ec-d5d2-4a70-a284-cbbb223365f3|debian-10-openstack-amd64.qcow2|active||4ee2c1b4-1055-40b8-ad6b-eb3c9eb7b4d7|debian-11-genericcloud-amd64.qcow2|active||f16a1332-a5fb-46d5-b2ae-caa136cf9432|jammy-server-cloudimg-amd64-disk-kvm.img|active||9e2c968c-c5b3-4a1b-9355-261fa9907e16|ubuntu-bionic-server-cloudimg-amd64.img|active||0ee7d71b-2043-49a0-b107-56ebbbcd6b95|ubuntu-focal-server-cloudimg-amd64-disk-kvm.img|active||804cc228-251c-4081-97df-f609c0e568e7|ubuntu-jammy-server-cloudimg-amd64-disk-kvm.img|active||da9923a8-ac4b-4036-ac14-46264247eb27|ubuntu-xenial-server-cloudimg-amd64-disk1.img|active|+--------------------------------------+-------------------------------------------------+--------+Authentication usingcURLYou can also usecURLto great effect.Example POST json files can be found in the files directory.curl-sS-D--H"Content-Type: application/json"--data-binary"@get-scoped-token""http://172.16.27.211:5000/v3/auth/tokens"-o/dev/null
HTTP/1.1201CREATED
Content-Type:application/json
Content-Length:5594X-Subject-Token:OS_TOKEN
Vary:X-Auth-Token
x-openstack-request-id:req-5a0eb098-eecc-41e1-a10d-d872dc867561
Connection:closeWith the about command we can pull out the value ofX-Subject-Tokenand store it asOS_TOKENso that we can
authenticate to the various APIs supported by our service catalog.curl-H"Accept: application/json"-H"X-Auth-Token:$OS_TOKEN"http://localhost:9292/v2/images