how to get an openstack token and validate it?

Question

I followed this guide: http://keystone.openstack.org/api_curl_examples.html

and it seemed that I got a valid token by ran:

curl -d '{"auth":{"passwordCredentials":{"username": "can", "password": "mypassword"}}}' -H "Content-type: application/json" http://url:35357/v2.0/tokens

and it returned:

{
"access": 
{
    "token": 
    {
        "expires": "2012-05-21T14:35:17Z", 
        "id": "468da447bd1c4821bbc5def0498fd441"
    }, 
    "serviceCatalog": {}, 
    "user": 
    {
        "username": "can",
        "roles_links": [],
        "id": "bb6d3a09ad0c4924bf20c1a32ccb5781",
        "roles": [],
        "name": "can"
    }
}
}

but when I came to the next few sections to validate this token, I encountered this magic number: X-Auth-Token:999888777666. At first I thought it's the token I got but I was wrong.

I think I may have missed something, so I read related sections in openstack documents( http://keystone.openstack.org/configuration.html and http://docs.openstack.org/api/openstack-compute/programmer/content/ ), but still no idea how the number comes from.

could anyone explain to me

1. what's the meaning of that magic number
2. how to get the right value of it so I can get a working token to manage other parts of openstack

Bucktooth

Is it possible to requesting by ajax not by curl .. ? – Fortin

Answer 1

That magic number (string really) is the admin_token setting in your keystone.conf file. Under the [DEFAULT] section in keystone.conf set

admin_token = abcd1234

If you don't use it for admin actions, you'll see something like

ubuntu@i-000004bc:~/devstack$ curl http://localhost:35357/v2.0/tenants
{"error": {"message": "The request you have made requires authentication.", "code": 401, "title": "Not Authorized"}}

If you do use it, you'll see something like

ubuntu@i-000004bc:~/devstack$ curl -H "X-Auth-Token: abcd1234" http://localhost:35357/v2.0/tenants
{"tenants_links": [], "tenants": [{"enabled": true, "description": null, "name": "demo", "id": "aee8a46babcb4e4286021c8f6ef996cd"}, {"enabled": true, "description": null, "name": "invisible_to_admin", "id": "de17fea45de148ada0a58e998e6c3e73"}, {"enabled": true, "description": null, "name": "admin", "id": "f34b0c8ab30e450489b121fbe723fde5"}, {"enabled": true, "description": null, "name": "service", "id": "fbe3e2e530fd47298cb2cba1b4afa3da"}]}

Humiliate

Note that if you have a valid username with an admin role in a tenant, you can use that username and password to retrieve a temporary token that will allow admin actions. – Impervious

Answer 2

To get the list of tenants, in our current implementation, we authenticate with admin credentials and use the token returned to get list of tenants. The implementation works smooth with the authentication token. It may work with admin_token but I have not verified.

If you see the examples you are referring to, there are 2 types of endpoints used

1. Endpoint pointing to port 5000 - public port
2. Endpoint pointing to port 35357 - admin port

In examples which are hitting admin port you would need to specify the "X-Auth-Token" header as the admin_token (specified in the keystone.conf file)

Episiotomy

Answer 3

The token itself is in dict["access"]["token"]["id"] which is that part that will go in the header of subsequent HTTP requests, i.e

X-Auth-Token: 468da447bd1c4821bbc5def0498fd441

The value 999888777666 is from the curl example tutorial and will definitely not work.

As for the value of the token itself, it's randomly generated by the OpenStack service and shouldn't contain any useful information from your point of view.

(BTW, you probably shouldn't go pasting the tokens into forums as they're valid for 24 hours and anyone with a copy of the token and access to your compute endpoint can use it to impersonate you).

Premarital

I said it's not the token. I tried this way: curl -H "X-Auth-Token: 468da447bd1c4821bbc5def0498fd441" url:35357/v2.0/tokens/468da447bd1c4821bbc5def0498fd441 and got a 401 not authorized – Bucktooth

Hrm - yeah the origin of the 999* token doesn't make a lot of sense in the docs. The curl request above should work, although the keystone.openstack.org/api_curl_examples.html tutorial seems to imply that you must connect with an admin account to access the /tokens resource. Can you access any other things with your token? e.g url:35357/v2.0/tenants – Premarital