User, tenants, and roles must be administered using admin credentials. There are two ways to configure python-keystoneclient to use admin credentials, using the token auth method, or password auth method.
To use keystone client using token auth, set the following flags
--endpoint SERVICE_ENDPOINT: allows you to specify the keystone endpoint to communicate with. The default endpoint is http://localhost:35357/v2.0'--token SERVICE_TOKEN: your administrator service token.
--username OS_USERNAME: allows you to specify the administrator username--password OS_PASSWORD: Your administrator password--tenant_name OS_TENANT_NAME: Name of your tenant--auth_url OS_AUTH_URL: url of your keystone auth server, for example http://localhost:5000/v2.0'
The keystone client is set up to expect
commands in the general form of keystone
command
argument, followed by flag-like keyword
arguments to provide additional (often optional) information.
For example, the command user-list and
tenant-create can be invoked as follows:
# Using token auth env variables export SERVICE_ENDPOINT=http://127.0.0.1:5000/v2.0/ export SERVICE_TOKEN=secrete_token keystone user-list keystone tenant-create --name=demo # Using token auth flags keystone --token=secrete --endpoint=http://127.0.0.1:5000/v2.0/ user-list keystone --token=secrete --endpoint=http://127.0.0.1:5000/v2.0/ tenant-create --name=demo # Using user + password + tenant_name env variables export OS_USERNAME=admin export OS_PASSWORD=secrete export OS_TENANT_NAME=admin keystone user-list keystone tenant-create --name=demo # Using user + password + tenant_name flags keystone --username=admin --password=secrete --tenant_name=admin user-list keystone --username=admin --password=secrete --tenant_name=admin tenant-create --name=demo
Tenants are the high level grouping within Keystone that represent groups of users. A tenant is the grouping that owns virtual machines within Nova, or containers within Swift. A tenant can have zero or more users, Users can be associated with more than one tenant, and each tenant - user pairing can have a role associated with it.
keyword arguments
name
description (optional, defaults to None)
enabled (optional, defaults to True)
example:
keystone tenant-create --name=demo
creates a tenant named "demo".
keyword arguments:
name
pass
email
default_tenant (optional, defaults to None)
enabled (optional, defaults to True)
example:
keystone user-create --name=admin \ --pass=secrete \ --email=admin@example.com
list users in the system, optionally by a specific tenant (identified by tenant_id)
arguments
tenant_id (optional, defaults to None)
example:
keystone user-list
arguments
user_id
email
example:
keystone user-update --email 03c84b51574841ba9a0d8db7882ac645 "someone@somewhere.com"
arguments
role_id
user_id
tenant_id
example:
keystone add-user-role \ 3a751f78ef4c412b827540b829e2d7dd \ 03c84b51574841ba9a0d8db7882ac645 \ 20601a7f1d94447daa4dff438cb1c209
keyword arguments
name
type
description
example:
keystone service create \ --name=nova \ --type=compute \ --description="Nova Compute Service"
