From f83cf93618ffc6e8c90c50fe567ba9329946718d Mon Sep 17 00:00:00 2001 From: Steven Hardy Date: Wed, 12 Mar 2014 16:54:01 +0000 Subject: [PATCH] heat add HEAT_DEFERRED_AUTH option Adds a HEAT_DEFERRED_AUTH, defaulted to trusts, so users can by default take advantage of the heat trusts functionality which provides the following benefits: - Deferred operations (e.g autoscaling) work with token-only auth - The password field in the heat page of horizon can be made optional (horizon patch pending) - It's more secure because heat no longers stores username/password credentials in the DB, only a trust ID. The previous behavior can be obtained by setting HEAT_DEFERRED_AUTH to something other than "trusts" - the value will only be set in the heat.conf if the value of "trusts" is found, otherwise the heat.conf default will be used (currently "password" which doesn't use trusts) Change-Id: I549f1e0071a082ac5d07d0f99db633f8337f3d87 Related-Bug: #1286157 --- lib/heat | 28 +++++++++++++++++----------- 1 file changed, 17 insertions(+), 11 deletions(-) diff --git a/lib/heat b/lib/heat index 902333e29a..7a2d764923 100644 --- a/lib/heat +++ b/lib/heat @@ -38,6 +38,9 @@ HEAT_CONF=$HEAT_CONF_DIR/heat.conf HEAT_ENV_DIR=$HEAT_CONF_DIR/environment.d HEAT_TEMPLATES_DIR=$HEAT_CONF_DIR/templates +# other default options +HEAT_DEFERRED_AUTH=${HEAT_DEFERRED_AUTH:-trusts} + # Tell Tempest this project is present TEMPEST_SERVICES+=,heat @@ -247,18 +250,21 @@ function create_heat_accounts { # heat_stack_user role is for users created by Heat openstack role create heat_stack_user - # heat_stack_owner role is given to users who create Heat stacks, - # it's the default role used by heat to delegate to the heat service - # user (for performing deferred operations via trusts), see heat.conf - HEAT_OWNER_ROLE=$(openstack role create \ - heat_stack_owner \ - | grep " id " | get_field 2) + if [[ $HEAT_DEFERRED_AUTH == trusts ]]; then + # heat_stack_owner role is given to users who create Heat stacks, + # it's the default role used by heat to delegate to the heat service + # user (for performing deferred operations via trusts), see heat.conf + HEAT_OWNER_ROLE=$(openstack role create \ + heat_stack_owner \ + | grep " id " | get_field 2) - # Give the role to the demo and admin users so they can create stacks - # in either of the projects created by devstack - openstack role add $HEAT_OWNER_ROLE --project demo --user demo - openstack role add $HEAT_OWNER_ROLE --project demo --user admin - openstack role add $HEAT_OWNER_ROLE --project admin --user admin + # Give the role to the demo and admin users so they can create stacks + # in either of the projects created by devstack + openstack role add $HEAT_OWNER_ROLE --project demo --user demo + openstack role add $HEAT_OWNER_ROLE --project demo --user admin + openstack role add $HEAT_OWNER_ROLE --project admin --user admin + iniset $HEAT_CONF DEFAULT deferred_auth_method trusts + fi # Note we have to pass token/endpoint here because the current endpoint and # version negotiation in OSC means just --os-identity-api-version=3 won't work