openstack-manuals/doc/common/section_cli_keystone_commands.xml

<?xml version="1.0" encoding="UTF-8"?>
<section xmlns="http://docbook.org/ns/docbook"
    xmlns:xi="http://www.w3.org/2001/XInclude"
    xmlns:xlink="http://www.w3.org/1999/xlink" version="5.0"
    xml:id="keystoneclient_commands">

    <!-- This file is automatically generated, do not edit -->

    <?dbhtml stop-chunking?>

    <title>keystone commands</title>
    <para>The keystone client is the command-line interface (CLI) for the
         OpenStack Identity API and its extensions.</para>
    <para>For help on a specific <command>keystone</command>
       command, enter:
    </para>
    <screen><prompt>$</prompt> <userinput><command>keystone</command> <option>help</option> <replaceable>COMMAND</replaceable></userinput></screen>

    <section xml:id="keystoneclient_command_usage">
       <title>keystone usage</title>
        <screen><computeroutput>                [--os-username &lt;auth-user-name>]
                [--os-password &lt;auth-password>]
                [--os-tenant-name &lt;auth-tenant-name>]
                [--os-tenant-id &lt;tenant-id>] [--os-auth-url &lt;auth-url>]
                [--os-region-name &lt;region-name>]
                [--os-identity-api-version &lt;identity-api-version>]
                [--os-token &lt;service-token>]
                [--os-endpoint &lt;service-endpoint>]
                [--os-cacert &lt;ca-certificate>] [--insecure]
                [--os-cert &lt;certificate>] [--os-key &lt;key>] [--os-cache]
                [--force-new-token] [--stale-duration &lt;seconds>]
                &lt;subcommand> ...</computeroutput></screen>
    </section>
    <section xml:id="keystoneclient_command_pos">
        <title>keystone positional arguments</title>
        <screen><computeroutput>  &lt;subcommand>
    catalog             List service catalog, possibly filtered by service.
    ec2-credentials-create
                        Create EC2-compatible credentials for user per tenant.
    ec2-credentials-delete
                        Delete EC2-compatible credentials.
    ec2-credentials-get
                        Display EC2-compatible credentials.
    ec2-credentials-list
                        List EC2-compatible credentials for a user
    endpoint-create     Create a new endpoint associated with a service.
    endpoint-delete     Delete a service endpoint.
    endpoint-get        Find endpoint filtered by a specific attribute or
                        service type.
    endpoint-list       List configured service endpoints.
    password-update     Update own password.
    role-create         Create new role.
    role-delete         Delete role.
    role-get            Display role details.
    role-list           List all roles.
    service-create      Add service to Service Catalog.
    service-delete      Delete service from Service Catalog.
    service-get         Display service from Service Catalog.
    service-list        List all services in Service Catalog.
    tenant-create       Create new tenant.
    tenant-delete       Delete tenant.
    tenant-get          Display tenant details.
    tenant-list         List all tenants.
    tenant-update       Update tenant name, description, enabled status.
    token-get           Display the current user token.
    user-create         Create new user
    user-delete         Delete user
    user-get            Display user details.
    user-list           List users.
    user-password-update
                        Update user password.
    user-role-add       Add role to user
    user-role-list      List roles granted to a user
    user-role-remove    Remove role from user
    user-update         Update user's name, email, and enabled status.
    discover            Discover Keystone servers, supported API versions and
                        extensions.
    bootstrap           Grants a new role to a new user on a new tenant, after
                        creating each.
    bash-completion     Prints all of the commands and options to stdout.
    help                Display help about this program or one of its
                        subcommands.
</computeroutput></screen>
    </section>
    <section xml:id="keystoneclient_command_optional">
        <title>keystone optional arguments</title>
        <screen><computeroutput>  --version             Shows the client version and exits
  --timeout &lt;seconds>   Set request timeout (in seconds)
  --os-username &lt;auth-user-name>
                        Name used for authentication with the OpenStack
                        Identity service. Defaults to env[OS_USERNAME]
  --os-password &lt;auth-password>
                        Password used for authentication with the OpenStack
                        Identity service. Defaults to env[OS_PASSWORD]
  --os-tenant-name &lt;auth-tenant-name>
                        Tenant to request authorization on. Defaults to
                        env[OS_TENANT_NAME]
  --os-tenant-id &lt;tenant-id>
                        Tenant to request authorization on. Defaults to
                        env[OS_TENANT_ID]
  --os-auth-url &lt;auth-url>
                        Specify the Identity endpoint to use for
                        authentication. Defaults to env[OS_AUTH_URL]
  --os-region-name &lt;region-name>
                        Defaults to env[OS_REGION_NAME]
  --os-identity-api-version &lt;identity-api-version>
                        Defaults to env[OS_IDENTITY_API_VERSION] or 2.0
  --os-token &lt;service-token>
                        Specify an existing token to use instead of retrieving
                        one via authentication (e.g. with username &amp;
                        password). Defaults to env[OS_SERVICE_TOKEN]
  --os-endpoint &lt;service-endpoint>
                        Specify an endpoint to use instead of retrieving one
                        from the service catalog (via authentication).
                        Defaults to env[OS_SERVICE_ENDPOINT]
  --os-cacert &lt;ca-certificate>
                        Specify a CA bundle file to use in verifying a TLS
                        (https) server certificate. Defaults to env[OS_CACERT]
  --insecure            Explicitly allow keystoneclient to perform "insecure"
                        TLS (https) requests. The server's certificate will
                        not be verified against any certificate authorities.
                        This option should be used with caution.
  --os-cert &lt;certificate>
                        Defaults to env[OS_CERT]
  --os-key &lt;key>        Defaults to env[OS_KEY]
  --os-cache            Use the auth token cache. Defaults to env[OS_CACHE]
  --force-new-token     If the keyring is available and in use, token will
                        always be stored and fetched from the keyring until
                        the token has expired. Use this option to request a
                        new token and replace the existing one in the keyring.
  --stale-duration &lt;seconds>
                        Stale duration (in seconds) used to determine whether
                        a token has expired when retrieving it from keyring.
                        This is useful in mitigating process or network
                        delays. Default is 30 seconds.
</computeroutput></screen>
    </section>
    <section xml:id="keystoneclient_subcommand_bootstrap">
        <title>keystone bootstrap command</title>
        <screen><computeroutput>usage: keystone bootstrap [--user-name &lt;user-name>] --pass &lt;password>
                          [--role-name &lt;role-name>]
                          [--tenant-name &lt;tenant-name>]

Grants a new role to a new user on a new tenant, after creating each.

Arguments:
  --user-name &lt;user-name>
                        The name of the user to be created (default="admin").
  --pass &lt;password>     The password for the new user.
  --role-name &lt;role-name>
                        The name of the role to be created and granted to the
                        user (default="admin").
  --tenant-name &lt;tenant-name>
                        The name of the tenant to be created
                        (default="admin").

</computeroutput></screen>
    </section>
    <section xml:id="keystoneclient_subcommand_catalog">
        <title>keystone catalog command</title>
        <screen><computeroutput>usage: keystone catalog [--service &lt;service-type>]

List service catalog, possibly filtered by service.

Arguments:
  --service &lt;service-type>
                        Service type to return

</computeroutput></screen>
    </section>
    <section xml:id="keystoneclient_subcommand_discover">
        <title>keystone discover command</title>
        <screen><computeroutput>usage: keystone discover

Discover Keystone servers, supported API versions and extensions. Usage:: $
keystone discover Keystone found at http://localhost:35357 - supports version
v1.0 (DEPRECATED) here http://localhost:35357/v1.0 - supports version v1.1
(CURRENT) here http://localhost:35357/v1.1 - supports version v2.0 (CURRENT)
here http://localhost:35357/v2.0 - and RAX-KSKEY: Rackspace API Key
Authentication Admin Extension - and RAX-KSGRP: Rackspace Keystone Group
Extensions

</computeroutput></screen>
    </section>
    <section xml:id="keystoneclient_subcommand_ec2-credentials-create">
        <title>keystone ec2-credentials-create command</title>
        <screen><computeroutput>usage: keystone ec2-credentials-create [--user-id &lt;user-id>]
                                       [--tenant-id &lt;tenant-id>]

Create EC2-compatible credentials for user per tenant.

Arguments:
  --user-id &lt;user-id>   User ID
  --tenant-id &lt;tenant-id>
                        Tenant ID

</computeroutput></screen>
    </section>
    <section xml:id="keystoneclient_subcommand_ec2-credentials-delete">
        <title>keystone ec2-credentials-delete command</title>
        <screen><computeroutput>usage: keystone ec2-credentials-delete [--user-id &lt;user-id>] --access
                                       &lt;access-key>

Delete EC2-compatible credentials.

Arguments:
  --user-id &lt;user-id>   User ID
  --access &lt;access-key>
                        Access Key

</computeroutput></screen>
    </section>
    <section xml:id="keystoneclient_subcommand_ec2-credentials-get">
        <title>keystone ec2-credentials-get command</title>
        <screen><computeroutput>usage: keystone ec2-credentials-get [--user-id &lt;user-id>] --access
                                    &lt;access-key>

Display EC2-compatible credentials.

Arguments:
  --user-id &lt;user-id>   User ID
  --access &lt;access-key>
                        Access Key

</computeroutput></screen>
    </section>
    <section xml:id="keystoneclient_subcommand_ec2-credentials-list">
        <title>keystone ec2-credentials-list command</title>
        <screen><computeroutput>usage: keystone ec2-credentials-list [--user-id &lt;user-id>]

List EC2-compatible credentials for a user

Arguments:
  --user-id &lt;user-id>  User ID

</computeroutput></screen>
    </section>
    <section xml:id="keystoneclient_subcommand_endpoint-create">
        <title>keystone endpoint-create command</title>
        <screen><computeroutput>usage: keystone endpoint-create [--region &lt;endpoint-region>] --service
                                &lt;service> --publicurl &lt;public-url>
                                [--adminurl &lt;admin-url>]
                                [--internalurl &lt;internal-url>]

Create a new endpoint associated with a service.

Arguments:
  --region &lt;endpoint-region>
                        Endpoint region
  --service &lt;service>, --service-id &lt;service>, --service_id &lt;service>
                        Name or ID of service associated with Endpoint
  --publicurl &lt;public-url>
                        Public URL endpoint
  --adminurl &lt;admin-url>
                        Admin URL endpoint
  --internalurl &lt;internal-url>
                        Internal URL endpoint

</computeroutput></screen>
    </section>
    <section xml:id="keystoneclient_subcommand_endpoint-delete">
        <title>keystone endpoint-delete command</title>
        <screen><computeroutput>usage: keystone endpoint-delete &lt;endpoint-id>

Delete a service endpoint.

Arguments:
  &lt;endpoint-id>  ID of endpoint to delete

</computeroutput></screen>
    </section>
    <section xml:id="keystoneclient_subcommand_endpoint-get">
        <title>keystone endpoint-get command</title>
        <screen><computeroutput>usage: keystone endpoint-get --service &lt;service-type>
                             [--endpoint-type &lt;endpoint-type>]
                             [--attr &lt;service-attribute>] [--value &lt;value>]

Find endpoint filtered by a specific attribute or service type.

Arguments:
  --service &lt;service-type>
                        Service type to select
  --endpoint-type &lt;endpoint-type>
                        Endpoint type to select
  --attr &lt;service-attribute>
                        Service attribute to match for selection
  --value &lt;value>       Value of attribute to match

</computeroutput></screen>
    </section>
    <section xml:id="keystoneclient_subcommand_endpoint-list">
        <title>keystone endpoint-list command</title>
        <screen><computeroutput>usage: keystone endpoint-list

List configured service endpoints.

</computeroutput></screen>
    </section>
    <section xml:id="keystoneclient_subcommand_password-update">
        <title>keystone password-update command</title>
        <screen><computeroutput>usage: keystone password-update [--current-password &lt;current-password>]
                                [--new-password  &lt;new-password>]

Update own password.

Arguments:
  --current-password &lt;current-password>
                        Current password, Defaults to the password as set by
                        --os-password or OS_PASSWORD
  --new-password  &lt;new-password>
                        Desired new password

</computeroutput></screen>
    </section>
    <section xml:id="keystoneclient_subcommand_role-create">
        <title>keystone role-create command</title>
        <screen><computeroutput>usage: keystone role-create --name &lt;role-name>

Create new role.

Arguments:
  --name &lt;role-name>  Name of new role

</computeroutput></screen>
    </section>
    <section xml:id="keystoneclient_subcommand_role-delete">
        <title>keystone role-delete command</title>
        <screen><computeroutput>usage: keystone role-delete &lt;role>

Delete role.

Arguments:
  &lt;role>  Name or ID of role to delete

</computeroutput></screen>
    </section>
    <section xml:id="keystoneclient_subcommand_role-get">
        <title>keystone role-get command</title>
        <screen><computeroutput>usage: keystone role-get &lt;role>

Display role details.

Arguments:
  &lt;role>  Name or ID of role to display

</computeroutput></screen>
    </section>
    <section xml:id="keystoneclient_subcommand_role-list">
        <title>keystone role-list command</title>
        <screen><computeroutput>usage: keystone role-list

List all roles.

</computeroutput></screen>
    </section>
    <section xml:id="keystoneclient_subcommand_service-create">
        <title>keystone service-create command</title>
        <screen><computeroutput>usage: keystone service-create --name &lt;name> --type &lt;type>
                               [--description &lt;service-description>]

Add service to Service Catalog.

Arguments:
  --name &lt;name>         Name of new service (must be unique)
  --type &lt;type>         Service type (one of: identity, compute, network,
                        image, object-store, or other service identifier
                        string)
  --description &lt;service-description>
                        Description of service

</computeroutput></screen>
    </section>
    <section xml:id="keystoneclient_subcommand_service-delete">
        <title>keystone service-delete command</title>
        <screen><computeroutput>usage: keystone service-delete &lt;service>

Delete service from Service Catalog.

Arguments:
  &lt;service>  Name or ID of service to delete

</computeroutput></screen>
    </section>
    <section xml:id="keystoneclient_subcommand_service-get">
        <title>keystone service-get command</title>
        <screen><computeroutput>usage: keystone service-get &lt;service>

Display service from Service Catalog.

Arguments:
  &lt;service>  Name or ID of service to display

</computeroutput></screen>
    </section>
    <section xml:id="keystoneclient_subcommand_service-list">
        <title>keystone service-list command</title>
        <screen><computeroutput>usage: keystone service-list

List all services in Service Catalog.

</computeroutput></screen>
    </section>
    <section xml:id="keystoneclient_subcommand_tenant-create">
        <title>keystone tenant-create command</title>
        <screen><computeroutput>usage: keystone tenant-create --name &lt;tenant-name>
                              [--description &lt;tenant-description>]
                              [--enabled &lt;true|false>]

Create new tenant.

Arguments:
  --name &lt;tenant-name>  New tenant name (must be unique)
  --description &lt;tenant-description>
                        Description of new tenant (default is none)
  --enabled &lt;true|false>
                        Initial tenant enabled status (default true)

</computeroutput></screen>
    </section>
    <section xml:id="keystoneclient_subcommand_tenant-delete">
        <title>keystone tenant-delete command</title>
        <screen><computeroutput>usage: keystone tenant-delete &lt;tenant>

Delete tenant.

Arguments:
  &lt;tenant>  Name or ID of tenant to delete

</computeroutput></screen>
    </section>
    <section xml:id="keystoneclient_subcommand_tenant-get">
        <title>keystone tenant-get command</title>
        <screen><computeroutput>usage: keystone tenant-get &lt;tenant>

Display tenant details.

Arguments:
  &lt;tenant>  Name or ID of tenant to display

</computeroutput></screen>
    </section>
    <section xml:id="keystoneclient_subcommand_tenant-list">
        <title>keystone tenant-list command</title>
        <screen><computeroutput>usage: keystone tenant-list

List all tenants.

</computeroutput></screen>
    </section>
    <section xml:id="keystoneclient_subcommand_tenant-update">
        <title>keystone tenant-update command</title>
        <screen><computeroutput>usage: keystone tenant-update [--name &lt;tenant_name>]
                              [--description &lt;tenant-description>]
                              [--enabled &lt;true|false>]
                              &lt;tenant>

Update tenant name, description, enabled status.

Arguments:
  --name &lt;tenant_name>  Desired new name of tenant
  --description &lt;tenant-description>
                        Desired new description of tenant
  --enabled &lt;true|false>
                        Enable or disable tenant
  &lt;tenant>              Name or ID of tenant to update

</computeroutput></screen>
    </section>
    <section xml:id="keystoneclient_subcommand_token-get">
        <title>keystone token-get command</title>
        <screen><computeroutput>usage: keystone token-get [--wrap &lt;integer>]

Display the current user token.

Arguments:
  --wrap &lt;integer>  wrap PKI tokens to a specified length, or 0 to disable

</computeroutput></screen>
    </section>
    <section xml:id="keystoneclient_subcommand_user-create">
        <title>keystone user-create command</title>
        <screen><computeroutput>usage: keystone user-create --name &lt;user-name> [--tenant &lt;tenant>]
                            [--pass &lt;pass>] [--email &lt;email>]
                            [--enabled &lt;true|false>]

Create new user

Arguments:
  --name &lt;user-name>    New user name (must be unique)
  --tenant &lt;tenant>, --tenant-id &lt;tenant>
                        New user default tenant
  --pass &lt;pass>         New user password
  --email &lt;email>       New user email address
  --enabled &lt;true|false>
                        Initial user enabled status (default true)

</computeroutput></screen>
    </section>
    <section xml:id="keystoneclient_subcommand_user-delete">
        <title>keystone user-delete command</title>
        <screen><computeroutput>usage: keystone user-delete &lt;user>

Delete user

Arguments:
  &lt;user>  Name or ID of user to delete

</computeroutput></screen>
    </section>
    <section xml:id="keystoneclient_subcommand_user-get">
        <title>keystone user-get command</title>
        <screen><computeroutput>usage: keystone user-get &lt;user>

Display user details.

Arguments:
  &lt;user>  Name or ID of user to display

</computeroutput></screen>
    </section>
    <section xml:id="keystoneclient_subcommand_user-list">
        <title>keystone user-list command</title>
        <screen><computeroutput>usage: keystone user-list [--tenant &lt;tenant>]

List users.

Arguments:
  --tenant &lt;tenant>, --tenant-id &lt;tenant>
                        Tenant; lists all users if not specified

</computeroutput></screen>
    </section>
    <section xml:id="keystoneclient_subcommand_user-password-update">
        <title>keystone user-password-update command</title>
        <screen><computeroutput>usage: keystone user-password-update [--pass &lt;password>] &lt;user>

Update user password.

Arguments:
  --pass &lt;password>  Desired new password
  &lt;user>             Name or ID of user to update password

</computeroutput></screen>
    </section>
    <section xml:id="keystoneclient_subcommand_user-role-add">
        <title>keystone user-role-add command</title>
        <screen><computeroutput>usage: keystone user-role-add --user &lt;user> --role &lt;role> [--tenant &lt;tenant>]

Add role to user

Arguments:
  --user &lt;user>, --user-id &lt;user>, --user_id &lt;user>
                        Name or ID of user
  --role &lt;role>, --role-id &lt;role>, --role_id &lt;role>
                        Name or ID of role
  --tenant &lt;tenant>, --tenant-id &lt;tenant>
                        Name or ID of tenant

</computeroutput></screen>
    </section>
    <section xml:id="keystoneclient_subcommand_user-role-list">
        <title>keystone user-role-list command</title>
        <screen><computeroutput>usage: keystone user-role-list [--user &lt;user>] [--tenant &lt;tenant>]

List roles granted to a user

Arguments:
  --user &lt;user>, --user-id &lt;user>
                        List roles granted to a user
  --tenant &lt;tenant>, --tenant-id &lt;tenant>
                        List roles granted on a tenant

</computeroutput></screen>
    </section>
    <section xml:id="keystoneclient_subcommand_user-role-remove">
        <title>keystone user-role-remove command</title>
        <screen><computeroutput>usage: keystone user-role-remove --user &lt;user> --role &lt;role>
                                 [--tenant &lt;tenant>]

Remove role from user

Arguments:
  --user &lt;user>, --user-id &lt;user>, --user_id &lt;user>
                        Name or ID of user
  --role &lt;role>, --role-id &lt;role>, --role_id &lt;role>
                        Name or ID of role
  --tenant &lt;tenant>, --tenant-id &lt;tenant>
                        Name or ID of tenant

</computeroutput></screen>
    </section>
    <section xml:id="keystoneclient_subcommand_user-update">
        <title>keystone user-update command</title>
        <screen><computeroutput>usage: keystone user-update [--name &lt;user-name>] [--email &lt;email>]
                            [--enabled &lt;true|false>]
                            &lt;user>

Update user's name, email, and enabled status.

Arguments:
  --name &lt;user-name>    Desired new user name
  --email &lt;email>       Desired new email address
  --enabled &lt;true|false>
                        Enable or disable user
  &lt;user>                Name or ID of user to update

</computeroutput></screen>
    </section>
</section>