Using Keystone Middleware with Barbican¶
Prerequisites¶
To enable Keystone integration with Barbican you’ll need a relatively current version of Keystone. If you don’t have an instance of Keystone available, you can use one of the following ways to setup your own.
Hooking up Barbican to Keystone¶
Assuming that you’ve already setup your Keystone instance, connecting Barbican to Keystone is quite simple. When completed, Barbican should require a valid X-Auth-Token to be provided with all API calls except the get version call.
Turn off any active instances of Barbican
Edit
/etc/barbican/barbican-api-paste.ini
- Replace the
barbican_api
pipeline with an authenticated pipeline
[pipeline:barbican_api] pipeline = keystone_authtoken context apiapp
- Replace
keystone_authtoken
filter values to match your Keystone setup
[filter:keystone_authtoken] paste.filter_factory = keystonemiddleware.auth_token:filter_factory signing_dir = /tmp/barbican/cache identity_uri = http://{YOUR_KEYSTONE_ENDPOINT}:35357 admin_tenant_name = service admin_user = {YOUR_KEYSTONE_USERNAME} admin_password = {YOUR_KEYSTONE_PASSWORD} auth_version = v2.0
- Replace the
Start Barbican
{barbican_home}/bin/barbican.sh start