I am configuring Glance to authenticate against Keystone. It works but I am unsure exactly how some of the authentication options interact.
I started with the configuring glance documentation, but this
doesn't actually document any of these options. I found the
authentication documentation, which discusses
some of them, but does not actually document auth_uri.
The example glance configuration in the OpenStack Install and Deploy Manual looks like this:
[filter:authtoken]
paste.filter_factory = keystone.middleware.auth_token:filter_factory
service_protocol = http
service_host = 127.0.0.1
service_port = 5000
auth_host = 127.0.0.1
auth_port = 35357
auth_protocol = http
auth_uri = http://127.0.0.1:5000/
admin_token = 012345SECRET99TOKEN012345
The authentication documentation says:
Those variables beginning with auth_ point to the Keystone Admin service. This information is used by the middleware to actually query Keystone about the validity of the authentication tokens.
Okay. So how does auth_uri interact with auth_host, auth_port,
and auth_protocol? Can one simply provide auth_uri and discard
the other options? Is there a corresponding service_uri
configuration option? And why does the port in auth_uri correspond to the service_port in the above configuration instead of the auth_port?
Keystone refers to port 35357 as the "admin" port, which to me
suggests that this would only be required for administration of
keystone (creating/deleting services, tenants, etc). Glance instead
refers to this as the "auth" port, which suggests a different use.
What exactly is provided by the service on port 35357 that is not
provided by the service on port 5000?
