Openstack Keystone OTP - openstack

Question

I need to write a TOTP plugin for Keystone. And now I follow this guide http://docs.openstack.org/developer/keystone/auth-totp.html
But I can't pass the first step and create the TOTP credential.
I got the following error.
{"error": {"message": "The request you have made requires authentication.", "code": 401, "title": "Unauthorized"}}
Debug:
sudo tail -n 50 /var/log/httpd/keystone.log
2016-03-09 12:04:55.808 1181 DEBUG keystone.middleware.auth [req-c8f883dd-cdb1-46fc-bca3-70ea60285050 - - - - -] There is either no auth token in the request or the certificate issuer is not trusted. No auth context will be set. 2016-03-09 12:04:55.808 process_request /opt/stack/keystone/keystone/middleware/auth.py:171
2016-03-09 12:04:55.814 1181 INFO keystone.common.wsgi [req-c8f883dd-cdb1-46fc-bca3-70ea60285050 - - - - -] POST http://localhost:5000/v3/credentials
2016-03-09 12:04:55.815 1181 DEBUG keystone.common.controller [req-c8f883dd-cdb1-46fc-bca3-70ea60285050 - - - - -] RBAC: Authorizing identity:create_credential(credential={u'user_id': u'4725c2a6592c46b89bbd42da1731d5ed', u'type': u'totp', u'blob': u'OBQXG43XN5ZGI'}) 2016-03-09 12:04:55.815 _build_policy_check_credentials /opt/stack/keystone/keystone/common/controller.py:80
2016-03-09 12:04:55.816 1181 DEBUG keystone.common.controller [req-c8f883dd-cdb1-46fc-bca3-70ea60285050 - - - - -] RBAC: building auth context from the incoming auth token 2016-03-09 12:04:55.816 _build_policy_check_credentials /opt/stack/keystone/keystone/common/controller.py:92
2016-03-09 12:04:55.817 1181 DEBUG oslo.cache._memcache_pool [req-c8f883dd-cdb1-46fc-bca3-70ea60285050 - - - - -] Memcached pool 140351135589296, thread 140351402075904: Acquiring connection 2016-03-09 12:04:55.817 _debug_logger /usr/lib/python2.7/site-packages/oslo_cache/_memcache_pool.py:116
2016-03-09 12:04:55.817 1181 DEBUG oslo.cache._memcache_pool [req-c8f883dd-cdb1-46fc-bca3-70ea60285050 - - - - -] Memcached pool 140351135589296, thread 140351402075904: Acquired connection 140351418931208 2016-03-09 12:04:55.817 _debug_logger /usr/lib/python2.7/site-packages/oslo_cache/_memcache_pool.py:116
2016-03-09 12:04:55.818 1181 DEBUG oslo.cache._memcache_pool [req-c8f883dd-cdb1-46fc-bca3-70ea60285050 - - - - -] Memcached pool 1
40351135589296, thread 140351402075904: Releasing connection 140351418931208 2016-03-09 12:04:55.818 _debug_logger /usr/lib/python2.7/site-packages/oslo_cache/_memcache_pool.py:116
2016-03-09 12:04:55.819 1181 DEBUG oslo.cache._memcache_pool [req-c8f883dd-cdb1-46fc-bca3-70ea60285050 - - - - -] Memcached pool 140351135589296, thread 140351402075904: Acquiring connection 2016-03-09 12:04:55.819 _debug_logger /usr/lib/python2.7/site-packages/oslo_cache/_memcache_pool.py:116
2016-03-09 12:04:55.819 1181 DEBUG oslo.cache._memcache_pool [req-c8f883dd-cdb1-46fc-bca3-70ea60285050 - - - - -] Memcached pool 140351135589296, thread 140351402075904: Acquired connection 140351418931208 2016-03-09 12:04:55.819 _debug_logger /usr/lib/python2.7/site-packages/oslo_cache/_memcache_pool.py:116
2016-03-09 12:04:55.820 1181 DEBUG oslo.cache._memcache_pool [req-c8f883dd-cdb1-46fc-bca3-70ea60285050 - - - - -] Memcached pool 140351135589296, thread 140351402075904: Releasing connection 140351418931208 2016-03-09 12:04:55.820 _debug_logger /usr/lib/python2.7/site-packages/oslo_cache/_memcache_pool.py:116
2016-03-09 12:04:55.821 1181 WARNING keystone.common.controller [req-c8f883dd-cdb1-46fc-bca3-70ea60285050 - - - - -] RBAC: Invalid token
2016-03-09 12:04:55.823 1181 WARNING keystone.common.wsgi [req-c8f883dd-cdb1-46fc-bca3-70ea60285050 - - - - -] Authorization failed. The request you have made requires authentication. from ::1
My scripts.
Encoding the TOTP secret:
cat base32_str_encoding.py
#!/usr/bin/python
import base64
secret = 'password'
print base64.b32encode(secret).rstrip('=')
./base32_str_encoding.py
OBQXG43XN5ZGI
Creating the TOTP credential:
cat create_totp_credential.sh
#!/usr/bin/bash
USER_ID=4725c2a6592c46b89bbd42da1731d5ed
SECRET=OBQXG43XN5ZGI
curl -i \
-H "Content-Type: application/json" \
-d '
{
"credential": {
"blob": "'$SECRET'",
"type": "totp",
"user_id": "'$USER_ID'"
}
}' \
http://localhost:5000/v3/credentials ; echo
Keystone user database.
mysql -uuser -h localhost -ppassword -Bse 'use keystone; select * from user where name="trex";'
| id | name | extra | password | enabled | domain_id | default_project_id |
4725c2a6592c46b89bbd42da1731d5ed trex {"description": "Test user", "email": "trex#trex.com"} $6$rounds=10000$GfVY/Ws6cxS43fVC$p.44zK6gskY9Y3Aa8MwMCpeIfmKaZVlpB2niv2ewDeQbCyuqBhwOuMwfHLY5Kl67I/QsQUmG5BuK5BB6UtaKe/ 1 default d2c1b6084c5a41ceb5582c736e3f03f8

Answer 1

curl -i \
-H "X-Auth-Token: $OS_TOKEN" \ ###########INSERT YOUR TOKEN############
-H "Content-Type: application/json" \
-d '
{
"credential": {
"blob": "'$SECRET'",
"type": "totp",
"user_id": "'$USER_ID'"
}
}' \
http://localhost:5000/v3/credentials ; echo