I am configuring Glance to authenticate against Keystone. It works but I am unsure exactly how some of the authentication options interact.
I started with the configuring glance documentation, but this
doesn't actually document any of these options. I found the
authentication documentation, which discusses
some of them, but does not actually document
[filter:authtoken] paste.filter_factory = keystone.middleware.auth_token:filter_factory service_protocol = http service_host = 127.0.0.1 service_port = 5000 auth_host = 127.0.0.1 auth_port = 35357 auth_protocol = http auth_uri = http://127.0.0.1:5000/ admin_token = 012345SECRET99TOKEN012345
The authentication documentation says:
Those variables beginning with auth_ point to the Keystone Admin service. This information is used by the middleware to actually query Keystone about the validity of the authentication tokens.
Okay. So how does
auth_uri interact with
auth_protocol? Can one simply provide
auth_uri and discard
the other options? Is there a corresponding
configuration option? And why does the port in
auth_uri correspond to the
service_port in the above configuration instead of the
Keystone refers to port
35357 as the "admin" port, which to me
suggests that this would only be required for administration of
keystone (creating/deleting services, tenants, etc). Glance instead
refers to this as the "auth" port, which suggests a different use.
What exactly is provided by the service on port 35357 that is not
provided by the service on port 5000?