You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Application credentials allow you to interact with Pouta via the [OpenStack command-line tools](command-line-tools.md) or directly via the API, by allowing you to create a **role specific** and **time limited**_TOKEN_ that can be revoked at any time. The most immediate advantage is that you no longer need to use or write your CSC password while using Pouta's API.
3
+
Application credentials allow you to interact with Pouta via the [OpenStack command-line tools](command-line-tools.md) or directly via the API, by allowing you to create, for a given **project**, a **role specific** and **time limited**_TOKEN_ that can be revoked at any time. The most immediate advantage is that you no longer need to use or write your CSC password while using Pouta's API.
4
+
5
+
* It will allow you access only to a given **project**.
4
6
5
7
***Role specific** means that the credentials can be created with limited permissions. You can create credentials that are only allowed to get data of your project, but not modify it. You can also create credentials that can only modify a specific resource. It is also possible to create credentials that can do everything that you can.
6
8
7
9
***Time limited** means that the credentials can have a much shorter life than the password of the account that created it. This is useful to limit the repercussion of a credential leak.
8
10
9
-
* Other advantages are that credentials can be revoked at any time, and that you cannot change or obtain the password if you have only the application credential that created it.
11
+
* Other advantages are that credentials can be revoked at any time from Poutas's web interface, and that you cannot change or obtain the password if you have only the application credential that created it.
10
12
11
13
!!! info "Application credentials are linked to the personal account"
12
14
@@ -18,7 +20,7 @@ In general Application credentials give the power and flexibility to allow a saf
18
20
19
21
1. Go to [Pouta's web-interface](https://pouta.csc.fi/).
20
22
2. Choose which project you want to use. (You will only see the projects that have cPouta activated in [my.csc.fi](https://my.csc.fi).)
21
-
3. Go to `Identitiy` -> `Application Credentials`.
23
+
3. Go to `Identity` -> `Application Credentials`.
22
24
4. Press `Create Application Credential`. A dialog will open.
service will create a secret for you, this is probably the preferred method.
31
33
7. It is a good idea to put an `expiration date` especially if you are testing the credentials only
32
34
for today.
33
-
8. There are four roles in cPouta, `member`, `heat_stack_owner`, `object_store_user` and `creator`. Usually you want to use the `member` role. You can find
34
-
out more in the [Using roles sections](#using-roles).
35
-
9. The `Unrestricted (dangerous)` check-box will allow your application credentials to
36
-
create new application credentials. You should never give an application or automation any credentials that have this permission.
37
-
10. Once you have created the application credentials you can either download the credentials as a
38
-
file that you can source, a YAML file that can be used directly by the CLI, or alternatively add the secret to your secret manager. This is the **first and last time** that you will be able to get access to this secret. If you lose it, you will need to revoke it and create a new one.
39
35
40
-
If you downloaded the `openrc file` you will get a file that contains something like this:
36
+
!!! warning "Temporary Unavailability of Role Restrictions for Application Credentials"
37
+
The usage of role restrictions for Application Credentials is temporarily unavailable.
41
38
42
-
```bash
43
-
#!/usr/bin/env bash
39
+
8. <del>There are four roles in cPouta, `member`, `heat_stack_owner`, `object_store_user` and `creator`. Usually you want to use the `member` role:</del>
44
40
45
-
export OS_AUTH_TYPE=v3applicationcredential
46
-
export OS_AUTH_URL=https://pouta.csc.fi:5001/v3
47
-
export OS_IDENTITY_API_VERSION=3
48
-
export OS_REGION_NAME="regionOne" # Depends if you are using cPouta or ePouta
* <del> `member` role is the normal user role. It can make changes to the system. When you login into the web-interface you have the member role enabled.</del>
42
+
43
+
* <del> `heat_stack_owner` can operate over Heat stacks, that is create, modify and delete infrastructure. This is useful for using it in a IaC setup.</del>
44
+
45
+
* <del> `object_store_user` can operate over Allas and Objects Store.</del>
53
46
54
-
If you source that file, you can use it together with with [OpenStack command-line tools](command-line-tools.md).
47
+
* <del> `creator`can create secrets such as passwords, encryption keys.</del>
55
48
56
-
You can also download the `cloud.yaml` file that will look like this:
49
+
<del> If you are using Applications credentials in ePouta, it's slightly different. There are two roles available: `member` and `heat_stack_owner`.</del>
50
+
51
+
1.`Access Rules` allows you to fine tune permissions. You can add one or more rules in either _JSON_ or _YAML_ format. Each rule needs to specify the `service`, `method` and `path`. This example allows you to list servers:
52
+
53
+
```yaml
54
+
- service: compute
55
+
method: GET
56
+
path: /v2.1/servers/**
57
+
```
58
+
59
+
This one allows to list volumes:
57
60
58
61
```yaml
59
-
# This is a clouds.yaml file, which can be used by OpenStack tools as a source
60
-
# of configuration on how to connect to a cloud. If this is your only cloud,
61
-
# just put this file in ~/.config/openstack/clouds.yaml and tools like
62
-
# python-openstackclient will just work with no further config. (You will need
63
-
# to add your password to the auth section)
64
-
# If you have more than one cloud account, add the cloud entry to the clouds
65
-
# section of your existing file and you can refer to them by name with
66
-
# OS_CLOUD=openstack or --os-cloud=openstack
67
-
clouds:
68
-
openstack:
62
+
- method: GET
63
+
path: /v3/*/volumes/**
64
+
service: volumev3
65
+
```
66
+
67
+
See the [Access rules](https://docs.openstack.org/keystone/victoria/user/application_credentials.html#access-rules) upstream documentation for more examples and help. Access Rules have a lot of granularity and it can be complex to craft the exact rules you need.
68
+
69
+
9. The `Unrestricted (dangerous)` check-box will allow your application credentials to
70
+
create new application credentials. You should never give an application or automation any credentials that have this permission.
71
+
72
+
## Using Application Credentials
73
+
74
+
Once you have created the application credentials you can either download the credentials as a
75
+
file that you can source, a YAML file that can be used directly by the CLI, or alternatively add the secret to your secret manager. This is the **first and last time** that you will be able to get access to this secret. If you lose it, you will need to revoke it and create a new one.
76
+
77
+
If you downloaded the `openrc file` you will get a file that contains something like this:
78
+
79
+
```bash
80
+
#!/usr/bin/env bash
81
+
82
+
export OS_AUTH_TYPE=v3applicationcredential
83
+
export OS_AUTH_URL=https://pouta.csc.fi:5001/v3
84
+
export OS_IDENTITY_API_VERSION=3
85
+
export OS_REGION_NAME="regionOne" # Depends if you are using cPouta or ePouta
- regionOne # Depends if you are using cPouta or ePouta
76
118
77
-
78
-
regions:
79
-
80
-
- regionOne # Depends if you are using cPouta or ePouta
81
-
82
-
83
-
interface: "public"
84
-
identity_api_version: 3
85
-
auth_type: "v3applicationcredential"
86
-
```
119
+
120
+
interface: "public"
121
+
identity_api_version: 3
122
+
auth_type: "v3applicationcredential"
123
+
```
87
124
88
-
See the comment on the file itself on how to use it.
125
+
See the comment on the file itself on how to use it.
89
126
90
127
!!! info "Verify the credentials"
91
128
92
129
It is a good idea to test that the application credentials are allowed to do what you expect them to be able to do. It is also a good idea to verify that they are **NOT** allowed to do what you expect them not to be allowed to do.
93
130
94
-
##Using roles
131
+
### Troubleshooting tips
95
132
96
-
!!! warning "Temporary Unavailability of Role Restrictions for Application Credentials"
97
-
The usage of role restrictions for Application Credentials is temporarily unavailable.
133
+
* You can review the application credentials by running:
98
134
135
+
```sh
136
+
$ openstack application credential list
137
+
```
99
138
100
-
<del> In cPouta, there are four roles available: `member`, `heat_stack_owner`, `object_store_user` and `creator`.
139
+
and to see single application credential:
101
140
141
+
```sh
142
+
$ openstack application credential show <name>
143
+
```
102
144
103
-
* <del> `member` role is the normal user role. It can make changes to the system. When you login into the web-interface you have the `member` role enabled.
145
+
It is also possible to see the rules on the [Application Credentials](https://pouta.csc.fi/dashboard/identity/application_credentials/) page by clicking on the name of the credential.
104
146
105
-
* <del> `heat_stack_owner` can operate over Heat stacks, that is create, modify and delete infrastructure. This is useful for using it in a `IaC` setup.
147
+
If you add `--debug` to any command you run, you will see a much more detailed output including API calls.
106
148
107
-
* <del> `object_store_user` can operate over Allas and Objects Store.
149
+
* Before sourcing the application credentials file, make sure you do not have any other OpenStack variables (`env | grep OS`). Otherwise you will get this failure:
108
150
109
-
* <del> `creator` can create secrets such as passwords, encryption keys.
151
+
```sh
152
+
$ openstack server list
153
+
Error authenticating with application credential: Application credentials cannot request a scope. (HTTP 401) (Request-ID: req-23dac9b0-5fd5-4f67-a23f-129b4ca55444)
154
+
```
110
155
111
-
<del> If you are using Applications credentials in ePouta, it's slightly different. There are two roles available: `member` and `heat_stack_owner`.
156
+
Please try again (the sourcing and the command) in a _clean_ terminal.
112
157
113
-
* <del> `member` role is the normal user role. When you login into the web-interface you have the `member` role enabled.
158
+
* In order to fine tune the Access Rules, you can see all the API endpoints in the [API access](https://pouta.csc.fi/dashboard/project/api_access/) page in the webinterface. You can also see the same information by running the command `openstack catalog list`.
114
159
115
-
* <del> `heat_stack_owner` can operate over Heat stacks, that is create, modify and delete infrastructure. This is useful for using it in a `IaC` setup.
160
+
* The `Object Store` API is not within `Pouta`, but `Allas`. This means that they do not support `Access Rules`. If `Access Rules` are used no access to Allas will be possible using them, no matter the configuration used.
0 commit comments