{
"roles": [
{
"description": "Default role for project membership",
"enabled": "True",
"id": "9fe2ff9ee4384b1894a90878d3e92bab",
"name": "_member_"
},
{
"id": "c105e3dc4a484f5582563e28f7483edc",
"name": "sdn-admin"
}
]
}
API access requires authentication
To authenticate, one needs to present username , domain, and password to the
/auth
API as
below (using curl as an example):
curl -sk -H 'Content-Type:application/json' -d '{"login":{"user":"sdn","password":"skyline","domain":"sdn"}}'
https://<controller-ip>:8443/sdn/v2.0/auth
CAUTION:
Credential information (user name, password, domain, and authentication tokens)
used in curl commands might be saved in the command history. For security reasons, Hewlett
Packard Enterprise recommends that you disable command history prior to executing commands
containing credential information.
The above call returns this example JSON data structure that includes the authentication token,
which, by default, expires in one hour:
{
"record": {
"domainId": "62e312edff47413fad7e1d7fa6ac7bc7",
"domainName": "sdn",
"expiration": 1377917359000,
"expirationDate": "2013-08-30 19-49-19 -0700",
"token": "54a6f80a9ae243db89bfa05de4ced51d",
"userId": "bca3dea8a28b457e99e899ae16b79634",
"userName": "sdn"
"roles":["sdn-user","sdn-admin"],
}
}
CAUTION:
Please guard this token information, as it can be used as an API key to gain access
to your controller REST APIs.
To gain access to the REST API, include the token in the
X-Auth-Token
header as in the
following curl example:
curl -sk -H "X-Auth-Token:54a6f80a9ae243db89bfa05de4ced51d" https://<controller-ip>:8443/sdn/v2.0/systems
One can continue using the same token for different SDN Controller APIs within the default one
hour period since token creation. If desired, one can change this default one hour timeout in the
/etc/keystone/keystone.conf
file. (See the
OpenStack Keystone Administration Guide
for more information).
Service and admin tokens
The Service token is used for internal communication between controllers and is not exposed to
the user. The Admin token is used for communication between controller and the Keystone server
and is not exposed to the user.
The values for these tokens can be seen in the controller UI in the
Configurations
screen in the
System
tab under the
com.hp.sdn.adm.auth.impl.AuthenticationManager
component.
All controllers in a team must have the same Service token to communicate successfully. For
the Admin token, both the controller token value and the Openstack Keystone admin_token in
the directory
/etc/keystone/keystone.conf
must match for successful authentication.
120
Security