Using OAuth 2.0 for Tacker¶
Note
The content of this document has been confirmed to work using Tacker and Keystone 2024.1 Caracal.
Overview¶
The third-party clients can access the NFV orchestration APIs that is provided by Tacker via the Client Credentials Grant flow in RFC6749 OAuth 2.0 Authorization Framework. OAuth 2.0 Client Credentials Grant flow is prescribed in the API specification of ETSI NFV-SOL013 v3.4.1. Tacker uses the Keystone middleware to support OAuth 2.0 Client Credentials Grant through the Keystone identity server.
Preparations¶
To use OAuth 2.0 for Tacker, it is necessary to confirm that OAuth 2.0 client credentials is enabled in the Keystone identity server. In this example, $keystone_host_name is the domain name used by the Keystone identity server, and the domain name used by the tacker server is $tacker_host_name.
Guide¶
To use OAuth 2.0 Client Credentials Grant in Tacker, you should configure the tacker-server and the Keystone middleware in the following steps.
Enable Tacker HTTPS Service¶
According to RFC6749, HTTPS must be enabled in the authorization server since requests include sensitive information in plain text, so it should enable Tacker to support HTTPS protocols.
Generate an RSA private key.
$ cd /etc/tacker $ openssl genrsa -out tacker.key 2048
Create a certificate signing request.
$ openssl req -new -key tacker.key -out tacker.csr You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [AU]:. State or Province Name (full name) [Some-State]:. Locality Name (eg, city) []:. Organization Name (eg, company) [Internet Widgits Pty Ltd]:. Organizational Unit Name (eg, section) []:. Common Name (e.g. server FQDN or YOUR name) []:$tacker_host_name Email Address []:. Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []:. An optional company name []:.
Generate a self signed certificate.
$ openssl x509 -req -days 365 -in tacker.csr \ -signkey tacker.key -out tacker.host.crt Certificate request self-signature ok subject=CN = $tacker_host_name
Modify the Configuration Options to enable SSL to implement HTTP support for the Tacker APIs.
$ vi /etc/tacker/tacker.conf [DEFAULT] # Enable SSL on the API server (boolean value) use_ssl = true # Certificate file to use when starting the server securely (string value) ssl_cert_file = /etc/tacker/tacker.host.crt # Private key file to use when starting the server securely (string value) ssl_key_file = /etc/tacker/tacker.key [v2_vnfm] # # From tacker.sol_refactored.common.config # # Endpoint of VNFM (self). (string value) endpoint = https://$tacker_host_name:9890 [vnf_lcm] # Vnflcm options group # # From tacker.conf # # endpoint_url (string value) endpoint_url = https://$tacker_host_name:9890/
Note
If the Keystone identity server supports the HTTPS protocol, set the following in tacker.conf:
[keystone_authtoken] #cafile = /opt/stack/data/ca-bundle.pem cafile = /etc/keystone/keystone.host.crt #auth_url = http://$keystone_host_name/identity auth_url = https://$keystone_host_name/identity
Restart tacker service so that the modified configuration information takes effect.
$ sudo systemctl restart devstack@tacker
Try access the Tacker APIs via HTTPS protocol to confirm that the service has been successfully configured.
$ curl -i --cacert tacker.host.crt -X GET https://$tacker_host_name:9890/ HTTP/1.1 200 OK Content-Type: application/json Content-Length: 122 Date: Wed, 22 May 2024 04:57:57 GMT {"versions": [{"id": "v1.0", "status": "CURRENT", "links": [{"rel": "self", "href": "https://$tacker_host_name/v1.0"}]}]}
When Tacker is switched to HTTPS, user can not access the Tacker APIs via HTTP protocol.
$ curl -i -X GET http://$tacker_host_name:9890/ curl: (52) Empty reply from server
Subscribe to Notifications that need OAuth 2.0 Client Credentials Grant¶
If the certification of the notification authorization server is not trusted,
the configuration file Configuration Options can be modified to set the
verify_oauth2_ssl to false, then the backend no longer verify the
certification when it obtains the OAuth 2.0 access token.
If the certification of the notification callback API is not trusted, the
configuration file Configuration Options can be modified to set the
verify_notification_ssl to false, then the backend no longer verify the
certification when it sends a notification.
Modify the configuration file as needed.
$ vi /etc/tacker/tacker.conf [vnf_lcm] verify_notification_ssl = false [authentication] verify_oauth2_ssl = false
Subscribe to a notification that requires OAuth 2.0 client authorization to confirm that the backend can send a notification successfully.
$ cat subsc_create_req.json { "filter": { "vnfInstanceSubscriptionFilter":{ "vnfdIds": [ "108135bb-8f21-4b91-a548-4aad3cf72a87" ] } }, "callbackUri" : "$callback_uri", "authentication": { "authType":["OAUTH2_CLIENT_CREDENTIALS"], "paramsOauth2ClientCredentials": { "clientId": "$notification_oauth2_client_id", "clientPassword": "$notification_oauth2_client_secret", "tokenEndpoint": "$notification_oauth2_token_endpoint" } } } $ openstack vnflcm subsc create subsc_create_req.json --os-tacker-api-version 2 +--------------+----------------------------------------------------------------------------------------------------------+ | Field | Value | +--------------+----------------------------------------------------------------------------------------------------------+ | Callback URI | $callback_uri | | Filter | { | | | "vnfInstanceSubscriptionFilter": { | | | "vnfdIds": [ | | | "108135bb-8f21-4b91-a548-4aad3cf72a87" | | | ] | | | } | | | } | | ID | b25c2d6f-6de4-450a-a25d-321868d3ed83 | | Links | { | | | "self": { | | | "href": "https://$tacker_host_name/vnflcm/v2/subscriptions/b25c2d6f-6de4-450a-a25d-321868d3ed83" | | | } | | | } | | verbosity | FULL | +--------------+----------------------------------------------------------------------------------------------------------+
