zoukankan      html  css  js  c++  java

  • 在Keystone V3基础上改进的分布式认证体系

    目标

    使用java实现keystone v3相关功能与概念:

    1. api client authentication
    2. service discovery
    3. distributed multi-tenant authorization

    架构

    服务注册发现

    (图1)
    image

    • Register

      服务中介与权限管理.

    • Provider

      服务提供者.

    • Consumer

      服务消费者.

    分布式校验

    (图2)
    image

    • Domain: 全局独立的服务提供者或消费者.
      • API: 服务API(如果Domain对外提供服务,例如CDN服务), Domain的endpoint属性与API的method/path属性组成完成的服务URL.
      • Policy: API策略. 即API与Role的关联表, 规定不同的Role(管理员/普通用户)能否访问的API集合.
      • User: 子用户概念. 例如升龙5.0与云2.0作为CDN的消费者, 拥有自己独立的用户系统. 同时CDN又作为自己服务的消费者,也会有一套独立的用户系统.
      • Project: 业务数据的逻辑集合. 例如升龙5.0, 云2.0以及CDN里面为不同业务方创建不同的项目划分数据归属.
      • Principal: 用户策略. 即User, Project, 和Role的关联表, 规定User在不同Project中的角色, 与Policy配合实现细粒度控制用户对项目数据的操作.
    • Role: 全局惟一的角色. 角色只是一抽象集合, 各个Domain的Policy会关联具体的API.

    关键

    • 域名与角色是全局惟一的. The domain name, role name and service name is globally unique across all domains.
    • 用户名,项目名是域惟一的. The user name and project name are only unique to the owning domain.

    用户类别:

    1. 系统管理用户: ADMIN域ADMIN项目ADMIN角色的用户. 允许:

      • 创建新域.
      • 销毁无用域, 无用域指至多只包含ADMIN项目的域.
      • 创建新角色.
      • 销毁无用角色, 无用角色指不在policy表或principal表出现的角色.
      • 更新IP白名单.
      • 更新全局域缓存.

      系统管理用户不是超级管理用户. 系统用户不能干扰域的日常管理, 例如创建用户, 创建项目, 加减用户角色等.

    2. 域管理用户: 特定域ADMIN项目ADMIN角色的用户. 允许:

      • 创建/销毁用户
      • 创建/销毁项目
      • 发布/更新服务与策略
      • 验证TOKEN并返回Session信息(发起者domain,user,project,roles,effectMillis等)

    3. 项目管理用户: 特定域特定项目ADMIN角色的用户. 允许操作由各个域发布的策略(policy)决定.

    4. 项目普通用户: 除系统管理用户, 域管理用户, 项目管理用户外的其他用户.

      项目管理用户与项目普通用户的允许行为 由域本身定义.

    API类目

    系统管理用户

    • 创建新域:
    curl -XPOST 'https://oauth.huya.com/v1/domain/createDomain' 
-H "X-AUTH-DOMAIN:${domain}" #required 
-H "X-AUTH-USER:${user}" #required 
-H "X-AUTH-PROJECT:${project}" #optional, maybe null 
-H "X-AUTH-EXPIRES:${HEX(expires_millis)}" #required, hex format of expires millliseonds 
-H "X-AUTH-NONCE:${HEX(nonce_nanos)}" #required, hex format of nonce nanoseonds 
-H "X-AUTH-SIGNATURE:${HEX(signature)} #required, hex format of signatue=MD5(domain,user,project(maybe null),SHA1(pass),HEX(expires_millis),HEX(nonce_nanos))"' 
-d '{"domain":"my_domain","user":"my_admin","pass":"123","enabled":true}'

response: 200 OK
{"errno":0,"data":{"domain":"my_domain"}}

结果:
- 创建my_domain域
- 在my_domain域创建ADMIN项目
- 在my_domain域创建my_admin管理用户,其密码为123.
    • 销毁无用域:
    curl -XDELETE 'https://oauth.huya.com/v1/domain/destroyDomain?domain=my_domain2' 
-H "X-AUTH-DOMAIN:${domain}" #required 
-H "X-AUTH-USER:${user}" #required 
-H "X-AUTH-PROJECT:${project}" #optional, maybe null 
-H "X-AUTH-EXPIRES:${HEX(expires_millis)}" #required, hex format of expires millliseonds 
-H "X-AUTH-NONCE:${HEX(nonce_nanos)}" #required, hex format of nonce nanoseonds 
-H "X-AUTH-SIGNATURE:${HEX(signature)} #required, hex format of signatue=MD5(domain,user,project(maybe null),SHA1(pass),HEX(expires_millis),HEX(nonce_nanos))"

response: 200 OK
{"errno":0}

注意:
- 无用域必须没有项目或仅仅含有ADMIN项目. 删除域会清除该域下所有用户,项目,服务,策略等数据.
    • 创建新角色:
    curl -XPOST 'https://oauth.huya.com/v1/domain/createRole' 
-H "X-AUTH-DOMAIN:${domain}" #required 
-H "X-AUTH-USER:${user}" #required 
-H "X-AUTH-PROJECT:${project}" #optional, maybe null 
-H "X-AUTH-EXPIRES:${HEX(expires_millis)}" #required, hex format of expires millliseonds 
-H "X-AUTH-NONCE:${HEX(nonce_nanos)}" #required, hex format of nonce nanoseonds 
-H "X-AUTH-SIGNATURE:${HEX(signature)} #required, hex format of signatue=MD5(domain,user,project(maybe null),SHA1(pass),HEX(expires_millis),HEX(nonce_nanos))"' 
-d '{"role":"SERVICE","remark":"服务角色"}'

response: 200 OK
{"errno":0,"data":{"role":"SERVICE","remark":"服务角色"}}
    • 销毁无用角色:
    curl -XDELETE 'https://oauth.huya.com/v1/domain/destroyRole?role=SERVICE2' 
-H "X-AUTH-DOMAIN:${domain}" #required 
-H "X-AUTH-USER:${user}" #required 
-H "X-AUTH-PROJECT:${project}" #optional, maybe null 
-H "X-AUTH-EXPIRES:${HEX(expires_millis)}" #required, hex format of expires millliseonds 
-H "X-AUTH-NONCE:${HEX(nonce_nanos)}" #required, hex format of nonce nanoseonds 
-H "X-AUTH-SIGNATURE:${HEX(signature)} #required, hex format of signatue=MD5(domain,user,project(maybe null),SHA1(pass),HEX(expires_millis),HEX(nonce_nanos))"

response: 200 OK
{"errno":0}

注意:
- 无用角色必须没有policy或principal引用.
    • 刷新IP白名单:
    curl -XPUT 'https://oauth.huya.com/v1/system/updateAllowHosts' 
-H "X-AUTH-DOMAIN:${domain}" #required 
-H "X-AUTH-USER:${user}" #required 
-H "X-AUTH-PROJECT:${project}" #optional, maybe null 
-H "X-AUTH-EXPIRES:${HEX(expires_millis)}" #required, hex format of expires millliseonds 
-H "X-AUTH-NONCE:${HEX(nonce_nanos)}" #required, hex format of nonce nanoseonds 
-H "X-AUTH-SIGNATURE:${HEX(signature)} #required, hex format of signatue=MD5(domain,user,project(maybe null),SHA1(pass),HEX(expires_millis),HEX(nonce_nanos))"

response: 200 OK
{"errno":0}
    • 刷新全部域缓存:
    curl -XPUT 'https://oauth.huya.com/v1/system/updateDomainCache' 
-H "X-AUTH-DOMAIN:${domain}" #required 
-H "X-AUTH-USER:${user}" #required 
-H "X-AUTH-PROJECT:${project}" #optional, maybe null 
-H "X-AUTH-EXPIRES:${HEX(expires_millis)}" #required, hex format of expires millliseonds 
-H "X-AUTH-NONCE:${HEX(nonce_nanos)}" #required, hex format of nonce nanoseonds 
-H "X-AUTH-SIGNATURE:${HEX(signature)} #required, hex format of signatue=MD5(domain,user,project(maybe null),SHA1(pass),HEX(expires_millis),HEX(nonce_nanos))"

response: 200 OK
{"errno":0}

    域管理用户

    • 创建用户
    curl -XPOST 'https://oauth.huya.com/v1/domain/createUser' 
-H "X-AUTH-DOMAIN:${domain}" #required 
-H "X-AUTH-USER:${user}" #required 
-H "X-AUTH-PROJECT:${project}" #optional, maybe null 
-H "X-AUTH-EXPIRES:${HEX(expires_millis)}" #required, hex format of expires millliseonds 
-H "X-AUTH-NONCE:${HEX(nonce_nanos)}" #required, hex format of nonce nanoseonds 
-H "X-AUTH-SIGNATURE:${HEX(signature)} #required, hex format of signatue=MD5(domain,user,project(maybe null),SHA1(pass),HEX(expires_millis),HEX(nonce_nanos))"' 
-d '{"user":"my_user","pass":"456","remark":"this is a test user","enabled":true}'

response: 200 OK
{"errno":0,"data":{"domain":"my_domain","user":"my_user","remark":"this is a test user","enabled":true}}
    • 禁启用户
    curl -XPUT 'https://oauth.huya.com/v1/domain/enableUser' 
-H "X-AUTH-DOMAIN:${domain}" #required 
-H "X-AUTH-USER:${user}" #required 
-H "X-AUTH-PROJECT:${project}" #optional, maybe null 
-H "X-AUTH-EXPIRES:${HEX(expires_millis)}" #required, hex format of expires millliseonds 
-H "X-AUTH-NONCE:${HEX(nonce_nanos)}" #required, hex format of nonce nanoseonds 
-H "X-AUTH-SIGNATURE:${HEX(signature)} #required, hex format of signatue=MD5(domain,user,project(maybe null),SHA1(pass),HEX(expires_millis),HEX(nonce_nanos))"' 
-d '{"user":"my_user","enabled":true}'

response: 200 OK
{"errno":0}
    • 销毁用户
    curl -XDELETE 'https://oauth.huya.com/v1/domain/destroyUser?user=my_user2' 
-H "X-AUTH-DOMAIN:${domain}" #required 
-H "X-AUTH-USER:${user}" #required 
-H "X-AUTH-PROJECT:${project}" #optional, maybe null 
-H "X-AUTH-EXPIRES:${HEX(expires_millis)}" #required, hex format of expires millliseonds 
-H "X-AUTH-NONCE:${HEX(nonce_nanos)}" #required, hex format of nonce nanoseonds 
-H "X-AUTH-SIGNATURE:${HEX(signature)} #required, hex format of signatue=MD5(domain,user,project(maybe null),SHA1(pass),HEX(expires_millis),HEX(nonce_nanos))"

response: 200 OK
{"errno":0}
    • 创建项目
    curl -XPOST 'https://oauth.huya.com/v1/domain/createProject' 
-H "X-AUTH-DOMAIN:${domain}" #required 
-H "X-AUTH-USER:${user}" #required 
-H "X-AUTH-PROJECT:${project}" #optional, maybe null 
-H "X-AUTH-EXPIRES:${HEX(expires_millis)}" #required, hex format of expires millliseonds 
-H "X-AUTH-NONCE:${HEX(nonce_nanos)}" #required, hex format of nonce nanoseonds 
-H "X-AUTH-SIGNATURE:${HEX(signature)} #required, hex format of signatue=MD5(domain,user,project(maybe null),SHA1(pass),HEX(expires_millis),HEX(nonce_nanos))"' 
-d '{"project":"my_project","remark":"这是我的测试项目!","enabled":true}'

response: 200 OK
{"errno":0,"data":{"domain":"my_domain","project":"my_project","remark":"这是我的测试项目!","enabled":true}}
    • 禁启项目
    curl -XPUT 'https://oauth.huya.com/v1/domain/enableProject' 
-H "X-AUTH-DOMAIN:${domain}" #required 
-H "X-AUTH-USER:${user}" #required 
-H "X-AUTH-PROJECT:${project}" #optional, maybe null 
-H "X-AUTH-EXPIRES:${HEX(expires_millis)}" #required, hex format of expires millliseonds 
-H "X-AUTH-NONCE:${HEX(nonce_nanos)}" #required, hex format of nonce nanoseonds 
-H "X-AUTH-SIGNATURE:${HEX(signature)} #required, hex format of signatue=MD5(domain,user,project(maybe null),SHA1(pass),HEX(expires_millis),HEX(nonce_nanos))"' 
-d '{"project":"my_project2","enabled":true}'

response: 200 OK
{"errno":0}
    • 销毁项目
    curl -XDELETE 'https://oauth.huya.com/v1/domain/destroyProject?project=my_project2' 
-H "X-AUTH-DOMAIN:${domain}" #required 
-H "X-AUTH-USER:${user}" #required 
-H "X-AUTH-PROJECT:${project}" #optional, maybe null 
-H "X-AUTH-EXPIRES:${HEX(expires_millis)}" #required, hex format of expires millliseonds 
-H "X-AUTH-NONCE:${HEX(nonce_nanos)}" #required, hex format of nonce nanoseonds 
-H "X-AUTH-SIGNATURE:${HEX(signature)} #required, hex format of signatue=MD5(domain,user,project(maybe null),SHA1(pass),HEX(expires_millis),HEX(nonce_nanos))"

response: 200 OK
{"errno":0}
    • 添加用户角色
    curl -XPOST 'https://oauth.huya.com/v1/domain/addUserRole' 
-H "X-AUTH-DOMAIN:${domain}" #required 
-H "X-AUTH-USER:${user}" #required 
-H "X-AUTH-PROJECT:${project}" #optional, maybe null 
-H "X-AUTH-EXPIRES:${HEX(expires_millis)}" #required, hex format of expires millliseonds 
-H "X-AUTH-NONCE:${HEX(nonce_nanos)}" #required, hex format of nonce nanoseonds 
-H "X-AUTH-SIGNATURE:${HEX(signature)} #required, hex format of signatue=MD5(domain,user,project(maybe null),SHA1(pass),HEX(expires_millis),HEX(nonce_nanos))"' 
-d '{"user":"my_user","project":"my_project","role":"SERVICE"}'

response: 200 OK
{"errno":0,"data":{"domain":"my_domain","user":"my_user","project":"my_project","role":"SERVICE"}}
    • 查询用户角色
    curl -XGET 'https://oauth.huya.com/v1/domain/getUserRoles?user=my_user&project=my_project' 
-H "X-AUTH-DOMAIN:${domain}" #required 
-H "X-AUTH-USER:${user}" #required 
-H "X-AUTH-PROJECT:${project}" #optional, maybe null 
-H "X-AUTH-EXPIRES:${HEX(expires_millis)}" #required, hex format of expires millliseonds 
-H "X-AUTH-NONCE:${HEX(nonce_nanos)}" #required, hex format of nonce nanoseonds 
-H "X-AUTH-SIGNATURE:${HEX(signature)} #required, hex format of signatue=MD5(domain,user,project(maybe null),SHA1(pass),HEX(expires_millis),HEX(nonce_nanos))"

response: 200 OK
{"errno":0,"data":["ADMIN","SERVICE"]}
    • 删除用户角色
    curl -XDELETE 'https://oauth.huya.com/v1/domain/delUserRole?user=my_user&project=my_project&role=ADMIN' 
-H "X-AUTH-DOMAIN:${domain}" #required 
-H "X-AUTH-USER:${user}" #required 
-H "X-AUTH-PROJECT:${project}" #optional, maybe null 
-H "X-AUTH-EXPIRES:${HEX(expires_millis)}" #required, hex format of expires millliseonds 
-H "X-AUTH-NONCE:${HEX(nonce_nanos)}" #required, hex format of nonce nanoseonds 
-H "X-AUTH-SIGNATURE:${HEX(signature)} #required, hex format of signatue=MD5(domain,user,project(maybe null),SHA1(pass),HEX(expires_millis),HEX(nonce_nanos))"

response: 200 OK
{"errno":0}
    • 查询域用户
    curl -XGET 'https://oauth.huya.com/v1/domain/getDomainUser' 
-H "X-AUTH-DOMAIN:${domain}" #required 
-H "X-AUTH-USER:${user}" #required 
-H "X-AUTH-PROJECT:${project}" #optional, maybe null 
-H "X-AUTH-EXPIRES:${HEX(expires_millis)}" #required, hex format of expires millliseonds 
-H "X-AUTH-NONCE:${HEX(nonce_nanos)}" #required, hex format of nonce nanoseonds 
-H "X-AUTH-SIGNATURE:${HEX(signature)} #required, hex format of signatue=MD5(domain,user,project(maybe null),SHA1(pass),HEX(expires_millis),HEX(nonce_nanos))"

response: 200 OK
{"errno":0,"data":[{"domain":"my_domain","user":"my_admin","enabled":true},{"domain":"my_domain","user":"my_user","remark":"this is a test user","enabled":true}]}
    • 查询域项目
    curl -XGET 'https://oauth.huya.com/v1/domain/getDomainProject' 
-H "X-AUTH-DOMAIN:${domain}" #required 
-H "X-AUTH-USER:${user}" #required 
-H "X-AUTH-PROJECT:${project}" #optional, maybe null 
-H "X-AUTH-EXPIRES:${HEX(expires_millis)}" #required, hex format of expires millliseonds 
-H "X-AUTH-NONCE:${HEX(nonce_nanos)}" #required, hex format of nonce nanoseonds 
-H "X-AUTH-SIGNATURE:${HEX(signature)} #required, hex format of signatue=MD5(domain,user,project(maybe null),SHA1(pass),HEX(expires_millis),HEX(nonce_nanos))"

response: 200 OK
{"errno":0,"data":[{"domain":"my_domain","project":"ADMIN","enabled":true},{"domain":"my_domain","project":"my_project","remark":"这是我的测试项目!","enabled":true}]}
    • 发布/更新服务
    curl -XPUT 'https://oauth.huya.com/v1/domain/publishService' 
-H "X-AUTH-DOMAIN:${domain}" #required 
-H "X-AUTH-USER:${user}" #required 
-H "X-AUTH-PROJECT:${project}" #optional, maybe null 
-H "X-AUTH-EXPIRES:${HEX(expires_millis)}" #required, hex format of expires millliseonds 
-H "X-AUTH-NONCE:${HEX(nonce_nanos)}" #required, hex format of nonce nanoseonds 
-H "X-AUTH-SIGNATURE:${HEX(signature)} #required, hex format of signatue=MD5(domain,user,project(maybe null),SHA1(pass),HEX(expires_millis),HEX(nonce_nanos))"' 
-d '{"endpoint":"https://cdn.game.yy.com/v1","apis":[{"api":"api_name_0","method":"GET","path":"/service/action0","category":"test"},{"api":"api_name_1","method":"GET","path":"/service/action1","category":"test"},{"api":"api_name_2","method":"GET","path":"/service/action2","category":"test"},{"api":"api_name_3","method":"GET","path":"/service/action3","category":"test"},{"api":"api_name_4","method":"GET","path":"/service/action4","category":"test"},{"api":"api_name_5","method":"GET","path":"/service/action5","category":"test"},{"api":"api_name_6","method":"GET","path":"/service/action6","category":"test"},{"api":"api_name_7","method":"GET","path":"/service/action7","category":"test"},{"api":"api_name_8","method":"GET","path":"/service/action8","category":"test"},{"api":"api_name_9","method":"GET","path":"/service/action9","category":"test"}],"policies":[{"role":"SERVICE","rules":"test,test:*"}]}'

response: 200 OK
{"errno":0}


注意:

- 发布服务可以指定endpoint, apis, policies. 每次发布这些信息都是全量覆盖.
    • 验证会话TOKEN
    curl -XPOST 'https://oauth.huya.com/v1/domain/verifyRequest' 
-H "X-AUTH-DOMAIN:${domain}" #required 
-H "X-AUTH-USER:${user}" #required 
-H "X-AUTH-PROJECT:${project}" #optional, maybe null 
-H "X-AUTH-EXPIRES:${HEX(expires_millis)}" #required, hex format of expires millliseonds 
-H "X-AUTH-NONCE:${HEX(nonce_nanos)}" #required, hex format of nonce nanoseonds 
-H "X-AUTH-SIGNATURE:${HEX(signature)} #required, hex format of signatue=MD5(domain,user,project(maybe null),SHA1(pass),HEX(expires_millis),HEX(nonce_nanos))"' 
-d '{"domain":"my_domain","user":"my_user","project":"my_project","expires":"1598b5b3eb7","nonce":"74a465fddab8b","signature":"56f8519d7f31460821e4722de0c77c5f","api":"api_name_0"}'

response: 200 OK
{"errno":0,"data":{"domain":"my_domain","user":"my_user","project":"my_project","expires":"1598b5b3eb7","nonce":"74a465fddab8b","signature":"56f8519d7f31460821e4722de0c77c5f","api":"api_name_0","roles":["SERVICE"]}}

- 如果指定api, 则根据policy规则校验
- 如果不指定api, 则仅仅验证签名

    其他用户

    • 查询全部域
    curl -XGET 'https://oauth.huya.com/v1/domain/lookupService?service=my_domain' 
-H "X-AUTH-DOMAIN:${domain}" #required 
-H "X-AUTH-USER:${user}" #required 
-H "X-AUTH-PROJECT:${project}" #optional, maybe null 
-H "X-AUTH-EXPIRES:${HEX(expires_millis)}" #required, hex format of expires millliseonds 
-H "X-AUTH-NONCE:${HEX(nonce_nanos)}" #required, hex format of nonce nanoseonds 
-H "X-AUTH-SIGNATURE:${HEX(signature)} #required, hex format of signatue=MD5(domain,user,project(maybe null),SHA1(pass),HEX(expires_millis),HEX(nonce_nanos))"

response: 200 OK
{"errno":0,"data":{"endpoint":"https://cdn.game.yy.com/v1","apis":[{"api":"api_name_4","method":"GET","path":"/service/action4","category":"test"},{"api":"api_name_3","method":"GET","path":"/service/action3","category":"test"},{"api":"api_name_6","method":"GET","path":"/service/action6","category":"test"},{"api":"api_name_5","method":"GET","path":"/service/action5","category":"test"},{"api":"api_name_0","method":"GET","path":"/service/action0","category":"test"},{"api":"api_name_2","method":"GET","path":"/service/action2","category":"test"},{"api":"api_name_1","method":"GET","path":"/service/action1","category":"test"},{"api":"api_name_8","method":"GET","path":"/service/action8","category":"test"},{"api":"api_name_7","method":"GET","path":"/service/action7","category":"test"},{"api":"api_name_9","method":"GET","path":"/service/action9","category":"test"}]}}
    • 查询全部角色
    curl -XGET 'https://oauth.huya.com/v1/domain/getAllRole' 
-H "X-AUTH-DOMAIN:${domain}" #required 
-H "X-AUTH-USER:${user}" #required 
-H "X-AUTH-PROJECT:${project}" #optional, maybe null 
-H "X-AUTH-EXPIRES:${HEX(expires_millis)}" #required, hex format of expires millliseonds 
-H "X-AUTH-NONCE:${HEX(nonce_nanos)}" #required, hex format of nonce nanoseonds 
-H "X-AUTH-SIGNATURE:${HEX(signature)} #required, hex format of signatue=MD5(domain,user,project(maybe null),SHA1(pass),HEX(expires_millis),HEX(nonce_nanos))"

response: 200 OK
{"errno":0,"data":[{"role":"ADMIN","remark":"全局管理角色"},{"role":"SERVICE","remark":"服务角色"},{"role":"ut_role_d6a62c98_c243_4fcc_9a61_b732185ffb3d"}]}
    • 查询域服务API
    curl -XGET 'https://oauth.huya.com/v1/domain/lookupService?service=my_domain' 
-H "X-AUTH-DOMAIN:${DOMAIN}" 
-H "X-AUTH-USER:${USER}" 
-H "X-AUTH-PASS:${PASS}"

response: 200 OK
{"errno":0,"data":{"endpoint":"","apis":[{"api":"api_name_4","method":"GET","path":"/service/action4"},{"api":"api_name_3","method":"GET","path":"/service/action3"},{"api":"api_name_6","method":"GET","path":"/service/action6"},{"api":"api_name_5","method":"GET","path":"/service/action5"},{"api":"api_name_0","method":"GET","path":"/service/action0"},{"api":"api_name_2","method":"GET","path":"/service/action2"},{"api":"api_name_1","method":"GET","path":"/service/action1"},{"api":"api_name_8","method":"GET","path":"/service/action8"},{"api":"api_name_7","method":"GET","path":"/service/action7"},{"api":"api_name_9","method":"GET","path":"/service/action9"}]}}

    请求头及签名规则:

    请求头:

    X-AUTH-DOMAIN: 域
X-AUTH-USER: 用户
X-AUTH-PROJECT: 项目,可选
X-AUTH-EXPIRES: 有效时间点毫秒时间戳的16进制
X-AUTH-NONCE: 惟一随机数值, 一般使用当前纳秒时间戳的16进制
X-AUTH-SIGNATURE: 用户签名, 规则见下

    规则:

    -带项目:
signature=md5sum(domain,user,project,sha1sum(pass),hex(expires_millis),hex(current_nanos))

-不带项目:
signature=md5sum(domain,user,sha1sum(pass),hex(expires_millis),hex(current_nanos))

    例子:

    • 服务请求方:
    假设my_domain的my_user的密码为456, 其要访问my_project的数据. 则相应脚本:


expires_millis_hex=$(printf '%x' $(($(date +%s)*1000+5000)))
nonce_nanos_hex=$(printf '%x' $(date +%N))
pass_sha1=$(printf 456 | openssl sha1 | awk '{print $2}')
signature=$(printf '%s%s%s%s%s%s' my_domain my_user $pass_sha1 my_project $expires_millis_hex $nonce_nanos_hex | openssl md5 | awk '{print $2}')

curl -XGET 'https://test.huya.com/v1/api_name_0' 
-H "X-AUTH-DOMAIN:my_domain" 
-H "X-AUTH-USER:my_user" 
-H "X-AUTH-PROJECT:my_project" 
-H "X-AUTH-EXPIRES:${HEX(expires_millis_hex)}" 
-H "X-AUTH-NONCE:nonce_nanos_hex" 
-H "X-AUTH-SIGNATURE:signature"
    • 服务提供方:

    提取http request中的X-AUTH-*头部,发往ikeystone验证, 成功返回对应用户的角色等信息:

    假设test服务管理员为test, 密码也为456, 验证请求脚本(与ikeystone交互不需要项目)

expires_millis_hex=$(printf '%x' $(($(date +%s)*1000+5000)))
nonce_nanos_hex=$(printf '%x' $(date +%N))
pass_sha1=$(printf 456 | openssl sha1 | awk '{print $2}')
signature=$(printf '%s%s%s%s%s' test test $pass_sha1 $expires_millis_hex $nonce_nanos_hex | openssl md5 | awk '{print $2}')

curl -XPOST 'https://oauth.huya.com/v1/domain/verifyRequest' 
-H "X-AUTH-DOMAIN:my_domain" 
-H "X-AUTH-USER:my_user" 
-H "X-AUTH-EXPIRES:${HEX(expires_millis_hex)}" 
-H "X-AUTH-NONCE:nonce_nanos_hex" 
-H "X-AUTH-SIGNATURE:signature" 
-d '{"domain":"my_domain","user":"my_user","project":"my_project","expires":"1598b7efac5","nonce":"74c67a48ebe23","signature":"bd99837ae32dcda3f21c91b7f95671cf","api":"api_name_0"}'

response: 200 OK
{"errno":0,"data":{"domain":"my_domain","user":"my_user","project":"my_project","expires":"1598b7efac5","nonce":"74c67a48ebe23","signature":"bd99837ae32dcda3f21c91b7f95671cf","api":"api_name_0","roles":["SERVICE"]}}

    参考

    1. OpenStack Keystone V3 简介
    2. Keystone, the OpenStack Identity Service
    3. Intro to Keystone v3 API
  • 相关阅读:
    遂宁2017届零诊16题(仅想说明网传答案的不正确)
    当参变分离遇见洛必达
    高考数学九大超纲内容(1)wffc
    给王志红老师构造的函数，想说明搜题软件的解答过程的不严谨！
    记住路径名
    php返回文件路径
    两个字符串合并为一个字符串的各种方法
    global作用域
    二进制字符串的比较
    var_dump — 打印变量的相关信息
  • 原文地址：https://www.cnblogs.com/zolo/p/6195615.html
Copyright © 2011-2022 走看看