Using OAuth2.0 for Tacker¶
Overview¶
The third-party clients can access the NFV orchestration APIs that is provided by Tacker via the Client Credentials Grant flow in RFC6749 OAuth 2.0 Authorization Framework. OAuth2.0 Client Credentials Grant flow is prescribed in the API specification of ETSI NFV NFV-SOL013 v3.3.1. Tacker uses the keystone middleware to support OAuth2.0 Client Credentials Grant through the keystone identity server.
Preparations¶
To use OAuth2.0 for Tacker, it is necessary to confirm that OAuth2.0 client
credentials is enabled in the Keystone identity server. In this example,
keystone.host is the domain name used by the Keystone identity server, and
the domain name used by the tacker server is tacker.host.
Guide¶
To use OAuth2.0 Client Credentials Grant in Tacker, you should configure the tacker-server and the Keystone middleware in the following steps.
Enable Tacker HTTPS Service¶
According to RFC6749, HTTPS must be enabled in the authorization server since requests include sensitive information in plain text, so it should enable Tacker to support HTTPS protocols.
Generate an RSA private key.
$ openssl genrsa -out tacker.key 2048
Generating RSA private key, 2048 bit long modulus (2 primes)
.........................................+++++
.........................+++++
e is 65537 (0x010001)
Create a certificate signing request.
$ openssl req -new -key tacker.key -out tacker.csr
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:
State or Province Name (full name) [Some-State]:
Locality Name (eg, city) []:
Organization Name (eg, company) [Internet Widgits Pty Ltd]:
Organizational Unit Name (eg, section) []:
Common Name (e.g. server FQDN or YOUR name) []:tacker.host
Email Address []:
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
Generate a self signed certificate.
$ openssl x509 -req -days 365 -in tacker.csr \
-signkey tacker.key -out tacker.host.crt
Signature ok
subject=C = , ST = , L = , O = , OU = , CN = tacker.host, emailAddress =
Getting Private key
Modify the configuration file tacker.conf to enable SSL to implement HTTP support for the Tacker APIs.
$ vi /etc/tacker/tacker.conf
[DEFAULT]
# Enable SSL on the API server (boolean value)
use_ssl = true
# Certificate file to use when starting the server securely (string value)
ssl_cert_file = /etc/tacker/tacker.host.crt
# Private key file to use when starting the server securely (string value)
ssl_key_file = /etc/tacker/tacker.key
Restart tacker service so that the modified configuration information takes effect.
$ sudo systemctl restart devstack@tacker
Try access the Tacker APIs via HTTPS protocol to confirm that the service has been successfully configured.
$ curl -sik -X GET https://tacker.host:9890/
HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 118
Date: Thu, 03 Mar 2022 08:12:56 GMT
{"versions": [{"id": "v1.0", "status": "CURRENT", "links": [{"rel": "self", "href": "https://tacker.host:9890/v1.0"}]}]}
When Tacker is switched to HTTPS, user can not access the Tacker APIs via HTTP protocol.
$ curl -ik -X GET http://tacker.host:9890/
curl: (52) Empty reply from server
Subscribe to Notifications that need OAuth2.0 Client Credentials Grant¶
If the certification of the notification authorization server is not trusted,
the configuration file tacker.conf can be modified to set the
verify_oauth2_ssl to false, then the backend no longer verify the
certification when it obtains the OAuth2.0 access token.
If the certification of the notification callback API is not trusted, the
configuration file tacker.conf can be modified to set the
verify_notification_ssl to false, then the backend no longer verify the
certification when it sends a notification.
Modify the configuration file as needed.
$ vi /etc/tacker/tacker.conf
[vnf_lcm]
verify_notification_ssl = false
[authentication]
verify_oauth2_ssl = false
Subscribe to a notification that requires OAuth2.0 client authorization to confirm that the backend can send a notification successfully.
$ curl -ik -X POST https://tacker.host:9890/vnflcm/v1/subscriptions \
-H "Authorization: Bearer $oauth2_access_token" \
-H "Content-Type: application/json" \
-d '{"filter": {"vnfInstanceSubscriptionFilter":{"vnfdIds":["20faf7bc-0e24-4ab7-adf3-870d0b4c873f"]}},"callbackUri":"$callback_url","authentication":{"authType":"OAUTH2_CLIENT_CREDENTIALS","paramsOauth2ClientCredentials":{"clientId":"$notification_oauth2_client_id","clientPassword":"$notification_oauth2_client_secret","tokenEndpoint":"$notification_oauth2_token_endpoint"}}}'
HTTP/1.1 201 Created
Content-Length: 322
Location: https://tacker.host:9890/vnflcm/v1/subscriptions/76425044-53e2-4bbd-9b8b-170559fda80c
Content-Type: application/json
X-Openstack-Request-Id: req-9f01e0b1-8e03-458e-a9d1-9f09bb0020b1
Date: Thu, 03 Mar 2022 07:26:34 GMT
{"id": "76425044-53e2-4bbd-9b8b-170559fda80c", "filter": {"vnfInstanceSubscriptionFilter": {"vnfdIds": ["20faf7bc-0e24-4ab7-adf3-870d0b4c873f"]}}, "callbackUri": "https://10.10.0.56:29000/mock_oauth2/test", "_links": {"self": {"href": "http://localhost:9890/vnflcm/v1/subscriptions/76425044-53e2-4bbd-9b8b-170559fda80c"}}}
