<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=ISO-8859-1">
</head>
<body text="#000000" bgcolor="#FFFFFF">
Unfortunately, the test day scheduled for Tuesday happens to fall
during my Family vacation. There are a couple of things I would
love to have tested.
<br>
<br>
<br>
In Foslom, my largest feature is PKI Tokens and their revocation. I
am not sure if the revocation code will land in the Fedora repo yet,
as it was committed after the F3 milestone was cut.
<br>
To check that is has been merged, look in the Keystone config file
under the section
<br>
[signing]
<br>
<br>
you should see a commented out value:
<br>
<br>
#token_format = PKI
<br>
<br>
<br>
To activate the PKI tokens, uncomment this value and restart
Keystone.
<br>
<br>
<br>
When you run keystone token-get, the tokens should now be several
lines long.
<br>
<br>
By default, the services like glance, nova, and the like store
their cached version of certificates etc in ~<i
class="moz-txt-slash"><span class="moz-txt-tag">/</span>keystone-signing<span
class="moz-txt-tag">/</span></i>. I tend to test against glance
so after running
<br>
<br>
glance image-list
<br>
<br>
you will see:
<br>
<br>
$ ls ~<i class="moz-txt-slash"><span class="moz-txt-tag">/</span>keystone-signing<span
class="moz-txt-tag">/</span></i>
<br>
cacert.pem revoked.pem signing_cert.pem
<br>
<br>
To modify the place that these files get saved, to put them in the
more correct location of <i class="moz-txt-slash"><span
class="moz-txt-tag">/</span>var/cache, create a directory
/var/cache<span class="moz-txt-tag">/</span></i>$USER where $USER
is glance, etc. Modify the config file for the appropriate service
to set:
<br>
<br>
[signing]
<br>
signing_dir = /var/cache/glance
<br>
<br>
<br>
This should also test Alan Pevec's change that configuration should
be read from the paste-config file of the application, as opposed to
Keystone's config file.
<br>
<br>
I just realized that the Revocation code made the cut, but the fix
to make the request for the revocation list as admin did not. If
the PKI token test fails with 401s it is probably due to the request
for the revocation list being denied by Keystone. This is a known
issue, and disregard the failure for now, as the fix is committed
upstream, but not in the Fedora RPMS yet.<br>
<br>
<br>
</body>
</html>