Page History

...

A key enabling component for this integration is a Swift Auth middleware that I wrote called 'mauth'.  This middleware supports CloudStack by default, but it is also extensible and open source.   The CloudStack implementation uses the CS username and api key as the users credentials.  After authentication, Swift will return a token to be used for the subsequent API calls.

How 'mauth' works:

To get thing started I will show a curl example using mauth to authenticate a CloudStack user.
In this example, http://127.0.0.1:8080/v1.0 is pointing at the Swift cluster.
The $username and $apikey reflect the CloudStack user and his api key respectively. 

...

• When a user logs in, a change had to be made to add the 'api key' to the CS user object in the browser
• This Swift object storage service implementation is only available to users who have an API Key generated in CS
  • There is a graceful degradation to explain to the user to to get the service to work if they try to use it without api keys
• The load balancer exposes the URL that is used by both CloudStack and Swift calls
  • One reason for this is to make sure the Swift traffic does not go through the CS server which would create a bottleneck
  • Another reason is to be able to make AJAX calls to Swift without having issues with the Same Origin Policy
• All Swift calls are done using AJAX and the load balancer handles routing the calls to Swift
• Swift uses the HTTP PUT verb and browsers do not support the PUT verb, so the client sends the requests as POST and the LB translates to PUT
  • This means that the current implementation does not support any of the Swift API calls that require POST
  • More details on this can be found in the HAproxy config attached at the end of this document
• This functionality requires the 'mauth' middleware to be installed on Swift
• The mauth configuration points to CS (the load balancer actually) and requires the 'admin' keys (mauth requires 'listUsers' API call for all accounts)
• It is VERY recommended to use CS on HTTPS (with SSL)
• TODO - Important - A global variable needs to be added to CS to enable/disable the Object Store functionality
• TODO - Medium - Clean up the couple places where text is not translatable
• TODO - Nice-to-have - Find a cleaner solution when someone tries to download a folder or container (maybe I should just hide download of those)
• TODO - Nice-to-have - Make the public URL for a public object clickable (just text right now)
• TODO - Nice-to-have - Reflect the full object path in the breadcrumb when an object is in detail view
• TODO - Nice-to-have - Remember what containers and folders were open and reopen them after a new container is added (enhancement)
• TODO - Nice-to-have - When a container or folder is clicked, expand/collapse it rather than forcing the arrow to be clicked (CS treeView enhancement)
• TODO - Medium - A user guide to explain the setup required to get Swift setup with mauth as well as setting the load balancer in front of CS and Swift
  • What is the best way to make this doc available?

...

• When a user logs in, a change was made to CS to ALSO pass the 'api key' to the client side, it is then saved in the user object.
  • This was added because mauth (the Swift middleware) authenticates to Swift with the CS 'username' and 'api key' (see curl example above).
  • It is highly recommended that you setup CS with SSL in front of it so the API requests are not in clear text (not safe against sniffers)
• It is required that a user has an API Key generated in order to use this service.
• A load balancer is put in front of CS (and Swift).  I have included details for getting this to work with HAproxy.
• mauth is required to enable authorization/authentication of CS users in Swift.

...