OSM Multi-tenancy

This is an experimental feature which allows to use a single instance of OSM for a set of different projects and users. Full support will be available in Release FOUR.

The required steps are:

• Enable PAM authentication at SO, to support multiple users.
• Create the required users and projects in SO, assigning the required privileges.
• Map each SO project with a new RO tenant, with its corresponding VIMs.
• [Optional] Create a separate Juju controller for each SO project.

Prerequisites

Since all the existing data will be cleared from SO as part of enabling PAM authentication, be sure to:

1. Backup any relevant descriptors.

2. Delete any existing instances.

3. Retrieve the current config-agent password, using the OSM client:

osm config-agent list

Enabling PAM authentication

PAM can use a local user database, as well as external ones, like for example LDAP. This example covers the interaction with a local user database only.

1. Edit /usr/rift/etc/default/launchpad, replacing "--start-auth-svc" for "--start-pam-svc"

...
# set this to any options you want passed to launchpad.py
LP_OPTS=" --start-pam-svc "
...

2. Clear the existing SO configuration, please note that this will delete all the data (descriptors, accounts, instances, etc.)

rm -rf /usr/rift/var/rift

3. Restart the service

systemctl stop launchpad
systemctl start launchpad

4. Create the local user database inside the SO container

adduser user_a
...
adduser user_b
...

Managing SO Projects

From the UI, go to Administration --> User Management, and clic on Add User.

Fill the form with the users created at the previous stage, making sure to specify 'localhost' in the 'DOMAIN' field.

Working with multiple Juju controllers

[work in progress]