OpenStack Barbican

https://docs.openstack.org/barbican/latest/
Admin
OpenStack Key Manager service that provides secure storage, provisioning, and management of secret...
Tokens:79,831
Snippets:1,313
Trust Score:10
Update:4 months ago
Show doc for...
Tokens:
Raw
### Install Dogtag Packages (Fedora/RHEL/Centos)

Source: https://docs.openstack.org/barbican/latest/configuration/dogtag_setup.html

Installs the required Dogtag packages on Fedora/RHEL/Centos platforms.

```bash
dnf install pki-ca pki-kra 389-ds-base

```

--------------------------------

### Start Apache HTTP service

Source: https://docs.openstack.org/barbican/latest/install/install-rdo.html

Start the Apache HTTP service and configure it to start on system boot.

```bash
# systemctl enable httpd.service

```

--------------------------------

### GET /v1/orders Request Example

Source: https://docs.openstack.org/barbican/latest/api/reference/orders.html

Example of a GET request to list orders, including necessary headers.

```http
GET /v1/orders
Headers:
    Content-Type: application/json
    X-Auth-Token: {token}


```

--------------------------------

### Create Dogtag CA

Source: https://docs.openstack.org/barbican/latest/configuration/dogtag_setup.html

Sets up a Dogtag CA using default configurations for an Apache Tomcat instance.

```bash
mkdir -p /etc/dogtag

cat > /etc/dogtag/ca.cfg <<EOF

[CA]
pki_admin_email=caadmin@example.com
pki_admin_name=caadmin
pki_admin_nickname=caadmin
pki_admin_password=PASSWORD
pki_admin_uid=caadmin
pki_backup_password=PASSWORD
pki_client_database_password=PASSWORD
pki_client_database_purge=False
pki_client_pkcs12_password=PASSWORD
pki_clone_pkcs12_password=PASSWORD
pki_ds_base_dn=dc=ca,dc=example,dc=com
pki_ds_database=ca
pki_ds_password=PASSWORD
pki_security_domain_name=EXAMPLE
pki_token_password=PASSWORD
pki_https_port=8373
pki_http_port=8370
pki_ajp_port=8379
pki_tomcat_server_port=8375
EOF

pkispawn -v -f /etc/dogtag/ca.cfg -s CA

```

--------------------------------

### ImportError: No module named site Example

Source: https://docs.openstack.org/barbican/latest/configuration/troubleshooting.html

An example of the error message seen with uWSGI configuration issues.

```text
...
uwsgi socket 0 bound to TCP address :9311 fd 3
Python version: 2.7.3 (...)  [...]
Set PythonHome to ./.venv
ImportError: No module named site


```

--------------------------------

### GET /v1/project-quotas Request/Response Example

Source: https://docs.openstack.org/barbican/latest/api/reference/quotas.html

Example of a GET request to retrieve a list of configured project quota records, including pagination parameters and the JSON response structure.

```http
Request:

  GET /v1/project-quotas
  Headers:
    X-Auth-Token:<token>
    Accept: application/json

Response:

  200 OK

  Content-Type: application/json

  {
    "project_quotas": [
      {
        "project_id": "1234",
        "project_quotas": {
             "secrets": 2000,
             "orders": 0,
             "containers": -1,
             "consumers": null,
             "cas": null
         }
      },
      {
        "project_id": "5678",
        "project_quotas": {
             "secrets": 200,
             "orders": 100,
             "containers": -1,
             "consumers": null,
             "cas": null
         }
      },
    ],
    "total" : 30,
  }


```

--------------------------------

### Create Directory Server Instance for Dogtag Internal DB

Source: https://docs.openstack.org/barbican/latest/configuration/dogtag_setup.html

Configures a 389 directory server instance to be used as an internal database for Dogtag CA and KRA subsystems.

```bash
mkdir -p /etc/389-ds

cat > /etc/389-ds/setup.inf <<EOF

[General]
FullMachineName= localhost.localdomain
SuiteSpotUserID= nobody
SuiteSpotGroup= nobody

[slapd]
ServerPort= 389
ServerIdentifier= pki-tomcat
Suffix= dc=example,dc=com
RootDN= cn=Directory Manager
RootDNPwd= PASSWORD
EOF

setup-ds.pl --silent --file=/etc/389-ds/setup.inf

```

--------------------------------

### GET /v1/quotas Request/Response Example

Source: https://docs.openstack.org/barbican/latest/api/reference/quotas.html

Example of a GET request to retrieve effective quotas for the requester's project and its corresponding JSON response.

```http
Request:

  GET /v1/quotas
  Headers:
    X-Auth-Token:<token>
    Accept: application/json


Response:

  HTTP/1.1 200 OK
  Content-Type: application/json

  {
    "quotas": {
      "secrets": 10,
      "orders": 20,
      "containers": 10,
      "consumers": -1,
      "cas": 5
    }
  }


```

--------------------------------

### CryptoMimeTypeNotSupportedException Example

Source: https://docs.openstack.org/barbican/latest/configuration/troubleshooting.html

An example of the error message when a crypto mime type is not supported.

```text
CryptoMimeTypeNotSupportedException: Crypto Mime Type of 'text/plain' not supported


```

--------------------------------

### OperationalError Example

Source: https://docs.openstack.org/barbican/latest/configuration/troubleshooting.html

An example of the error message when the sqlite database file cannot be opened.

```text
...
  File "./site-packages/sqlalchemy/engine/strategies.py", line 80, in connect
    return dialect.connect(*cargs, **cparams)
  File "./site-packages/sqlalchemy/engine/default.py", line 283, in connect
    return self.dbapi.connect(*cargs, **cparams)
OperationalError: (OperationalError) unable to open database file None None
[emperor] removed uwsgi instance barbican-api.ini
...


```

--------------------------------

### GET /v1/secret-stores Request/Response Example

Source: https://docs.openstack.org/barbican/latest/api/reference/store_backends.html

Example of a GET request to list available secret store backends and its corresponding JSON response.

```http
GET /secret-stores
   Headers:
      X-Auth-Token: "f9cf2d480ba3485f85bdb9d07a4959f1"
      Accept: application/json

  Response:

    HTTP/1.1 200 OK
    Content-Type: application/json

   {
      "secret_stores":[
         {
            "status": "ACTIVE",
            "updated": "2016-08-22T23:46:45.114283",
            "name": "PKCS11 HSM",
            "created": "2016-08-22T23:46:45.114283",
            "secret_store_ref": "http://localhost:9311/v1/secret-stores/4d27b7a7-b82f-491d-88c0-746bd67dadc8",
            "global_default": True,
            "crypto_plugin": "p11_crypto",
            "secret_store_plugin": "store_crypto"
         },
         {
            "status": "ACTIVE",
            "updated": "2016-08-22T23:46:45.124554",
            "name": "KMIP HSM",
            "created": "2016-08-22T23:46:45.124554",
            "secret_store_ref": "http://localhost:9311/v1/secret-stores/93869b0f-60eb-4830-adb9-e2f7154a080b",
            "global_default": False,
            "crypto_plugin": None,
            "secret_store_plugin": "kmip_plugin"
         },
         {
            "status": "ACTIVE",
            "updated": "2016-08-22T23:46:45.127866",
            "name": "Software Only Crypto",
            "created": "2016-08-22T23:46:45.127866",
            "secret_store_ref": "http://localhost:9311/v1/secret-stores/0da45858-9420-42fe-a269-011f5f35deaa",
            "global_default": False,
            "crypto_plugin": "simple_crypto",
            "secret_store_plugin": "store_crypto"
         }
   }

```

--------------------------------

### Start httpd service

Source: https://docs.openstack.org/barbican/latest/install/install-rdo.html

Starts the Apache HTTP Server service, which is often a prerequisite for web-based services like Barbican.

```bash
systemctl start httpd.service
```

--------------------------------

### Set up a virtual environment and install Barbican

Source: https://docs.openstack.org/barbican/latest/contributor/dev.html

Clones the Barbican source, creates and activates a virtual environment, and installs Barbican in development mode.

```bash
# Clone barbican source
git clone https://opendev.org/openstack/barbican
cd barbican

# Create and activate a virtual environment
virtualenv .barbicanenv
. .barbicanenv/bin/activate

# Install barbican in development mode
pip install -e $PWD

```

--------------------------------

### Create Dogtag KRA

Source: https://docs.openstack.org/barbican/latest/configuration/dogtag_setup.html

Sets up the Dogtag KRA in the same Apache Tomcat instance as the CA. Note: The actual hostname should be used.

```bash
mkdir -p /etc/dogtag

hostname=$(hostname)
cat > /etc/dogtag/kra.cfg <<EOF

[KRA]
pki_admin_cert_file=/root/.dogtag/pki-tomcat/ca_admin.cert
pki_admin_email=kraadmin@example.com
pki_admin_name=kraadmin
pki_admin_nickname=kraadmin
pki_admin_password=PASSWORD
pki_admin_uid=kraadmin
pki_backup_password=PASSWORD
pki_client_database_password=PASSWORD
pki_client_database_purge=False
pki_client_pkcs12_password=PASSWORD
pki_clone_pkcs12_password=PASSWORD
pki_ds_base_dn=dc=kra,dc=example,dc=com
pki_ds_database=kra
pki_ds_password=PASSWORD
pki_security_domain_name=EXAMPLE
pki_security_domain_user=caadmin
pki_security_domain_password=PASSWORD
pki_token_password=PASSWORD
pki_https_port=8373
pki_http_port=8370
pki_ajp_port=8379
pki_tomcat_server_port=8375
pki_security_domain_hostname=$hostname
pki_security_domain_https_port=8373
EOF

pkispawn -v -f /etc/dogtag/kra.cfg -s KRA

```

--------------------------------

### Install the packages

Source: https://docs.openstack.org/barbican/latest/install/install-rdo.html

Install the necessary packages for the Key Manager service.

```bash
# dnf install openstack-barbican-api

```

--------------------------------

### GET /v1/orders/{uuid} Request Example

Source: https://docs.openstack.org/barbican/latest/api/reference/orders.html

Example of a GET request to retrieve a specific order's metadata using its UUID.

```http
GET /v1/orders/{order_uuid}
Headers:
    Accept: application/json
    X-Auth-Token: {token}


```

--------------------------------

### ArgsAlreadyParsedError Example

Source: https://docs.openstack.org/barbican/latest/configuration/troubleshooting.html

An example of the error message seen when trying to register CLI options after arguments have already been parsed.

```text
...
  File ".../oslo_config/cfg.py", line 1275, in register_cli_opt
    raise ArgsAlreadyParsedError("cannot register CLI option")
ArgsAlreadyParsedError: arguments already parsed: cannot register CLI option


```

--------------------------------

### Generating an MKEK

Source: https://docs.openstack.org/barbican/latest/admin/pkcs11keygeneration.html

Example command to generate a new MKEK using the pkcs11-key-generation script, specifying library path, passphrase, slot ID, length, and label.

```bash
$ pkcs11-key-generation --library-path {library_path here}
--passphrase {HSM password here} --slot-id {HSM slot here} mkek --length 32
--label 'HMACLabelHere'
MKEK successfully generated!


```

--------------------------------

### Crontab Examples

Source: https://docs.openstack.org/barbican/latest/admin/database_cleaning.html

Examples of cron job configurations for the `barbican-manage db clean` command.

```bash
00 00 * * * barbican-manage db clean -p -e
```

```bash
00 03 01 * * barbican-manage db clean -m 30
```

```bash
05 01 07 * 6 barbican-manage db clean -m 180 -p -e -L /tmp/barbican-clean-command.log
```

--------------------------------

### GET /v1/orders Response Example

Source: https://docs.openstack.org/barbican/latest/api/reference/orders.html

Example of a successful (200 OK) response when listing orders, showing the structure of the orders list and total count.

```json
{
    "orders": [
    {
        "created": "2015-10-20T18:38:44",
        "creator_id": "40540f978fbd45c1af18910e3e02b63f",
        "meta": {
            "algorithm": "AES",
            "bit_length": 256,
            "expiration": null,
            "mode": "cbc",
            "name": "secretname",
            "payload_content_type": "application/octet-stream"
        },
        "order_ref": "http://localhost:9311/v1/orders/2284ba6f-f964-4de7-b61e-c413df5d1e47",
        "secret_ref": "http://localhost:9311/v1/secrets/15dcf8e4-3138-4360-be9f-fc4bc2e64a19",
        "status": "ACTIVE",
        "sub_status": "Unknown",
        "sub_status_message": "Unknown",
        "type": "key",
        "updated": "2015-10-20T18:38:44"
    },
    {
        "created": "2015-10-20T18:38:47",
        "creator_id": "40540f978fbd45c1af18910e3e02b63f",
        "meta": {
            "algorithm": "AES",
            "bit_length": 256,
            "expiration": null,
            "mode": "cbc",
            "name": "secretname",
            "payload_content_type": "application/octet-stream"
        },
        "order_ref": "http://localhost:9311/v1/orders/87b7169e-3aa2-4cb1-8800-b5aadf6babd1",
        "secret_ref": "http://localhost:9311/v1/secrets/80183f4b-c0de-4a94-91ad-6d55251acee2",
        "status": "ACTIVE",
        "sub_status": "Unknown",
        "sub_status_message": "Unknown",
        "type": "key",
        "updated": "2015-10-20T18:38:47"
    }
    ],
    "total": 2
}

```

--------------------------------

### Create the `barbican` database

Source: https://docs.openstack.org/barbican/latest/install/install-ubuntu.html

This snippet shows how to create the `barbican` database.

```sql
CREATE DATABASE barbican;

```

--------------------------------

### Start DevStack

Source: https://docs.openstack.org/barbican/latest/contributor/devstack.html

Command to start the DevStack environment.

```bash
./stack.sh

```

--------------------------------

### GET /v1/orders/{uuid} Response Example

Source: https://docs.openstack.org/barbican/latest/api/reference/orders.html

Example of a successful (200 OK) response when retrieving an order's metadata.

```json
{
    "created": "2015-10-20T18:49:02",
    "creator_id": "40540f978fbd45c1af18910e3e02b63f",
    "meta": {
        "algorithm": "AES",
        "bit_length": 256,
        "expiration": null,
        "mode": "cbc",
        "name": "secretname",
        "payload_content_type": "application/octet-stream"
    },
    "order_ref": "http://localhost:9311/v1/orders/5443d349-fe0c-4bfd-bd9d-99c4a9770638",
    "secret_ref": "http://localhost:9311/v1/secrets/16f8d4f3-d3dd-4160-a5bd-8e5095a42613",
    "status": "ACTIVE",
    "sub_status": "Unknown",
    "sub_status_message": "Unknown",
    "type": "key",
    "updated": "2015-10-20T18:49:02"
}

```

--------------------------------

### TypeError Example

Source: https://docs.openstack.org/barbican/latest/configuration/troubleshooting.html

An example of the error message seen when a responder raises a TypeError due to a NoneType object.

```text
...
2013-04-14 14:17:56 [FALCON] [ERROR] POST \
/da71dfbc-a959-4ad3-bdab-5ee190ce7515/csrs? => Responder raised \
TypeError: 'NoneType' object has no attribute '__getitem__'


```

--------------------------------

### Install Git

Source: https://docs.openstack.org/barbican/latest/contributor/devstack.html

Commands to install git on Debian/Ubuntu and CentOS systems.

```bash
# Debian/Ubuntu
sudo apt-get install git

# CentOS
sudo dnf install git

```

--------------------------------

### Install development tools and dependency build requirements on Ubuntu 15.10

Source: https://docs.openstack.org/barbican/latest/contributor/dev.html

Installs git, python-tox, libffi-dev, libssl-dev, python-dev, and gcc.

```bash
# Install development tools
sudo apt-get install git python-tox

# Install dependency build requirements
sudo apt-get install libffi-dev libssl-dev python-dev gcc

```

--------------------------------

### Install the packages

Source: https://docs.openstack.org/barbican/latest/install/install-ubuntu.html

This snippet shows how to update apt and install the necessary Barbican packages.

```bash
# apt-get update

# apt-get install barbican-api barbican-keystone-listener barbican-worker

```

--------------------------------

### ImportError: No module named barbican.api.app Example

Source: https://docs.openstack.org/barbican/latest/configuration/troubleshooting.html

An example of Python 'can't find module errors' with uWSGI scripts.

```text
*** has_emperor mode detected (fd: 6) ***
...
!!! UNABLE to load uWSGI plugin: dlopen(./python_plugin.so, 10): image not found !!!
...
  File "./site-packages/paste/deploy/loadwsgi.py", line 22, in import_string
      return pkg_resources.EntryPoint.parse("x=" + s).load(False)
  File "./site-packages/distribute-0.6.35-py2.7.egg/pkg_resources.py", line 2015, in load
      entry = __import__(self.module_name, globals(),globals(), ['__name__'])
ImportError: No module named barbican.api.app
...
*** Starting uWSGI 1.9.13 (64bit) on [Fri Jul  5 09:59:29 2013] ***


```

--------------------------------

### Malformed JSON Example

Source: https://docs.openstack.org/barbican/latest/configuration/troubleshooting.html

An example of the JSON error response when the Barbican REST server cannot parse incoming JSON.

```json
{
    "title": "Malformed JSON"
}


```

--------------------------------

### Clone and Install Barbican Tempest Plugin

Source: https://docs.openstack.org/barbican/latest/contributor/devstack.html

Commands to clone the barbican-tempest-plugin and install it using pip.

```bash
cd /opt/stack/
git clone https://opendev.org/openstack/barbican-tempest-plugin.git
pip install -e /opt/stack/barbican-tempest-plugin

```

--------------------------------

### Generating an HMAC

Source: https://docs.openstack.org/barbican/latest/admin/pkcs11keygeneration.html

Example command to generate a new HMAC key using the pkcs11-key-generation script, specifying library path, passphrase, slot ID, and label.

```bash
$ pkcs11-key-generation --library-path {library_path here}
--passphrase {HSM password here} --slot-id {HSM slot here} hmac
--label 'HMACLabelHere'
HMAC successfully generated!


```

--------------------------------

### Create the `creator` role

Source: https://docs.openstack.org/barbican/latest/install/install-ubuntu.html

This snippet shows how to create the `creator` role.

```bash
$ openstack role create creator

```

--------------------------------

### Install development tools and dependency build requirements on Fedora 30

Source: https://docs.openstack.org/barbican/latest/contributor/dev.html

Installs git, python3-tox, gcc, libffi-devel, openssl-devel, and redhat-rpm-config.

```bash
# Install development tools
sudo dnf install git python3-tox

# Install dependency build requirements
sudo dnf install gcc libffi-devel openssl-devel redhat-rpm-config

```

--------------------------------

### Install python-barbicanclient package on Ubuntu

Source: https://docs.openstack.org/barbican/latest/install/verify.html

Installs the python-barbicanclient package using apt-get.

```bash
$ apt-get install python-barbicanclient

```

--------------------------------

### GET /v1/project-quotas/{uuid} Request/Response

Source: https://docs.openstack.org/barbican/latest/api/reference/quotas.html

Example request and response for retrieving project-specific quotas.

```http
Request:

  GET /v1/project-quotas/{uuid}
  Headers:
    X-Auth-Token:<token>
    Accept: application/json


Response:

  200 OK

  Content-Type: application/json

  {
    "project_quotas": {
      "secrets": 10,
      "orders": 20,
      "containers": -1,
      "consumers": 10,
      "cas": 5
    }
  }


```

--------------------------------

### Configure barbican.conf for Dogtag plugin

Source: https://docs.openstack.org/barbican/latest/configuration/dogtag_setup.html

This snippet shows the necessary modifications to the barbican.conf file to enable the Dogtag plugins as the only secret store. It includes settings for the PEM path, Dogtag host and port, NSS database paths, password, and approved certificate profiles.

```ini
[dogtag_plugin]
pem_path = '/etc/barbican/kra_admin_cert.pem'
dogtag_host = $(hostname)
dogtag_port = 8373
nss_db_path = '/etc/barbican/alias'
nss_db_path_ca = '/etc/barbican/alias-ca'
nss_password = 'password'
simple_cmc_profile = 'caOtherCert'
approved_profile_list = 'caServerCert'

[secretstore]
namespace = barbican.secretstore.plugin
enabled_secretstore_plugins = dogtag_crypto

```

--------------------------------

### Example of ffi.h not found error during tox tests on Mac

Source: https://docs.openstack.org/barbican/latest/configuration/troubleshooting.html

This error message indicates that the 'ffi.h' header file is not found, causing Barbican's tox tests to fail on a Mac.

```text
c/_cffi_backend.c:13:10: fatal error: 'ffi.h' file not found
... (truncated)
ERROR: could not install deps [...]; v = InvocationError('...', 1)

```

--------------------------------

### Example of clang error during tox tests on Mac

Source: https://docs.openstack.org/barbican/latest/configuration/troubleshooting.html

This is the error message seen when Barbican's tox tests fail on a Mac due to an unknown clang argument.

```text
clang: error: unknown argument: '-mno-fused-madd'

```

--------------------------------

### Example Match Statement

Source: https://docs.openstack.org/barbican/latest/admin/access_control.html

An example of a MATCH_STATEMENT in the policy file, showing how role-based access is enforced for creating new secrets.

```plaintext
"secrets:post": "role:admin or role:creator"
```

--------------------------------

### Create the `barbican` user

Source: https://docs.openstack.org/barbican/latest/install/install-ubuntu.html

This snippet shows how to create the `barbican` user.

```bash
$ openstack user create --domain default --password-prompt barbican

```

--------------------------------

### POST /v1/orders Request Example

Source: https://docs.openstack.org/barbican/latest/api/reference/orders.html

Example of a POST request to create an order, including headers and the request body with order type and metadata.

```http
POST /v1/orders
Headers:
    Content-Type: application/json
    X-Auth-Token: {token}

Content:
{
    "type":"key",
    "meta":
        {
            "name":"secretname",
            "algorithm": "AES",
            "bit_length": 256,
            "mode": "cbc",
            "payload_content_type":"application/octet-stream"
        }
}


```

--------------------------------

### Generate PEM file with trusted agent credentials

Source: https://docs.openstack.org/barbican/latest/configuration/dogtag_setup.html

This snippet shows how to create a PEM file with trusted agent credentials for Barbican to use when interacting with the Dogtag CA and KRA. It involves setting a password, user, and configuration directory, then using openssl to convert a PKCS12 file to PEM format and setting ownership.

```bash
PASSWORD=password
USER=barbican
BARBICAN_CONF_DIR=/etc/barbican
openssl pkcs12 -in /root/.dogtag/pki-tomcat/ca_admin_cert.p12 -passin pass:PASSWORD \
    -out $BARBICAN_CONF_DIR/kra_admin_cert.pem -nodes
chown $USER $BARBICAN_CONF_DIR/kra_admin_cert.pem

```

--------------------------------

### Install Python 3 development headers on Fedora

Source: https://docs.openstack.org/barbican/latest/contributor/testing.html

Installs necessary development headers for Python 3 on Fedora systems.

```bash
sudo dnf install python3-devel
```

--------------------------------

### Create Container Response

Source: https://docs.openstack.org/barbican/latest/api/reference/containers.html

Example response after successfully creating a container.

```json
{
    "container_ref": "https://{barbican_host}/v1/containers/{container_uuid}"
}
```

--------------------------------

### Build Barbican documentation

Source: https://docs.openstack.org/barbican/latest/contributor/dev.html

Builds the HTML documentation using tox.

```bash
tox -e docs

```

--------------------------------

### Create the barbican service entities

Source: https://docs.openstack.org/barbican/latest/install/install-ubuntu.html

This snippet shows how to create the barbican service entities.

```bash
$ openstack service create --name barbican --description "Key Manager" key-manager

```

--------------------------------

### Run the Barbican development server

Source: https://docs.openstack.org/barbican/latest/contributor/dev.html

Starts the Barbican API process, which will listen on http://localhost:9311.

```bash
bin/barbican-api

```

--------------------------------

### Browser Error Message

Source: https://docs.openstack.org/barbican/latest/configuration/troubleshooting.html

Example error message indicating an issue with the 'accept-encoding' header, potentially related to browser or network configurations.

```text
Secret retrieval issue seen - accept-encoding of 'gzip,deflate,sdch' not supported

```

--------------------------------

### POST /v1/orders Response Example

Source: https://docs.openstack.org/barbican/latest/api/reference/orders.html

Example of a successful (202 Accepted) response when creating an order, returning the order reference.

```json
{
    "order_ref": "http://{barbican_host}/v1/orders/{order_uuid}"
}

```

--------------------------------

### Install Python 3 development headers on Ubuntu/Debian

Source: https://docs.openstack.org/barbican/latest/contributor/testing.html

Installs necessary development headers for Python 3 on Ubuntu/Debian systems.

```bash
sudo apt-get install python3-dev
```

--------------------------------

### Run Barbican unit tests

Source: https://docs.openstack.org/barbican/latest/contributor/dev.html

Executes the unit test suite using tox.

```bash
tox -e py36

```

--------------------------------

### Configure Barbican directories and copy config files

Source: https://docs.openstack.org/barbican/latest/contributor/dev.html

Creates necessary directories, copies configuration files, and adjusts the api-paste.ini file.

```bash
# Create the directories and copy the config files
sudo mkdir /etc/barbican
sudo mkdir /var/lib/barbican
sudo chown $(whoami) /etc/barbican
sudo chown $(whoami) /var/lib/barbican
cp -r etc/barbican /etc
tox -e genconfig
cp etc/oslo-config-generator/barbican.conf /etc/barbican/barbican.conf
sed -i 's/\/v1: barbican-api-keystone/\/v1: barbican_api/' /etc/barbican/barbican-api-paste.ini

```

--------------------------------

### Restart the Key Manager services

Source: https://docs.openstack.org/barbican/latest/install/install-ubuntu.html

This snippet shows how to restart the Key Manager services.

```bash
# service barbican-keystone-listener restart
# service barbican-worker restart
# service apache2 restart

```

--------------------------------

### List Containers Request

Source: https://docs.openstack.org/barbican/latest/api/reference/containers.html

Example request to list a project's containers.

```http
GET /v1/containers
Headers:
    X-Auth-Token: <token>
```

--------------------------------

### GET /v1/secret-stores/{secret_store_id} Request/Response Example

Source: https://docs.openstack.org/barbican/latest/api/reference/store_backends.html

Example of a GET request to retrieve details of a specific secret store by its ID and its corresponding JSON response.

```http
GET /secret-stores/93869b0f-60eb-4830-adb9-e2f7154a080b
   Headers:
      X-Auth-Token: "f9cf2d480ba3485f85bdb9d07a4959f1"
      Accept: application/json

Response:
   HTTP/1.1 200 OK
   Content-Type: application/json

   {
      "status": "ACTIVE",
      "updated": "2016-08-22T23:46:45.124554",
      "name": "KMIP HSM",
      "created": "2016-08-22T23:46:45.124554",
      "secret_store_ref": "http://localhost:9311/v1/secret-stores/93869b0f-60eb-4830-adb9-e2f7154a080b",
      "global_default": False,
      "crypto_plugin": None,
      "secret_store_plugin": "kmip_plugin"
   }

```

--------------------------------

### List Containers Response

Source: https://docs.openstack.org/barbican/latest/api/reference/containers.html

Example response when listing containers.

```json
{
    "containers": [
        {
            "consumers": [],
            "container_ref": "https://{barbican_host}/v1/containers/{uuid}",
            "created": "2015-03-26T21:10:45.417835",
            "name": "container name",
            "secret_refs": [
                {
                    "name": "private_key",
                    "secret_ref": "https://{barbican_host}/v1/secrets/{uuid}"
                }
            ],
            "status": "ACTIVE",
            "type": "generic",
            "updated": "2015-03-26T21:10:45.417835"
        }
    ],
    "total": 1
}
```

--------------------------------

### Create Container Request

Source: https://docs.openstack.org/barbican/latest/api/reference/containers.html

Example request to create a new container.

```http
POST /v1/containers
Headers:
    X-Auth-Token: <token>

Content:
{
    "type": "generic",
    "name": "container name",
    "secret_refs": [
        {
            "name": "private_key",
            "secret_ref": "https://{barbican_host}/v1/secrets/{secret_uuid}"
        }
    ]
}
```

--------------------------------

### Install python-barbicanclient package on Red Hat Enterprise Linux and CentOS

Source: https://docs.openstack.org/barbican/latest/install/verify.html

Installs the python-barbicanclient package using dnf.

```bash
$ dnf install python-barbicanclient

```

--------------------------------

### Client Interaction Header

Source: https://docs.openstack.org/barbican/latest/api/microversions.html

Example HTTP header for specifying a desired API microversion.

```http
OpenStack-API-Version: key-manager 1.1

```

--------------------------------

### Configure database access

Source: https://docs.openstack.org/barbican/latest/install/install-ubuntu.html

This snippet shows how to configure database access in the `/etc/barbican/barbican.conf` file.

```ini
[DEFAULT]
...
sql_connection = mysql+pymysql://barbican:BARBICAN_DBPASS@controller/barbican

```

--------------------------------

### pkcs11-key-generation help command

Source: https://docs.openstack.org/barbican/latest/admin/pkcs11keygeneration.html

Displays the help message for the pkcs11-key-generation script, outlining its arguments and subcommands for MKEK and HMAC generation.

```bash
$ pkcs11-key-generation --help

usage: pkcs11-key-generation [-h] [--library-path LIBRARY_PATH]
                            [--passphrase PASSPHRASE] [--slot-id SLOT_ID]
                            {mkek,hmac} ...

Barbican MKEK & HMAC Generator

optional arguments:
  -h, --help            show this help message and exit
  --library-path LIBRARY_PATH
                        Path to vendor PKCS11 library
  --passphrase PASSPHRASE
                        Password to login to PKCS11 session
  --slot-id SLOT_ID     HSM Slot id (Should correspond to a configured PKCS11
                        slot)

subcommands:
  Action to perform

  {mkek,hmac}
    mkek                Generates a new MKEK.
    hmac                Generates a new HMAC.


```

--------------------------------

### Unit Test Example for Microversioned API

Source: https://docs.openstack.org/barbican/latest/contributor/microversions.html

Example of how to use the `set_version` function in unit tests to set the OpenStack-API-Version header for testing microversioned API methods.

```python
def test_should_get_secret_as_json_v1(self):
    utils.set_version(self.app, '1.1')
    secret = self._test_should_get_secret_as_json()
    self.assertIn('consumers', secret)

```

--------------------------------

### GET /v1/secrets/{uuid}/payload Response Example

Source: https://docs.openstack.org/barbican/latest/api/reference/secrets.html

Example of a successful response when retrieving the secret payload.

```text
200 OK

beer


```

--------------------------------

### Example unauthenticated request to Barbican

Source: https://docs.openstack.org/barbican/latest/contributor/dev.html

Demonstrates how to make a request to the Barbican API without authentication, using the X-Project-Id header.

```bash
curl -v -H 'X-Project-Id: 12345' \
        -H 'Accept: application/json' \
        http://localhost:9311/v1/secrets

```

--------------------------------

### GET /v1/secrets/{uuid} Response Example (Metadata)

Source: https://docs.openstack.org/barbican/latest/api/reference/secrets.html

Example of a successful response when retrieving secret metadata.

```json
{
    "status": "ACTIVE",
    "created": "2015-03-23T20:46:51.650515",
    "updated": "2015-03-23T20:46:51.654116",
    "expiration": "2015-12-28T19:14:44.180394",
    "algorithm": "aes",
    "bit_length": 256,
    "mode": "cbc",
    "name": "AES key",
    "secret_ref": "https://{barbican_host}/v1/secrets/{secret_uuid}",
    "secret_type": "opaque",
    "content_types": {
        "default": "application/octet-stream"
    }
}


```

--------------------------------

### GET /v1/secrets/{uuid} Request Example (Metadata)

Source: https://docs.openstack.org/barbican/latest/api/reference/secrets.html

Example of a request to retrieve a secret's metadata.

```http
GET /v1/secrets/{uuid}
Headers:
    Accept: application/json
    X-Auth-Token: {token}
    (or X-Project-Id: {project_id})


```

--------------------------------

### Create the `barbican` database

Source: https://docs.openstack.org/barbican/latest/install/install-ubuntu.html

This snippet shows how to create the `barbican` database using the MySQL client.

```bash
# mysql

```

--------------------------------

### Create the barbican database

Source: https://docs.openstack.org/barbican/latest/install/install-rdo.html

Steps to create the database and grant access privileges.

```bash
# mysql

```

```bash
CREATE DATABASE barbican;

```

```bash
GRANT ALL PRIVILEGES ON barbican.* TO 'barbican'@'localhost' \
  IDENTIFIED BY 'BARBICAN_DBPASS';
GRANT ALL PRIVILEGES ON barbican.* TO 'barbican'@'%' \
  IDENTIFIED BY 'BARBICAN_DBPASS';

```

```bash
exit;

```

--------------------------------

### Exit the database access client

Source: https://docs.openstack.org/barbican/latest/install/install-ubuntu.html

This snippet shows how to exit the MySQL client.

```bash
exit;

```

--------------------------------

### GET /v1/secrets/{uuid}/payload Request Example

Source: https://docs.openstack.org/barbican/latest/api/reference/secrets.html

Example of a request to retrieve the actual payload of a secret by setting the Accept header.

```http
GET /v1/secrets/{uuid}
Headers:
    Accept: application/octet-stream
    X-Auth-Token: <token>


```

--------------------------------

### List Secrets Request Example

Source: https://docs.openstack.org/barbican/latest/api/reference/secrets.html

Example of an HTTP GET request to list secrets with pagination and sorting parameters, including necessary headers.

```http
GET /v1/secrets?offset=1&limit=2&sort=created
Headers:
    Accept: application/json
    X-Auth-Token: {keystone_token}
    (or X-Project-Id: {project id})
```

--------------------------------

### GET /v1/containers/{uuid}/acl Request/Response (With no ACL defined)

Source: https://docs.openstack.org/barbican/latest/api/reference/acls.html

Example of a GET request to retrieve ACL for a container when no ACL is defined, and its successful response.

```http
GET /v1/containers/{uuid}/acl
Headers:
    X-Auth-Token: {token_id}

Response:

HTTP/1.1 200 OK
{
  "read":{
    "project-access": true
  }
}

```

--------------------------------

### Create a new database version file

Source: https://docs.openstack.org/barbican/latest/admin/barbican_manage.html

Creates a new database version file.

```bash
barbican-manage db revision [--db-url] [--message] [--autogenerate]
```

--------------------------------

### GET /v1/containers/{uuid}/acl Request/Response (With ACL defined)

Source: https://docs.openstack.org/barbican/latest/api/reference/acls.html

Example of a GET request to retrieve ACL for a container when an ACL is defined, and its successful response.

```http
GET /v1/containers/{uuid}/acl
Headers:
    X-Auth-Token: {token_id}

Response:

HTTP/1.1 200 OK
{
  "read":{
    "updated":"2015-05-12T20:08:47.644264",
    "created":"2015-05-12T19:23:44.019168",
    "users":[
      {user_id1},
      {user_id2},
      .....
    ],
    "project-access":{project-access-flag}
  }
}

```

--------------------------------

### Create an RSA keypair for public secret storage

Source: https://docs.openstack.org/barbican/latest/api/reference/secret_types.html

This example shows the initial step of creating an RSA keypair using the openssl command-line tool, which is a prerequisite for storing the public key in Barbican.

```bash
# Create the RSA keypair
openssl genrsa -out private.pem 2048

```

--------------------------------

### GET /v1/secrets/{uuid}/metadata Response

Source: https://docs.openstack.org/barbican/latest/api/reference/secret_metadata.html

Example response for listing secret metadata.

```json
{
  'metadata': {
    'description': 'contains the AES key',
    'geolocation': '12.3456, -98.7654'
    }
}

```

--------------------------------

### Multiple Plugin Configuration Example

Source: https://docs.openstack.org/barbican/latest/configuration/plugin_backends.html

This configuration snippet shows how to enable multiple secret store plugins and define individual store configurations.

```ini
[secretstore]
# Set to True when multiple plugin backends support is needed
enable_multiple_secret_stores = True
stores_lookup_suffix = software, kmip, pkcs11, dogtag, vault

[secretstore:software]
secret_store_plugin = store_crypto
crypto_plugin = simple_crypto

[secretstore:kmip]
secret_store_plugin = kmip_plugin
global_default = True

[secretstore:dogtag]
secret_store_plugin = dogtag_plugin

[secretstore:pkcs11]
secret_store_plugin = store_crypto
crypto_plugin = p11_crypto

[secretstore:vault]
secret_store_plugin = vault_plugin

```

--------------------------------

### List Secret Consumers Request

Source: https://docs.openstack.org/barbican/latest/api/reference/secret_consumers.html

Example GET request to list consumers for a secret.

```http
GET {secret_ref}/consumers
Headers:
    X-Auth-Token: <token>

```

--------------------------------

### Barbican Configuration File

Source: https://docs.openstack.org/barbican/latest/sample_config.html

This is a sample configuration file for Barbican, showing various options that can be set.

```ini
[DEFAULT]

#
# From barbican.common.config
#

# Role used to identify an authenticated user as administrator.
# (string value)
#admin_role = admin

# Allow unauthenticated users to access the API with read-only
# privileges. This only applies when using ContextMiddleware. (boolean
# value)
#allow_anonymous_access = false

# Maximum allowed http request size against the barbican-api. (integer
# value)
#max_allowed_request_size_in_bytes = 25000

# Maximum allowed secret size in bytes. (integer value)
#max_allowed_secret_in_bytes = 20000

# Host name, for use in HATEOAS-style references Note: Typically this
# would be the load balanced endpoint that clients would use to
# communicate back with this service. If a deployment wants to derive
# host from wsgi request instead then make this blank. Blank is needed
# to override default config value which is 'http://localhost:9311'
# (string value)
#host_href = http://localhost:9311

# Create the Barbican database on service startup. (boolean value)
#db_auto_create = false

# Maximum page size for the 'limit' paging URL parameter. (integer
# value)
#max_limit_paging = 100

# Default page size for the 'limit' paging URL parameter. (integer
# value)
#default_limit_paging = 10

# DEPRECATED: Accepts a class imported from the sqlalchemy.pool
# module, and handles the details of building the pool for you. If
# commented out, SQLAlchemy will select based on the database dialect.
# Other options are QueuePool (for SQLAlchemy-managed connections) and
# NullPool (to disabled SQLAlchemy management of connections). See
# http://docs.sqlalchemy.org/en/latest/core/pooling.html for more
# details (string value)
# This option is deprecated for removal.
# Its value may be silently ignored in the future.
# Reason: This option has been ineffective
#sql_pool_class = QueuePool

# Show SQLAlchemy pool-related debugging output in logs (sets DEBUG
# log level output) if specified. (boolean value)
#sql_pool_logging = false

#
# From cotyledon
#

# Enables or disables logging values of all registered options when
# starting a service (at DEBUG level). (boolean value)
# Note: This option can be changed without restarting.
#log_options = true

# Specify a timeout after which a gracefully shutdown server will
# exit. Zero value means endless wait. (integer value)
# Note: This option can be changed without restarting.
#graceful_shutdown_timeout = 60

#
# From oslo.log
#

# If set to true, the logging level will be set to DEBUG instead of
# the default INFO level. (boolean value)
# Note: This option can be changed without restarting.
#debug = false

# The name of a logging configuration file. This file is appended to
# any existing logging configuration files. For details about logging
# configuration files, see the Python logging module documentation.
# Note that when logging configuration files are used then all logging
# configuration is set in the configuration file and other logging
# configuration options are ignored (for example, log-date-format).
# (string value)
# Note: This option can be changed without restarting.
# Deprecated group/name - [DEFAULT]/log_config
#log_config_append = <None>

# Defines the format string for %%(asctime)s in log records. Default:
# %(default)s . This option is ignored if log_config_append is set.
# (string value)
#log_date_format = %Y-%m-%d %H:%M:%S

# (Optional) Name of log file to send logging output to. If no default
# is set, logging will go to stderr as defined by use_stderr. This
# option is ignored if log_config_append is set. (string value)
# Deprecated group/name - [DEFAULT]/logfile
#log_file = <None>

# (Optional) The base directory used for relative log_file  paths.
# This option is ignored if log_config_append is set. (string value)
# Deprecated group/name - [DEFAULT]/logdir
#log_dir = <None>

# Use syslog for logging. Existing syslog format is DEPRECATED and
# will be changed later to honor RFC5424. This option is ignored if
# log_config_append is set. (boolean value)
#use_syslog = false

# Enable journald for logging. If running in a systemd environment you
# may wish to enable journal support. Doing so will use the journal
# native protocol which includes structured metadata in addition to
# log messages.This option is ignored if log_config_append is set.
# (boolean value)
#use_journal = false

# Syslog facility to receive log lines. This option is ignored if
# log_config_append is set. (string value)
#syslog_log_facility = LOG_USER

# Use JSON formatting for logging. This option is ignored if
# log_config_append is set. (boolean value)
#use_json = false

# Log output to standard error. This option is ignored if
# log_config_append is set. (boolean value)
#use_stderr = false

# (Optional) Set the 'color' key according to log levels. This option

```

--------------------------------

### GET /v1/secret-stores/preferred Request/Response

Source: https://docs.openstack.org/barbican/latest/api/reference/store_backends.html

Example request and response for retrieving the preferred secret store for a project.

```http
Request:

  GET /v1/secret-stores/preferred
  Headers:
    X-Auth-Token: "f9cf2d480ba3485f85bdb9d07a4959f1"
    Accept: application/json


Response:

  HTTP/1.1 200 OK
  Content-Type: application/json

  {
    "status": "ACTIVE",
    "updated": "2016-08-22T23:46:45.114283",
    "name": "PKCS11 HSM",
    "created": "2016-08-22T23:46:45.114283",
    "secret_store_ref": "http://localhost:9311/v1/secret-stores/4d27b7a7-b82f-491d-88c0-746bd67dadc8",
    "global_default": True,
    "crypto_plugin": "p11_crypto",
    "secret_store_plugin": "store_crypto"
  }


```

--------------------------------

### GET /v1/secret-stores/global-default Request/Response

Source: https://docs.openstack.org/barbican/latest/api/reference/store_backends.html

Example request and response for retrieving the global default secret store for the deployment.

```http
Request:

  GET /v1/secret-stores/global-default
  Headers:
    X-Auth-Token: "f9cf2d480ba3485f85bdb9d07a4959f1"
    Accept: application/json


Response:

  HTTP/1.1 200 OK
  Content-Type: application/json

 {
    "status": "ACTIVE",
    "updated": "2016-08-22T23:46:45.114283",
    "name": "PKCS11 HSM",
    "created": "2016-08-22T23:46:45.114283",
    "secret_store_ref": "http://localhost:9311/v1/secret-stores/4d27b7a7-b82f-491d-88c0-746bd67dadc8",
    "global_default": True,
    "crypto_plugin": "p11_crypto",
    "secret_store_plugin": "store_crypto"
 }


```

--------------------------------

### GET Container Consumers Response (200 OK)

Source: https://docs.openstack.org/barbican/latest/api/reference/container_consumers.html

Example successful response for listing container consumers.

```json
{
    "total": 3,
    "consumers": [
        {
            "status": "ACTIVE",
            "URL": "consumerurl",
            "updated": "2015-10-15T21:06:33.123878",
            "name": "consumername",
            "created": "2015-10-15T21:06:33.123872"
        },
        {
            "status": "ACTIVE",
            "URL": "consumerURL2",
            "updated": "2015-10-15T21:17:08.092416",
            "name": "consumername2",
            "created": "2015-10-15T21:17:08.092408"
        },
        {
            "status": "ACTIVE",
            "URL": "consumerURL3",
            "updated": "2015-10-15T21:21:29.970370",
            "name": "consumername3",
            "created": "2015-10-15T21:21:29.970365"
        }
    ]
}

```

--------------------------------

### GET Container Consumers Request

Source: https://docs.openstack.org/barbican/latest/api/reference/container_consumers.html

Example request to list a container's consumers with default parameters.

```http
GET {container_ref}/consumers
Headers:
    X-Auth-Token: <token>

```

--------------------------------

### Populate the Key Manager service database

Source: https://docs.openstack.org/barbican/latest/install/install-ubuntu.html

This snippet shows how to manually populate the Key Manager service database.

```bash
$ su -s /bin/sh -c "barbican-manage db upgrade" barbican

```

--------------------------------

### GET /v1/secrets/{uuid}/metadata Request

Source: https://docs.openstack.org/barbican/latest/api/reference/secret_metadata.html

Example request to list a secret's user-defined metadata.

```http
GET /v1/secrets/{uuid}/metadata
Headers:
    Accept: application/json
    X-Auth-Token: <token>

```

--------------------------------

### Create the barbican user and service entities

Source: https://docs.openstack.org/barbican/latest/install/install-rdo.html

Steps to create the barbican user, assign roles, and create service entities.

```bash
$ openstack user create --domain default --password-prompt barbican

```

```bash
$ openstack role add --project service --user barbican admin

```

```bash
$ openstack role create creator

```

```bash
$ openstack role add --project service --user barbican creator

```

```bash
$ openstack service create --name barbican --description "Key Manager" key-manager

```

--------------------------------

### GET /v1/secrets/{uuid}/payload Request

Source: https://docs.openstack.org/barbican/latest/api/reference/secrets.html

Example request to retrieve a secret's payload, specifying the Accept header.

```http
GET /v1/secrets/{uuid}/payload
Headers:
    Accept: text/plain
    X-Auth-Token: <token>
```

--------------------------------

### GET /v1/secrets/{uuid}/metadata/{key} Response

Source: https://docs.openstack.org/barbican/latest/api/reference/secret_metadata.html

Example response for retrieving a specific secret metadata key/value pair.

```http
200 OK
{
  "key": "access-limit",
  "value": "0"
}

```
Tokens:
Raw