OpenStack实践系列②认证服务Keystone

htbzwd

　　OpenStack实践系列②认证服务Keystone
　　三、实战OpenStack之控制节点
3.1 CentOS7的时间同步服务器chrony
　　下载chrony



# yum install -y chrony
　　修改其配置文件



# vim /etc/chrony.conf
allow 192.168/16
　　chrony开机自启动，并且启动



# systemctl enable chronyd.service
# systemctl start chronyd.service
　　设置Centos7的时区为Asia/Shanghai



# timedatectl set-timezone Asia/Shanghai
　　查看时区和时间



# timedatectl status
Local time: Tue 2017-04-25 15:42:22 CST
Universal time: Tue 2017-04-25 07:42:22 UTC
RTC time: Tue 2017-04-25 15:42:22
Time zone: Asia/Shanghai (CST, +0800)
NTP enabled: yes
NTP synchronized: no
RTC in local TZ: no
DST active: n/a
# date
Tue Apr 25 15:42:58 CST 2017
　　3.2 配置mysql
　　Openstack的所有组件除了Horizon，都要用到数据库，本文使用的是MariaDB
拷贝配置文件



# cp /usr/share/mariadb/my-medium.cnf /etc/my.cnf
cp: overwrite ‘/etc/my.cnf’? y
　　
# vim /etc/my.cnf（在mysqld模块下添加如下内容）



[mysqld]
default-storage-engine = innodb # 默认的存储引擎
innodb_file_per_table # 使用独享的表空间
collation-server = utf8_general_ci # 设置校对标准
init-connect = 'SET NAMES utf8' # 设置连接的字符集
character-set-server = utf8 # 设置创建数据库时默认的字符集

　　开机自启和启动mysql



# systemctl enable mariadb.service
Created symlink from /etc/systemd/system/multi-user.target.wants/mariadb.service to /usr/lib/systemd/system/mariadb.service.
[iyunv@node1 ~]# systemctl start mariadb.service
[iyunv@node1 ~]# systemctl status mariadb.service
● mariadb.service - MariaDB 10.1 database server
Loaded: loaded (/usr/lib/systemd/system/mariadb.service; enabled; vendor preset: disabled)
Active: active (running) since Tue 2017-04-25 15:50:54 CST; 10s ago
Process: 21977 ExecStartPost=/usr/libexec/mysql-check-upgrade (code=exited, status=0/SUCCESS)
Process: 21790 ExecStartPre=/usr/libexec/mysql-prepare-db-dir %n (code=exited, status=0/SUCCESS)
Process: 21765 ExecStartPre=/usr/libexec/mysql-check-socket (code=exited, status=0/SUCCESS)
Main PID: 21947 (mysqld)
Status: "Taking your SQL requests now..."
CGroup: /system.slice/mariadb.service
└─21947 /usr/libexec/mysqld --basedir=/usr
Apr 25 15:50:54 node1.chinasoft.com mysql-prepare-db-dir[21790]: '/usr/bin/mysql_secure_installation'
Apr 25 15:50:54 node1.chinasoft.com mysql-prepare-db-dir[21790]: which will also give you the option of removing the test
Apr 25 15:50:54 node1.chinasoft.com mysql-prepare-db-dir[21790]: databases and anonymous user created by default. This is
Apr 25 15:50:54 node1.chinasoft.com mysql-prepare-db-dir[21790]: strongly recommended for production servers.
Apr 25 15:50:54 node1.chinasoft.com mysql-prepare-db-dir[21790]: See the MariaDB Knowledgebase at http://mariadb.com/kb or the
Apr 25 15:50:54 node1.chinasoft.com mysql-prepare-db-dir[21790]: MySQL manual for more instructions.
Apr 25 15:50:54 node1.chinasoft.com mysql-prepare-db-dir[21790]: Please report any problems at http://mariadb.org/jira
Apr 25 15:50:54 node1.chinasoft.com mysql-prepare-db-dir[21790]: The latest information about MariaDB is available at http://mariadb.org/.
Apr 25 15:50:54 node1.chinasoft.com mysqld[21947]: 2017-04-25 15:50:54 140071239162048 [Note] /usr/libexec/mysqld (mysqld 10.1.20-MariaDB) starting as process 21947 ...
Apr 25 15:50:54 node1.chinasoft.com systemd[1]: Started MariaDB 10.1 database server.
Hint: Some lines were ellipsized, use -l to show in full.
　　设置mysql密码，关闭匿名用户，删除测试数据库
　　[iyunv@node1 ~]# mysql_secure_installation
　　创建所有组件的库并授权(生产环境建议配置复杂密码)



# mysql -uroot -proot
执行sql
CREATE DATABASE keystone;
GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'localhost' IDENTIFIED BY 'keystone';
GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'%' IDENTIFIED BY 'keystone';
CREATE DATABASE glance;
GRANT ALL PRIVILEGES ON glance.* TO 'glance'@'localhost' IDENTIFIED BY 'glance';
GRANT ALL PRIVILEGES ON glance.* TO 'glance'@'%' IDENTIFIED BY 'glance';
CREATE DATABASE nova;
GRANT ALL PRIVILEGES ON nova.* TO 'nova'@'localhost' IDENTIFIED BY 'nova';
GRANT ALL PRIVILEGES ON nova.* TO 'nova'@'%' IDENTIFIED BY 'nova';
CREATE DATABASE neutron;
GRANT ALL PRIVILEGES ON neutron.* TO 'neutron'@'localhost' IDENTIFIED BY 'neutron';
GRANT ALL PRIVILEGES ON neutron.* TO 'neutron'@'%' IDENTIFIED BY 'neutron';
CREATE DATABASE cinder;
GRANT ALL PRIVILEGES ON cinder.* TO 'cinder'@'localhost' IDENTIFIED BY 'cinder';
GRANT ALL PRIVILEGES ON cinder.* TO 'cinder'@'%' IDENTIFIED BY 'cinder';



MariaDB [mysql]> show databases;
+--------------------+
| Database |
+--------------------+
| cinder |
| glance |
| information_schema |
| keystone |
| mysql |
| neutron |
| nova |
| performance_schema |
+--------------------+
8 rows in set (0.00 sec)
　　3.3 Rabbit消息队列
　　SOA架构：面向服务的体系结构是一个组件模型，它将应用程序的不同功能单元（称为服务）通过这些服务之间定义良好的接口和契约联系起来。接口是采用中立的方式进行定义的，它应该独立于实现服务的硬件平台、操作系统和编程语言。这使得构建在各种各样的系统中的服务可以使用一种统一和通用的方式进行交互。
在这里Openstack采用了SOA架构方案，结合了SOA架构的松耦合特点，单独组件单独部署，每个组件之间可能互为消费者和提供者，通过消息队列（openstack 支持Rabbitmq，Zeromq，Qpid）进行通信，保证了当某个服务当掉的情况，不至于其他都当掉。
　　启动Rabbitmq



[iyunv@node1 ~]# systemctl enable rabbitmq-server.service
Created symlink from /etc/systemd/system/multi-user.target.wants/rabbitmq-server.service to /usr/lib/systemd/system/rabbitmq-server.service.
[iyunv@node1 ~]# systemctl start rabbitmq-server.service
　　新建Rabbitmq用户并授权



[iyunv@node1 ~]# rabbitmqctl add_user openstack openstack
Creating user "openstack" ...
[iyunv@node1 ~]# rabbitmqctl set_permissions openstack ".*" ".*" ".*"
Setting permissions for user "openstack" in vhost "/" ...
　　启用Rabbitmq的web管理插件



[iyunv@node1 ~]# rabbitmq-plugins enable rabbitmq_management
　　重启Rabbitmq



[iyunv@node1 ~]# systemctl restart rabbitmq-server.service
　　查看Rabbit的端口，其中5672是服务端口，15672是web管理端口，25672是做集群的端口



[iyunv@node1 ~]# netstat -lntup|grep 5672
tcp 0 0 0.0.0.0:15672 0.0.0.0:* LISTEN 23058/beam.smp
tcp 0 0 0.0.0.0:25672 0.0.0.0:* LISTEN 23058/beam.smp
tcp6 0 0 :::5672 :::* LISTEN 23058/beam.smp
　　在web界面添加openstack用户，设置权限，首次登陆必须使用账号和密码必须都是guest
http://192.168.3.199:15672/
　　role设置为administrator，并设置openstack的密码

　　3.4 Keystone组件
　　修改keystone的配置文件用作无用户时，创建用户来链接，此内容使用openssl随机产生



# openssl rand -hex 15
4ab82b3da89d10c47243bd54487d2d
# vim /etc/keystone/keystone.conf
admin_token = 4ab82b3da89d10c47243bd54487d2d
connection = mysql://keystone:keystone@192.168.3.199/keystone # [database] 部分 用作链接数据库，三个keysthone分别为keystone组件，keystone用户名，mysql中的keysthone库名
　　切换到keystone用户，导入keystoe数据库



# su -s /bin/sh -c "keystone-manage db_sync" keystone
　　检查数据库导入结果



MariaDB [keystone]> show tables;
+------------------------+
| Tables_in_keystone |
+------------------------+
| access_token |
| assignment |
| config_register |
| consumer |
| credential |
| domain |
| endpoint |
| endpoint_group |
| federation_protocol |
| group |
| id_mapping |
| identity_provider |
| idp_remote_ids |
| mapping |
| migrate_version |
| policy |
| policy_association |
| project |
| project_endpoint |
| project_endpoint_group |
| region |
| request_token |
| revocation_event |
| role |
| sensitive_config |
| service |
| service_provider |
| token |
| trust |
| trust_role |
| user |
| user_group_membership |
| whitelisted_config |
+------------------------+
33 rows in set (0.00 sec)
　　# cd /var/log/keystone/
# ll
total 8
-rw-r--r-- 1 keystone keystone 7064 Apr 25 16:17 keystone.log（通过切换到keystone用户下导入数据库，当启动的时候回把日志写入到该日志中，如果使用root执行倒库操作，则无法通过keysthone启动keystone程序）
　　继续修改/etc/keystone/keystone.conf配置



# vim /etc/keystone/keystone.conf
verbose = true # 开启debug模式
servers = 127.0.0.1:11211 # [memcache]部分 更改servers标签，填写memcache地址
driver = sql # [revoke] 部分 开启默认sql驱动
provider = uuid # [token] 部分 开启并使用唯一识别码
driver = memcache # [token] 部分 (使用用户密码生成token时，存储到memcache中，高性能提供服务)
　　查看更改结果



# grep -n "^[a-Z]" /etc/keystone/keystone.conf
12:admin_token = 4ab82b3da89d10c47243bd54487d2d
107:verbose = true
495:connection = mysql://keystone:keystone@192.168.3.199/keystone
1313:servers = 127.0.0.1:11211
1718:driver = sql
1911:provider = uuid
1916:driver = memcache
　　注意：
memcache配置
很多教程配置都是直接绑定在eth0上，默认安装memcache以后只监听在127.0.0.1上，一定要注意，否则后面keystone认证的时候会报错(大坑)
servers = 192.168.3.199:11211
配置可以用telnet 192.168.3.199 11211验证被拒绝
　　修改Memcached配置



# cat /etc/sysconfig/memcached
PORT="11211"
USER="memcached"
MAXCONN="1024"
CACHESIZE="64"
OPTIONS="-l 0.0.0.0,::1" # 改为0.0.0.0这样就监听在了所有网卡上
　　添加一个apache的wsgi-keystone配置文件，其中5000端口是提供该服务的，35357是为admin提供管理用的
[iyunv@node1 keystone]# vim /etc/httpd/conf.d/wsgi-keystone.conf



Listen 5000
Listen 35357
<VirtualHost *:5000>
WSGIDaemonProcess keystone-public processes=5 threads=1 user=keystone group=keystone display-name=%{GROUP}
WSGIProcessGroup keystone-public
WSGIScriptAlias / /usr/bin/keystone-wsgi-public
WSGIApplicationGroup %{GLOBAL}
WSGIPassAuthorization On
<IfVersion >= 2.4>
ErrorLogFormat "%{cu}t %M"
</IfVersion>
ErrorLog /var/log/httpd/keystone-error.log
CustomLog /var/log/httpd/keystone-access.log combined
<Directory /usr/bin>
<IfVersion >= 2.4>
Require all granted
</IfVersion>
<IfVersion < 2.4>
Order allow,deny
Allow from all
</IfVersion>
</Directory>
</VirtualHost>
<VirtualHost *:35357>
WSGIDaemonProcess keystone-admin processes=5 threads=1 user=keystone group=keystone display-name=%{GROUP}
WSGIProcessGroup keystone-admin
WSGIScriptAlias / /usr/bin/keystone-wsgi-admin
WSGIApplicationGroup %{GLOBAL}
WSGIPassAuthorization On
<IfVersion >= 2.4>
ErrorLogFormat "%{cu}t %M"
</IfVersion>
ErrorLog /var/log/httpd/keystone-error.log
CustomLog /var/log/httpd/keystone-access.log combined
<Directory /usr/bin>
<IfVersion >= 2.4>
Require all granted
</IfVersion>
<IfVersion < 2.4>
Order allow,deny
Allow from all
</IfVersion>
</Directory>
</VirtualHost>
　　配置apache的servername,如果不配置servername，会影响keystone服务



[iyunv@node1 keystone]# vim /etc/httpd/conf/httpd.conf
ServerName 192.168.3.199:80
　　启动memcached，httpd，keystone



[iyunv@node1 keystone]# systemctl enable memcached httpd
Created symlink from /etc/systemd/system/multi-user.target.wants/memcached.service to /usr/lib/systemd/system/memcached.service.
Created symlink from /etc/systemd/system/multi-user.target.wants/httpd.service to /usr/lib/systemd/system/httpd.service.
[iyunv@node1 keystone]# systemctl start memcached httpd
　　修改默认的memcached监听地址127.0.0.1为0.0.0.0



[iyunv@node1 ~]# cat /etc/sysconfig/memcached
PORT="11211"
USER="memcached"
MAXCONN="1024"
CACHESIZE="64"
OPTIONS="-l 0.0.0.0,::1"
　　查看httpd占用端口情况



[iyunv@node1 keystone]# netstat -lntup|grep httpd
tcp6 0 0 :::80 :::* LISTEN 24007/httpd
tcp6 0 0 :::35357 :::* LISTEN 24007/httpd
tcp6 0 0 :::5000 :::* LISTEN 24007/httpd
　　创建用户并连接keystone，在这里可以使用两种方式，通过keystone –help后家参数的方式，或者使用环境变量env的方式，下面就将使用环境变量的方式,分别设置了token，API及控制版本（SOA中很适用）



[iyunv@node1 keystone]# export OS_TOKEN=4ab82b3da89d10c47243bd54487d2d
[iyunv@node1 keystone]# export OS_URL=http://192.168.3.199:35357/v3
[iyunv@node1 keystone]# export OS_IDENTITY_API_VERSION=3
　　创建admin项目（project）



[iyunv@node1 keystone]# openstack project create --domain default --description "Admin Project" admin
+-------------+----------------------------------+
| Field | Value |
+-------------+----------------------------------+
| description | Admin Project |
| domain_id | default |
| enabled | True |
| id | ddbd3b664df640fb842f791c1c852f8a |
| is_domain | False |
| name | admin |
| parent_id | None |
+-------------+----------------------------------+
　　
创建admin用户（user）并设置密码（生产环境建议设置复杂密码）



[iyunv@node1 keystone]# openstack user create --domain default --password-prompt admin
User Password:
Repeat User Password:
+-----------+----------------------------------+
| Field | Value |
+-----------+----------------------------------+
| domain_id | default |
| enabled | True |
| id | 0d0e11a89eec4b9f9812491f967bfc29 |
| name | admin |
+-----------+----------------------------------+
　　创建admin的角色（role）



[iyunv@node1 keystone]# openstack role create admin
+-------+----------------------------------+
| Field | Value |
+-------+----------------------------------+
| id | e07056a7929640eea958d01519d16de4 |
| name | admin |
+-------+----------------------------------+
　　把admin用户加到admin项目，赋予admin角色，把角色，项目，用户关联起来



[iyunv@node1 keystone]# openstack role add --project admin --user admin admin
　　创建一个普通用户demo,demo项目，角色为普通用户（uesr），并把它们关联起来



[iyunv@node1 keystone]# openstack project create --domain default --description "Demo Project" demo
+-------------+----------------------------------+
| Field | Value |
+-------------+----------------------------------+
| description | Demo Project |
| domain_id | default |
| enabled | True |
| id | 019eaae6f6c049658da8d7c6776201d7 |
| is_domain | False |
| name | demo |
| parent_id | None |
+-------------+----------------------------------+
　　配置密码也为demo



[iyunv@node1 keystone]# openstack user create --domain default --password=demo demo
+-----------+----------------------------------+
| Field | Value |
+-----------+----------------------------------+
| domain_id | default |
| enabled | True |
| id | 09e4d0b4d57c45e29cea321d1f620de3 |
| name | demo |
+-----------+----------------------------------+
[iyunv@node1 keystone]# openstack role create user
+-------+----------------------------------+
| Field | Value |
+-------+----------------------------------+
| id | 12d9c22c247149e79af8c28e2ef1066c |
| name | user |
+-------+----------------------------------+
[iyunv@node1 keystone]# openstack role add --project demo --user demo user
　　创建一个service的项目，此服务用来管理nova，neuturn，glance等组件的服务



[iyunv@node1 keystone]# openstack project create --domain default --description "Service Project" service
+-------------+----------------------------------+
| Field | Value |
+-------------+----------------------------------+
| description | Service Project |
| domain_id | default |
| enabled | True |
| id | 7721ff49147445ad8bbc87a3e37534ec |
| is_domain | False |
| name | service |
| parent_id | None |
+-------------+----------------------------------+
查看创建的用户,角色，项目
[iyunv@node1 keystone]# openstack user list
+----------------------------------+-------+
| ID | Name |
+----------------------------------+-------+
| 09e4d0b4d57c45e29cea321d1f620de3 | demo |
| 0d0e11a89eec4b9f9812491f967bfc29 | admin |
+----------------------------------+-------+
[iyunv@node1 keystone]# openstack project list
+----------------------------------+---------+
| ID | Name |
+----------------------------------+---------+
| 019eaae6f6c049658da8d7c6776201d7 | demo |
| 7721ff49147445ad8bbc87a3e37534ec | service |
| ddbd3b664df640fb842f791c1c852f8a | admin |
+----------------------------------+---------+
[iyunv@node1 keystone]# openstack role list
+----------------------------------+-------+
| ID | Name |
+----------------------------------+-------+
| 12d9c22c247149e79af8c28e2ef1066c | user |
| e07056a7929640eea958d01519d16de4 | admin |
+----------------------------------+-------+
　　注册keystone服务，虽然keystone本身是搞注册的，但是自己也需要注册服务
创建keystone认证



[iyunv@node1 keystone]# openstack service create --name keystone --description "OpenStack Identity" identity
+-------------+----------------------------------+
| Field | Value |
+-------------+----------------------------------+
| description | OpenStack Identity |
| enabled | True |
| id | 826594136e754665bc7c2ffd61e5c60d |
| name | keystone |
| type | identity |
+-------------+----------------------------------+
　　分别创建三种类型的endpoint,分别为public:对外可见，internal内部使用，admin管理使用



[iyunv@node1 keystone]# openstack endpoint create --region RegionOne identity public http://192.168.3.199:5000/v2.0
+--------------+----------------------------------+
| Field | Value |
+--------------+----------------------------------+
| enabled | True |
| id | 1cd6d3b8cb55480eb830722cb8032b04 |
| interface | public |
| region | RegionOne |
| region_id | RegionOne |
| service_id | 826594136e754665bc7c2ffd61e5c60d |
| service_name | keystone |
| service_type | identity |
| url | http://192.168.3.199:5000/v2.0 |
+--------------+----------------------------------+
[iyunv@node1 keystone]# openstack endpoint create --region RegionOne identity internal http://192.168.3.199:5000/v2.0
+--------------+----------------------------------+
| Field | Value |
+--------------+----------------------------------+
| enabled | True |
| id | fe67f7ff5f5344f0aa24079fcd7e9999 |
| interface | internal |
| region | RegionOne |
| region_id | RegionOne |
| service_id | 826594136e754665bc7c2ffd61e5c60d |
| service_name | keystone |
| service_type | identity |
| url | http://192.168.3.199:5000/v2.0 |
+--------------+----------------------------------+
[iyunv@node1 keystone]# openstack endpoint create --region RegionOne identity admin http://192.168.3.199:35357/v2.0
+--------------+----------------------------------+
| Field | Value |
+--------------+----------------------------------+
| enabled | True |
| id | 803bfebdac67435180a0fa0a6df6acba |
| interface | admin |
| region | RegionOne |
| region_id | RegionOne |
| service_id | 826594136e754665bc7c2ffd61e5c60d |
| service_name | keystone |
| service_type | identity |
| url | http://192.168.3.199:35357/v2.0 |
+--------------+----------------------------------+
　　查看创建的endpoint



[iyunv@node1 keystone]# openstack endpoint list
+----------------------------------+-----------+--------------+--------------+---------+-----------+---------------------------------+
| ID | Region | Service Name | Service Type | Enabled | Interface | URL |
+----------------------------------+-----------+--------------+--------------+---------+-----------+---------------------------------+
| 1cd6d3b8cb55480eb830722cb8032b04 | RegionOne | keystone | identity | True | public | http://192.168.3.199:5000/v2.0 |
| 803bfebdac67435180a0fa0a6df6acba | RegionOne | keystone | identity | True | admin | http://192.168.3.199:35357/v2.0 |
| fe67f7ff5f5344f0aa24079fcd7e9999 | RegionOne | keystone | identity | True | internal | http://192.168.3.199:5000/v2.0 |
+----------------------------------+-----------+--------------+--------------+---------+-----------+---------------------------------+
　　链接到keystone，请求token，在这里由于已经添加了用户名和密码，就不再使用token，所有就一定要取消环境变量了



[iyunv@node1 ~]# unset OS_TOKEN
[iyunv@node1 ~]# unset OS_URL
[iyunv@node1 ~]# openstack --os-auth-url http://192.168.3.199:35357/v3 --os-project-domain-id default --os-user-domain-id default --os-project-name admin --os-username admin --os-auth-type password token issue
Password:
+------------+----------------------------------+
| Field | Value |
+------------+----------------------------------+
| expires | 2017-04-25T12:12:44.648250Z |
| id | b63b05cb3a6d4c438a072d501ad64355 |
| project_id | 7340dd86a8b14e73ac36b6d6385c689c |
| user_id | 4e857cca196e44d6994a3bee058a0274 |
+------------+----------------------------------+
　　
报错记录：
[iyunv@node1 keystone]# openstack --os-auth-url http://192.168.3.199:35357/v3 --os-project-domain-id default --os-user-domain-id default --os-project-name admin --os-username admin --os-auth-type password token issue
An unexpected error prevented the server from fulfilling your request. (HTTP 500) (Request-ID: req-1d330a83-ab77-4e0f-8e42-1c8d461aea3b)
　　通过看日志也没看出啥(/var/log/httpd/keystone-access.log  keystone-error.log)，其实是memcached监听的IP需要由192.168.3.199改为127.0.0.1
下面的报错可以忽略
2017-04-25 19:05:40.954308 No handlers could be found for logger "oslo_config.cfg"
创建OpenStack的客户端环境的脚本
　　配置admin和demo用户的环境变量，并添加执行权限，以后执行命令,直接source一下就行了



[iyunv@linux-node1 ~]# cat admin-openrc.sh
export OS_PROJECT_DOMAIN_ID=default
export OS_USER_DOMAIN_ID=default
export OS_PROJECT_NAME=admin
export OS_TENANT_NAME=admin
export OS_USERNAME=admin
export OS_PASSWORD=admin
export OS_AUTH_URL=http://192.168.3.199:35357/v3
export OS_IDENTITY_API_VERSION=3
[iyunv@linux-node1 ~]# cat demo-openrc.sh
export OS_PROJECT_DOMAIN_ID=default
export OS_USER_DOMAIN_ID=default
export OS_PROJECT_NAME=demo
export OS_TENANT_NAME=demo
export OS_USERNAME=demo
export OS_PASSWORD=demo
export OS_AUTH_URL=http://192.168.3.199:5000/v3
export OS_IDENTITY_API_VERSION=3
[iyunv@node1 ~]# chmod +x demo-openrc.sh
[iyunv@node1 ~]# chmod +x admin-openrc.sh
[iyunv@node1 ~]# source admin-openrc.sh



[iyunv@node1 ~]# openstack token issue
+------------+----------------------------------+
| Field | Value |
+------------+----------------------------------+
| expires | 2017-04-25T12:20:48.242121Z |
| id | c0d9510f39034b779479af4a91f8f3b2 |
| project_id | 7340dd86a8b14e73ac36b6d6385c689c |
| user_id | 4e857cca196e44d6994a3bee058a0274 |
+------------+----------------------------------+