What is Openstack Keystone ?

By /

OpenStack Keystone is the identity service component of the OpenStack cloud computing platform. It provides authentication, authorization, and service catalog services for the other OpenStack services. Keystone allows users to authenticate themselves and obtain tokens that can be used to access other OpenStack services.

Here are some key aspects of Keystone:

  1. Authentication: Keystone provides authentication services to users, allowing them to prove their identity. It supports various authentication methods, such as username/password, token-based authentication, and external authentication mechanisms like LDAP or Active Directory.
  2. Authorization: Once a user is authenticated, Keystone handles authorization by enforcing access controls based on policies. It defines role-based access control (RBAC) policies that determine what actions a user can perform on specific resources within the OpenStack environment.
  3. Service Catalog: Keystone maintains a catalog of all the services available within the OpenStack deployment. This catalog provides information about the endpoints and API endpoints for each service, enabling users and services to discover and access the available resources.
  4. Tokens: Keystone issues tokens to users upon successful authentication. These tokens serve as proof of identity and are required to access other OpenStack services. Tokens have an expiration time, and Keystone supports various token formats, including UUID and PKI.
  5. Federation: Keystone supports federation, which allows users to authenticate against external identity providers (IdPs) such as SAML or OAuth2. This enables integration with external identity systems and simplifies the management of user credentials.
  6. Multi-domain Support: Keystone supports multi-domain environments, allowing the separation of users, roles, and policies across different administrative domains. This feature is particularly useful in large-scale deployments or when multiple organizations share the same OpenStack infrastructure.
  7. Identity Management: Keystone stores and manages user identities, roles, and projects. It provides a central identity store that can be integrated with external identity sources like LDAP or Active Directory.
  8. Integration with Other OpenStack Services: Keystone integrates with other OpenStack services by providing authentication and authorization services to these services. OpenStack services rely on Keystone for user authentication and authorization checks.
  9. RESTful API: Keystone exposes a RESTful API that enables administrators and developers to interact with the service programmatically. The API allows managing users, roles, projects, and other resources within Keystone.
  10. Scalability and High Availability: Keystone is designed to be scalable and highly available. It supports horizontal scaling by deploying multiple Keystone nodes behind a load balancer. It also supports replication and synchronization of data across multiple Keystone instances to ensure high availability.

Here are the main components of Keystone:

  1. Identity Service (keystone-api): The Identity Service API is the primary interface for interacting with Keystone. It exposes a RESTful API that allows clients to authenticate and obtain access tokens, manage users, projects, roles, and perform various administrative tasks related to identity management.
  2. Identity Manager (keystone-identity): The Identity Manager is responsible for managing users and their authentication credentials, such as passwords or tokens. It provides functionality to create, update, and delete user accounts, as well as authenticate users based on their credentials.
  3. Token Service (keystone-token): The Token Service generates and validates access tokens, which are used for authentication and authorization purposes. When a user successfully authenticates, the Token Service issues an access token that can be used to authorize subsequent requests to other OpenStack services.
  4. Catalog Service (keystone-catalog): The Catalog Service provides a central repository for service catalog information. It maintains a list of all available OpenStack services, their endpoints, and the corresponding APIs that can be accessed by authenticated users. The service catalog helps users discover and connect to the different services within an OpenStack deployment.
  5. Policy Engine (keystone-policy): The Policy Engine enforces authorization policies within Keystone. It defines a set of rules that determine what actions a user can perform based on their role and the requested resource. The Policy Engine evaluates these rules to make access control decisions and ensure that users are granted the appropriate level of access.
  6. Role-Based Access Control (RBAC): RBAC is a fundamental concept in Keystone that allows administrators to assign roles to users and groups. Roles define a set of permissions or privileges that determine what actions a user can perform within an OpenStack deployment. Keystone uses RBAC to enforce access controls and manage authorization across the various services.
  7. Backend Databases: Keystone requires backend databases to store its data. It supports multiple database options, including SQL-based databases like MySQL or PostgreSQL, as well as NoSQL databases like MongoDB. The backend databases store user accounts, roles, projects, tokens, and other identity-related information.

Overall, Keystone plays a critical role in providing secure and controlled access to the OpenStack infrastructure. It acts as a central identity management system, enabling authentication and authorization for users and services, while also maintaining a service catalog for resource discovery.

Scroll to Top