Identity Service in Openstack (Keystone)
- User name and password
- Central directory (IPA)
- Token-based authentication
- AWS-style logins (Amazon Web Services)
Identity Service Components
Token: A token is a randomly generated string of characters used to authenticate resource access.
User: A user is a consumer or administrator entity. It can log in and maybe assigned tokens for access to specific resources. Users can belong to multiple projects.
Project: A project is a unit of ownership that contains one or more users. You can look at projects as logical groups that are used to define users' privileges and scopes. Projects are sometimes referred to as tenants, particularly in the output for certain commands.
Credentials: Credentials consist of a user name and password, a user name and API key, or a Keystone authentication token.
Service: A service is a task-specific engine that provides an infrastructure function. It describes an OpenStack component and contains a name and topic that describes the type of service. Keystone is a service.
Service catalog: A service catalog is a selection of available OpenStack services with their API endpoint addresses.
Role: A role is a set of rights and privileges that can be assigned to a user.
Endpoint: An endpoint is a network-accessible address, usually described by URL, where a service is accessed. The location consists of a network address, the API for contacting the service, and any variable parameters that modify the service invocation, such as a dynamically passed user or project ID. For example, the Keystone service provides two endpoints: admin API, which listens at port 35357, and public API, which listens at port 5000.
Users and Projects:
- The number of volumes that can be created
- The total size of all volumes within a project, measured in gigabytes
- The number of instances that may be launched
- The number of processor cores that may be allocated
- The floating IP addresses are assigned to any instance when it launches so that the instance has consistent publicly accessible IP addresses
- Fixed IP addresses are assigned to the same instance each time it boots. These addresses can be publicly or privately accessible. Typically private IP addresses are used for management purposes.
Service Catalog:
- Admin URL is an administrative URL used only by the Identity service and is different from the Public URL, which is used by all other services.
- Internal URL is the URL of an internal-facing endpoint for the service. internal URL is typically the same as public URL.
- Public URL is the URL of the public-facing endpoint for the service.
- Region is the location in which the service exists. By default, if no region is specified, the RegionOne location is used.
Keystone authentication process:
- A user decides to launch an instance. User credentials are sent to Keystone, which creates a temporary token and sends a generic catalog.
- The user requests all projects. Keystone sends the temporary token and list of projects to the user.
- Keystone provides the user with a list of services.
- The user sends credentials with the desired project, and Keystone sends back a list of available services and a project token. The user determines the correct endpoint to launch the instance and provides the project token to that service.
- The service asks Keystone to verify the user’s project token and confirm permission to use the service.
- Keystone provides additional information and the token.
- Keystone verifies that the token belongs to the user and that it matches the user’s request, then authorizes the user’s access to the project and service. The service validates the request against its own policy.
- The service executes the request and creates the instance.
- The service reports the status back to the user, telling the user that the instance has been created and where the user can reach the instance.
 Keystone, the Identity service, manages the authentication and authorization infrastructure for th…){kind=link}