Configuring Keystone

Configuring Keystone

Identity sources

One of the most impactful decisions you’ll have to make when configuring keystone is deciding how you want keystone to source your identity data. Keystone supports several different choices that will substantially impact how you’ll configure, deploy, and interact with keystone.

You can also mix-and-match various sources of identity (see Domain-specific Configuration for an example). For example, you can store OpenStack service users and their passwords in SQL, manage customers in LDAP, and authenticate employees via SAML federation.

Summary

Feature Status REMOTE_USER LDAP OAuth v1.0a OpenID Connect SAML v2 SQL
Local authentication optional
External authentication optional
Identity management optional
PCI-DSS controls optional
Auditing optional

Details

  • Local authentication

    Status: optional. Authenticate with keystone by providing credentials directly to keystone.

    drivers:

    • REMOTE_USER: missing
    • OpenID Connect: missing
    • SAML v2: missing
    • LDAP: complete
    • OAuth v1.0a: complete
    • SQL: complete

  • External authentication

    Status: optional. Authenticate with keystone by providing credentials to an external system that keystone trusts (as with federation).

    drivers:

    • REMOTE_USER: complete
    • OpenID Connect: complete
    • SAML v2: complete
    • LDAP: missing
    • OAuth v1.0a: missing
    • SQL: missing

  • Identity management

    Status: optional. Create, update, enable/disable, and delete users via Keystone’s HTTP API.

    drivers:

    • REMOTE_USER: missing
    • OpenID Connect: missing
    • SAML v2: missing
    • LDAP: partial
    • OAuth v1.0a: complete
    • SQL: complete

  • PCI-DSS controls

    Status: optional. Configure keystone to enforce PCI-DSS compliant security controls.

    drivers:

    • REMOTE_USER: partial
    • OpenID Connect: missing
    • SAML v2: missing
    • LDAP: partial
    • OAuth v1.0a: missing
    • SQL: complete

  • Auditing

    Status: optional. Audit authentication flows using PyCADF.

    drivers:

    • REMOTE_USER: missing
    • OpenID Connect: complete
    • SAML v2: complete
    • LDAP: complete
    • OAuth v1.0a: missing
    • SQL: complete

Creative Commons Attribution 3.0 License

Except where otherwise noted, this document is licensed under Creative Commons Attribution 3.0 License. See all OpenStack Legal Documents.