Difference between revisions of "Keystone"
| Line 20: | Line 20: | ||
** Call for blueprints (frozen by '''start '''of e-2: [[EssexReleaseSchedule|http://wiki.openstack.org/EssexReleaseSchedule]]) | ** Call for blueprints (frozen by '''start '''of e-2: [[EssexReleaseSchedule|http://wiki.openstack.org/EssexReleaseSchedule]]) | ||
*** [[Keystone-Essex-BP-UserStructure|User structure]] ([https://blueprints.launchpad.net/keystone/+spec/essex-keystone-user-structure blueprint]) | *** [[Keystone-Essex-BP-UserStructure|User structure]] ([https://blueprints.launchpad.net/keystone/+spec/essex-keystone-user-structure blueprint]) | ||
| − | *** [[Keystone-Essex-BP-AuthZ|AuthZ structure]] ([https://blueprints.launchpad.net/keystone/+spec/essex-keystone-authz-structure blueprint]) | + | *** [[Keystone-Essex-BP-AuthZ|Full AuthZ structure]] ([https://blueprints.launchpad.net/keystone/+spec/essex-keystone-authz-structure blueprint]) |
| − | *** [[Keystone-Essex-Scopes|Scopes]] | + | **** [[ AuthZ - Explicit Capability Mapping|AuthZ - Explicit Capability Mapping]] |
| + | **** [[AuthZ - Empty Roles]] | ||
| + | **** [[AuthZ - Empty Roles|AuthZ - Restricted Roles]] | ||
| + | ** [[Keystone-Essex-Scopes|Scopes]] | ||
*** [http://www.simplecloud.info/ SCIM protocol] (blueprint) | *** [http://www.simplecloud.info/ SCIM protocol] (blueprint) | ||
*** Federated Auth-Z requirements for Zones - [[FederatedAuthZwithZones]] | *** Federated Auth-Z requirements for Zones - [[FederatedAuthZwithZones]] | ||
Revision as of 15:37, 22 September 2011
What is Keystone?
Keystone is the identity service used by OpenStack for authentication (authN) and high-level authorization (authZ). It currently supports token-based authN and user-service authorization. It is scalable to include oAuth, SAML and openID in future versions. Out of the box, Keystone uses a SQLite DB as an identity store with the option to connect to external LDAP.
Doc
Code
Releases
- Diablo
- Core functionality (calls shared by all implementations)
- Extensions(calls that are specific to the implementation; ie: enabling company "ACME" user, role, and group structure)
- Essex (Keystone is part of OpenStack core for Essex)
- Call for blueprints (frozen by start of e-2: http://wiki.openstack.org/EssexReleaseSchedule)
- Scopes
- SCIM protocol (blueprint)
- Federated Auth-Z requirements for Zones - FederatedAuthZwithZones
- The Service (ie: nova) shouldn't really care about the Role of the user. But we should be able to go back to the Auth-Z service to say "Can <token> [execute verb] on <some resource>" and get back a True/False from keystone. Nova itself, for example, shouldn't have to remember what capabilities a role has. But this may be cached.
- Identifying full-path URI for Keystone-Token (Keystone-Essex-Federated-Token)
- SQL schema migrations (ie - sqlalchemy-migrate migrations).
