Difference between revisions of "Keystone"

Revision as of 19:54, 25 February 2012

What is Keystone?

Keystone is the identity service used by OpenStack for authentication (authN) and high-level authorization (authZ). It currently supports token-based authN and user-service authorization. It has recently been rearchitected to allow for expansion to support proxying external services and AuthN/AuthZ mechanisms such as oAuth, SAML and openID in future versions.

Meetings

http://wiki.openstack.org/Meetings/KeystoneMeeting

Doc

http://keystone.openstack.org

Code

Source
- https://github.com/openstack/keystone
Pending Code Reviews:
- https://review.openstack.org/#q,status:open+keystone,n,z

Bugs and Blueprints

Use Cases

KeystoneUseCases

Essex Roadmap (as per current discussions in OpenStack Design Summit in Boston - October 2011):

RBAC (with Dashboard and core project integration) <
>
- Fine-grained access control
- Non-admin users
- Create your own roles
- RBAC discussions: http://etherpad.openstack.org/canhaz
Reset baseline of code
- expandability, future development
Stability
- Performance
- Deployability
- Documentation

Topics for Folsom: KeystoneFolsomSummitTopics

Releases

Diablo
- Core functionality (calls shared by all implementations)
- Extensions(calls that are specific to the implementation; ie: enabling company "ACME" user, role, and group structure)
Essex (Keystone is part of OpenStack core for Essex)
- Call for blueprints (feature freeze by start of e-2; code freeze by start of e-4: http://wiki.openstack.org/EssexReleaseSchedule)
Folsom
- KeystoneFolsomSummitTopics

Originally Scheduled for Essex:

User structure (blueprint)
Full AuthZ structure (blueprint)
AuthZ - Explicit Capability Mapping
AuthZ - Empty Roles
AuthZ - Restricted Roles
Scopes
SCIM protocol (blueprint)
Service endpoint location (https://blueprints.launchpad.net/keystone/+spec/service-endpoint-location)
Federated Auth-Z requirements for Zones - FederatedAuthZwithZones
The Service (ie: nova) shouldn't really care about the Role of the user. But we should be able to go back to the Auth-Z service to say "Can <token> [execute verb] on <some resource>" and get back a True/False from keystone. Nova itself, for example, shouldn't have to remember what capabilities a role has. But this may be cached.
Identifying full-path URI for Keystone-Token (Keystone-Essex-Federated-Token)
SQL schema migrations (ie - sqlalchemy-migrate migrations).
Folsom
- Summit Topics

@@ Line 18: / Line 18: @@
 * Pending Code Reviews:
 ** https://review.openstack.org/#q,status:open+keystone,n,z
-* [https://bugs.launchpad.net/keystone/+bugs?field.searchtext=&orderby=-importance&field.status%3Alist=NEW&field.status%3Alist=CONFIRMED&field.status%3Alist=TRIAGED&field.status%3Alist=INPROGRESS&field.status%3Alist=INCOMPLETE_WITH_RESPONSE&field.status%3Alist=INCOMPLETE_WITHOUT_RESPONSE&assignee_option=any&field.tags_combinator=ANY&field.omit_dupes=on&field.has_branches=on&field.has_no_branches=on&field.has_blueprints=on&field.has_no_blueprints=on   Open Bugs]
+'''Bugs and Blueprints'''
+* [https://bugs.launchpad.net/keystone/+bugs?orderby=-importance&field.status%3Alist=NEW&field.status%3Alist=CONFIRMED&field.status%3Alist=TRIAGED&field.status%3Alist=INPROGRESS&field.status%3Alist=INCOMPLETE_WITH_RESPONSE&field.status%3Alist=INCOMPLETE_WITHOUT_RESPONSE&assignee_option=any&field.tag=-python-keystoneclient&field.tags_combinator=ANY&field.omit_dupes=on&field.has_branches=on&field.has_no_branches=on&field.has_blueprints=on&field.has_no_blueprints=on   keystone bugs]
+* [https://bugs.launchpad.net/keystone/+bugs?orderby=-importance&field.status%3Alist=NEW&field.status%3Alist=CONFIRMED&field.status%3Alist=TRIAGED&field.status%3Alist=INPROGRESS&field.status%3Alist=INCOMPLETE_WITH_RESPONSE&field.status%3Alist=INCOMPLETE_WITHOUT_RESPONSE&assignee_option=any&field.tag=python-keystoneclient&field.tags_combinator=ANY&field.omit_dupes=on&field.has_branches=on&field.has_no_branches=on&field.has_blueprints=on&field.has_no_blueprints=on   keystone bugs]
 '''Use Cases'''