Difference between revisions of "Multi-Realm Keystone"
| Line 7: | Line 7: | ||
== The “Realm” == | == The “Realm” == | ||
| + | |||
| + | The concept of a “''realm''” originates with the Kerberos authentication system. Essentially, a realm, in the context of [[OpenStack]], is a set of services which all rely on a specific Keystone database for authentication. | ||
| + | |||
---- | ---- | ||
[[Category:Proposal]] | [[Category:Proposal]] | ||
Revision as of 19:33, 25 January 2012
Multi-realm Keystone
Introduction
Currently, in order to make use of a given OpenStack service—when Keystone is in use—, a token issued by Keystone must be presented in the request. This falls short of the federation goal, where a customer running an OpenStack instance could issue a request to a contracted service provider also running OpenStack, using their existing authentication tokens. In this proposal, I put forward a mechanism by which this federation can be accomplished, along with a terminology that can help simplify future discussions.
The “Realm”
The concept of a “realm” originates with the Kerberos authentication system. Essentially, a realm, in the context of OpenStack, is a set of services which all rely on a specific Keystone database for authentication.
