Multi-Realm Keystone

Multi-realm Keystone

Introduction

Currently, in order to make use of a given OpenStack service—when Keystone is in use—, a token issued by Keystone must be presented in the request. This falls short of the federation goal, where a customer running an OpenStack instance could issue a request to a contracted service provider also running OpenStack, using their existing authentication tokens. In this proposal, I put forward a mechanism by which this federation can be accomplished, along with a terminology that can help simplify future discussions.

The “Realm”

The concept of a “realm” originates with the Kerberos authentication system. Essentially, a realm, in the context of OpenStack, is a set of services which all rely on a specific Keystone database for authentication.

---