Difference between revisions of "Nova/AuthManagerSpec"

Revision as of 19:06, 13 May 2011

Launchpad Entry: NovaSpec:finalize-nova-auth
Created: May 12, 2011
Contributors: Brian Waldon, Brian Lamar

Summary

OpenStack needs an authentication/authorization system which will allow for centralization of authentication/authorization credentials. Currently we are investigating Keystone for such a system.

""Author(s):"" John Eo, Khaled Hussein, Ziad Swahala, and more... ""Version Control:"" https://github.com/khussein/keystone

User stories

As a deployer of Nova, I want to use Keystone as my authn/authz backend.

As a deployer of Nova, I want to use the existing authn/authz backend.

As a deployer of Nova, I want it to be painless to transition an existing deployment from the existing database into Keystone.

Implementation

Phase 1

Code Changes

We will ensure Keystone is using compatible/standard methods for it's WSGI/API interface. Currently it is utilizing `bottle` for many WSGI tasks. Updating Keystone to use `webob`, `routes`, and other OpenStack standard WSGI libraries will greatly increase the chances of success for the project.

@@ Line 6: / Line 6: @@
 == Summary ==
-Currently, the [[AuthManager]] simply utilizes the database to store all authn/authz information. We want Nova users to be able to choose an authentication & authorization system that works best for them. Right now, we are only planning on adding support for Keystone.
+[[OpenStack]] needs an authentication/authorization system which will allow for centralization of authentication/authorization credentials. Currently we are investigating Keystone for such a system.
+""Author(s):"" John Eo, Khaled Hussein, Ziad Swahala, and more...
+""Version Control:"" https://github.com/khussein/keystone
 == User stories ==
@@ Line 17: / Line 20: @@
 == Implementation ==
+=== Phase 1 ===
 === Code Changes ===
-We will refactor [[AuthManager]] in Nova to support pluggable drivers, similar to our virtualization drivers. We will have to move the existing code into a "local db" driver, while implementing a second Keystone driver. This approach will help minimize code changes across the project.
+We will ensure Keystone is using compatible/standard methods for it's WSGI/API interface. Currently it is utilizing `bottle` for many WSGI tasks. Updating Keystone to use `webob`, `routes`, and other [[OpenStack]] standard WSGI libraries will greatly increase the chances of success for the project.
-=== Migration ===
-We plan to design a set of scripts that will assist in data migrations between local and Keystone drivers.
 ----
 [[Category:Spec]]