Steve Martinelli - Identity, Authentication, and Access Management in OpenStack: Implementing and Deploying Keystone

A key aspect to setting up a cloud, whether it be private, public, or dedicated, is ensuring that access to cloud resources and security are in place. For OpenStack environments, the focal point for securing the cloud is Keystone, OpenStacks Identity service. Keystone provides many key functions, such as authenticating users and determining what resources users are authorized to access.

Keystone started from humble beginnings. In the early days, it provided basic user management and constructs for organized access to resources. As enterprise customers became more interested in OpenStack, it became readily apparent that Keystone needed significant enhancements to meet the demanding needs of enterprise customers before it would be adopted in the enterprise.

Early enterprise requirements were focused on improving Keystones Lightweight Directory Access Protocol (LDAP) and Microsofts Active Directory support. Enterprise customers want to reuse their existing identity-management tools and dont want a separate new identity tool to manage their OpenStack users. Support was added to ensure Keystone could reuse existing LDAPs and Active Directories that were read only and only contained user and group information. Next, secure connections were added so Keystone could connect to LDAP and Active Directories over a TLS connection.

This basic support for ease of integration with existing enterprise identity managers helped OpenStack to distinguish itself from competing cloud infrastructures. It then led to a second phase of advanced enterprise integration where customers demanded support for integration with multiple LDAPs and Active Directories. This feature was critical for large enterprises that, through means such as acquisitions, had multiple identity servers they needed to support. Also as part of this phase, customers started requesting true federated identity support whereby they expected Keystone to integrate with federated identity-management tools that supported well-known and standard identity protocols such as the Security Assertion Markup Language (SAML) and OpenID Connect. Around this time Keystone started to add audit support to better enable it to meet the compliance requirements of many enterprise customers.

With the foundations of federated support, Keystone has moved to its current phase, focusing on federated support for hybrid clouds. With this federation support foundation in place, multiple Keystones can work together using standard federated protocols to support interoperable hybrid clouds. In this book, we describe all of these enhancements. We begin by providing an overview of how to perform basic Keystone operations, and we provide concrete examples using the latest version (v3) of the Keystone Identity API. We then cover Keystones support for multiple token formats and describe how its preferred token formats have evolved over time. After we discuss these fundamentals, we move on to advanced topics of LDAP integration and federation. We conclude with a discussion on topics of future work for Keystone.