2. OpenStack Keystone
Identity Project Update
Dolph Mathews
PTL

3. Overview
● What is Keystone?
● Grizzly
● Havana
● Questions

4. What is Keystone?
● Interface to Identity Management
● Authentication
○ Client authentication: username + password
○ Request authentication: token
● Limited authorization
○ Centrally managed role assignments
○ Decentralized policy enforcement
● Service Discovery

5. Grizzly
● Signed Tokens
● Identity API v3
● Domains
● User groups
● Trusts
● Policies
● External authentication methods
● Pluggable authentication driver

6. Havana
● External authentication
○ OAuth 1.0a
○ x509
● Client support
○ Middleware: auth_token
○ Command line: openstackclient
○ Web UI: Horizon
● Event notifications
● Availability zones and region management

7. Havana
● Key management
● LDAP integration
● Centralized quotas
● Secure endpoint-endpoint communication
● Fine-grained access control

8. OpenStack Keystone
Questions?
Dolph Mathews
PTL