Keystone, the OpenStack Identity Service¶
Keystone is an OpenStack service that provides API client authentication, service discovery, and distributed multi-tenant authorization by implementing OpenStack’s Identity API.
This documentation is primarily targeted towards contributors of the project, and assumes that you are already familiar with Keystone from an end-user perspective; however, end users, deployers, and operators will also find it useful.
This documentation is generated by the Sphinx toolkit and lives in the source tree. Also see the Getting Involved page for other ways to interact with the community.
Installation Guides¶
General Information¶
This section sontains the general information related to keystone which is commom to all the developers, users and operators. For documentation specific to the any of these three, please see the subsequent sections.
Contributor Documentation¶
This section contains the documentation needed for developing keystone.
Operator Documentation¶
This section contains the documentation for operating, deploying and configuring the keystone service.
- Configuring Keystone
- Config Files
- Bootstrapping Keystone with
keystone-manage bootstrap - Bootstrapping Keystone with
ADMIN_TOKEN - Setting up other OpenStack Services
- Identity sources
- Authentication Plugins
- Token Drivers and Providers
- Encryption Keys for Fernet Tokens
- Caching Layer
- Certificates for PKI
- Service Catalog
- Endpoint Filtering
- Endpoint Policy
- SSL
- OAuth1 1.0a
- Token Binding
- Limiting list return size
- URL safe naming of projects and domains
- Health Check middleware
- API protection with Role Based Access Control (RBAC)
- Preparing your deployment
keystone-manage- Supported clients
- Using an LDAP server
- Credential Encryption
- Advanced Topics
- Sample Files
Administrator Guides¶
- Administrator Guides
- Identity concepts
- Certificates for PKI
- Domain-specific configuration
- External authentication with Identity
- Integrate Identity with LDAP
- Keystone tokens
- Configure Identity service for token binding
- Fernet - Frequently Asked Questions
- Use trusts
- Caching layer
- Security compliance and PCI-DSS
- Example usage and Identity features
- Authentication middleware with user name and password
- Identity API protection with role-based access control (RBAC)
- Troubleshoot the Identity service
API Documentation¶
An end user can find the specific API documentation here, OpenStack’s Identity API.
Except where otherwise noted, this document is licensed under Creative Commons Attribution 3.0 License. See all OpenStack Legal Documents.