Resource Options¶

A resource option is an attribute that can be optionally set on an entity in keystone. These options are used to control specific features or behaviors within keystone. This allows flexibility on a per-resource basis as opposed to settings a configuration file value that controls a behavior for all resources in a deployment.

This flexibility can be useful for deployments is setting different authentication requirements for users. For example, operators can use resource options to set the number of failed authentication attempts on a per-user basis as opposed to setting a global value that is applied to all users.

The purpose of this document is to formally document the supported resource options used in keystone, their intended behavior, and how to use them.

{
    "user": {
        "options": {
            "ignore_lockout_failure_attempts": true
        }
    }
}

{
    "user": {
        "options": {
            "ignore_change_password_upon_first_use": true
        }
    }
}

{
    "user": {
        "options": {
            "ignore_password_expiry": true
        }
    }
}

{
    "user": {
        "options": {
            "ignore_lockout_failure_attempts": true
        }
    }
}

{
    "user": {
        "options": {
            "lock_password": true
        }
    }
}

{
    "user": {
        "options": {
            "multi_factor_auth_enabled": true
        }
    }
}

{
    "user": {
        "options": {
            "multi_factor_auth_rules": [
                ["password", "totp"],
                ["password", "u2f"]
            ]
        }
    }
}