Token provider¶

OpenStack Identity supports customizable token providers. This is specified in the [token] section of the configuration file. The token provider controls the token construction, validation, and revocation operations.

You can register your own token provider by configuring the following property:

• provider - token provider driver. Defaults to fernet. Implemented by keystone.token.providers.fernet.Provider. This is the entry point for the token provider in the keystone.token.provider namespace.

Below is the detailed list of the token formats supported by keystone.:

Fernet

fernet tokens do not need to be persisted at all, but require that you run keystone-manage fernet_setup (also see the keystone-manage fernet_rotate command).

JWS

jws tokens do not need to be persisted at all, but require that you configure an asymmetric key pair to sign and validate tokens. The key pair can be generated using keystone-manage create_jws_keypair or it can be generated out-of-band manually so long as it is compatible with the JWT ES256 Elliptic Curve Digital Signature Algorithm (ECDSA) using a P-256 curve and a SHA-256 hash algorithm.