Keystone Service

Keystone Service
Name	Keystone Service
Developed by	OpenStack Foundation
Initial release	2010
Programming language	Python
License	Apache License 2.0

Keystone Service Keystone Service is an identity service that provides authentication and authorization for cloud platforms, originally developed as part of the OpenStack OpenStack ecosystem. It functions as a centralized identity catalog and token provider used by projects such as Nova (OpenStack), Glance (OpenStack), Cinder (OpenStack), and Neutron (OpenStack), while integrating with external systems like LDAP, Active Directory, and SAML 2.0 providers. Keystone Service supports multiple credential types and policy frameworks used across deployments from research clouds like NASA facilities to commercial offerings by vendors such as Red Hat, Canonical (company), and Mirantis.

Overview

Keystone Service acts as the identity, token, catalog, and policy authority for OpenStack clouds, providing RESTful endpoints and catalog discovery consumed by services like Horizon (OpenStack), Heat (OpenStack), and Ceilometer. It issues scoped tokens, maintains a service catalog used by orchestration tools such as Ansible and Terraform (software), and enforces policies defined using frameworks like Policy-as-Code and the Open Policy Agent. Keystone Service interoperates with federation systems like Shibboleth and OAuth 2.0 and is commonly deployed alongside projects including Mistral (OpenStack), Ironic (OpenStack), and Sahara (OpenStack).

Architecture and Components

Keystone Service follows a modular architecture comprising the identity backend, token manager, catalog, policy engine, and federation components. The identity backend can be implemented using directories such as OpenLDAP, 389 Directory Server, or databases like PostgreSQL and MySQL. The token manager supports token formats including UUID tokens and structured tokens compatible with JWT standards used elsewhere by projects like Kubernetes and Istio. The service catalog exposes endpoints for services such as Swift (OpenStack), Trove (OpenStack), and Barbican (OpenStack), while the policy engine maps to rule sets similar to SELinux policies or AppArmor profiles. Keystone Service integrates with middleware and WSGI servers such as Gunicorn, uWSGI, and Apache HTTP Server mod_wsgi in production.

Authentication and Authorization

Authentication methods supported include password-based credentials, token-based flows, API key exchanges, and federated protocols like SAML 2.0, OpenID Connect, and OAuth 2.0. Federation enables identity brokering with providers such as Google (company), Microsoft Azure Active Directory, and institutional identity providers using Shibboleth. Authorization is implemented via role assignments, domain scoping, and policy files consumed by services including Ceph gateways and Rally (OpenStack) benchmarks. Keystone Service’s role model is similar to access control constructs used by AWS Identity and Access Management, Google Cloud IAM, and Azure Role-Based Access Control while retaining OpenStack-specific constructs like projects (tenants) used by Swift (OpenStack) and Glance (OpenStack).

Integration and APIs

Keystone Service exposes REST APIs used by client libraries such as python-openstackclient, Ansible, Terraform (software), Puppet (software), and Chef (software). It publishes a service catalog consumed by SDKs like openstacksdk and drivers in Libcloud and Boto (software). Integration patterns include identity federation with SAML 2.0 federated hubs, token exchange with OAuth 2.0 providers, and synchronization with directory servers like Active Directory and OpenLDAP. Keystone Service’s API versioning strategy parallels approaches seen in Kubernetes API and Docker Engine API, and it is often fronted by API gateways such as Kong (software) or NGINX with rate limiting and authentication plugins.

Deployment and Scalability

Typical deployments use multiple Keystone Service instances behind load balancers such as HAProxy and Keepalived with persistent storage in PostgreSQL or MySQL clusters managed by systems like Galera Cluster. High-availability patterns mirror those used by Ceph clusters and RabbitMQ clusters, employing replication, connection pooling, and caching layers via Memcached or Redis. Keystone Service scales horizontally by stateless API nodes, while stateful components rely on database and directory scaling solutions used by OpenStack operators at organizations like NASA and telecommunications carriers such as AT&T. CI/CD pipelines for Keystone Service often use tools like Jenkins, Zuul (software), and GitLab CI for continuous integration and rolling upgrades.

Security Considerations

Security for Keystone Service covers token protection, secure storage of credentials, audit logging, and compliance with standards like PCI DSS, HIPAA, and FISMA in regulated deployments. Transport encryption uses TLS certificates issued by authorities such as Let's Encrypt or enterprise Microsoft Certificate Services, and key management often leverages Barbican (OpenStack) or external HSMs compatible with PKCS#11. Audit trails integrate with systems like ELK Stack and Splunk for incident response workflows following frameworks such as NIST SP 800-53 and ISO/IEC 27001. Best practices recommend integration with identity providers like Azure Active Directory for MFA, logging via Syslog, and vulnerability scanning tools such as OpenVAS and Nessus.

Category:OpenStack