book

Identity, Authentication, and Access Management in OpenStack

by Steve Martinelli, Henry Nash, Brad Topol

December 2015

Beginner

130 pages

3h 8m

English

O'Reilly Media, Inc.

Read now

Unlock full access

PrologueConventions Used in This BookUsing Code ExamplesSafari® Books OnlineHow to Contact UsAcknowledgments
Identity, Authentication, and Access Management Capabilities of KeystoneIdentityAuthenticationAccess Management (Authorization)Keystone’s Primary Benefits
1.1 Keystone Concepts1.1.1 What’s a Project?1.1.2 What’s a Domain?1.1.3 Users and User Groups (Actors)1.1.4 Roles1.1.5 Assignment1.1.6 Targets1.1.7 What’s a Token?1.1.8 What’s a Catalog?1.2 Identity1.2.1 SQL1.2.2 LDAP1.2.3 Multiple Backends1.2.4 Identity Providers1.2.5 Use Cases for Identity Backends1.3 Authentication1.3.1 Password1.3.2 Token1.4 Access Management and Authorization1.5 Backends and Services1.6 FAQs
2.1 Getting DevStack2.2 Basic Keystone Operations Using OpenStackClient2.2.1 Getting a Token2.2.2 Listing Users2.2.3 Listing Projects2.2.4 Listing Groups2.2.5 Listing Roles2.2.6 Listing Domains2.2.7 Creating Another Domain2.2.8 Create a Project within the Domain2.2.9 Create a User within the Domain2.2.10 Assigning a Role to a User for a Project2.2.11 Authenticating as the New User2.3 Basic Keystone Operations Using Horizon2.3.1 What Keystone Operations Are Available through Horizon?2.3.2 Accessing the Identity Operations2.3.3 List, Set, Delete, Create, and View a Project2.3.4 List, Set, Delete, Create, and View a User2.4 Tips, Common Pitfalls, and TroubleshootingCheck Your Scope: A Common Authentication ProblemCheck Your Policy and Role: A Common Authorization ProblemGetting Additional Information
3.1 History of Keystone Token Formats3.2 UUID Tokens3.3 PKI Tokens3.4 Fernet Tokens3.5 Tips, Common Pitfalls, and Troubleshooting3.5.1 UUID Token Performance Degradation for Authentication Operations3.5.2 Using PKI Token and Swift or Horizon Not Working?
4.1 Approach to LDAP Integration4.2 Configuring Keystone to Integrate with LDAP4.2.1 Other Keystone Configuration Options in Classic LDAP Support4.3 Multiple Domains and LDAP4.3.1 Requirements for Multi-Domain Corporate Directory Support4.3.2 Setting Up Multi-Domain Using the Configuration File–Based Approach4.3.3 Setting Up Multi-Domain Using the Keystone API–Based Approach4.3.4 Restrictions When Using Multi-Domain IdentityUse SQL for the Default DomainUse LDAP for All Domains, Except an SQL Service DomainUse LDAP for All Domains4.4 A Practical Guide to Using Multi-Domains and Keystone4.4.1 Setting Up LDAP4.4.2 Running Admin Commands4.4.3 Running LDAP User Commands4.4.4 Authenticating with Horizon4.5 Projects, Roles, and Assignments from LDAP (Just Say NO!)4.6 Tips, Common Pitfalls, and Troubleshooting4.6.1 General LDAP Issues4.6.2 Tips for Using Multi-Domain LDAP
5.1 Approach to Federation5.1.1 Leveraging Existing Technology5.1.2 Keystone-Specific Federation Concepts5.2 Translating User Attributes to Keystone Concepts5.2.1 OpenID Connect Claims5.2.2 SAML Assertions5.2.3 The Mapping Engine5.2.4 Mapping Rules5.3 Authentication Flow: What’s It Look Like?5.4 Single Sign-OnSingle Sign-On Flow5.5 A Practical Guide to Federating Identities for IBM WebSphere Liberty and Bluepages5.5.1 Download, Install, and Configure IBM WebSphere Liberty5.5.2 Configuring Keystone to Use OpenID Connect5.5.3 Testing It All Out5.6 A Practical Guide to Setting Up SSO with Google5.6.1 Configure Keystone to Use OpenID Connect5.6.2 Configure Horizon for Single Sign-On5.6.3 Let’s See It with Screenshots!5.7 Tips, Common Pitfalls, and TroubleshootingEnsure All Libraries Are InstalledKnown Limitations of Social Media LoginsUsing SAML from the Command Line
6.1 Multi-Factor Authentication6.2 Integration with Horizon for Multi-Region Keystone to Keystone Federation Support6.3 Using LDAP as a Federated Identity Provider6.4 Replacement of Service Users with X.509 Certificates and Barbican Integration6.5 Centralized Policy and Distribution6.6 Integrating with Other Technologies

Overview

Keystone—OpenStack's Identity service—provides secure controlled access to a cloud’s resources. In OpenStack environments, Keystone performs many vital functions, such as authenticating users and determining what resources users are authorized to access.

Whether the cloud is private, public, or dedicated, access to cloud resources and security is essential. This practical guide to using Keystone provides detailed, step-by-step guidance to creating a secure cloud environment at the Infrastructure-as-a-Service layer—as well as key practices for safeguarding your cloud's ongoing security.