Identity, Authentication, and Access Management in OpenStack

Table of contents

1. Preface
   1. Prologue
   2. Conventions Used in This Book
   3. Using Code Examples
   4. Safari® Books Online
   5. How to Contact Us
   6. Acknowledgments
2. Introduction
   1. Identity, Authentication, and Access Management Capabilities of Keystone
   2. Identity
   3. Authentication
   4. Access Management (Authorization)
   5. Keystone’s Primary Benefits
3. 1. Fundamental Keystone Topics
   1. 1.1 Keystone Concepts
      1. 1.1.1 What’s a Project?
      2. 1.1.2 What’s a Domain?
      3. 1.1.3 Users and User Groups (Actors)
      4. 1.1.4 Roles
      5. 1.1.5 Assignment
      6. 1.1.6 Targets
      7. 1.1.7 What’s a Token?
      8. 1.1.8 What’s a Catalog?
   2. 1.2 Identity
      1. 1.2.1 SQL
      2. 1.2.2 LDAP
      3. 1.2.3 Multiple Backends
      4. 1.2.4 Identity Providers
      5. 1.2.5 Use Cases for Identity Backends
   3. 1.3 Authentication
      1. 1.3.1 Password
      2. 1.3.2 Token
   4. 1.4 Access Management and Authorization
   5. 1.5 Backends and Services
   6. 1.6 FAQs
4. 2. Let’s Use Keystone!
   1. 2.1 Getting DevStack
   2. 2.2 Basic Keystone Operations Using OpenStackClient
      1. 2.2.1 Getting a Token
      2. 2.2.2 Listing Users
      3. 2.2.3 Listing Projects
      4. 2.2.4 Listing Groups
      5. 2.2.5 Listing Roles
      6. 2.2.6 Listing Domains
      7. 2.2.7 Creating Another Domain
      8. 2.2.8 Create a Project within the Domain
      9. 2.2.9 Create a User within the Domain
      10. 2.2.10 Assigning a Role to a User for a Project
      11. 2.2.11 Authenticating as the New User
   3. 2.3 Basic Keystone Operations Using Horizon
      1. 2.3.1 What Keystone Operations Are Available through Horizon?
      2. 2.3.2 Accessing the Identity Operations
      3. 2.3.3 List, Set, Delete, Create, and View a Project
      4. 2.3.4 List, Set, Delete, Create, and View a User
   4. 2.4 Tips, Common Pitfalls, and Troubleshooting
      1. Check Your Scope: A Common Authentication Problem
      2. Check Your Policy and Role: A Common Authorization Problem
      3. Getting Additional Information
5. 3. Token Formats
   1. 3.1 History of Keystone Token Formats
   2. 3.2 UUID Tokens
   3. 3.3 PKI Tokens
   4. 3.4 Fernet Tokens
   5. 3.5 Tips, Common Pitfalls, and Troubleshooting
      1. 3.5.1 UUID Token Performance Degradation for Authentication Operations
      2. 3.5.2 Using PKI Token and Swift or Horizon Not Working?
6. 4. LDAP
   1. 4.1 Approach to LDAP Integration
   2. 4.2 Configuring Keystone to Integrate with LDAP
      1. 4.2.1 Other Keystone Configuration Options in Classic LDAP Support
   3. 4.3 Multiple Domains and LDAP
      1. 4.3.1 Requirements for Multi-Domain Corporate Directory Support
      2. 4.3.2 Setting Up Multi-Domain Using the Configuration File–Based Approach
      3. 4.3.3 Setting Up Multi-Domain Using the Keystone API–Based Approach
      4. 4.3.4 Restrictions When Using Multi-Domain Identity
      5. Use SQL for the Default Domain
      6. Use LDAP for All Domains, Except an SQL Service Domain
      7. Use LDAP for All Domains
   4. 4.4 A Practical Guide to Using Multi-Domains and Keystone
      1. 4.4.1 Setting Up LDAP
      2. 4.4.2 Running Admin Commands
      3. 4.4.3 Running LDAP User Commands
      4. 4.4.4 Authenticating with Horizon
   5. 4.5 Projects, Roles, and Assignments from LDAP (Just Say NO!)
   6. 4.6 Tips, Common Pitfalls, and Troubleshooting
      1. 4.6.1 General LDAP Issues
      2. 4.6.2 Tips for Using Multi-Domain LDAP
7. 5. Federated Identity
   1. 5.1 Approach to Federation
      1. 5.1.1 Leveraging Existing Technology
      2. 5.1.2 Keystone-Specific Federation Concepts
   2. 5.2 Translating User Attributes to Keystone Concepts
      1. 5.2.1 OpenID Connect Claims
      2. 5.2.2 SAML Assertions
      3. 5.2.3 The Mapping Engine
      4. 5.2.4 Mapping Rules
   3. 5.3 Authentication Flow: What’s It Look Like?
   4. 5.4 Single Sign-On
      1. Single Sign-On Flow
   5. 5.5 A Practical Guide to Federating Identities for IBM WebSphere Liberty and Bluepages
      1. 5.5.1 Download, Install, and Configure IBM WebSphere Liberty
      2. 5.5.2 Configuring Keystone to Use OpenID Connect
      3. 5.5.3 Testing It All Out
   6. 5.6 A Practical Guide to Setting Up SSO with Google
      1. 5.6.1 Configure Keystone to Use OpenID Connect
      2. 5.6.2 Configure Horizon for Single Sign-On
      3. 5.6.3 Let’s See It with Screenshots!
   7. 5.7 Tips, Common Pitfalls, and Troubleshooting
      1. Ensure All Libraries Are Installed
      2. Known Limitations of Social Media Logins
      3. Using SAML from the Command Line
8. 6. Future Work
   1. 6.1 Multi-Factor Authentication
   2. 6.2 Integration with Horizon for Multi-Region Keystone to Keystone Federation Support
   3. 6.3 Using LDAP as a Federated Identity Provider
   4. 6.4 Replacement of Service Users with X.509 Certificates and Barbican Integration
   5. 6.5 Centralized Policy and Distribution
   6. 6.6 Integrating with Other Technologies
9. Index