Identity, Authentication, and Access Management in OpenStack

Preface

Prologue

A key aspect to setting up a cloud, whether it be private, public, or dedicated, is ensuring that access to cloud resources and security are in place. For OpenStack environments, the focal point for securing the cloud is Keystone, OpenStack’s Identity service. Keystone provides many key functions, such as authenticating users and determining what resources users are authorized to access.

Keystone started from humble beginnings. In the early days, it provided basic user management and constructs for organized access to resources. As enterprise customers became more interested in OpenStack, it became readily apparent that Keystone needed significant enhancements to meet the demanding needs of enterprise customers before it would be adopted in the enterprise.

Early enterprise requirements were focused on improving Keystone’s Lightweight Directory Access Protocol (LDAP) and Microsoft’s Active Directory support. Enterprise customers want to reuse their existing identity-management tools and don’t want a separate new identity tool to manage their OpenStack users. Support was added to ensure Keystone could reuse existing LDAPs and Active Directories that were read only and only contained user and group information. Next, secure connections were added so Keystone could connect to LDAP and Active Directories over a TLS connection.

This basic support for ease of integration with existing enterprise identity managers helped OpenStack to distinguish itself from competing ...