Identity, Authentication, and Access Management in OpenStack

Introduction

Identity, Authentication, and Access Management Capabilities of Keystone

Cloud environments at the Infrastructure-as-a-Service layer (IaaS) provide users access to key resources such as virtual machine instances, large amounts of block and object storage, and network bandwidth. A critical feature of any cloud environment is how it provides secure, controlled access to these valuable resources. In OpenStack environments, the Keystone service is responsible for providing secure controlled access to all of the cloud’s resources. Keystone has proven itself to be a vital component for a secure cloud. As shown in Figure P-1, 90% to 95% of OpenStack users report that they utilize Keystone in their deployments.

Figure P-1. Percentage of deployments using Keystone and other OpenStack services (source)

In order to understand how Keystone provides secure and controlled access to OpenStack Cloud resources we need to examine Keystone’s fundamental capabilities for providing Identity, Authentication, and Access Management. The following sections provide short overviews of these core Keystone capabilities.

Identity

Identity refers to the identification of who is trying to access cloud resources. In OpenStack Keystone, identity is typically represented as a user. In simple deployments, the identity of a user can be stored in Keystone’s own database. In production or enterprise ...