How OpenStack's Keystone handles authentication and authorization

Take a deep dive into the Keystone Identity service and how it interacts with other services by creating a virtual machine.

Posted: September 16, 2021 by Amy Marrich (Sudoer, Red Hat)

How to use find to audit permissions — ^{Andrea Piacquadio from Pexels}

OpenStack's Identity service, Keystone, verifies the user's identity and provides information about which resources the user has access to.

The Keystone project provides authentication, authorization, and other services such as delivering the service catalog, as this diagram shows:

basic Keystone service interaction diagram — (Amy Marrich, CC BY-SA 4.0)

It is important to note that the Identity service also provides the authorization for a user between services. For example, does the user have the authority to access a particular image in Glance for Nova and create a virtual machine (VM) from it?

Due to its critical role in authentication, authorization, and managing the catalog of services and their endpoints, the Identity service is the first service installed during an OpenStack deployment.

How the Identity service authenticates

Whether you're using OpenStack's Horizon dashboard or the command-line interface (CLI), requests to the Identity service are made via an API call. In the following diagram, it seems like a fairly easy process with a single call being made and with a single answer received:

basic Authentication overview diagram — (Amy Marrich, CC BY-SA 4.0)

The Identity service's role in launching a VM

Now let's dive deeper into the steps for a user to launch a VM.

[ Learn more OpenStack usage tips by building a lab in five minutes with three simple commands. ]

The following diagram shows that the initial API call authenticates the user's credentials, creates a temporary token for the user, and creates a generic catalog.

basic Initial step to launch a VM — (Amy Marrich, CC BY-SA 4.0)

In the next step, the Identity service replies with the temporary token and the list of tenants the user has access to.

basic User request to launch diagram — (Amy Marrich, CC BY-SA 4.0)

The user then selects the tenant from the provided list and receives a list of services they are authorized to access in that tenant and a token for that tenant. The user then connects to the correct endpoint based on the selected service and sends the token.

basic Response to user from Keystone — (Amy Marrich, CC BY-SA 4.0)

The Identity service then verifies that the token is correct and also that the user has permission to access the requested service (compute, in this case), as well as any other services the compute services might need to access to complete the request.

basic User request to launch — (Amy Marrich, CC BY-SA 4.0)

The Identity service then authorizes the user for the tenant, verifies the token is correct for the request, and confirms the user. The service also verifies the user has the correct permissions for the request based on its own policies.

Keystone provides additional info — (Amy Marrich, CC BY-SA 4.0)

With the user authorized and their permissions verified, the other services involved create the new VM.

Service executes request — (Amy Marrich, CC BY-SA 4.0)

Finally, the compute service informs the user the VM is created and how to connect to it.

Service reports back to the user — (Amy Marrich, CC BY-SA 4.0)

Wrap up

Walking through the process of creating a VM demonstrates where the Identity service fits in with the other services. The authentication and authorization processes Keystone provides make it clear why this service is installed before any of the others when deploying OpenStack.

[ Download now: A system administrator's guide to IT automation.]

How OpenStack uses Ceph for storage

You may know that OpenStack can use Ceph as back-end storage, but do you know how it works?

Setting up multi-factor authentication on Linux systems

Pluggable Authentication Modules allow Linux to work with Google Authenticator and other OTP tools to add two-factor security to your system.

Automate VM deployment with Ansible: Design

Automate virtual machine deployment with Ansible: Design

The first of three articles to help you automate VM creation on Red Hat Virtualization by using Ansible. This article focuses on goals, design, and assumptions.