Keystone: identity & projects · Prasanta Kumar Behera

Keystone is the front door of OpenStack: domains and projects for tenancy, users, groups and roles, tokens and the service catalog, clouds.yaml for clients, application credentials for automation, and federation with your identity provider.

Keystone's job

Every OpenStack request carries a token issued by Keystone. Keystone answers three questions: who are you (authentication), what are you allowed to do, and in which project (role assignments, enforced by each service's policy), and where are the services (the catalog).

Keystone is the front desk of an office complex. It checks your ID, gives you a day pass (token) printed with the company you're visiting (project) and your job there (role), and hands you a map of where every department sits (the service catalog). Each department's guard reads the pass and decides what you may do.

The tenancy model

Concept	Meaning
Domain	A container for users, groups and projects (e.g. per organisation or IdP)
Project	Owns resources; has quotas (the "tenant")
User / Group	Identities; groups make access management scalable
Role	A name (`reader`, `member`, `admin`) that services' policies interpret
Role assignment	Actor (user/group) + role + target (project/domain/system)

Default roles in recent releases are reader ⊂ member ⊂ admin, with scopes (project, domain, system) so an "admin" of one project isn't an admin of the whole cloud. Grant roles to groups, not individual users.

$ openstack project create --domain acme shop-prod
$ openstack group create --domain acme shop-devs
$ openstack role add --project shop-prod --group shop-devs member
$ openstack quota set --instances 50 --cores 200 --ram 409600 shop-prod

Tokens

Keystone issues Fernet tokens by default: small, encrypted, and never stored in the database. The Fernet keys must be identical on all controllers and rotated regularly (deployment tools do this). Tokens expire (1 hour by default); clients re-authenticate automatically.

Clients: clouds.yaml

# ~/.config/openstack/clouds.yaml
clouds:
  shop-prod:
    auth:
      auth_url: https://keystone.cloud.example.com:5000/v3
      application_credential_id: "0b3f…"
      application_credential_secret: "…"
    auth_type: v3applicationcredential
    region_name: RegionOne
    interface: public
    identity_api_version: 3

$ export OS_CLOUD=shop-prod
$ openstack server list

The same file works for the CLI, Terraform's OpenStack provider, Ansible's OpenStack modules and SDKs. Keep secrets out of Git (a separate secure.yaml, or a secret store).

Application credentials

For automation, create application credentials: scoped to one project, limited to chosen roles, optionally expiring, revocable without touching the user's password, and optionally restricted to specific API calls (access rules).

Federation

In enterprises, users come from the corporate IdP via federation (OIDC or SAML): Keystone maps IdP attributes (groups) to OpenStack groups and roles with mapping rules. Users log in through Horizon's SSO, or get tokens with the CLI using federated authentication plugins. It's the same principle as OIDC for Kubernetes (see Kubernetes Security, lesson 04).

Try it: tenancy and least privilege (lab cloud)

As admin, create domain acme, project shop-prod, group shop-devs, and a user in that group.
Give the group member on the project and set quotas.
Log in as the user (a clouds.yaml entry with password auth), boot an instance, then try openstack project list --domain acme and an admin-only call. Read the errors.
Create an application credential for CI with role member, switch clouds.yaml to it, and confirm it works. Revoke it and confirm it stops working.
List all role assignments for the project with --names.

Going deeper: identity operations

Monitor Keystone latency: every API call in the cloud depends on token validation (memcached caching helps a lot).
Rotate Fernet keys on schedule and distribute them consistently; a key mismatch between controllers causes random 401s.
Review policy customisations carefully; defaults in recent releases are designed around the reader/member/admin + scope model.
Audit: enable CADF notifications/audit middleware to record who did what across services.

Recap

Keystone authenticates, issues tokens (Fernet), and publishes the service catalog.
Tenancy: domains → projects (quotas) → role assignments to groups (reader/member/admin, with scopes).
Clients use clouds.yaml; automation uses application credentials.
Enterprises connect the corporate IdP through federation (OIDC/SAML) with mapping rules.

This site is a public version of my personal engineering knowledge hub. It intentionally excludes confidential company information and internal operational details.