PKI Support for Authentication and Delegation

Thus, this blueprint describes an overall PKI approach for securing an OpenStack deployment. Authentication in OpenStack is a two part mechanism. The first stage is when the user makes the initial authentication to Keystone, which results in the issue of a token. The second is the use of the token to provide single sign on and delegated authentication throughout the OpenStack cluster. PKI can improve the security of the first stage. It can both help security and scalability of the second.