Initial Keystone Integration
Keystone provides a common auth framework for all of the services. This blueprint is for the initial integration of the keystone service (described below) with nova. The first version will be a very non-invasive approach with a couple of middlewares.
The purpose of this blueprint is to define a standard for authentication in OpenStack that enables services to support multiple authentication protocols in a pluggable manner. By providing support for authentication via pluggable authentication components, this standard allows OpenStack services to be integrated easily into existing deployment environments. It also provides a path by which to implement support for emerging authentication standards such as OpenID. The standard is not an authentication system onto itself, but rather a protocol by which authentication systems may be integrated with OpenStack services.
Blueprint information
- Status:
- Complete
- Approver:
- Rick Clark
- Priority:
- Essential
- Drafter:
- Khaled Hussein
- Direction:
- Approved
- Assignee:
- Jesse Andrews
- Definition:
- Approved
- Series goal:
- Accepted for diablo
- Implementation:
-
Implemented
- Milestone target:
-
2011.3
- Started by
- Thierry Carrez
- Completed by
- Vish Ishaya
Whiteboard
First appeared in diablo-2
Going to mark this complete for the moment. The initial middleware works fine with the openstack api. EC2 compatibility and removal of user code from nova will have to go in a separate blueprint. --vish
Since we now have the separate keystone project, this will be the blueprint for integrating nova with the keystone service --vish
First round complete. There is an auto-create middleware in keystone that will automatically create users and projects in nova.
Still to do:
switch to tenants instead of projects in nova
add ec2 compatibility middleware
jorgew: I've updated the spec to address some concerns from the swift team:
1) Delegated Mode: The decision to reject an unauthenticated request can now be made by the underlying implementation.
2) Default Component: Details of the default component are moved out of this spec, we'll be submitting the details in a separate blueprint.
Expect a merge request for swift soon.
Work Items
Dependency tree
* Blueprints in grey have been implemented.
