Chapter 9. Consolidating the OpenStack Authentication

"The more you know, the more you know you don't know."

–Aristotle

In this chapter, we will tackle the identification service in OpenStack from a different angle. Firstly, we will revisit the key concepts forming the Keystone service. In a second iteration, we will bring under the scope an extended identification setup in OpenStack by adopting the identity federation layout. Since the Icehouse release, the OpenStack community has greatly increased the number of ways in which users can authenticate against the Keystone service. That includes identity federation support, which delegates authentication tasks to a central trusted identifying entity defined as Identity Providers (IdP). At the time of writing, Keystone supports various federation protocols, such as Security Assertion Markup Language (SAML) and OpenID Connect, based on OAuth protocol. We will discover how to redesign the identity service in OpenStack and enable more profitable...