KeyStone is an OpenStack identity service which provides the following capabilities:
- Identity provider: In OpenStack, identity is represented as a user in the form of a name and password. In simple setups, KeyStone stores the identity of a user in its database. But it is recommended you use third-party identity providers such as LDAP in production.
- API client authentication: Authentication is validating a user's identity. KeyStone can do it by using many third-party backends such as LDAP and AD. Once authenticated, the user gets a token which he/she can use to access other OpenStack service APIs.
- Multitenant authorization: KeyStone provides the authorization to access a particular resource by adding a role to every user in every tenant. When a user access any OpenStack service, the service verifies the role of the...
