Introduction to KeyStone, the OpenStack identity service
KeyStone is an OpenStack identity service which provides the following capabilities:
- Identity provider: In OpenStack, identity is represented as a user in the form of a name and password. In simple setups, KeyStone stores the identity of a user in its database. But it is recommended you use third-party identity providers such as LDAP in production.
- API client authentication: Authentication is validating a user's identity. KeyStone can do it by using many third-party backends such as LDAP and AD. Once authenticated, the user gets a token which he/she can use to access other OpenStack service APIs.
- Multitenant authorization: KeyStone provides the authorization to access a particular resource by adding a role to every user in every tenant. When a user access any OpenStack service, the service verifies the role of the user and whether he/she can access the resource.
- Service discovery: KeyStone manages a service catalog in which other services...
