What's new in Havana--Keystone
2 likes3,266 views
Keystone in OpenStack Havana includes more granular role-based access control policies, the ability to assign roles via OAuth 1.0a and inherit domain roles from projects, a new group API, and separating projects and roles from authentication. It also allows for pluggable token generation and remote authentication through environment variables sent by web servers.
1 of 7
Downloaded 35 times
![Keystone
Role-based Access Control (RBAC)
• More granular policies
• Can be based on aspects of the request such
as API request parameters
"identity:delete_user": [["role:admin",
"domain_id:%(target.user.domain_id)s"]]
37](https://image.slidesharecdn.com/whatsnewinhavanakeystone-131111111022-phpapp02/85/What-s-new-in-Havana-Keystone-3-320.jpg)
![Keystone
Separate projects etc. from authentication
• Projects, roles, etc. follow “assignments”
driver
• Users, groups, etc. follow “identity” driver
• Credentials follow “credentials” driver
[identity]
driver = keystone.identity.backends.ldap.Identity
[assignment]
driver = keystone.assignment.backends.sql.Assignment
39](https://image.slidesharecdn.com/whatsnewinhavanakeystone-131111111022-phpapp02/85/What-s-new-in-Havana-Keystone-5-320.jpg)
More Related Content
What's hot (20)
Ad
Similar to What's new in Havana--Keystone (20)
Ad
More from Mirantis (20)
Recently uploaded (20)
What's new in Havana--Keystone
- 3. Keystone Role-based Access Control (RBAC) • More granular policies • Can be based on aspects of the request such as API request parameters "identity:delete_user": [["role:admin", "domain_id:%(target.user.domain_id)s"]] 37
- 4. Keystone Role handling • Assign roles via OAuth 1.0a • Domain roles can be inherited from project • Group API 38
- 5. Keystone Separate projects etc. from authentication • Projects, roles, etc. follow “assignments” driver • Users, groups, etc. follow “identity” driver • Credentials follow “credentials” driver [identity] driver = keystone.identity.backends.ldap.Identity [assignment] driver = keystone.assignment.backends.sql.Assignment 39
- 6. Keystone Token generation • Currently PKI or UUID • Can now be pluggable • keystone.token.provider.Provider interface can be custom implemented 40
- 7. Keystone Remote handling of authentication through REMOTE_USER • Sent by the web server as an environment variable • Can be disabled (remove "external" from plug-ins list) 41