Identity, Authentication & Access Management in OpenStack

130 Pages·2015·4.46 MB·English

Identity,
Authentication
& Access
Management
in OpenStack
IMPLEMENTING AND DEPLOYING KEYSTONE
Steve Martinelli,
Henry Nash & Brad Topol

Identity, Authentication, and
Access Management in OpenStack
Implementing and Deploying Keystone,
OpenStack’s Identity Service
Steve Martinelli, Henry Nash, and Brad Topol
Boston
Identity, Authentication, and Access Management in OpenStack
by Steve Martinelli, Henry Nash, and Brad Topol
Copyright © 2016 Steve Martinelli, Henry Nash, and Brad Topol. All rights reserved.
Printed in the United States of America.
Published by O’Reilly Media, Inc., 1005 Gravenstein Highway North, Sebastopol, CA 95472.
O’Reilly books may be purchased for educational, business, or sales promotional use. Online editions are
also available for most titles (http://safaribooksonline.com). For more information, contact our corporate/
institutional sales department: 800-998-9938 or [email protected].
Acquisitions Editor: Rachel Roumeliotis Indexer: WordCo Indexing Services, Inc.
Editor: Nan Barber Interior Designer: David Futato
Production Editor: Dan Fauxsmith Cover Designer: Ellie Volckhausen
Proofreader: Christina Edwards Illustrator: Rebecca Demarest
October 2015: First Edition
Revision History for the First Edition
2015-09-28: First Release
2015-12-07: Second Release
See http://oreilly.com/catalog/errata.csp?isbn=9781449370787 for release details.
The O’Reilly logo is a registered trademark of O’Reilly Media, Inc. Identity, Authentication, and Access
Management in OpenStack, the cover image, and related trade dress are trademarks of O’Reilly Media, Inc.
While the publisher and the authors have used good faith efforts to ensure that the information and
instructions contained in this work are accurate, the publisher and the authors disclaim all responsibility
for errors or omissions, including without limitation responsibility for damages resulting from the use of
or reliance on this work. Use of the information and instructions contained in this work is at your own
risk. If any code samples or other technology this work contains or describes is subject to open source
licenses or the intellectual property rights of others, it is your responsibility to ensure that your use
thereof complies with such licenses and/or rights.
978-1-491-94120-1
[LSI]
To Dini, for your never-ending support and love, and to my parents and grandfather for
their patience, selflessness and unwavering support.
—Steve Martinelli
To my wife Susan, for her incredible love and support (and for putting up with a steady
stream of my crazy ideas over the years), and to everyone who strives to disrupt the status
quo with new ways of thinking. Remember, if it was easy, someone else would have
already done it.
—Henry Nash
I dedicate this book to my wife Janet, my daughter Morgan, and my son Ryan. I could not
have done this without your love and support during this process.
—Brad Topol

Table of Contents
Preface. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ix
Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xv
1. Fundamental Keystone Topics. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
1.1 Keystone Concepts 1
1.1.1 What’s a Project? 1
1.1.2 What’s a Domain? 2
1.1.3 Users and User Groups (Actors) 2
1.1.4 Roles 3
1.1.5 Assignment 3
1.1.6 Targets 3
1.1.7 What’s a Token? 4
1.1.8 What’s a Catalog? 5
1.2 Identity 5
1.2.1 SQL 6
1.2.2 LDAP 6
1.2.3 Multiple Backends 7
1.2.4 Identity Providers 8
1.2.5 Use Cases for Identity Backends 9
1.3 Authentication 9
1.3.1 Password 10
1.3.2 Token 11
1.4 Access Management and Authorization 12
1.5 Backends and Services 13
1.6 FAQs 14
v
2. Let’s Use Keystone!. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
2.1 Getting DevStack 17
2.2 Basic Keystone Operations Using OpenStackClient 18
2.2.1 Getting a Token 19
2.2.2 Listing Users 21
2.2.3 Listing Projects 22
2.2.4 Listing Groups 24
2.2.5 Listing Roles 25
2.2.6 Listing Domains 26
2.2.7 Creating Another Domain 27
2.2.8 Create a Project within the Domain 27
2.2.9 Create a User within the Domain 28
2.2.10 Assigning a Role to a User for a Project 29
2.2.11 Authenticating as the New User 30
2.3 Basic Keystone Operations Using Horizon 31
2.3.1 What Keystone Operations Are Available through Horizon? 31
2.3.2 Accessing the Identity Operations 32
2.3.3 List, Set, Delete, Create, and View a Project 32
2.3.4 List, Set, Delete, Create, and View a User 32
2.4 Tips, Common Pitfalls, and Troubleshooting 33
Check Your Scope: A Common Authentication Problem 33
Check Your Policy and Role: A Common Authorization Problem 34
Getting Additional Information 34
3. Token Formats. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35
3.1 History of Keystone Token Formats 35
3.2 UUID Tokens 37
3.3 PKI Tokens 37
3.4 Fernet Tokens 40
3.5 Tips, Common Pitfalls, and Troubleshooting 42
3.5.1 UUID Token Performance Degradation for Authentication
Operations 42
3.5.2 Using PKI Token and Swift or Horizon Not Working? 42
4. LDAP. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45
4.1 Approach to LDAP Integration 45
4.2 Configuring Keystone to Integrate with LDAP 46
4.2.1 Other Keystone Configuration Options in Classic LDAP Support 50
4.3 Multiple Domains and LDAP 55
4.3.1 Requirements for Multi-Domain Corporate Directory Support 55
4.3.2 Setting Up Multi-Domain Using the Configuration File–Based
Approach 57
vi | Table of Contents
4.3.3 Setting Up Multi-Domain Using the Keystone API–Based Approach 58
4.3.4 Restrictions When Using Multi-Domain Identity 61
Use SQL for the Default Domain 62
Use LDAP for All Domains, Except an SQL Service Domain 63
Use LDAP for All Domains 64
4.4 A Practical Guide to Using Multi-Domains and Keystone 64
4.4.1 Setting Up LDAP 64
4.4.2 Running Admin Commands 67
4.4.3 Running LDAP User Commands 68
4.4.4 Authenticating with Horizon 70
4.5 Projects, Roles, and Assignments from LDAP (Just Say NO!) 72
4.6 Tips, Common Pitfalls, and Troubleshooting 73
4.6.1 General LDAP Issues 73
4.6.2 Tips for Using Multi-Domain LDAP 74
5. Federated Identity. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77
5.1 Approach to Federation 78
5.1.1 Leveraging Existing Technology 78
5.1.2 Keystone-Specific Federation Concepts 79
5.2 Translating User Attributes to Keystone Concepts 80
5.2.1 OpenID Connect Claims 80
5.2.2 SAML Assertions 81
5.2.3 The Mapping Engine 82
5.2.4 Mapping Rules 83
5.3 Authentication Flow: What’s It Look Like? 85
5.4 Single Sign-On 86
Single Sign-On Flow 86
5.5 A Practical Guide to Federating Identities for IBM WebSphere Liberty and
Bluepages 87
5.5.1 Download, Install, and Configure IBM WebSphere Liberty 87
5.5.2 Configuring Keystone to Use OpenID Connect 90
5.5.3 Testing It All Out 92
5.6 A Practical Guide to Setting Up SSO with Google 93
5.6.1 Configure Keystone to Use OpenID Connect 93
5.6.2 Configure Horizon for Single Sign-On 95
5.6.3 Let’s See It with Screenshots! 96
5.7 Tips, Common Pitfalls, and Troubleshooting 99
Ensure All Libraries Are Installed 99
Known Limitations of Social Media Logins 99
Using SAML from the Command Line 99
Table of Contents | vii
6. Future Work. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101
6.1 Multi-Factor Authentication 101
6.2 Integration with Horizon for Multi-Region Keystone to Keystone
Federation Support 102
6.3 Using LDAP as a Federated Identity Provider 102
6.4 Replacement of Service Users with X.509 Certificates and Barbican
Integration 102
6.5 Centralized Policy and Distribution 103
6.6 Integrating with Other Technologies 103
Index. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105
viii | Table of Contents