OpenStack Keystone identity service skill for deploying, configuring, operating, and troubleshooting the authentication and authorization backbone of an OpenStack cloud. Covers identity management, token lifecycle (Fernet provider with rotation), service catalog registration, RBAC policy customization, domain/project/user hierarchy, federation basics (SAML/OIDC), credential encryption, and endpoint management. Use when deploying Keystone via Kolla-Ansible, managing users and projects, debugging 401 errors, rotating Fernet keys, configuring RBAC policies, or integrating services through the service catalog.
OpenStack Keystone identity service skill for deploying, configuring, operating, and troubleshooting the authentication and authorization backbone of an OpenStack cloud. Covers identity management, token lifecycle (Fernet provider with rotation), service catalog registration, RBAC policy customization, domain/project/user hierarchy, federation basics (SAML/OIDC), credential encryption, and endpoint management. Use when deploying Keystone via Kolla-Ansible, managing users and projects, debugging 401 errors, rotating Fernet keys, configuring RBAC policies, or integrating services through the service catalog.
user-invocable
true
allowed-tools
Read Grep Glob
metadata
{"extensions":{"gsd-skill-creator":{"version":1,"createdAt":"2026-02-22","triggers":{"intents":["keystone","identity","authentication","service catalog","RBAC","token","federation","policy.json","endpoint"],"contexts":["deploying openstack","configuring identity","troubleshooting authentication","managing users and projects"]}}}}
OpenStack Keystone Identity Service
Keystone is the identity service for OpenStack. Every API call to every OpenStack service passes through Keystone for authentication and authorization. It is the first service deployed and the last decommissioned. If Keystone is down, the entire cloud is down.
Keystone provides five core functions: (users, groups), (projects, domains), (roles mapped to users on projects), (authentication proof with configurable lifetime), and (service endpoint registry). Understanding Keystone means understanding how every OpenStack service discovers and trusts every other service.
identity
resources
assignment
token
catalog
Deploy
Kolla-Ansible Configuration
globals.yml settings:
# Required -- set strong passwordskeystone_admin_password:"{{ vault_keystone_admin_password }}"keystone_database_password:"{{ vault_keystone_database_password }}"# TLS (recommended for production)kolla_enable_tls_internal:"yes"kolla_enable_tls_external:"yes"kolla_copy_ca_into_containers:"yes"# Token provider (Fernet is default and recommended)keystone_token_provider:"fernet"# Optional tuningkeystone_token_expiration:3600# seconds, default 1 hour
Deployment sequence:
# 1. Bootstrap -- creates databases, service users, initial endpoints
kolla-ansible -i inventory bootstrap-servers
# 2. Deploy Keystone (runs as part of full deploy or targeted)
kolla-ansible -i inventory deploy --tags keystone
# 3. Post-deploy -- creates admin credentials file
kolla-ansible -i inventory post-deploy
Container verification:
# Verify Keystone containers are running
docker ps --filter "name=keystone" --format "table {{.Names}}\t{{.Status}}"# Expected: keystone_api, keystone_fernet (both Up)# Verify service respondssource /etc/kolla/admin-openrc.sh
openstack token issue # Must return a valid token table
Service catalog registration:
Kolla-Ansible auto-registers Keystone in the service catalog. Verify:
openstack service list # Should show "identity" service
openstack endpoint list --service keystone
# Expected: 3 endpoints (public, internal, admin) per region
Initial admin setup:
# admin-openrc.sh is generated by post-deploysource /etc/kolla/admin-openrc.sh
# Verify admin project and user exist
openstack project show admin
openstack user show admin
openstack role assignment list --user admin --project admin
# admin should have "admin" role on "admin" project
Configure
Fernet Token Provider
Fernet tokens are cryptographic tokens validated without database lookup. They require synchronized key repositories across Keystone nodes.
max_active_keys: Default 3. Set to (token_expiration / rotation_interval) + 2
Domain, Project, and User Hierarchy
Domain (organizational boundary)
+-- Project (resource container, formerly "tenant")
+-- User (identity with credentials)
+-- Group (collection of users)
+-- Role Assignment (user/group + role on this project)
Best practices:
Create a domain per organization or department
Use the "default" domain for service accounts
Never modify the "admin" project; create separate operator projects
Assign roles to groups, not individual users, for scalability
# Example: restrict user creation to domain-scoped admins"identity:create_user":"rule:admin_required and domain_id:%(target.user.domain_id)s"# Example: allow project members to list users in their project"identity:list_users":"role:member and project_id:%(scope.project.id)s"
Policy evaluation order:
Check explicit rule match in policy.yaml
Fall back to code default (oslo.policy)
Deny if no rule matches
Verify policy changes:
# Test a specific policy rule
openstack --os-auth-url http://keystone:5000/v3 \
--os-username testuser --os-password testpass \
--os-project-name testproject --os-user-domain-name default \
--os-project-domain-name default user list
Service Catalog Management
# List all registered services and endpoints
openstack service list
openstack endpoint list
# Register a new service
openstack service create --name nova --description "Compute" compute
openstack endpoint create --region RegionOne \
compute public http://controller:8774/v2.1
openstack endpoint create --region RegionOne \
compute internal http://controller:8774/v2.1
openstack endpoint create --region RegionOne \
compute admin http://controller:8774/v2.1
Federation (SAML/OIDC)
Federation allows external identity providers to authenticate OpenStack users.
# Keystone itself has no quotas, but controls project-level quotas for other services# Set Nova quotas for a project
openstack quota set --instances 20 --cores 40 --ram 81920 dev-team
# Set Cinder quotas
openstack quota set --volumes 50 --gigabytes 1000 dev-team
Troubleshoot
1. "401 Unauthorized" on All Services
Symptoms: Every openstack CLI command returns 401. All service-to-service calls fail.
Root causes and resolution:
Cause
Diagnosis
Fix
Expired Fernet keys
docker exec keystone_api ls -la /etc/kolla/keystone/fernet-keys/ -- check modification timestamps
kolla-ansible -i inventory keystone_fernet_rotate
Clock skew
date on controller vs compute nodes -- difference > 30s causes token validation failure
Sync NTP: chronyc sources and chronyc tracking
Wrong endpoint in admin-openrc.sh
cat /etc/kolla/admin-openrc.sh -- verify OS_AUTH_URL matches actual Keystone endpoint
Symptoms: Services fail to find each other. Errors like "Could not find service endpoint" or wrong URLs in API responses.
Diagnosis:
openstack endpoint list --long
# Check: public/internal/admin URLs match actual service locations# Check: region names are consistent across all services
Fix: Correct the mismatched endpoint:
openstack endpoint set --url http://correct-host:port/v3 <endpoint-id>
3. Token Validation Failures
Symptoms: Tokens issue successfully but fail validation on other services. Intermittent auth failures.
Root causes:
Cause
Diagnosis
Fix
Fernet key mismatch (multi-node)
Compare key files across Keystone nodes
kolla-ansible -i inventory keystone_fernet_rotate to sync
Service user pattern: Each service has a dedicated user in the service project with the admin role. Kolla-Ansible creates these automatically.
Endpoint discovery: Services find each other through the Keystone service catalog. When Nova needs to fetch an image from Glance, it queries the catalog for the image service endpoint.
Token flow:
User authenticates to Keystone, receives scoped token
User sends request to Nova with token in X-Auth-Token header
Nova's keystonemiddleware validates token against Keystone (or memcached cache)
Nova uses its own service user token to call Glance, Neutron, Cinder as needed
