Welcome to the Comprehensive Guide to Keystone

Keystone is an OpenStack service that provides API client authentication, service discovery, and distributed multi-tenant authorization. In this guide, we’ll take a deep dive into the foundational APIs offered by Keystone and explore them with practical code snippets and an application example.

Key Keystone APIs

1. Authentication API

Keystone’s authentication API enables users to obtain and manage authentication tokens.

POST /v3/auth/tokens
{
  "auth": {
    "identity": {
      "methods": [
        "password"
      ],
      "password": {
        "user": {
          "name": "admin",
          "domain": {
            "id": "default"
          },
          "password": "secretpassword"
        }
      }
    }
  }
}

2. CRUD Operations on Users

Create, read, update, and delete users with Keystone’s user API.

Create User

POST /v3/users
{
  "user": {
    "name": "newuser",
    "domain_id": "default",
    "enabled": true,
    "password": "supersecretpassword"
  }
}

Update User

PATCH /v3/users/{user_id}
{
  "user": {
    "enabled": false
  }
}

Delete User

DELETE /v3/users/{user_id}

3. Role Assignment API

Manage role assignments for users and projects.

Assign Role to User

PUT /v3/projects/{project_id}/users/{user_id}/roles/{role_id}

Application Example: Keystone Integration

Let’s create a Python application that interacts with Keystone using the APIs mentioned above.

Step 1: Obtain Authentication Token

import requests

auth_url = "http://keystone.example.com/v3/auth/tokens"
auth_data = {
    "auth": {
        "identity": {
            "methods": ["password"],
            "password": {
                "user": {
                    "name": "admin",
                    "domain": {"id": "default"},
                    "password": "secretpassword"
                }
            }
        }
    }
}

auth_response = requests.post(auth_url, json=auth_data)
token = auth_response.headers['X-Subject-Token']
print("Authentication Token:", token)

Step 2: Create User

user_url = "http://keystone.example.com/v3/users"
headers = {"X-Auth-Token": token}
user_data = {
    "user": {
        "name": "newuser",
        "domain_id": "default",
        "enabled": True,
        "password": "supersecretpassword"
    }
}

user_response = requests.post(user_url, json=user_data, headers=headers)
print("Create User Response:", user_response.json())

Step 3: Assign Role to User

role_url = "http://keystone.example.com/v3/projects/{project_id}/users/{user_id}/roles/{role_id}"
role_response = requests.put(role_url, headers=headers)
print("Assign Role Response:", role_response.status_code)

By following these steps, you can effectively integrate Keystone’s powerful authentication and authorization capabilities into your applications.

Hash: 4cc7a4b341d8ce3315ea112ebb01e664bd328e88781db0f4bbc0e3f65e201bf9