OpenStack OpenStack Identity (Keystone) 2 — Questions and Answers
Question 1: What is a Keystone 'domain' used for in multi-tenant deployments?
- A DNS domain for service endpoint resolution
- A high-level administrative boundary for grouping projects and users (Correct answer)
- A geographic region hosting OpenStack services
- A network domain managed by Neutron
Correct answer: A high-level administrative boundary for grouping projects and users
Keystone domains provide a high-level administrative boundary to isolate users and projects, enabling multi-organization deployments.
Question 2: Which authentication backend does Keystone use by default for storing user credentials?
- LDAP
- SQL (local database) (Correct answer)
- Active Directory
- Kerberos
Correct answer: SQL (local database)
By default, Keystone stores user credentials in a SQL database (typically MySQL or MariaDB).
Question 3: What does 'OS_AUTH_URL' in an OpenStack RC file point to?
- The Nova compute API endpoint
- The Keystone Identity API endpoint for authentication (Correct answer)
- The Horizon dashboard URL
- The Swift object storage endpoint
Correct answer: The Keystone Identity API endpoint for authentication
OS_AUTH_URL specifies the Keystone Identity API endpoint that OpenStack CLI and SDKs use for authentication.
Question 4: What is Keystone federation used for?
- Replicating Keystone databases across regions
- Allowing users from external identity providers (IdPs) to authenticate to OpenStack (Correct answer)
- Synchronizing service catalogs between OpenStack clouds
- Enabling cross-project resource sharing
Correct answer: Allowing users from external identity providers (IdPs) to authenticate to OpenStack
Keystone federation allows users from external identity providers (like SAML or OIDC) to authenticate to OpenStack.
Question 5: What is the purpose of the 'application credentials' feature in Keystone?
- Providing API access for applications without embedding user passwords in config files (Correct answer)
- Creating service accounts for OpenStack internal services
- Generating OAuth tokens for mobile applications
- Managing certificates for TLS service endpoints
Correct answer: Providing API access for applications without embedding user passwords in config files
Application credentials allow applications to authenticate to OpenStack using dedicated credentials without exposing user passwords.
Question 6: What is Keystone's 'policy.json' file used for?
- Configuring Keystone's database connection settings
- Defining RBAC rules that determine what operations each role can perform on APIs (Correct answer)
- Specifying which identity backends to use for authentication
- Setting token expiration times and rotation policies
Correct answer: Defining RBAC rules that determine what operations each role can perform on APIs
The policy.json (or policy.yaml) file defines RBAC rules governing which roles are permitted to perform which API operations.
OpenStack OpenStack Identity (Keystone) 2
What is a Keystone 'domain' used for in multi-tenant deployments?