OpenStack OpenStack Identity (Keystone) 2

Question 1

What is a Keystone 'domain' used for in multi-tenant deployments?

Accepted Answer

A high-level administrative boundary for grouping projects and users

Answer

Keystone domains provide a high-level administrative boundary to isolate users and projects, enabling multi-organization deployments.

Question 2

Which authentication backend does Keystone use by default for storing user credentials?

Accepted Answer

SQL (local database)

Answer

By default, Keystone stores user credentials in a SQL database (typically MySQL or MariaDB).

Question 3

What does 'OS_AUTH_URL' in an OpenStack RC file point to?

Accepted Answer

The Keystone Identity API endpoint for authentication

Answer

OS_AUTH_URL specifies the Keystone Identity API endpoint that OpenStack CLI and SDKs use for authentication.

Question 4

What is Keystone federation used for?

Accepted Answer

Allowing users from external identity providers (IdPs) to authenticate to OpenStack

Answer

Keystone federation allows users from external identity providers (like SAML or OIDC) to authenticate to OpenStack.

Question 5

What is the purpose of the 'application credentials' feature in Keystone?

Accepted Answer

Providing API access for applications without embedding user passwords in config files

Answer

Application credentials allow applications to authenticate to OpenStack using dedicated credentials without exposing user passwords.

OpenStack Practice Test