OpenStack Identity (Keystone) Flashcards

What is a Keystone 'domain' used for in multi-tenant deployments?

Answer: A high-level administrative boundary for grouping projects and users

Keystone domains provide a high-level administrative boundary to isolate users and projects, enabling multi-organization deployments.

Which authentication backend does Keystone use by default for storing user credentials?

Answer: SQL (local database)

By default, Keystone stores user credentials in a SQL database (typically MySQL or MariaDB).

What does 'OS_AUTH_URL' in an OpenStack RC file point to?

Answer: The Keystone Identity API endpoint for authentication

OS_AUTH_URL specifies the Keystone Identity API endpoint that OpenStack CLI and SDKs use for authentication.

What is Keystone federation used for?

Answer: Allowing users from external identity providers (IdPs) to authenticate to OpenStack

Keystone federation allows users from external identity providers (like SAML or OIDC) to authenticate to OpenStack.

What is the purpose of the 'application credentials' feature in Keystone?

Answer: Providing API access for applications without embedding user passwords in config files

Application credentials allow applications to authenticate to OpenStack using dedicated credentials without exposing user passwords.

What is Keystone's 'policy.json' file used for?

Answer: Defining RBAC rules that determine what operations each role can perform on APIs

The policy.json (or policy.yaml) file defines RBAC rules governing which roles are permitted to perform which API operations.