Implementing Federated Identity in OpenStack via SAML2
Learn how to implement SAML2 federated identity in OpenStack Keystone to allow external authentication without storing local passwords, including mapping rules and failure diagnostics.
Loading…
ReadMeFeed / Community knowledge
#keystone
Real questions. Useful conversations. Find the people who know your stack.
openstackKeystone UUID token validation latency limits under concurrent load
OpenStack Keystone utilizes UUID tokens that require a database lookup for each validation request. In high-concurrency environments, this architecture can lead to increased latency due to lock contention on the token table, particularly when backed by a Galera cluster. While token caching via memcached or Redis is a documented mitigation in keystone.conf ,
Keystone, Neutron and Designate: TLS trust store coordination for external DNS updates?
The goal is to determine whether OpenStack services involved in the Neutron‑Designate DNS update path—Keystone for authentication, Neutron for triggering the update, and Designate for contacting the external DNS provider—can be configured to use a common TLS trust store when validating the certificates of those external DNS endpoints. Current documentation i