Implementing Federated Identity in OpenStack via SAML2
Learn how to implement SAML2 federated identity in OpenStack Keystone to allow external authentication without storing local passwords, including mapping rules and failure diagnostics.
Loading…
ReadMeFeed / Community knowledge
#keystone
Real questions. Useful conversations. Find the people who know your stack.
openstackKeystone UUID token validation latency limits under concurrent load
OpenStack Keystone utilizes UUID tokens that require a database lookup for each validation request. In high-concurrency environments, this architecture can lead to increased latency due to lock contention on the token table, particularly when backed by a Galera cluster. While token caching via memcached or Redis is a documented mitigation in keystone.conf ,
What is the recommended approach for handling regional time zone offsets in OpenStack API responses?
OpenStack services, including Keystone and Nova, standardize internal timestamping and database storage using UTC to maintain consistency across distributed regional deployments. While API responses typically return timestamps in ISO 8601 format, the core services delegate time synchronization to the host operating system via NTP or chrony. Because the datab
Keystone, Neutron and Designate: TLS trust store coordination for external DNS updates?
The goal is to determine whether OpenStack services involved in the Neutron‑Designate DNS update path—Keystone for authentication, Neutron for triggering the update, and Designate for contacting the external DNS provider—can be configured to use a common TLS trust store when validating the certificates of those external DNS endpoints. Current documentation i