Architecture of Openstack: Keystone

Understanding the concept of Keystone;

A generic Identity and Access Management (IAM) system consists of an access management service.  The core of an IAM system is authentication and authorization. Authentication is the process of verifying credentials and authorization grants a subject to perform an action on a target resource. 

Keystone is the centralized Identity and access management (IAM) component of OpenStack.

It supports two type of auth mechanism: EC2 style and OS style (tokenization).

In Keystone, Authentication is centralized. The authorization part is still evolving.

Keystone middleware acts as an agent to communicate and validate token between the Keystone server and services within openstack. It enables a common mechanism for centralized authentication and authorization for OpenStack services. 

In short, Keystone is an Openstack Identity service which verifies the user's and provides inofrmation about which resourcs the user has access to. 

Following are some of the snapshorts where you can see the login system provided by keystone;