Identity and Access
Overview
We use the OpenStack component Keystone for identity and access. There are different ways to authenticate towards Keystone. Upon successful authentication, the identity service provides the user with an authorization token used for later service requests.
Supported authentication methods
| Method | Supported |
|---|---|
| Password | yes |
| Token | yes |
| Application Credentials | yes |
| Multi-Factor-Authentication (TOTP) | no |
Password
A common way for an user or service to authenticate towards Keystone is by using username and password. For an example, have a look at the API access tutorial.
Users can change their password either using the OpenStack CLI command openstack user password set, or via the Horizon Dashboard.
If you forgot your password, please contact our Support.
Token
When you authenticate using a token, it is not necessary anymore to provide username and password. Tokens are valid for only one hour.
The OpenStack CLI allows you to create tokens with the command openstack token issue. It can also be manually revoked using openstack token revoke. For more information how to get started with the OpenStack CLI, have a look at the API access tutorial.
Many clients will switch to the token authentication methods with these environment variables in place:
export OS_TOKEN="ab4d1e500c5245e5a166892943118a44"
export OS_AUTH_TYPE="token"
unset OS_USER_DOMAIN_NAME
unset OS_USERNAME
Application Credentials
Users can create Application Credentials and use them instead of the Password method. This is useful, to configure third party software like Prometheus to query the OpenStack API.
Using Application Credentials it can be avoided to put clear text passwords into the configuration of applications.
Application Credentials always belong to a user, and can inherit some or all roles of their owner.
Using this approach a user can delegate the operator (for read-write access) or, if desired, only the viewer role (for read-only access) to an application.
Please refer to the Application Credentials How-To to learn more about how to use Application Credentials.
Access management
On the OpenStack Cloud, users belong to groups, which can get access to projects. The access privileges of the user are defined by their roles in the project.
Typically every customer will have one or more users (for every team member), and one or more projects. Users can have access to all customer projects, or only to a subset of projects if required.
We manage projects, users, groups and roles for you. Please contact our Support if you happen to require changes to your projects, users or groups.
Projects
Every cloud resource, like virtual machines, belongs to a certain project. It might be good practice to separate unrelated pieces of infrastructure into different projects. If you need separate projects, please contact the Support.
Groups
By default, we create one group for read-only access and one group for read-write access for every project. If you have special requirements, please contact our Support.
Roles
| Role | Access to cloud resources |
|---|---|
| operator | create, read, update, delete |
| viewer | read |
For users with read-write access, we will assign both the operator and the viewer roles. This allows them to delegate these roles separately when creating Application Credentials.
Access to SEOS (S3-compatible Object Storage)
For access to the S3-compatible Object Storage, users can create, list and delete EC2 credentials (access key and secret key). They are only valid for the S3-compatible Object Storage (SEOS).
It is only possible to create EC2 credentials with the operator role, because they allow write access to all S3 buckets within a project by default.
For more information, see the Object Storage reference guide