Skip to content


Subversion checkout URL

You can clone with HTTPS or Subversion.

Download ZIP
Identity Service for OpenStack
branch: master

Keystone: Identity Service

Keystone is a proposed independent authentication service for OpenStack.

This initial proof of concept aims to address the current use cases in Swift and Nova which are:

  • REST-based, token auth for Swift
  • many-to-many relationship between identity and tenant for Nova.


  • Keystone - authentication service
  • Auth_Token - WSGI middleware that can be used to handle token auth protocol (WSGI or remote proxy)
  • Echo - A sample service that responds by returning call details

Also included:

  • Auth_Basic - Stub for WSGI middleware that will be used to handle basic auth
  • Auth_OpenID - Stub for WSGI middleware that will be used to handle openid auth protocol
  • RemoteAuth - WSGI middleware that can be used in services (like Swift, Nova, and Glance) when Auth middleware is running remotely


See pip-requires for dependency list

Setup: Install sudo easy_install pip sudo pip install -r pip-requires

Configuration: Keystone gets its configuration from command-line parameters or a .conf file. The file can be provided explicitely on the command line otherwise the following logic applies (the conf file in use will be output to help in troubleshooting:

  1. takes the config file from /etc/keystone.conf
  2. If the keystone package is also intalled on the system, /etc/keystone.conf or /etc/keystone/keystone.conf have higher priority than /etc/keystone.conf.

If you are also doing development on a system that has keystone.conf installed in /etc you may need to disambiguate it by providing the conf file in the command-line

 $ bin/keystone-control --confg-file etc/keystone.conf  --pid-file <pidfile> auth <start|stop|restart>

Path: keystone-control calls keystone-auth and it needs to be in the PATH

 $ export PATH=<top_dir>/bin:$PATH


$ cd bin
$ ./keystone-auth


During development, you can simply run as user (root not needed)

From the top Keystone directory ()

 $ bin/keystone=auth

It dumps stdout and stderr onto the terminal.

If you want to specify additional parameters (optional):

 $ bin/keystone-control --pid-file <pidfile>  --config-file etc/keystone.conf auth <start|stop|restart>


In production, stdout and stderr need to be closed and all the output needs to be redirected to a log file. Once the package is installed through setup tools, RPM, deb, or ebuild keystone-control is installed as /usr/sbin/keystone-control. Typically, it will be started a script in /etc/init.d/keystoned

keystone-control can invoke keystone-auth and start the keystone daemon with

 $ /usr/sbin/keystone-control auth start

It writes the process id of the daemon into /var/run/keystone/ The daemon can be stopped with

 $ /usr/sbin/keystone-control auth stop

keystone-control has the infrastructure to start and stop multiple servers keystone-xxx


Standalone stack (with Auth_Token)
$ cd echo/bin
$ ./echod

Distributed stack (with RemoteAuth local and Auth_Token remote)
$ cd echo/bin
$ ./echod --remote

in separate session
$ cd keystone/auth_protocols
$ python --remote


$ cd echo/echo
$ python
Note: this requires tests data. See section TESTING for initializing data


After starting keystone a keystone.db sqlite database should be created in the keystone folder.

Add test data to the database:

$ sqlite3 keystone/keystone.db < test/test_setup.sql

To clean the test database

$ sqlite3 keystone/keystone.db < test/kill.sql

To run client demo (with all auth middleware running locally on sample service):

$ ./echo/bin/echod
$ python echo/echo/

To run unit tests:

  • go to unit test/unit directory
  • run tests: python test_keystone

There are 8 groups of tests. They can be run individually or as an entire colection. To run the entire test suite run

$ python

A test can also be run individually e.g.

$ python

For more on unit testing please refer

$ python --help

To perform contract validation and load testing, use SoapUI (for now).


Download SOAPUI:

To Test Keystone Service:

  • File->Import Project
  • Select tests/IdentitySOAPUI.xml
  • Double click on "Keystone Tests" and press the green play (>) button
Something went wrong with that request. Please try again.