For Icehouse Keystone should support SAML. This is an attempt to pull
together the various pieces necessary to make that happen.
The general apporach is that a Keystone will maintain a short lived set
of user records for users that have presented valid SAML assertions.
The assertions will be processed through a "mapping" backend and stored
in the identity backend.
Morgan Fainberg is going to be reworking the Memcached backend so that
it uses dogpile, the same mechanism that we are using for caching.
Bascially, we will have one Key/Value Store backend, and then various
drivers for mapping that to in memory, memcached, Cassandra, or any
others that come up. I think we will continue to call this the
Key/Value Store (KVS) backend.
Henry Nash is working on integrating multiple LDAP servers into
Keystone. Each LDAP server backs a single domain. Each one gets its
own mapping from LDAP calls to Identity based on a config file.
For Federation, we will want to use the KVS backend for identity. Thus,
we need to be able to configure a domain or set of domains to store
identity information in KVS. This will follow the pattern of Henry
Nash's LDAP work.
We need to keep user IDs Globally unique. In addition, we need to
ensure that a user Id can be mapped to the appropriate identity
backend. This is slated to be discussed at the summit Federated ID session:
http://summit.openstack.org/cfp/details/28
The diagram at the bottom of the federation blueprint shows how they are
linked together.
https://blueprints.launchpad.net/keystone/+spec/federation
https://blueprints.launchpad.net/keystone/+spec/mapping-distributed-admin
https://blueprints.launchpad.net/keystone/+spec/saml-id
https://blueprints.launchpad.net/keystone/+spec/dogpile-kvs-backends
https://blueprints.launchpad.net/keystone/+spec/multiple-datastores
https://blueprints.launchpad.net/keystone/+spec/abfab
We have a planned API freeze for Keystone in I2. Grizzly 2 was in Mid
January. The Grizzly Summit was about 3 weeks early than the Icehouse
summit, so if we go by a similar schedule, we should plan on having
until the end of January to get this work done. If we wait until the
Summit to get started, we will miss Icehouse.
_______________________________________________
OpenStack-dev mailing list
OpenStack-dev@lists.openstack.org
http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev
