# Configuring Keystone

## Identity sources

One of the most impactful decisions you’ll have to make when configuring keystone is deciding how you want keystone to source your identity data. Keystone supports several different choices that will substantially impact how you’ll configure, deploy, and interact with keystone.

You can also mix-and-match various sources of identity (see Domain-specific Configuration for an example). For example, you can store OpenStack service users and their passwords in SQL, manage customers in LDAP, and authenticate employees via SAML federation.

Summary

Feature | Status | LDAP | OAuth v1.0a | OpenID Connect | REMOTE_USER | SAML v2 | SQL
--- | --- | --- | --- | --- | --- | --- | ---
Local authentication | optional | `✔` | `✔` | `✖` | `✖` | `✖` | `✔`
External authentication | optional | `✖` | `✖` | `✔` | `✔` | `✔` | `✖`
Identity management | optional | `✔` | `✔` | `✖` | `✖` | `✖` | `✔`
PCI-DSS controls | optional | `✔` | `✖` | `✖` | `✔` | `✖` | `✔`
Auditing | optional | `✔` | `✖` | `✔` | `✖` | `✔` | `✔`

Details

- Local authentication

  Status: optional.

  Notes: Authenticate with keystone by providing credentials directly to keystone.

  Driver Support:

  - LDAP: `complete`
  - OAuth v1.0a: `complete`
  - OpenID Connect: `missing`
  - REMOTE_USER: `missing`
  - SAML v2: `missing`
  - SQL: `complete`
- External authentication

  Status: optional.

  Notes: Authenticate with keystone by providing credentials to an external system that keystone trusts (as with federation).

  Driver Support:

  - LDAP: `missing`
  - OAuth v1.0a: `missing`
  - OpenID Connect: `complete`
  - REMOTE_USER: `complete`
  - SAML v2: `complete`
  - SQL: `missing`
- Identity management

  Status: optional.

  Notes: Create, update, enable/disable, and delete users via Keystone’s HTTP API.

  Driver Support:

  - LDAP: `partial`
  - OAuth v1.0a: `complete`
  - OpenID Connect: `missing`
  - REMOTE_USER: `missing`
  - SAML v2: `missing`
  - SQL: `complete`
- PCI-DSS controls

  Status: optional.

  Notes: Configure keystone to enforce PCI-DSS compliant security controls.

  Driver Support:

  - LDAP: `partial`
  - OAuth v1.0a: `missing`
  - OpenID Connect: `missing`
  - REMOTE_USER: `partial`
  - SAML v2: `missing`
  - SQL: `complete`
- Auditing

  Status: optional.

  Notes: Audit authentication flows using PyCADF.

  Driver Support:

  - LDAP: `complete`
  - OAuth v1.0a: `missing`
  - OpenID Connect: `complete`
  - REMOTE_USER: `missing`
  - SAML v2: `complete`
  - SQL: `complete`

Notes:

- This document is a continuous work in progress

this page last updated: 2026-06-11 21:45:03

Except where otherwise noted, this document is licensed under Creative Commons Attribution 3.0 License. See all OpenStack Legal Documents.

found an error? report a bug