# Keystone, the OpenStack Identity Service

Keystone is an OpenStack service that provides API client authentication, service discovery, and distributed multi-tenant authorization by implementing OpenStack’s Identity API.

This documentation is useful for contributors looking to get involved in our community, developers writing applications on top of OpenStack, and operators administering their own OpenStack deployments.

This documentation is generated by the Sphinx toolkit and lives in the source tree. Also see the Getting Involved page for other ways to interact with the community.

## Related Projects

In addition to creating OpenStack’s Identity Service, the Keystone team also provides a WSGI middleware, an Authentication library and a Python client library.

## Installation Guides

- Keystone Installation Tutorial
  - Keystone Installation Tutorial for Red Hat Enterprise Linux and CentOS
  - Keystone Installation Tutorial for Ubuntu

## General Information

This section contains general information related to keystone which is relevant to developers, users and operators. For documentation specific to any of these three, please see the subsequent sections.

- Getting Started
  - Keystone Architecture
  - Mapping of policy target to API
  - Getting Involved
- Code Documentation
  - keystone
- Indices and tables

## Contributor Documentation

This section contains the documentation needed for developing keystone.

- Contributor Documentation
  - So You Want to Contribute…
  - How Can I Help?
  - Setting up Keystone
  - Identity API v2.0 and v3 History
  - Proposing Features
  - Working with Release Notes
  - Testing Keystone
  - Developing `doctor` checks
  - Making an API Change
  - Authentication Plugins
  - Database Migrations
  - Identity entity ID management for domain-specific backends
  - Learning Architecture Internals
  - Keystone for Other Services
  - Developing Keystone Drivers
  - Service Catalog Overview
  - Technical Vision for Keystone
  - Programming Exercises for Interns and New Contributors

## User Documentation

This section contains the documentation for end-users of keystone.

- User Documentation
  - Supported clients
  - Application Credentials
  - Trusts
  - API Discovery with JSON Home
  - API Examples using Curl
  - Multi-Factor Authentication
  - Domain Manager Usage

## CLI Documentation

This section details information related to keystone management commands.

- CLI Documentation
  - keystone-manage
  - keystone-status

## Administrator Guides

- Administrator Guides
  - Getting Started
    - Identity concepts
    - Configuring Keystone
    - Bootstrapping Identity
    - Manage projects, users, and roles
    - Create and manage services and service users
  - Keystone Configuration
    - Troubleshoot the Identity service
    - Logging
    - Domain-specific configuration
    - Integrate Identity with LDAP
    - Caching layer
    - Security compliance and PCI-DSS
    - Performance and scaling
    - URL safe naming of projects and domains
    - Limiting list return size
    - Endpoint Filtering
    - Endpoint Policy
  - Keystone Operations
    - Upgrading Keystone
    - Case-Insensitivity in keystone
    - Managing trusts
  - All about keystone tokens
    - Keystone tokens
    - Fernet - Frequently Asked Questions
    - JWS key rotation
    - Token provider
  - Default Roles
    - Primer
    - Roles Definitions
    - System Personas
    - Domain Personas
    - Project Personas
    - Writing Policies
  - Advanced Keystone Features
    - Unified Limits
    - Resource Options
    - Credential Encryption
    - Health Check
    - Keystone Event Notifications
  - Authentication Mechanisms
    - Multi-Factor Authentication
    - Time-based One-time Password (TOTP)
    - Federated Identity
    - Using external authentication with Keystone
    - Configuring Keystone for Tokenless Authorization
    - OAuth1 1.0a
  - OAuth2.0 Client Credentials Grant Flow
    - Overview
    - Guide
  - Configure HTTPS in Identity Service
  - OAuth 2.0 Mutual-TLS Client Authentication Flow
    - Overview
    - Guide

## Configuration Options

- Keystone Configuration Options
  - API Configuration options
  - Policy configuration
  - Sample configuration files

this page last updated: 2026-06-11 21:50:20

Except where otherwise noted, this document is licensed under Creative Commons Attribution 3.0 License. See all OpenStack Legal Documents.

found an error? report a bug