# Trusts

OpenStack Identity manages authentication and authorization. A trust is an OpenStack Identity extension that enables delegation and, optionally, impersonation through `keystone`. A trust extension defines a relationship between:

Trustor

  The user delegating a limited set of their own rights to another user.

Trustee

  The user trust is being delegated to, for a limited time.

  The trust can eventually allow the trustee to impersonate the trustor. For security reasons, some safeties are added. For example, if a trustor loses a given role, any trusts the user issued with that role, and the related tokens, are automatically revoked.

The delegation parameters are:

User ID

  The user IDs for the trustor and trustee.

Privileges

  The delegated privileges are a combination of a project ID and a number of roles that must be a subset of the roles assigned to the trustor.

  If you omit all privileges, nothing is delegated. You cannot delegate everything.

Delegation depth

  Defines whether or not the delegation is recursive. If it is recursive, defines the delegation chain length.

  Specify one of the following values:

  - `0`. The delegate cannot delegate these permissions further.

  - `1`. The delegate can delegate the permissions to any set of delegates but the latter cannot delegate further.

  - `inf`. The delegation is infinitely recursive.

Endpoints

  A list of endpoints associated with the delegation.

  This parameter further restricts the delegation to the specified endpoints only. If you omit the endpoints, the delegation is useless. A special value of `all_endpoints` allows the trust to be used by all endpoints associated with the delegated project.

Duration

  (Optional) Comprised of the start time and end time for the trust.

Note

See the administrator guide on removing expired trusts for recommended maintenance procedures.

## Usage

Trusts can be created using the `openstack trust create` command. This command expects a trustor, a trustee, and a project and list of roles that the trust is being delegated for.

For example, if you are the `admin` user and wish to delegate the `admin` role to the user `demo` for the project `admin`:

    $ openstack trust create --role admin --project admin admin demo

This will return a response including a `trust_id`. This `trust_id` can then be used during authentication for the user `demo`. For example, you can specify the following in `clouds.yaml`:

    devstack:
        auth:
            auth_url: 'http://example.com/identity'
            username: 'demo'
            password: '***'
            trust_id: '95946f9eef864fdc993079d8fe3e5747'
        identity_api_version: '3'
        region_name: RegionOne
        volume_api_version: '3'

Tokens returned when using a trust have a different format. You can inspect this by running a command with the `--debug` flag using the above cloud.

this page last updated: 2026-08-17 12:45:24

Except where otherwise noted, this document is licensed under Creative Commons Attribution 3.0 License. See all OpenStack Legal Documents.

found an error? report a bug