keystone — Scenarios

sequenceDiagram
  autonumber
  participant U as Client (openstack CLI)
  participant K as keystone-api
  participant DB as SQL
  participant C as memcached
  participant N as nova-api + keystonemiddleware
  U->>K: POST /v3/auth/tokens {password, scope project}
  K->>DB: SELECT user/local_user/password (+ failure counter)
  alt bad password
    K->>DB: UPDATE local_user SET failed_auth_count+1
    K-->>U: 401 "The request you have made requires authentication."
  else account locked / disabled / password expired
    K-->>U: 401 AccountLocked / UserDisabled / PasswordExpired
  else
    K->>DB: roles (effective assignments), catalog
    K->>K: Fernet encrypt(msgpack payload v2) with the primary key
    K-->>U: 201 X-Subject-Token + token body + catalog
  end
  U->>N: GET /servers  X-Auth-Token
  N->>K: GET /v3/auth/tokens  X-Auth-Token=<service token>  X-Subject-Token=<user token>  [inferred: middleware]
  K->>C: tokens region (cached validation?)
  alt not cached
    K->>K: decrypt with the active keys, expiry check
    K->>DB: SELECT revocation_event … (check_token)
    K->>DB: SELECT user (enabled?)
  end
  alt revoked / expired / unreadable key
    K-->>N: 404 TokenNotFound
    N-->>U: 401 [inferred]
  else
    K-->>N: 200 token (roles, project, catalog)
    N->>N: middleware cache (token_cache_time) [inferred]
  end

sequenceDiagram
  autonumber
  participant A as Administrator
  participant K as keystone-api
  participant DB as SQL
  participant C as memcached
  participant MQ as RabbitMQ
  participant N as other services
  A->>K: PATCH /v3/users/{id} {"enabled": false}
  K->>DB: UPDATE user SET enabled=false
  K->>K: callbacks "disabled user" (same request)
  K->>DB: INSERT revocation_event(user_id, issued_before=now) + purge of expired events
  K->>DB: DELETE application_credential … WHERE user_id
  K->>C: invalidate tokens and receipts regions (new region identifier)
  K->>MQ: identity.user.updated (CADF)
  K-->>A: 200
  N->>K: validation of an old token of the user [inferred]
  K-->>N: 404 TokenNotFound (revocation event matched)

sequenceDiagram
  autonumber
  participant B as Browser (Horizon)
  participant H as Apache + mod_auth_openidc
  participant K as keystone-api
  participant I as External IdP (OIDC)
  participant DB as SQL
  B->>H: GET /v3/auth/OS-FEDERATION/websso/openid?origin=https://horizon/…
  H->>I: OIDC redirect, authentication
  I-->>H: code → id_token (validated by the module)
  H->>K: same request + OIDC-* attributes in the WSGI environment
  K->>DB: identity_provider (by remote_id), federation_protocol, mapping
  K->>K: RuleProcessor.process(assertion) → user, groups, projects
  alt no rule matches / IdP disabled
    K-->>B: 401 / 403
  else
    K->>DB: shadow user (federated_user, nonlocal_user), expiring_user_group_membership (TTL authorization_ttl)
    K->>K: federated unscoped token (payload v4)
    K-->>B: 200 HTML page that POSTs the token to "origin" (trusted_dashboard)
  end
  B->>K: POST /v3/auth/tokens {token, scope project}
  K-->>B: 201 federated project-scoped token (v5)

sequenceDiagram
  autonumber
  participant U as User
  participant K as keystone-api
  participant DB as SQL
  U->>K: POST /v3/users/{me}/application_credentials {name, roles?, expires_at?, access_rules?}
  K->>DB: effective roles of the user on the token's project
  alt requested role not held
    K-->>U: 404 RoleAssignmentNotFound
  else quota reached
    K-->>U: 403 ApplicationCredentialLimitExceeded
  else
    K->>DB: INSERT application_credential (secret_hash), application_credential_role, access_rule
    K-->>U: 201 {id, secret (shown once only), …}
  end
  Note over U: later, from a script or a service
  U->>K: POST /v3/auth/tokens {methods:[application_credential], id, secret}
  K->>DB: application_credential + hash check + expiry + user enabled
  K-->>U: 201 token v9 (credential's roles only, expiry ≤ the credential's)

sequenceDiagram
  autonumber
  participant O as Operator / cron
  participant M as keystone-manage (node 1)
  participant FS1 as fernet-keys node 1
  participant FS2 as fernet-keys nodes 2..n
  O->>M: fernet_rotate --keystone-user keystone --keystone-group keystone
  M->>FS1: create a new staged key 0; rename the old 0 to N+1 (primary)
  M->>FS1: delete the oldest keys beyond max_active_keys
  O->>FS2: rsync of the repository (must be fast)
  Note over FS1,FS2: between rotation and sync, node 1 encrypts with key N+1, which nodes 2..n already know as key 0 (staged): validation keeps working