Interactions with other components — keystoneauth — branch stable/2026.2
Branch
stable/2026.2@1cd5400202c6— repository https://opendev.org/openstack/keystoneauth — analysed on 2026-10-28
A library that runs in-process: no database, no bus, no cache shared between processes. Its only exchanges are HTTP (requests):
| Target | What keystoneauth sends | What it expects | Source |
|---|---|---|---|
| Keystone, authentication | POST {auth_url}/v3/auth/tokens (/v3 added if missing; ?nocatalog on request), body {"auth": {"identity": {"methods": [...], <method>: {...}}, "scope": ...}}, Accept: application/json, not authenticated | 201 + **X-Subject-Token** header + JSON body {"token": {...}}; 401 + Openstack-Auth-Receipt for MFA | keystoneauth1/identity/v3/base.py:163-262, keystoneauth1/access/access.py:45 |
| Keystone, discovery (generic plugins) | GET {auth_url} (often the root /) | a version document: {"versions": {"values": [...]}}, {"versions": [...]} or {"version": {...}} | keystoneauth1/discover.py:66-160 |
| Any service, discovery | GET on the candidate URLs (catalog URL, without the version, without project_id), first anonymous, then authenticated if 401 | entries with id (v2.1), status (CURRENT/SUPPORTED/STABLE/DEPRECATED/EXPERIMENTAL), links (rel=self), min_version/max_version (or version) for microversions | keystoneauth1/discover.py:572-1520 |
| Any service, calls | X-Auth-Token, OpenStack-API-Version: <type> <x.y> (+ legacy Nova/Ironic headers), User-Agent, X-Openstack-Request-Id (if given) | statuses and error bodies read by from_response (errors); Location for redirects; Retry-After | keystoneauth1/session.py:683-1162 |
| IdP (OIDC, SAML, ADFS, Kerberos) | OIDC token endpoint, ECP/ADFS assertion… | per protocol | keystoneauth1/identity/v3/oidc.py, keystoneauth1/extras/ |
Timing and robustness:
timeoutper request: none by default (self.timeout = None,keystoneauth1/session.py:428-447);connect_retriesandstatus_code_retriesare 0 by default; exponential delay from 0.5 s, capped at 60 s;- re-authentication: once, on a 401;
- the token is renewed 120 s before it expires.
Recorded frames: the 26 exchanges of _rewrite/exchanges_stable-2026.2.json (keystoneauth against Keystone stable/2026.2), for example the version discovery on GET / (300 Multiple Choices, accepted), and POST /v3/auth/tokens → 201 X-Subject-Token.
Source: reverse-spec-keystoneauth/03-interactions_stable-2026.2.md. The _rewrite/ and _inventory/ files are not published on the site.