keystoneauth — Scenarios

End-to-end scenarios — keystoneauth — branch stable/2026.2

Branch stable/2026.2 @ 1cd5400202c6 — repository https://opendev.org/openstack/keystoneauth — analysed on 2026-10-28

The four diagrams below follow exchanges actually recorded between keystoneauth stable/2026.2 and Keystone stable/2026.2 (_rewrite/exchanges_stable-2026.2.json).

1. Generic plugin: discovery, authentication, service call

sequenceDiagram
  autonumber
  participant A as Application (Session + generic.Password)
  participant K as Keystone
  participant S as Service (e.g. Placement)
  A->>K: GET /  (discovery, anonymous)
  K-->>A: 300 {"versions": {"values": [{"id": "v3.14", "links": [...]}]}}
  A->>K: POST /v3/auth/tokens {"auth": {identity: password, scope: project}}
  alt bad credentials
    K-->>A: 401 → exceptions.Unauthorized
  else
    K-->>A: 201 X-Subject-Token + token (catalog)
  end
  A->>A: catalog: service_type, interface (public), region → URL
  A->>S: GET <version URL> (service discovery, unless the catalog URL already matches)
  A->>S: GET /resource_providers  X-Auth-Token, OpenStack-API-Version: placement 1.x
  S-->>A: 200 / 4xx → from_response

2. Token revoked during the session: automatic re-authentication

sequenceDiagram
  autonumber
  participant A as Session
  participant K as Keystone
  A->>K: POST /v3/auth/tokens → 201 (token T1)
  Note over K: T1 revoked (DELETE /v3/auth/tokens)
  A->>K: GET /v3/projects X-Auth-Token: T1
  K-->>A: 401
  A->>A: invalidate() (allow_reauth)
  A->>K: POST /v3/auth/tokens → 201 (T2)
  A->>K: GET /v3/projects X-Auth-Token: T2 → 200

Source: keystoneauth1/session.py:1128-1136. One retry only: a second 401 is raised as Unauthorized.

3. MFA: receipt, then second factor

sequenceDiagram
  autonumber
  participant A as keystoneauth
  participant K as Keystone
  A->>K: POST /v3/auth/tokens {methods: [password]}
  K-->>A: 401 + Openstack-Auth-Receipt + {"receipt": {"methods": ["password"], "expires_at"}, "required_auth_methods": [["password","totp"]]}
  A-->>A: exceptions.MissingAuthMethods (receipt, methods, required_auth_methods)
  A->>K: POST /v3/auth/tokens {methods: [password, totp]} (v3.MultiFactor)
  K-->>A: 201 token, methods = [password, totp]

Sources: keystoneauth1/exceptions/http.py:505-510, keystoneauth1/exceptions/auth.py:23-32.

4. Application credential

sequenceDiagram
  autonumber
  participant A as keystoneauth (v3.ApplicationCredential)
  participant K as Keystone
  A->>K: POST /v3/auth/tokens {"identity": {"methods": ["application_credential"], "application_credential": {"id", "secret"}}}
  K-->>A: 201 project-scoped token, methods = [application_credential]

The scenario sends no scope: Keystone scopes the token to the credential's project (plugin at keystoneauth1/identity/v3/application_credential.py).

Source: reverse-spec-keystoneauth/04-scenarios_stable-2026.2.md. The _rewrite/ and _inventory/ files are not published on the site.