Interactions with other components — keystonemiddleware — branch stable/2026.2
Branch
stable/2026.2@3a8a835bb573— repository https://opendev.org/openstack/keystonemiddleware — analysed on 2026-10-28
| System | Protocol | Library | Direction | Purpose |
|---|---|---|---|---|
| Keystone | HTTP | keystoneauth (session + [keystone_authtoken] auth plugin), keystoneclient for validation | outbound, synchronous, in the request | authenticate the middleware itself, validate tokens |
| memcached (optional) | memcache (optionally TLS, SASL) | python-memcached / pymemcache pool, or oslo.cache | outbound | token validation cache |
| RabbitMQ (audit only) | AMQP (notifier) | oslo.messaging, or the log | outbound | CADF events |
external OAuth2 server (external_oauth2_token) | HTTP | requests / keystoneauth | outbound | token introspection |
1. Calls to Keystone (recorded, _rewrite/exchanges_stable-2026.2.json)
| Call | When | Details |
|---|---|---|
POST /v3/auth/tokens | first validation, then when the middleware's own token expires | credentials of [keystone_authtoken] (auth_type=password…) |
GET /v3 | discovery of the identity version, once per middleware | keystonemiddleware/auth_token/_identity.py |
**GET /v3/auth/tokens** | every token absent from the cache | X-Auth-Token (middleware's token), X-Subject-Token (token to validate), **OpenStack-Identity-Access-Rules: 1**, User-Agent: python-keystoneclient; ?allow_expired=1 when a valid service token is present; ?nocatalog if include_service_catalog = false (keystonemiddleware/auth_token/_identity.py:21, keystonemiddleware/auth_token/_identity.py:48-58) |
Expected responses: 200 with the token, 404 for an invalid token (→ 401), 401 if the middleware's token is no longer valid (→ re-authentication, then a retry).
2. Token cache (keystonemiddleware/auth_token/_cache.py)
- Key:
tokens/<sha256(token)>, or a key derived through HMAC withmemcache_security_strategy(keystonemiddleware/auth_token/_cache.py:24-37,keystonemiddleware/auth_token/_cache.py:141-214). - Value: the JSON of the token validation; encrypted (AES) or signed (HMAC) in
ENCRYPT/MACmode (keystonemiddleware/auth_token/_memcache_crypt.py). - TTL:
token_cache_time(300 s). - Only valid validations are cached: an invalid token goes back to Keystone every time [inferred:
setis only called after a successful validation,keystonemiddleware/auth_token/__init__.py:747-752]. - Consequence: a token revoked in Keystone stays accepted by a service for up to
token_cache_time. Recorded scenario 9: 200 → revocation → still 200 from the same middleware, 401 from a fresh middleware.
3. Audit (keystonemiddleware/audit/)
For each request (except ignore_req_list and ignore_path_list), it emits:
audit.http.request, a CADF event built from the request and theaudit_map_filemapping;audit.http.response, with the outcome (successfor 2xx/3xx,failureotherwise) andreason.reasonCode= the status.
Through oslo.messaging (use_oslo_messaging) or the log (keystonemiddleware/audit/__init__.py:109-172, keystonemiddleware/audit/_notifier.py).
Source: reverse-spec-keystonemiddleware/03-interactions_stable-2026.2.md. The _rewrite/ and _inventory/ files are not published on the site.