keystonemiddleware — Scenarios

End-to-end scenarios — keystonemiddleware — branch stable/2026.2

Branch stable/2026.2 @ 3a8a835bb573 — repository https://opendev.org/openstack/keystonemiddleware — analysed on 2026-10-28

Scenarios recorded with auth_token in front of a test application, against Keystone stable/2026.2 (_rewrite/exchanges_stable-2026.2.json).

1. Request with a valid token, then cache

sequenceDiagram
  autonumber
  participant C as Client
  participant M as auth_token (in nova-api, placement-api…)
  participant K as Keystone
  participant A as Service
  C->>M: GET /…  X-Auth-Token: T
  M->>M: remove client-supplied X-* headers
  M->>M: cache tokens/sha256(T)? (miss)
  M->>K: POST /v3/auth/tokens (middleware's own credentials, first time only)
  M->>K: GET /v3/auth/tokens  X-Subject-Token: T, OpenStack-Identity-Access-Rules: 1
  alt 404 (invalid, expired, revoked)
    M-->>C: 401 + WWW-Authenticate (or Invalid + continue if delay_auth_decision)
  else 200
    M->>M: cache for token_cache_time (300 s)
    M->>A: request + X-Identity-Status: Confirmed, X-User-Id, X-Project-Id, X-Roles (member,reader)…
    A-->>C: response
  end

2. Revocation and cache (recorded scenario 9)

sequenceDiagram
  autonumber
  participant C as Client
  participant M as auth_token (cache filled)
  participant K as Keystone
  C->>M: X-Auth-Token: T → 200 (validated, cached)
  Note over K: DELETE /v3/auth/tokens (T revoked)
  C->>M: X-Auth-Token: T → 200 (cache, Keystone not called)
  Note over M: after token_cache_time, or on another worker or process with no shared cache
  C->>M: X-Auth-Token: T → GET /v3/auth/tokens → 404 → 401

3. Service token and expired user token

sequenceDiagram
  autonumber
  participant N as nova-compute (user token + service token)
  participant M as auth_token (Cinder)
  participant K as Keystone
  N->>M: X-Auth-Token: U (possibly expired), X-Service-Token: S
  M->>K: GET /v3/auth/tokens (S)
  K-->>M: 200, roles include "service"
  M->>K: GET /v3/auth/tokens?allow_expired=1 (U)
  K-->>M: 200 (within allow_expired_window)
  M->>M: X-Service-Identity-Status: Confirmed, X-Service-Roles: service

Without the service role (scenario 8): 401.

4. Application credential with access rules (scenario 10)

sequenceDiagram
  autonumber
  participant C as Client (application-credential token, rule identity GET /v3/users)
  participant M as auth_token (service_type = identity)
  participant K as Keystone
  C->>M: GET /v3/users
  M->>K: GET /v3/auth/tokens (OpenStack-Identity-Access-Rules: 1)
  K-->>M: 200 token.application_credential.access_rules
  M-->>C: 200 (rule matched)
  C->>M: GET /v3/projects
  M-->>C: 401 (no matching rule)

Without service_type in the middleware: 401 for every request carrying such a token.

Source: reverse-spec-keystonemiddleware/04-scenarios_stable-2026.2.md. The _rewrite/ and _inventory/ files are not published on the site.