OpenKeel: the sovereign French Cloud solution of the inherent group, with a European reach Discover inherent

Get started

Reverse-spec · Libraries

keystonemiddleware — Summary

Reverse-specification of keystonemiddleware — branch stable/2026.2

Branch stable/2026.2 @ 3a8a835bb573 (13.0.1 + 2 maintenance commits) — repository https://opendev.org/openstack/keystonemiddleware — analysed on 2026-10-28

  • Scope: all non-test code (29 files, about 4,500 lines): auth_token, audit, oauth2_token, oauth2_mtls_token, external_oauth2_token.
  • References are file:line relative to the repository root. [inferred] marks a statement that was not followed to the end in the code.

Files of this specification

FileContent
01-middleware-interface_stable-2026.2.mdthe 5 filters; auth_token flow; headers injected for the service; access rules; options
02-errors_stable-2026.2.md401 / 503 to callers; translation of Keystone's responses; log-only errors
03-interactions_stable-2026.2.mdcalls to Keystone, token cache (key, TTL, encryption), CADF audit
04-scenarios_stable-2026.2.md4 scenarios: validation and cache, revocation, service token, access rules
05-async-processing_stable-2026.2.mdnone
06-change-history_stable-2026.2.md2 maintenance commits
07-rewrite-pack_stable-2026.2.mdrequirements towards Keystone, specification of a Go middleware for OpenKeel, 10 scenarios recorded against Keystone (10/10), a security point

Overview

Each OpenStack service (Nova, Placement, Neutron, Cinder…) puts auth_token in front of its API:

  1. it validates the token of each request against Keystone, keeping the result in cache for 300 s;
  2. it rejects the request with 401, or lets it through marked Invalid if delay_auth_decision is set;
  3. it passes the identity to the service as **X-* headers** (user, project, roles, scope, catalog), which oslo.context reads.

audit publishes CADF events for each request. Three OAuth2 variants accept Bearer tokens.

Key figures

5 filters; about 25 identity headers removed then injected; cache 300 s by default; 3 connection retries to Keystone; 0 background processing.

Points of attention

  1. Revocation is not immediate: a validated token stays accepted for up to token_cache_time (300 s), per process if memcached is not configured (scenario 9).
  2. **OpenStack-System-Scope is not removed** from client requests. It reaches the service when the token is invalid and delay_auth_decision is set (scenario 6, 07 § 5).
  3. **Without service_type**, every token from an application credential with access rules is refused.
  4. Keystone unavailable → 503 for all requests not in the cache.
  5. **X-Is-Admin-Project: True** for every project as long as Keystone has no admin_project_name/admin_project_domain_name configured (scenario 1).

Blind spots / [inferred]

  • OAuth2 (internal, mTLS, external), audit and memcached modes were not run.
  • The impact of point 2 depends on how each service uses delay_auth_decision and X-Identity-Status.

Source: reverse-spec-keystonemiddleware/00-summary_stable-2026.2.md. The _rewrite/ and _inventory/ files are not published on the site.