Contents
The basic function of the authentication service is to validate a client's credentials. If a client offers valid credentials, Auth returns a token and a service catalog. The client can use the service catalog to find endpoints for the services it can use. To any of those services, the client can show the token as evidence of having been authenticated.
Figure 2.1. A client sends credentials to the Auth service; if they are valid, the Auth service returns a token which can be used to identify the client to other services.
You can see some OpenStack-oriented illustrations of this idea, showing the OpenStack Keystone identity service authenticating for the OpenStack Nova compute service, at http://docs.openstack.org/trunk/openstack-identity/admin/content/example-flows.html. Some of the OpenStack functions illustrated may not be consistent with the privileges available to you as a Rackspace customer; you are very welcome to examine this and other OpenStack publications as general background material, but please rely on Rackspace sources for specific information about what you can do and how you can do it.
If the client's authentication attempt fails, the authentication service returns 401 unAuth.
To use the Cloud Authentication Service effectively, you should understand several key concepts:
- API Key
Your API Key is a unique alphanumeric identifier associated with your account. You can use your API key as an authentication credential, paired with your username, to generate an authentication token which will be recognized by the services in your service catalog. To find or generate your API key, login to the Rackspace Cloud Control Panel at http://mycloud.rackspace.com/.
- Authentication
Authentication is the act or process of confirming the identity of a user or the truth of a claim. The authentication service confirms that an incoming request is being made by the user who claims to be making the request. It does this by validating a set of claims that the user makes. These claims are initially in the form of a set of credentials. After initial confirmation based on credentials, the authentication service issues a token to the user; when making subsequent requests, the user can provide the token as evidence that the user's identity has already been authenticated.
- Credentials
Credentials are data that belong to and identify a specific user. Because credentials are assumed to be known by only one user, users who present valid credentials are assumed to have proven that they are who they say they are. Examples of credentials include:
a matching username and password
a matching username and API key
a unique token
- Endpoint
An endpoint is an entry point to an API. The endpoint is defined as a set of base URLs. API operations are defined relative to these URLs. An API may offer several regional endpoints for a single API. Rackspace provides two authentication endpoints: one for US-based accounts and one for UK-based accounts. To use v2.0 of the API for authentication, specify the API version as shown below:
US-based accounts authenticate through https://identity.api.rackspacecloud.com/v2.0/.
UK-based accounts authenticate through https://lon.identity.api.rackspacecloud.com/v2.0/.
Your account may be based in either the US or the UK; this is not determined by your physical location but by the location of the Rackspace retail site which was used to create your account:
If your account was created via http://www.rackspacecloud.com, it is a US-based account.
If your account was created via http:/www.rackspace.co.uk, it is a UK-based account.
If you are unsure how your account was created, use the Rackspace contact information at either site to ask for help.
- Role
A role is a personality that a user assumes when performing a specific set of operations. A role includes a set of rights and privileges. A user assuming a role inherits the rights and privileges associated with the role. A token that is issued to a user includes the list of roles the user can assume. When a user calls a service, that service determines how to interpret a user's roles. A role that grants access to a list of operations or resources within one service may grant access to a completely different list when interpreted by a different service.
- Service
A service provides one or more endpoints through which users can access resources and perform operations. Examples of OpenStack services include Compute (Nova), Object Storage (Swift), and Image Service (Glance).
- Service Catalog
Your service catalog is the list of services available to you, as returned along with your authentication token and an expiration date for that token. All the services in your service catalog should recognize your token as valid until it expires.
The catalog listing for each service provides at least one endpoint URL for that service. Other information, such as regions and versions and tenants, is provided if it's relevant to your access to this service.
- Sub-User
A sub-user, also called a sub-account, is a child of the account's fully-privileged administrative user. Each account has exactly one administrative user, holding the
identity:user-adminrole; optionally, one or multiple sub-users can be created, each holding theidentity:defaultrole. Each sub-user shares its parent's tenant information, group memberships, and endpoints.- Tenant
A tenant is a container used to group or isolate resources and/or identity objects. Depending on the service operator, a tenant may map to a customer, account, organization, or project.
- Token
A token is an opaque string that represents an authorization to access cloud resources. Tokens may be revoked at any time and are valid for a finite duration.
- User
A user is a digital representation of a person, system, or service who consumes cloud services. Users have credentials and may be assigned tokens; based on these credentials and tokens, the authentication service validates that incoming requests are being made by the user who claims to be making the request, and that the user has the right to access the requested resources. Users may be directly assigned to a particular tenant and behave as if they are contained within that tenant.
