Keystone role assignments backend plugin OpenFGA
This project implements a backend plugin for Keystone to manage role assignments not in the Keystone database, but in the OpenFGA.
It is expected that every role assignment in Keystone context is represented by a relation in the OpenFGA (ReBAC) between user/group and project/domain.
model
schema 1.1
type domain
type user
relations
define owner: [domain]
type group
relations
define member: [user, group#member]
define owner: [domain]
type project
relations
define admin: [user, group#member]
define manager: [user, group#member] or admin
define member: [user, group#member] or admin or manager
define owner: [domain]
define reader: [user, group#member] or member or admin
define service: [system]
type system
relations
define admin: [user, group#member]
define member: [user, group#member] or admin
define reader: [user, group#member] or member or admin
define system: [user, group#member]Delegating role assignments to the OpenFGA allows to improve integration of OpenStack with the external IdP and authorization system to centrally manage user authorizations for different service providers (improves service provider role of OpenStack).
Installation
For the moment the project is not being published to the PyPi so you can install it from git repository.
Install the project into the virtual environment with the Keystone using pip install .
Configuration
In order to enable the integration it is necessary to make few changes in the keystone.conf
[fga]
api_url = <OPEN_FGA_URL>
store_id = <OPENFGA_STORE_ID>
model_id = <OPENFGA_MODEL_ID>
...
[assignment]
driver = openfgaAdditional considerations
OpenFGA must be highly available. In this deployment style OpenStack will query OpenFGA for at least every authentication request.
Having many roles requires expanding OpenFGA authorization model to define every role as a relation. This is not very scalable but at the same time unavoidable due to the nature of role assignments in OpenStack being a triplets (actor-role-object).
Keystone and OpenFGA both have methods of inheriting/inferring roles through role inferrence, group membership, domain to project delegation and so on. Currently Keystone does not support delegating such decisions to the backend and instead reimplements it internally. This has an effect that when certain role is granted between assignee and the object it is not possible to learn how is this achieved (as a direct assignment of through inheritance). It is strongly advised to keep role inferrence and user/group relations in sync between Keystone and OpenFGA to reduce confusion.
1 maintainer
Metadata
1 maintainer
Release files for keystone-role-assignment-openfga 0.1.0
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | |
|---|---|---|---|---|
| keystone_role_assignment_openfga-0.1.0.tar.gz | 108.3 kB | With provenance | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| keystone_role_assignment_openfga-0.1.0-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 128.1 kB
Release files / keystone_role_assignment_openfga-0.1.0.tar.gz
| Download URL | keystone_role_assignment_openfga-0.1.0.tar.gz |
|---|---|
| Size | 108.3 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
f42afac0baa9c80bcabbf29c8144f53b33e67b2a0abef8b33ad6ff0bb2fdeb8a
|
|
BLAKE2b-256 checksum How to use checksums |
3a508dac24d806fc2724b5a04ea9bddf036e7d2256c1cf2d7f5a951fdde4fb6a
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/6.1.0 CPython/3.12.9
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Apr 7, 2025.
Transparency logRelease files / keystone_role_assignment_openfga-0.1.0-py3-none-any.whl
| Download URL | keystone_role_assignment_openfga-0.1.0-py3-none-any.whl |
|---|---|
| Size | 19.8 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
360ed18b9e3d1f823b43a10edc40854bf8180f78a07ad494a822030f8bff9c5f
|
|
BLAKE2b-256 checksum How to use checksums |
df9535e7a92eb7d4acf57a4fa6af8302768f9a5fea9e8f735cbc28b92881e06f
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/6.1.0 CPython/3.12.9
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Apr 7, 2025.
Transparency logSecurity for keystone-role-assignment-openfga 0.1.0
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
Full provenance
All 2 files in this release have been uploaded with provenance metadata.
Attestation for keystone_role_assignment_openfga-0.1.0.tar.gz
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Apr 7, 2025.
Transparency logA note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
To learn more about protecting yourself from malicious actors, visit our package security documentation.
