UKC - Msc Project - Providing Moonshot access to OpenStack
•
1 like•747 views
This document discusses providing access to OpenStack using federated authentication with Moonshot. It provides an overview of Moonshot and OpenStack, then describes how federated Keystone authentication would allow users authenticated via Moonshot to access OpenStack resources. The technical architecture shows communication between the OpenStack client, Keystone, and identity provider via Moonshot modules. Finally, it outlines the roadmap to implement a Moonshot authentication module for federated Keystone authentication to OpenStack.
Recommended
More Related Content
What's hot
What's hot (20)
Viewers also liked
Viewers also liked (8)
Similar to UKC - Msc Project - Providing Moonshot access to OpenStack
Similar to UKC - Msc Project - Providing Moonshot access to OpenStack (20)
Recently uploaded
Recently uploaded (20)
UKC - Msc Project - Providing Moonshot access to OpenStack
- 1. Providing Moonshot access to OpenStack Vincent Giersch - vg66 MSc Computer Security - University of Kent Moonshot Supervisor: David Chadwick
- 2. Contents • Moonshot overview • OpenStack overview • Providing Moonshot access to OpenStack • Federated Keystone • How it will work ? • Technical architecture • Roadmap • Questions
- 3. Moonshot Overview Moonshot
- 4. Moonshot Federated authentication and authorization For web and non-web services and applications
- 5. Example: IE à Apache Moonshot Source: Janet
- 6. Example: PuTTY à OpenSSH Moonshot Source: Janet
- 7. Moonshot technologies Moonshot is built on: • Strong authentication: EAP/RADIUS • Strong authorisation: SAML • Easy service/application integration: SASL/GSS-API Standardisation approaching completion within the Internet Engineering Task Force (IETF) Moonshot
- 9. Starting the virtualization... Source: OpenStack Foundation
- 10. Starting the virtualization... Host 1 Host 2 Host 3 Host 4, etc. Hypervisor (VMWare ESX, Citrix XEN Server, KVM, etc.) Hardware abstraction for each server Source: OpenStack Foundation
- 11. ... but how to manage the resources ? Provisioning ? User management ?
- 12. Add the missing cloud management layer APIs Self-service for users Creates Automates Pools of Resources deployment
- 13. Main components of OpenStack Applications APIs Identity Compute Storage Network Keystone Nova Swift Quantum Standard Hardware
- 14. Moonshot +
- 15. Federated Keystone Allows to use external Identity Providers (IdP) Easy user provisioning Provides Single Sign On (SSO) to the users Developed as a Keystone middleware
- 16. How it will work ?
- 17. How it will work ? Asks a list of Identity providers User Keystone
- 18. How it will work ? Returns the Identity Providers available User Keystone
- 19. How it will work ? Chooses a IdP (Moonshot) User Keystone
- 20. How it will work ? Returns Moonshot details User Keystone
- 21. How it will work ? Chooses the identity that he will use User Keystone
- 22. How it will work ? Negotiate authentication User Keystone Identity Provider
- 23. How it will work ? Returns list of tenants User Keystone
- 24. How it will work ? Chooses a tenant User Keystone
- 25. How it will work ? Returns a tenant token User Keystone
- 26. How it will work ? User Keystone
- 27. Technical architecture OpenStack Client OpenStack Keystone Identity Provider
- 28. Technical architecture Federated Keystone Federated Keystone HTTP OpenStack Client OpenStack Keystone Identity Provider
- 29. Technical architecture Moonshot module Moonshot module Federated Keystone Federated Keystone HTTP OpenStack Client OpenStack Keystone Identity Provider
- 30. Technical architecture GSS-API GSS-API AAA AAA GSS AAA Moonshot module EAP mech Moonshot module transport Federated Keystone Federated Keystone HTTP OpenStack Client OpenStack Keystone Identity Provider
- 31. Technical architecture EAP method EAP peer EAP server GSS-API GSS-API AAA AAA GSS AAA Moonshot module EAP mech Moonshot module transport Federated Keystone Federated Keystone HTTP OpenStack Client OpenStack Keystone Identity Provider
- 32. Project roadmap • Study of the existing Moonshot implementations (e.g. Apache / Firefox). • Fork the PyKerberos library to add flexibility in the usage of the GSS-API C library. • Study of the potential needed improvements of the Keystone Federated protocol. • Implement the authentication / authorization Moonshot module. • Validation testing using a OpenStack client (e.g. python-swiftclient).
- 33. Questions ? Moonshot Vincent Giersch - vg66