---
id: keystone
version: "29.0.2"
license: Apache-2.0
license_treatment: permissive
maintenance: active
---

# keystone — OpenStack Identity

License: permissive · Maintenance: active · Downloads: 135.3K/mo

## What it is and what it does

Keystone is OpenStack's identity and access management service. It provides centralized authentication (verifying who users are), authorization (determining what they can do), and service discovery (helping other OpenStack services find each other) via HTTP APIs. It is designed to be deployed as a standalone service in an OpenStack cloud, not as a library embedded in other applications.

The package includes a Flask-based HTTP server, integrates with SQLAlchemy for persistence, uses cryptography and bcrypt for secure credential handling, and supports multiple authentication backends including LDAP, OAuth, and SAML2. It depends on the oslo.* family of libraries for configuration, logging, caching, and policy enforcement—standard infrastructure components across OpenStack services. Deployment typically involves configuration files, a database, and integration with an identity provider.

Use it for:

- Deploy as the identity service for an OpenStack cloud to authenticate users and issue tokens for API access.
- Integrate with an existing LDAP directory to provide cloud-native authentication without duplicating user accounts.
- Enable service-to-service authentication and discovery so OpenStack components (Nova, Glance, Cinder) can securely communicate.
- Support federated identity via SAML2 or OAuth to allow users from external identity providers to access the cloud.
- Manage role-based access control (RBAC) policies across OpenStack projects and services using oslo.policy.

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

OpenStack Keystone provides authentication, authorization, and service discovery for OpenStack cloud infrastructure via HTTP, typically deployed as an interface to existing identity systems like LDAP.

Yes, if you are deploying or operating an OpenStack cloud. Keystone is essential infrastructure for any OpenStack deployment. However, this is not a library for general application use—it is a service component. Be aware of 5 known vulnerabilities in the security database; verify that version 29.0.2 includes patches or plan mitigations. Requires Python 3.10+, substantial operational setup (database, messaging, identity backend), and integration with other OpenStack services.

## Install

pip install keystone
uv add keystone
poetry add keystone

## Installing keystone

Before you install: Low install friction with a pure-Python wheel distribution. Active maintenance with a release 43 days old. Requires Python 3.10 or later. Brings 31 runtime dependencies including Flask, SQLAlchemy, cryptography, and multiple oslo.* libraries, which is typical for OpenStack services but represents a substantial dependency footprint.

License in practice: Licensed under Apache-2.0 (permissive), allowing commercial use, modification, and redistribution with minimal restrictions beyond attribution and liability disclaimers.

Quickstart:

pip install keystone

from keystone import service

# Keystone is typically deployed as an OpenStack service via configuration files
# and run as a daemon, not imported directly in application code.

Keystone is an OpenStack service component designed for deployment in a cloud infrastructure context, not a library for direct application import. Requires Python 3.10 or later and is intended to run as a standalone HTTP service.

Verify before relying:

- Whether the 5 known vulnerabilities (GHSA-gf2q-j2qq-pjf2, GHSA-mrxv-65rv-6hxq, PYSEC-2012-19, PYSEC-2012-20, PYSEC-2026-833) have been patched in version 29.0.2 or remain open.
- Whether Keystone 29.0.2 is compatible with the specific OpenStack release cycle and other OpenStack components in your deployment.
- Operational requirements: database setup, message broker configuration, and LDAP or other identity backend integration specifics.

## Package facts

- License: Apache-2.0 (permissive)
- Python support: supports_current
- Install friction: low
- Maintenance: active
- Downloads: 135.3K/month (top 15,000 on PyPI)
- Known vulnerabilities: 5

## Tags

openstack identity service, cloud authentication authorization, keystone identity provider, openstack service discovery, http identity management, ldap integration openstack, token-based cloud auth, openstack-service, identity-management, cloud-infrastructure

[View on SkillFed](https://skillfed.io/packages/keystone) · [View on PyPI](https://pypi.org/project/keystone/)