keystonemiddleware
Middleware for OpenStack Identity
Decision gist · record as of 2026-08-14
Yes, if you are building or deploying services within an OpenStack environment that requires Keystone authentication. The package is actively maintained, has no known vulnerabilities, and is the standard middleware for this purpose. Not applicable outside OpenStack deployments.AI-flagged interpretation of the facts on this page — verify before relying
Before you install
- Requires Python 3.10 or later; designed for integration into WSGI applications, not standalone use.
- Low friction installation with a pure-Python wheel distribution.
- Actively maintained with a recent release (93 days ago).
License · maintenance · safety
permissive license (permissive) — Licensed under Apache License 2.0 (permissive). Suitable for use in commercial and open-source projects with standard attribution requirements.
last release 2026-05-13 (93 days)
0 known vulnerabilities (OSV.dev, 2026-08-14) · 344,038 downloads/mo, #7,379 on PyPI
Alternatives
Verify before relying
pip install keystonemiddleware
from keystonemiddleware import auth_token
app = auth_token.AuthProtocol(application, {'oslo_config_config': cfg.CONF})- Whether keystonemiddleware works with Keystone versions other than the current release cycle.
- Performance characteristics under high token validation load.
- Compatibility with non-WSGI frameworks or async application servers.
What it is and what it does
Keystonemiddleware is a WSGI middleware package that integrates OpenStack Keystone identity services into web applications. It provides the auth_token module, which intercepts requests, validates tokens against a Keystone server, and injects authentication context into the application. The package is designed for OpenStack deployments where services need to verify user identity and authorization without implementing their own token handling.
The middleware relies on a substantial set of dependencies—including keystoneauth1 for Keystone communication, oslo libraries for configuration and logging, PyJWT for token processing, and WebOb for WSGI integration. It does not expose CLI or Python API features; instead, it operates as a transparent request filter in the WSGI pipeline. Typical use involves configuring it with Keystone endpoint details and letting it validate incoming tokens before passing requests to the protected application.
Use it for
- Protect OpenStack API services by validating Keystone tokens on every incoming request.
- Integrate identity and authorization context into custom OpenStack-aware web applications.
- Enforce role-based access control by extracting user roles from validated Keystone tokens.
- Delegate authentication to a centralized Keystone server across multiple microservices.
- Add token caching and validation retry logic to reduce latency in token verification.
Worth the install?
AI-flagged interpretation of the facts on this page. Verify before relying on it.
Yes, if you are building or deploying services within an OpenStack environment that requires Keystone authentication.
The package is actively maintained, has no known vulnerabilities, and is the standard middleware for this purpose. Not applicable outside OpenStack deployments.
Install
keystonemiddleware on PyPI
Before you install
Low friction installation with a pure-Python wheel distribution. Actively maintained with a recent release (93 days ago). Requires Python 3.10 or later and depends on 14 runtime packages including keystoneauth1, oslo libraries, and PyJWT.
Requires Python 3.10 or later; designed for integration into WSGI applications, not standalone use.
License in practice
Licensed under Apache License 2.0 (permissive). Suitable for use in commercial and open-source projects with standard attribution requirements.
Quickstart
pip install keystonemiddleware
from keystonemiddleware import auth_token
app = auth_token.AuthProtocol(application, {'oslo_config_config': cfg.CONF})Verify before relying
- Whether keystonemiddleware works with Keystone versions other than the current release cycle.
- Performance characteristics under high token validation load.
- Compatibility with non-WSGI frameworks or async application servers.
Package facts
| License | permissive license permissive |
| Python support | Supports the current Python release >=3.10 |
| Install friction | Low. Pure-Python wheel |
| Runtime dependencies | 14 packageskeystoneauth1oslo.cacheoslo.configoslo.contextoslo.i18noslo.logoslo.serializationoslo.utilspbrpycadfPyJWTpython-keystoneclientrequestsWebOb |
| Maintenance | Actively maintained 93 days since the last release |
| First released | |
| Downloads | 344,038 / month, #7,379 on PyPI 30-day window, as of 2026-08-14 |
| Known vulnerabilities | None known OSV.dev, checked 2026-08-14 |
| Classifiers | Environment :: OpenStackIntended Audience :: Information TechnologyIntended Audience :: System AdministratorsLicense :: OSI Approved :: Apache Software LicenseOperating System :: POSIX :: LinuxProgramming Language :: PythonProgramming Language :: Python :: 3Programming Language :: Python :: 3 :: OnlyProgramming Language :: Python :: 3.10Programming Language :: Python :: 3.11Programming Language :: Python :: 3.12 |
Evidence: keystonemiddleware-13.0.0-py3-none-any.whl
Tags
Let your AI agent find packages like this
Example. Real query, live index.
You found this page by searching. An agent finds it by wishing: SkillFed indexes 14,416 PyPI packages by what they can do, searchable in plain language.
wish › “openstack keystone middleware”
- keystonemiddlewareProvides authentication and authorization middleware for OpenStack…
- python-keystoneclientPython client library for authenticating with and managing OpenStack…
- keystoneOpenStack Keystone provides authentication, authorization, and…
Give your agent the search over MCP, or paste the wish link into any chat.
More WWW/HTTP packages
urllib3 is an HTTP client library that provides thread-safe connection pooling, SSL/TLS verification, multipart file uploads, request retries, compression support, and proxy handling for Python applications.
Requests is a Python HTTP library that simplifies sending HTTP/1.1 requests with automatic handling of headers, authentication, cookies, and response parsing.
h11 is a pure-Python HTTP/1.1 protocol implementation that handles parsing and serializing HTTP messages without any built-in I/O, letting you integrate it with any network layer you choose.
HTTPX is a fully featured HTTP client library for Python that provides both sync and async APIs, with support for HTTP/1.1 and HTTP/2, plus an integrated command-line client.
Install it if you are building new projects or modernizing existing ones that rely on HTTP.
A minimal low-level HTTP client library that sends HTTP requests with thread-safe and task-safe connection pooling, supporting HTTP/1.1, HTTP/2, proxies, and both sync and async interfaces.
aiohttp is an async HTTP client and server framework built on asyncio, supporting both WebSockets and middleware-based routing for building concurrent web applications.
Install it if you need async HTTP client or server capabilities in asyncio-based applications.
See also cursive · keystone · keystoneauth1 · python-keystoneclient · oslo.middleware · fastapi-keycloak-middleware · keystone-engine · microversion-parse · repoze.who · oslo.policy