keystonemiddleware

What it is and what it does

Keystonemiddleware is a WSGI middleware package that integrates OpenStack Keystone identity services into web applications. It provides the auth_token module, which intercepts requests, validates tokens against a Keystone server, and injects authentication context into the application. The package is designed for OpenStack deployments where services need to verify user identity and authorization without implementing their own token handling.

The middleware relies on a substantial set of dependencies—including keystoneauth1 for Keystone communication, oslo libraries for configuration and logging, PyJWT for token processing, and WebOb for WSGI integration. It does not expose CLI or Python API features; instead, it operates as a transparent request filter in the WSGI pipeline. Typical use involves configuring it with Keystone endpoint details and letting it validate incoming tokens before passing requests to the protected application.

Use it for:

• Protect OpenStack API services by validating Keystone tokens on every incoming request.
• Integrate identity and authorization context into custom OpenStack-aware web applications.
• Enforce role-based access control by extracting user roles from validated Keystone tokens.
• Delegate authentication to a centralized Keystone server across multiple microservices.
• Add token caching and validation retry logic to reduce latency in token verification.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Provides authentication and authorization middleware for OpenStack web services through token validation against the Keystone identity service.

Yes, if you are building or deploying services within an OpenStack environment that requires Keystone authentication. The package is actively maintained, has no known vulnerabilities, and is the standard middleware for this purpose. Not applicable outside OpenStack deployments.

Install

keystonemiddleware on PyPI

pip install keystonemiddleware

uv add keystonemiddleware

poetry add keystonemiddleware

Installing keystonemiddleware

Before you install

Low friction installation with a pure-Python wheel distribution. Actively maintained with a recent release (93 days ago). Requires Python 3.10 or later and depends on 14 runtime packages including keystoneauth1, oslo libraries, and PyJWT.

License in practice

Licensed under Apache License 2.0 (permissive). Suitable for use in commercial and open-source projects with standard attribution requirements.

Quickstart

pip install keystonemiddleware

from keystonemiddleware import auth_token

app = auth_token.AuthProtocol(application, {'oslo_config_config': cfg.CONF})

Requires Python 3.10 or later; designed for integration into WSGI applications, not standalone use.

Verify before relying

• Whether keystonemiddleware works with Keystone versions other than the current release cycle.
• Performance characteristics under high token validation load.
• Compatibility with non-WSGI frameworks or async application servers.

Package facts

Evidence: keystonemiddleware-13.0.0-py3-none-any.whl

Tags

More WWW/HTTP packages