<html><body><p>This has been our hidden agenda for many releases (minus the project split). There are other projects that you mention that are much better at handling authentication, many enterprises already have these place as well. We have been trying to get out of the identity management (and consequently, the authentication) space for a while. That's why we have been focusing on federated identity and removing write operations to LDAP.<br><br>Enter the admin, service users, and sql backed users. Many existing deployments store users in an SQL based backend. We pushed back on adding features for this use case for a while, but there are enough folks out there that want to do this, which is why we approving a spec to enforce password lifecycle in the N release. So the new project/repo would have to handle this case as well.<br><br>Architecturally, I can see why you would want to split things up, it is a logical break. But I also see a few arguments against a split: 1) we already support Kerberos and OpenLDAP (and other auth services); 2) I don't think we have a trouble with scope / not enough contribution; and 3) inertia, adopting new services takes a long time (see v2 to v3 transition), and this would add to that pile. <br><br>Thanks,<br><br>Steve Martinelli<br>OpenStack Keystone Project Team Lead<br><br><img width="16" height="16" src="cid:1__=8FBBF51EDFE0963D8f9e8a93df938690918c8FB@" border="0" alt="Inactive hide details for Boris Pavlovic ---2016/04/06 03:27:49 PM---Hi stackers, I would like to suggest very simple idea of s"><font color="#424282">Boris Pavlovic ---2016/04/06 03:27:49 PM---Hi stackers, I would like to suggest very simple idea of splitting out of Keystone</font><br><br><font size="2" color="#5F5F5F">From: </font><font size="2">Boris Pavlovic <bpavlovic@mirantis.com></font><br><font size="2" color="#5F5F5F">To: </font><font size="2">OpenStack Development Mailing List <openstack-dev@lists.openstack.org></font><br><font size="2" color="#5F5F5F">Date: </font><font size="2">2016/04/06 03:27 PM</font><br><font size="2" color="#5F5F5F">Subject: </font><font size="2">[openstack-dev] [tc][ptl][keystone] Proposal to split authentication part out of Keystone to separated project</font><br><hr width="100%" size="2" align="left" noshade style="color:#8091A5; "><br><br><br><font size="4">Hi stackers, </font><br><br><font size="4">I would like to suggest very simple idea of splitting out of Keystone authentication</font><br><font size="4">part in the separated project. </font><br><br><font size="4">Such change has 2 positive outcomes: </font><br><font size="4">1) It will be quite simple to create scalable service with high performance for authentication based on very mature projects like: Kerberos[1] and OpenLDAP[2].</font><br><br><font size="4">2) This will reduce scope of Keystone, which means 2 things</font><br><font size="4">2.1) Smaller code base that has less issues and is simpler for testing</font><br><font size="4">2.2) Keystone team would be able to concentrate more on fixing perf/scalability issues of authorization, which is crucial at the moment for large clouds.</font><br><br><font size="4">Thoughts? </font><br><br><font size="4">[1] </font><a href="http://web.mit.edu/kerberos/"><u><font size="4" color="#0000FF">http://web.mit.edu/kerberos/</font></u></a><br><font size="4">[2] </font><a href="http://ldapcon.org/2011/downloads/hummel-slides.pdf"><u><font size="4" color="#0000FF">http://ldapcon.org/2011/downloads/hummel-slides.pdf</font></u></a><br><br><font size="4">Best regards,</font><br><font size="4">Boris Pavlovic </font><tt>__________________________________________________________________________<br>OpenStack Development Mailing List (not for usage questions)<br>Unsubscribe: OpenStack-dev-request@lists.openstack.org?subject:unsubscribe<br></tt><tt><a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a></tt><tt><br></tt><br><br><BR>
</body></html>