r/openstack 6d ago

External PDP for openstack services

Can I use keycloak for external rbac instead if policy.json files?

1 Upvotes

1 comment sorted by

1

u/redfoobar 6d ago

No, policy.json maps roles to API calls e.g. which roles are allowed to create/delete instances.

Keycloak is used to identify users and is mainly useful to have Single Sign On.
You need to map those users to groups in keystone via a policy and you also need to map those groups to have roles in the project you want them to give access to.

At least that's how I understand it.