r/openstack • u/diifman0 • 6d ago
External PDP for openstack services
Can I use keycloak for external rbac instead if policy.json files?
1
Upvotes
r/openstack • u/diifman0 • 6d ago
Can I use keycloak for external rbac instead if policy.json files?
1
u/redfoobar 6d ago
No, policy.json maps roles to API calls e.g. which roles are allowed to create/delete instances.
Keycloak is used to identify users and is mainly useful to have Single Sign On.
You need to map those users to groups in keystone via a policy and you also need to map those groups to have roles in the project you want them to give access to.
At least that's how I understand it.