Identity Federation in SCS

SovereignCloudStack wants to make it possible for operators to delegate administration of user identities to the organizational entities that the users are part of. Usually that's customer organizations but it could also be the operator itself. Federation protocols like OpenID Connect can be used to achieve that goal. To simplify connecting the different parts of SCS to customer owned IAM solutions, the SCS reference implementation uses Keycloak as central Identity Provider (IdP) service.

Keycloak is available as a component of OSISM that operators can enable and configure as the central IdP.

The following sections describe how this is done.

1. IaaS / OpenStack

To provide Infrastrucure as a Service SCS builds upon OpenStack. See section OpenStack Federation via OpenID-Connect for more details on identity federation for OpenStack.

2. CaaS

To provide Container as a Service SCS builds upon Kubernetes. There is work in progress to optionally connect Kubernetes to Keycloak and to map authorization decisions based on claims via cluster role bindings.