Although Keystone implements Identity API, it doesn't try to be a user management tool and encourages administrators to manage users with existing fully-fledged tools. Federation allows users to authenticate with their username and password at a trusted identity provider, get a token from it and use it to authenticate in Keystone, while Keystone stores information about the user neither in database, nor in LDAP.

In the talk I will tell about history of identity federation in OpenStack keystone, about who uses it, about existing problems, about general architecture and features.