Keystone

OpenStack identity service issues scoped tokens, publishes the service catalog, and enforces RBAC across APIs. Other components trust Keystone validation and revocation lists. Federation integrates corporate IdPs without duplicating user stores.