Integrating an AAA-based federation mechanism for OpenStack - The CLASSe view

Identity federations enable users, service providers and identity providers from different organizations to exchange authentication and authorization information in a secure way. In this paper we present a novel identity federation architecture for cloud services based on the integration of a cloud identity management service with an Authentication, Authorization and Accounting (AAA) infrastructure. Specifically we analyse how this type of AAA-based federation can be smoothly integrated into OpenStack, the leading open source cloud software solution, using the IETF Application Bridging for Federated Access Beyond web (ABFAB) specification for authentication and authorization. We provide details of the implementation undertaken in GÉANT╆s CLASSe project, and show its validation in a real testbed.