A Design of Cross-Realm Authentication Scheme in Openstack Based on Declaration

Aiming at the issue how users in Windows domain cross-realm access cloud computing resources, a cross-realm authentication scheme based on federated identity was proposed. Based on the idea of the declaration, the scheme uses the federated identity provider to replace the gateway in the traditional gateway-based cross-realm authentication model, so as to realize the users in Windows domain access the cloud resources without re-authentication. The scheme uses SAML protocol to exchange user identity information between different domains, which ensures versatility and security of the system and realizes seamlessly secure communication between different security domains. Finally, based on claim provider, federated identity provider and application service provider, we give the design of the key components of the three modules, then the feasibility of the scheme is verified with the popular cloud platform OpenStack.