Authentication Challenges In Multi-Region Deployments
summary
At Cleura scale there is no silver bullet: separate regions (independent Keystone per region) works but forces users to manage multiple accounts; pointing services at a central Keystone creates cross-region outages; the pragmatic approach is local Keystones with database replication using Galera + ProxySQL/MaxScale to route reads and writes, accepting temporary stale tokens and GDPR risks. LDAP and Keystone-to-Keystone via SAML ECP can auto-provision but do not revoke roles reliably (fixed in 2024.1), while Keycloak (OIDC) with 2FA gives rich auth but breaks noninteractive clients unless using application credentials per region or the VX host driver.
AI-written summary · about
chapters (15)
- 0:00Introduction and speaker background
- 1:57Cura’s multi-region cloud setup
- 3:47Single-region architecture overview
- 4:29N-shared architecture approach
- 6:16Sharded Keystone challenges
- 8:03Local Keystone with MariaDB replication
- 10:35Integration with corporate LDAP
- 13:23Keystone to Keystone Federation basics
- 15:31Keystone to Keystone Federation deep dive
- 19:25Identity provider high availability
- 21:10Federation with Keycloak overview
- 24:02Keycloak integration benefits and downsides
- 26:57VX host driver for Keystone
- 29:10Tradeoffs and conclusions
- 31:21Q&A session
related talks
12mScaling Identity for Global SASE with Keycloak
21mDon't Be Afraid to Operate Alone! The ABCs of Authentication Infrastructure Management
46mHighly available Identity and Access Management with multi-site Keycloak deployments in t...
39mSecure Authorization for Agentic AI in Multi-Domain Environments
23mIdentity Best Practices to Secure & Scale Agentic AI / MCP Deployments
15mImprovements to Identity Federation in Keystone
12mWhat Is New and Coming for Managing Cloud Native Identities in…
46mBuilding a Unified Authentication Platform Using Keycloak