Skip to main content

OpenStack Keystone

OpenStack services that authenticate with a Keystone v3 token, such as Swift.

X-Auth-Token header✓ header signing— query / presign— WASMdocs.rs/reqsign-openstack-keystone ↗

Inserts the X-Auth-Token header; expires_in is not interpreted.

Get started​

cargo add reqsign --features openstack
use reqsign::openstack;

// Environment variables — resolved by the default chain.
let signer = openstack::default_signer();

let mut req = http::Request::builder()
    .method(http::Method::GET)
    .uri("https://swift.example.com/v1/AUTH_test/container/object")
    .body(())?
    .into_parts()
    .0;

// Sign in place, then send with the HTTP client you already use.
signer.sign(&mut req, None).await?;

The default chain authenticates against the Keystone v3 identity API with OS_AUTH_URL, OS_USERNAME, and OS_PASSWORD. A scoped token also carries the service catalog Keystone returned for it, so Credential::endpoint_in_region resolves the endpoint of a service such as Swift without another request.

Credentials

Default credential chain

The default signer tries these sources in order and uses the first one that yields a credential — no configuration needed when any of them is present:

  1. Environment variables

Credential providers

Available ProvideCredential implementations. Construct any of them directly, reorder them, or compose them into your own chain — see Loading credentials: