---
# System prepended metadata

title: OSP Keystone Support Matrix

---

# OSP Keystone Support Matrix

## Token Providers (tokens)

| OSP Release | UUID | PKI | PKIZ | JWT | Fernet |
| ----------- | ---- | --- | ---- | --- | ------ |
| OSP 10 |:heavy_check_mark:\*|:heavy_check_mark:|:heavy_check_mark:|:x:|:heavy_check_mark:|
| OSP 13 |:heavy_check_mark:|:x:|:x:|:x:|:heavy_check_mark:\*|
| OSP 15 |:x:|:x:|:x:|:x:|:heavy_check_mark:\* |
| OSP 16 |:x:|:x:|:x:|:x:|:heavy_check_mark:\* |
| OSP 17 |:x:|:x:|:x:|:x:|:heavy_check_mark:\* |

\* Default token provider

## Token Backends

This backend is only applicable to token providers that require persistence like ``uuid``, ``pki``, and ``pkiz`` formats. This option isn't applicable after the OSP 13 release (Stein) since keystone didn't support any persistent formats.

| OSP Release | SQL | Memcache | Memcached Pool | KVS |
| ----------- | ---- | --- | ---- | --- |
| OSP 10 |:heavy_check_mark:\*|:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|
| OSP 13 |:heavy_check_mark:\*|:x:|:x:|:x:|
| OSP 15 |:x:|:x:|:x:|:x:|
| OSP 16 |:x:|:x:|:x:|:x:|
| OSP 17 |:x:|:x:|:x:|:x:|

\* Default token backend

## Caching

Support for caching various keystone resource isn't enabled by default. Although, it is recommended for optimal performance.

## Identity Backends (users + groups)

| OSP Release | SQL | LDAP | LDAP + write support |
| ----------- | --- | ---- | -------------------- |
| OSP 10 |:heavy_check_mark:\*|:heavy_check_mark:|:heavy_check_mark:|
| OSP 13 |:heavy_check_mark:\*|:heavy_check_mark:|:x:|
| OSP 15 |:heavy_check_mark:\*|:heavy_check_mark:|:x:|
| OSP 16 |:heavy_check_mark:\*|:heavy_check_mark:|:x:|
| OSP 17 |:heavy_check_mark:\*|:heavy_check_mark:|:x:|

\* Default identity backend

## Resource Backends (projects + domains)

| OSP Release | SQL | LDAP |
| ----------- | --- | ---- |
| OSP 10 |:heavy_check_mark:\*|:x:|
| OSP 13 |:heavy_check_mark:\*|:x:|
| OSP 15 |:heavy_check_mark:\*|:x:|
| OSP 16 |:heavy_check_mark:\*|:x:|
| OSP 17 |:heavy_check_mark:\*|:x:|

\* Default resource backend

## Catalog Backends (services + endpoints)

| OSP Release | SQL | Templated |
| ----------- | --- | --------- |
| OSP 10 |:heavy_check_mark:\*|:heavy_check_mark:|
| OSP 13 |:heavy_check_mark:\*|:heavy_check_mark:|
| OSP 15 |:heavy_check_mark:\*|:heavy_check_mark:|
| OSP 16 |:heavy_check_mark:\*|:heavy_check_mark:|
| OSP 17 |:heavy_check_mark:\*|:heavy_check_mark:|

\* Default catalog backend

## Authentication Plugins

| OSP Release | Application Credential | Password | Token | External | Kerberos | OAuth1 | Mapped | SAML2 | TOTP | x509 | OpenID Connect |
| ----------- | ---------------------- | -------- | ----- | -------- | -------- | ------ | ------ | ----- | ---- | ---- | -------------- |
| OSP 10 |:x:|:heavy_check_mark:\*|:heavy_check_mark:\*|:heavy_check_mark:\*|:heavy_check_mark:|:heavy_check_mark:\*|:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|
| OSP 13 |:heavy_check_mark:\*|:heavy_check_mark:\*|:heavy_check_mark:\*|:heavy_check_mark:\*|:heavy_check_mark:|:heavy_check_mark:\*|:heavy_check_mark:\*|:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|
| OSP 15 |:heavy_check_mark:\*|:heavy_check_mark:\*|:heavy_check_mark:\*|:heavy_check_mark:\*|:heavy_check_mark:|:heavy_check_mark:\*|:heavy_check_mark:\*|:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|
| OSP 16 |:heavy_check_mark:\*|:heavy_check_mark:\*|:heavy_check_mark:\*|:heavy_check_mark:\*|:heavy_check_mark:|:heavy_check_mark:\*|:heavy_check_mark:\*|:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|
| OSP 17 |:heavy_check_mark:\*|:heavy_check_mark:\*|:heavy_check_mark:\*|:heavy_check_mark:\*|:heavy_check_mark:|:heavy_check_mark:\*|:heavy_check_mark:\*|:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|

\* Default authentcation plugin

## Identity Federation

Identity federation is not fully supported through TripleO, but it can be deployed manually. Deployments using federation setup manually are not guaranteed to work across major or minor updates and usually require support exceptions.

| OSP Release | SAML2 | OpenID Connect|
| ----------- | ----- | ------------- |
| OSP 10 |:x:|:x:|
| OSP 13 |:x:|:x:|
| OSP 15 |:x:|:x:|
| OSP 16 |:x:|:question:|
| OSP 17 |:x:|:question:|
