Skip to content

Authentication

Infomaniak Ceph Object Storage uses Keystone v3 for authentication. This applies to both the S3 API and Swift API.

Obtaining a Token

All API requests require a valid Keystone token passed in the X-Auth-Token header.

Via OpenStack CLI

openstack token issue -c id -f value --os-cloud <your-cloud>

Via curl

curl -s -X POST \
  -H "Content-Type: application/json" \
  -d '{
    "auth": {
      "identity": {
        "methods": ["password"],
        "password": {
          "user": {
            "name": "USERNAME",
            "domain": {"name": "Default"},
            "password": "PASSWORD"
          }
        }
      },
      "scope": {
        "project": {
          "name": "PROJECT_NAME",
          "domain": {"name": "Default"}
        }
      }
    }
  }' \
  -D - \
  https://api.pub1.infomaniak.cloud/identity/v3/auth/tokens \
  | grep -i "x-subject-token"

The token is returned in the X-Subject-Token response header.

Required Keystone Roles

Your user must have one of these roles in the project to access Object Storage:

  • member
  • admin
  • SwiftOperator

Verify your roles from the token:

curl -s \
  -H "X-Auth-Token: $TOKEN" \
  -H "X-Subject-Token: $TOKEN" \
  https://api.pub1.infomaniak.cloud/identity/v3/auth/tokens | \
  python3 -c "import sys,json; t=json.load(sys.stdin)['token']; print([r['name'] for r in t['roles']])"

Getting Your Identifiers

Several API operations require your user_id and project_id (tenant_id).

From your token

curl -s \
  -H "X-Auth-Token: $TOKEN" \
  -H "X-Subject-Token: $TOKEN" \
  https://api.pub1.infomaniak.cloud/identity/v3/auth/tokens | \
  python3 -c "
import sys, json
t = json.load(sys.stdin)['token']
print(f\"user_id:    {t['user']['id']}\")
print(f\"project_id: {t['project']['id']}\")
print(f\"roles:      {[r['name'] for r in t['roles']]}\")
"

Example output: 

user_id:    86d215caaf6141bcbb224ec71eb703d8
project_id: f70d2db9834e402e8792703009904c65
roles:      ['member', 'SwiftOperator']

Via OpenStack CLI

# User ID
openstack token issue -c user_id -f value --os-cloud <your-cloud>

# Project ID
openstack project show <project-name> --os-cloud <your-cloud> -c id -f value

From your clouds.yaml

grep -A2 "project_name: <your-project>" ~/.config/openstack/clouds.yaml

EC2 Credentials (S3 API Access Key)

To use the S3 API, you need EC2 credentials (access key + secret key) derived from your Keystone identity.

Creating EC2 Credentials

You need your USER_ID and PROJECT_ID from the section above.

USER_ID="<your_user_id>"
PROJECT_ID="<your_project_id>"

curl -X POST \
  -H "X-Auth-Token: $TOKEN" \
  -H "Content-Type: application/json" \
  -d "{\"tenant_id\": \"$PROJECT_ID\"}" \
  https://api.pub1.infomaniak.cloud/identity/v3/users/$USER_ID/credentials/OS-EC2

Example response: 

{
  "credential": {
    "user_id": "86d215caaf6141bcbb224ec71eb703d8",
    "tenant_id": "f70d2db9834e402e8792703009904c65",
    "access": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
    "secret": "yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy"
  }
}

Via OpenStack CLI

openstack ec2 credentials create --os-cloud <your-cloud>

Listing existing credentials

openstack ec2 credentials list --os-cloud <your-cloud>

Token Expiration

Keystone tokens expire (typically after 1 hour). Handle expiration in your application:

  1. Cache the token and reuse it
  2. On 401 Unauthorized, request a new token
  3. Alternatively, use application credentials for long-lived access

Application Credentials

For automation and scripts, create long-lived application credentials instead of using your password:

openstack application credential create --description "My backup script" my-backup-credential

Use the generated id as username and secret as password in your API requests.

Authentication Reference

Method Use Case Validity
Token Interactive/API calls ~1 hour
EC2 Credentials S3 API (AWS CLI, SDKs) Permanent until deleted
Application Credentials Scripts, automation Configurable

Troubleshooting

401 Unauthorized

  • Token has expired — request a new one
  • Token was not properly scoped to a project
  • User lacks required roles (member, admin, or SwiftOperator)

403 AccessDenied (Swift)

  • Verify rgw_keystone_accepted_roles includes one of your user's roles
  • The SwiftOperator role is specifically required for some Swift operations
  • With rgw_keystone_implicit_tenants=true, verify the user mapping exists in RGW

NoSuchBucket with correct bucket name

  • Double-check the tenant ID in the URL path
  • Ensure you're using the correct endpoint (gva1 vs gva2)
  • Verify the bucket was created via the same API (S3 vs Swift)