关于OpenStack邮件发送功能及Keystone账户触发邮件的技术咨询

Hey there! Let's break down your questions clearly:

1. Does OpenStack have built-in email sending functionality? #

Short answer: No, OpenStack doesn’t include a native email service out of the box, but it provides flexible integration points to add email capabilities for use cases like user account notifications.

2. Triggering emails when creating Keystone accounts (with default passwords) #

Keystone itself doesn’t have a pre-built feature to send emails on user creation, but there are two reliable ways to implement this workflow:

Option 1: Use Keystone's Native Notification System #

Keystone emits event notifications for core actions (like user creation, role assignment, etc.). You can build a custom notification consumer to listen for these events and trigger emails:

• First, enable notifications in your keystone.conf by configuring the messaging driver (example for RabbitMQ):

  [notification]
  notification_driver = messagingv2
  notification_topics = notifications
  

• Deploy a lightweight custom service that listens to the identity.user.created event on your message queue (RabbitMQ/Redis). When this event fires (right after a new user is created), the service can extract user details (username, temporary password, tenant info) and call an email service (like Postfix, SendGrid, or your internal SMTP server) to send the welcome/reset email.
• This approach is scalable and aligns with OpenStack’s native architecture, working for users created via CLI, API, or dashboard.

Option 2: Post-Creation Scripts (Simpler for Small Deployments) #

If you manage users via CLI or deployment tools (like Ansible/Terraform), you can add a post-hook script that runs immediately after user creation:

• For example, after executing openstack user create --password <temp-password> <username>, your script can fetch the user’s details, compose an email with the temporary password and a link to your password reset portal, then send it via a command-line email client (like sendmail or mutt).
• Note: This method won’t catch users created via direct API calls, so it’s better suited for smaller, controlled environments.

3. Integrating with Keystone's Password Reset API #

Since you’re already aware of Keystone’s password reset API, optimize your email by including a secure, time-limited reset link:

• Generate a reset token via Keystone’s POST /v3/users/{user_id}/password/reset endpoint, then embed that token in your email’s URL (e.g., https://your-portal.com/reset?token=<token>&user=<user_id>). This lets users set their own initial password securely, avoiding the risk of sending plaintext passwords.

Quick Security Tips #

• Always send emails over encrypted channels (SMTP with TLS/SSL) to protect temporary credentials or reset tokens.
• Set short expiration limits on temporary passwords or reset tokens to minimize security risks.
• Consider disabling direct login with the temporary password, forcing users to reset it first via the link in your email.

内容的提问来源于stack exchange，提问作者Vishal Anand