Skip to main content

​
Overview

Polystack Identity runs as a distributed service with API endpoints fronted by HAProxy. The token validation path is on every service’s critical path — all Polystack services call the Identity API to validate incoming requests. Understanding the architecture is essential for sizing, high availability planning, and troubleshooting.
Administrator Access Required — This operation requires the admin role. Contact your Polystack administrator if you do not have sufficient permissions.

​
Service Topology

​
Component Reference

​
Authentication Flow

​
High Availability Considerations

Stateless token validation

Fernet tokens are stateless — no database lookup is needed to validate them. The Identity API decrypts the token locally using the Fernet key repository. This means token validation scales horizontally without database pressure, and any Identity API node can validate any token as long as all nodes share the same Fernet key set.
All Identity API nodes must have identical Fernet key sets. The deployment console manages key distribution automatically during rotation. If nodes become out of sync, tokens signed by one node cannot be validated by another.Verify key consistency:
Check key file count on all nodes
All nodes must report the same count and file timestamps.
The Identity database is a MariaDB Galera cluster in a multi-node deployment. Identity writes (user creation, role assignments) are replicated synchronously across all MariaDB nodes. HAProxy in front of MariaDB distributes read operations.

​
Deployment Footprint

Identity API container
/etc/keystone
keystone.conf
policy.yaml

​
Next Steps

Authentication Backends

Configure SQL, LDAP, and federation authentication drivers.

Token Configuration

Set Fernet key rotation schedules and token lifetime policies.

Security Hardening

Enforce MFA, audit assignments, and apply hardening best practices.

Admin Troubleshooting

Diagnose token validation failures and service communication issues.