TigerGate scans your private OpenStack cloud’s security posture (security group rules, Nova/Neutron/Cinder configuration, and more) via Keystone v3 credentials for a dedicated read-only user.
The user only needs the built-in reader role (or your deployment’s equivalent read-only role). TigerGate can never create, modify, or delete resources in the project.

​
Before you start

In TigerGate, open Integrations → Cloud Providers and choose OpenStack. The connect form asks for a connection name plus these Keystone v3 values:
ValueWhat it isRequired
Auth URLThe Keystone v3 identity endpoint (e.g. https://identity.example.com/v3).Yes
UsernameThe read-only user created below.Yes
PasswordThat user’s password.Yes
Project IDThe project (tenant) to scan.Yes
User DomainDefaults to Default — set this if your deployment uses a non-default domain.No

​
1. Create the read-only user

1

Create the user and role assignment

openstack user create --domain default --password-prompt tigergate-cspm-scan

openstack role add --project <PROJECT_ID> \
  --user tigergate-cspm-scan reader
reader is the standard OpenStack read-only role (available since the Secure RBAC work landed in most distributions); if your deployment predates it, use a custom role scoped to list/get actions only, or member if reader isn’t available — avoid admin.
2

Note the project and auth details

openstack project show <PROJECT_ID>
openstack endpoint list --interface public --service identity
The identity endpoint from the second command (with /v3 appended if not already present) is your Auth URL.

​
2. Connect it in TigerGate

1

Fill in the credentials

Under Integrations → Cloud Providers, open OpenStack and enter the Auth URL, Username, Password, and Project ID. Set User Domain only if it isn’t Default.
2

Test

Click Test. TigerGate checks that the required fields (Auth URL, Username, Password, Project ID) are present. It does not yet perform a live Keystone authentication, so bad credentials, a wrong domain, or a missing project first surface on the initial scan (see Troubleshooting).
3

Scan or schedule

Run an on-demand scan, or add a Schedule under Cloud Security → Schedules for this account.

​
Troubleshooting

Scan errorCauseFix
401 UnauthorizedWrong username/password, or wrong user domainRe-check the password; set User Domain if it isn’t Default
Project not foundProject ID is wrong, or the user isn’t assigned to itRe-check with openstack project show; re-run the role assignment
403 Forbidden on read callsreader (or equivalent) role wasn’t actually assigned on the projectRe-run openstack role add against the correct project
Connection times outAuth URL isn’t reachable from TigerGate (private/on-prem OpenStack behind a firewall)Allow-list TigerGate’s scanning IP range, or contact support about network requirements