Can I authenticate using X.509 client certificates?

Hi there,

we have a use case where users have X.509 client certificates. The current draft of the Identity API v3 [1] states "The 'just a token' has been the starting requirement, and with PKI coming online, it provides a resource path for the tokens independent of linkages to anything else."

How would I set this up and can it be done with any version of Keystone that is available today? I am currently running stable/essex from a devstack installation. I do know how to setup WSGI services in an Apache2 [2], such that the real "authentication" (the user proving that he has the private data beloging to the certificate) leads to an X.509 DN which should be mapped to a Keystone user. Can this DN be considered the "token"? I guess for a direct mapping the tenant for one user would have to be fixed, but this seems to be a limitation of other already documented credential mechanisms as well. I think one could even add a header to the HTTP(S) request to pass in the Tenant in addition to the user credential.

Best regards,
Björn

[1] https://docs.google.com/document/d/1s9C4EMxIZ55kZr62CKEC9ip7He_Q4_g1KRfSk9hY-Sg/edit#heading=h.exf8l44oq5hr
[2] http://www.rackspace.com/blog/enabling-ssl-for-the-openstack-api/