Skip to content
Snippets Groups Projects
  • Pedro Henrique's avatar
    f3fbe837
    Add support to OpenID Connect Authentication flow · f3fbe837
    Pedro Henrique authored
    
    This pull request adds support for the OpenID Connect authentication
    flow in Keystone and enables both ID and access token authentication
    flows. The ID token configuration is designed to allow users to
    authenticate via Horizon using an identity federation; whereas the
    Access token is used to allow users to authenticate in the OpenStack CLI
    using a federated user.
    
    Without this PR, if one wants to configure OpenStack to use identity
    federation, he/she needs to do a lot of configurations in the keystone,
    Horizon, and register quite a good number of different parameters using
    the CLI such as mappings, identity providers, federated protocols, and
    so on. Therefore, with this PR, we propose a method for operators to
    introduce/present the IdP's metadata to Kolla-ansible, and based on the
    presented metadata, Kolla-ansible takes care of all of the
    configurations to prepare OpenStack to work in a federated environment.
    
    Implements: blueprint add-openid-support
    Co-Authored-By: default avatarJason Anderson <jasonanderson@uchicago.edu>
    Change-Id: I0203a3470d7f8f2a54d5e126d947f540d93b8210
    f3fbe837
    History
    Add support to OpenID Connect Authentication flow
    Pedro Henrique authored
    
    This pull request adds support for the OpenID Connect authentication
    flow in Keystone and enables both ID and access token authentication
    flows. The ID token configuration is designed to allow users to
    authenticate via Horizon using an identity federation; whereas the
    Access token is used to allow users to authenticate in the OpenStack CLI
    using a federated user.
    
    Without this PR, if one wants to configure OpenStack to use identity
    federation, he/she needs to do a lot of configurations in the keystone,
    Horizon, and register quite a good number of different parameters using
    the CLI such as mappings, identity providers, federated protocols, and
    so on. Therefore, with this PR, we propose a method for operators to
    introduce/present the IdP's metadata to Kolla-ansible, and based on the
    presented metadata, Kolla-ansible takes care of all of the
    configurations to prepare OpenStack to work in a federated environment.
    
    Implements: blueprint add-openid-support
    Co-Authored-By: default avatarJason Anderson <jasonanderson@uchicago.edu>
    Change-Id: I0203a3470d7f8f2a54d5e126d947f540d93b8210