Skip to content

Commit 00b1758

Browse files
cloudnullcloudnull
committed
feat: add SAML federation support
This change documents the process of setting up federation support within Keystone and Skyline. Documentation has been added highlighting how to setup SAML using Auth-0 as an example. Additional examples to be added later. Depends-On: rackerlabs#992 Signed-off-by: Kevin Carter <[email protected]>
1 parent a9caa99 commit 00b1758

File tree

12 files changed

+1082
-210
lines changed

12 files changed

+1082
-210
lines changed

‎base-helm-configs/keystone/keystone-helm-overrides-saml.yaml.example‎

Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,85 @@
1+
---
2+
conf:
3+
software:
4+
apache2:
5+
a2enmod:
6+
- shib
7+
keystone:
8+
auth:
9+
methods: "password,token,saml2,application_credential,totp"
10+
saml2:
11+
remote_id_attribute: Shib-Identity-Provider
12+
federation:
13+
trusted_dashboard:
14+
type: multistring
15+
values:
16+
- https://skyline.api.example.com/api/openstack/skyline/api/v1/websso
17+
- https://horizon.api.example.com/auth/websso
18+
wsgi_keystone: |
19+
{{- $portInt := tuple "identity" "service" "api" $ | include "helm-toolkit.endpoints.endpoint_port_lookup" }}
20+
21+
Listen 0.0.0.0:{{ $portInt }}
22+
23+
LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
24+
LogFormat "%{X-Forwarded-For}i %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" proxy
25+
26+
SetEnvIf X-Forwarded-For "^.*\..*\..*\..*" forwarded
27+
CustomLog /dev/stdout combined env=!forwarded
28+
CustomLog /dev/stdout proxy env=forwarded
29+
30+
<VirtualHost *:{{ $portInt }}>
31+
ServerName https://keystone.api.example.com:443
32+
UseCanonicalName On
33+
34+
WSGIDaemonProcess keystone-public processes={{ .Values.conf.keystone_api_wsgi.wsgi.processes }} threads={{ .Values.conf.keystone_api_wsgi.wsgi.threads }} user=keystone group=keystone display-name=%{GROUP}
35+
WSGIProcessGroup keystone-public
36+
WSGIScriptAlias / /var/www/cgi-bin/keystone/keystone-wsgi-public
37+
WSGIScriptAliasMatch ^(/v3/OS-FEDERATION/identity_providers/IDENTITY_PROVIDER_NAME/protocols/saml2/auth)$ /var/www/cgi-bin/keystone/keystone-wsgi-public/$1
38+
WSGIApplicationGroup %{GLOBAL}
39+
WSGIPassAuthorization On
40+
LimitRequestBody 114688
41+
42+
<IfVersion >= 2.4>
43+
ErrorLogFormat "%{cu}t %M"
44+
</IfVersion>
45+
ErrorLog /dev/stdout
46+
47+
SetEnvIf X-Forwarded-For "^.*\..*\..*\..*" forwarded
48+
CustomLog /dev/stdout combined env=!forwarded
49+
CustomLog /dev/stdout proxy env=forwarded
50+
51+
<Location /Shibboleth.sso>
52+
SetHandler shib
53+
</Location>
54+
<Location /v3/OS-FEDERATION/identity_providers/IDENTITY_PROVIDER_NAME/protocols/saml2/auth>
55+
Require valid-user
56+
AuthType shibboleth
57+
ShibRequestSetting requireSession 1
58+
ShibExportAssertion off
59+
<IfVersion < 2.4>
60+
ShibRequireSession On
61+
ShibRequireAll On
62+
</IfVersion>
63+
</Location>
64+
RedirectMatch ^/v3/auth/OS-FEDERATION/websso/IDENTITY_PROVIDER_NAME$ /v3/auth/OS-FEDERATION/websso/saml2
65+
<Location /v3/auth/OS-FEDERATION/websso/saml2>
66+
Require valid-user
67+
AuthType shibboleth
68+
ShibRequestSetting requireSession 1
69+
ShibExportAssertion off
70+
<IfVersion < 2.4>
71+
ShibRequireSession On
72+
ShibRequireAll On
73+
</IfVersion>
74+
</Location>
75+
<Location /v3/auth/OS-FEDERATION/identity_providers/IDENTITY_PROVIDER_NAME/protocols/saml2/websso>
76+
Require valid-user
77+
AuthType shibboleth
78+
ShibRequestSetting requireSession 1
79+
ShibExportAssertion off
80+
<IfVersion < 2.4>
81+
ShibRequireSession On
82+
ShibRequireAll On
83+
</IfVersion>
84+
</Location>
85+
</VirtualHost>

‎base-helm-configs/keystone/keystone-helm-overrides.yaml‎

Lines changed: 8 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -6,14 +6,14 @@ images:
66
db_init: "quay.io/rackspace/rackerlabs-heat:2024.1-ubuntu_jammy"
77
dep_check: "quay.io/rackspace/rackerlabs-kubernetes-entrypoint:latest-ubuntu_jammy"
88
image_repo_sync: "quay.io/rackspace/rackerlabs-docker:17.07.0"
9-
keystone_api: "quay.io/rackspace/rackerlabs-keystone-rxt:2024.1-ubuntu_jammy-1747934956"
9+
keystone_api: "quay.io/rackspace/rackerlabs-keystone-rxt:2024.1-ubuntu_jammy-1747958291"
1010
keystone_credential_cleanup: "quay.io/rackspace/rackerlabs-heat:2024.1-ubuntu_jammy"
11-
keystone_credential_rotate: "quay.io/rackspace/rackerlabs-keystone-rxt:2024.1-ubuntu_jammy-1747934956"
12-
keystone_credential_setup: "quay.io/rackspace/rackerlabs-keystone-rxt:2024.1-ubuntu_jammy-1747934956"
13-
keystone_db_sync: "quay.io/rackspace/rackerlabs-keystone-rxt:2024.1-ubuntu_jammy-1747934956"
14-
keystone_domain_manage: "quay.io/rackspace/rackerlabs-keystone-rxt:2024.1-ubuntu_jammy-1747934956"
15-
keystone_fernet_rotate: "quay.io/rackspace/rackerlabs-keystone-rxt:2024.1-ubuntu_jammy-1747934956"
16-
keystone_fernet_setup: "quay.io/rackspace/rackerlabs-keystone-rxt:2024.1-ubuntu_jammy-1747934956"
11+
keystone_credential_rotate: "quay.io/rackspace/rackerlabs-keystone-rxt:2024.1-ubuntu_jammy-1747958291"
12+
keystone_credential_setup: "quay.io/rackspace/rackerlabs-keystone-rxt:2024.1-ubuntu_jammy-1747958291"
13+
keystone_db_sync: "quay.io/rackspace/rackerlabs-keystone-rxt:2024.1-ubuntu_jammy-1747958291"
14+
keystone_domain_manage: "quay.io/rackspace/rackerlabs-keystone-rxt:2024.1-ubuntu_jammy-1747958291"
15+
keystone_fernet_rotate: "quay.io/rackspace/rackerlabs-keystone-rxt:2024.1-ubuntu_jammy-1747958291"
16+
keystone_fernet_setup: "quay.io/rackspace/rackerlabs-keystone-rxt:2024.1-ubuntu_jammy-1747958291"
1717
ks_user: "quay.io/rackspace/rackerlabs-heat:2024.1-ubuntu_jammy"
1818
rabbit_init: "quay.io/rackspace/rackerlabs-rabbitmq:3.13-management"
1919
test: "quay.io/rackspace/rackerlabs-xrally-openstack:2.0.0"
@@ -111,6 +111,7 @@ conf:
111111
WSGIApplicationGroup %{GLOBAL}
112112
WSGIPassAuthorization On
113113
LimitRequestBody 114688
114+
114115
<IfVersion >= 2.4>
115116
ErrorLogFormat "%{cu}t %M"
116117
</IfVersion>

‎base-kustomize/keystone/federation/kustomization.yaml‎

Lines changed: 89 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,89 @@
1+
---
2+
sortOptions:
3+
order: fifo
4+
resources:
5+
- ../base
6+
7+
images:
8+
- name: keystone-shib
9+
newName: ghcr.io/rackerlabs/keystone-rxt/shibd
10+
newTag: "1747958286"
11+
12+
patches:
13+
- target:
14+
kind: Service
15+
name: keystone-api
16+
patch: |-
17+
- op: add
18+
path: /spec/sessionAffinity
19+
value: ClientIP
20+
- op: add
21+
path: /spec/sessionAffinityConfig
22+
value:
23+
clientIP:
24+
timeoutSeconds: 28800
25+
- target:
26+
kind: Deployment
27+
name: keystone-api
28+
patch: |-
29+
- op: add
30+
path: /spec/template/spec/volumes/-
31+
value:
32+
name: keystone-shibd-etc
33+
secret:
34+
secretName: keystone-shibd-etc
35+
- op: add
36+
path: /spec/template/spec/volumes/-
37+
value:
38+
name: run-shibd
39+
emptyDir: {}
40+
- op: add
41+
path: /spec/template/spec/containers/0/volumeMounts/-
42+
value:
43+
mountPath: "/etc/shibboleth"
44+
name: keystone-shibd-etc
45+
readOnly: true
46+
- op: add
47+
path: /spec/template/spec/containers/0/volumeMounts/-
48+
value:
49+
mountPath: "/var/run/shibboleth"
50+
name: run-shibd
51+
- op: add
52+
path: /spec/template/spec/containers/-
53+
value:
54+
command:
55+
- /usr/sbin/shibd
56+
- -f
57+
- -c
58+
- /etc/shibboleth/shibboleth2.xml
59+
- -p
60+
- /var/run/shibboleth/shibd.pid
61+
- -F
62+
name: keystone-shib
63+
securityContext:
64+
allowPrivilegeEscalation: false
65+
readOnlyRootFilesystem: false
66+
terminationMessagePath: /dev/termination-log
67+
terminationMessagePolicy: File
68+
image: keystone-shib
69+
imagePullPolicy: IfNotPresent
70+
volumeMounts:
71+
- mountPath: "/etc/shibboleth"
72+
name: keystone-shibd-etc
73+
readOnly: true
74+
- mountPath: /var/run/shibboleth
75+
name: run-shibd
76+
livenessProbe:
77+
exec:
78+
command:
79+
- stat
80+
- /var/run/shibboleth/shibd.sock
81+
initialDelaySeconds: 10
82+
periodSeconds: 10
83+
readinessProbe:
84+
exec:
85+
command:
86+
- stat
87+
- /var/run/shibboleth/shibd.sock
88+
initialDelaySeconds: 10
89+
periodSeconds: 10

‎base-kustomize/skyline/base/configmap-bin.yaml‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,9 @@ data:
5353
yq -yi ".openstack.system_project_domain=\"${SERVICE_PROJECT_DOMAIN}\"" /etc/skyline/skyline.yaml
5454
yq -yi ".openstack.keystone_url=\"${SKYLINE_KEYSTONE_ENDPOINT}\"" /etc/skyline/skyline.yaml
5555
yq -yi ".openstack.default_region=\"${SKYLINE_DEFAULT_REGION}\"" /etc/skyline/skyline.yaml
56+
yq -yi ".openstack.sso_enabled=${SKYLINE_SSO_ENABLED:-false}" /etc/skyline/skyline.yaml
57+
yq -yi ".openstack.sso_protocols=${SKYLINE_SSO_PROTOCOLS:-[]}" /etc/skyline/skyline.yaml
58+
yq -yi ".openstack.sso_region=\"${SKYLINE_SSO_REGION:-RegionOne}\"" /etc/skyline/skyline.yaml
5659
yq -yi ".default.secret_key=\"${SKYLINE_SECRET_KEY}\"" /etc/skyline/skyline.yaml
5760
yq -yi ".default.database_url=\"mysql://${DB_USERNAME}:${DB_PASSWORD}@${DB_ENDPOINT}/${DB_NAME}\"" /etc/skyline/skyline.yaml
5861
yq -yi ".default.prometheus_basic_auth_password=\"${PROMETHEUS_BASIC_AUTH_PASSWORD}\"" /etc/skyline/skyline.yaml
@@ -91,24 +94,26 @@ data:
9194
reclaim_instance_interval: 604800
9295
service_mapping:
9396
baremetal: ironic
97+
block-storage: cinder
9498
compute: nova
9599
container: zun
96100
container-infra: magnum
97101
database: trove
102+
dns: designate
98103
identity: keystone
99104
image: glance
105+
instance-ha: masakari
100106
key-manager: barbican
101107
load-balancer: octavia
102108
network: neutron
103109
object-store: swift
104110
orchestration: heat
105111
placement: placement
106112
sharev2: manilav2
107-
volumev3: cinder
108-
cloudformation: heat-cfn
109113
sso_enabled: false
110114
sso_protocols:
111115
- openid
116+
sso_region: RegionOne
112117
system_admin_roles:
113118
- admin
114119
system_project: 'service'

0 commit comments

Comments
 (0)