Skip to content

Commit 2a3528e

Browse files
cloudnullcloudnull
committed
feat: add SAML federation support
This change documents the process of setting up federation support within Keystone and Skyline. Signed-off-by: Kevin Carter <[email protected]>
1 parent a9caa99 commit 2a3528e

File tree

8 files changed

+878
-199
lines changed

8 files changed

+878
-199
lines changed

‎base-helm-configs/keystone/keystone-helm-overrides-saml.yaml.example‎

Lines changed: 90 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,90 @@
1+
pod:
2+
security_context:
3+
keystone:
4+
container:
5+
keystone_api:
6+
runAsUser: 0
7+
readOnlyRootFilesystem: false
8+
9+
conf:
10+
software:
11+
apache2:
12+
a2enmod:
13+
- shib
14+
keystone:
15+
auth:
16+
methods: "password,token,saml2,application_credential,totp"
17+
saml2:
18+
remote_id_attribute: Shib-Identity-Provider
19+
federation:
20+
trusted_dashboard:
21+
type: multistring
22+
values:
23+
- https://skyline.api.example.com/api/openstack/skyline/api/v1/websso
24+
- https://horizon.api.example.com/auth/websso
25+
wsgi_keystone: |
26+
{{- $portInt := tuple "identity" "service" "api" $ | include "helm-toolkit.endpoints.endpoint_port_lookup" }}
27+
28+
Listen 0.0.0.0:{{ $portInt }}
29+
30+
LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
31+
LogFormat "%{X-Forwarded-For}i %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" proxy
32+
33+
SetEnvIf X-Forwarded-For "^.*\..*\..*\..*" forwarded
34+
CustomLog /dev/stdout combined env=!forwarded
35+
CustomLog /dev/stdout proxy env=forwarded
36+
37+
<VirtualHost *:{{ $portInt }}>
38+
ServerName https://keystone.api.example.com:443
39+
UseCanonicalName On
40+
41+
WSGIDaemonProcess keystone-public processes={{ .Values.conf.keystone_api_wsgi.wsgi.processes }} threads={{ .Values.conf.keystone_api_wsgi.wsgi.threads }} user=keystone group=keystone display-name=%{GROUP}
42+
WSGIProcessGroup keystone-public
43+
WSGIScriptAlias / /var/www/cgi-bin/keystone/keystone-wsgi-public
44+
WSGIApplicationGroup %{GLOBAL}
45+
WSGIPassAuthorization On
46+
LimitRequestBody 114688
47+
48+
<IfVersion >= 2.4>
49+
ErrorLogFormat "%{cu}t %M"
50+
</IfVersion>
51+
ErrorLog /dev/stdout
52+
53+
SetEnvIf X-Forwarded-For "^.*\..*\..*\..*" forwarded
54+
CustomLog /dev/stdout combined env=!forwarded
55+
CustomLog /dev/stdout proxy env=forwarded
56+
57+
<Location /Shibboleth.sso>
58+
SetHandler shib
59+
</Location>
60+
<Location /v3/OS-FEDERATION/identity_providers/IDENTITY_PROVIDER_NAME/protocols/saml2/auth>
61+
Require valid-user
62+
AuthType shibboleth
63+
ShibRequestSetting requireSession 1
64+
ShibExportAssertion off
65+
<IfVersion < 2.4>
66+
ShibRequireSession On
67+
ShibRequireAll On
68+
</IfVersion>
69+
</Location>
70+
<Location /v3/auth/OS-FEDERATION/websso/saml2>
71+
Require valid-user
72+
AuthType shibboleth
73+
ShibRequestSetting requireSession 1
74+
ShibExportAssertion off
75+
<IfVersion < 2.4>
76+
ShibRequireSession On
77+
ShibRequireAll On
78+
</IfVersion>
79+
</Location>
80+
<Location /v3/auth/OS-FEDERATION/identity_providers/IDENTITY_PROVIDER_NAME/protocols/saml2/websso>
81+
Require valid-user
82+
AuthType shibboleth
83+
ShibRequestSetting requireSession 1
84+
ShibExportAssertion off
85+
<IfVersion < 2.4>
86+
ShibRequireSession On
87+
ShibRequireAll On
88+
</IfVersion>
89+
</Location>
90+
</VirtualHost>

‎base-helm-configs/keystone/keystone-helm-overrides.yaml‎

Lines changed: 8 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -6,14 +6,14 @@ images:
66
db_init: "quay.io/rackspace/rackerlabs-heat:2024.1-ubuntu_jammy"
77
dep_check: "quay.io/rackspace/rackerlabs-kubernetes-entrypoint:latest-ubuntu_jammy"
88
image_repo_sync: "quay.io/rackspace/rackerlabs-docker:17.07.0"
9-
keystone_api: "quay.io/rackspace/rackerlabs-keystone-rxt:2024.1-ubuntu_jammy-1747934956"
9+
keystone_api: "ghcr.io/rackerlabs/keystone-rxt:2024.1-ubuntu_jammy-1747958291"
1010
keystone_credential_cleanup: "quay.io/rackspace/rackerlabs-heat:2024.1-ubuntu_jammy"
11-
keystone_credential_rotate: "quay.io/rackspace/rackerlabs-keystone-rxt:2024.1-ubuntu_jammy-1747934956"
12-
keystone_credential_setup: "quay.io/rackspace/rackerlabs-keystone-rxt:2024.1-ubuntu_jammy-1747934956"
13-
keystone_db_sync: "quay.io/rackspace/rackerlabs-keystone-rxt:2024.1-ubuntu_jammy-1747934956"
14-
keystone_domain_manage: "quay.io/rackspace/rackerlabs-keystone-rxt:2024.1-ubuntu_jammy-1747934956"
15-
keystone_fernet_rotate: "quay.io/rackspace/rackerlabs-keystone-rxt:2024.1-ubuntu_jammy-1747934956"
16-
keystone_fernet_setup: "quay.io/rackspace/rackerlabs-keystone-rxt:2024.1-ubuntu_jammy-1747934956"
11+
keystone_credential_rotate: "ghcr.io/rackerlabs/keystone-rxt:2024.1-ubuntu_jammy-1747958291"
12+
keystone_credential_setup: "ghcr.io/rackerlabs/keystone-rxt:2024.1-ubuntu_jammy-1747958291"
13+
keystone_db_sync: "ghcr.io/rackerlabs/keystone-rxt:2024.1-ubuntu_jammy-1747958291"
14+
keystone_domain_manage: "ghcr.io/rackerlabs/keystone-rxt:2024.1-ubuntu_jammy-1747958291"
15+
keystone_fernet_rotate: "ghcr.io/rackerlabs/keystone-rxt:2024.1-ubuntu_jammy-1747958291"
16+
keystone_fernet_setup: "ghcr.io/rackerlabs/keystone-rxt:2024.1-ubuntu_jammy-1747958291"
1717
ks_user: "quay.io/rackspace/rackerlabs-heat:2024.1-ubuntu_jammy"
1818
rabbit_init: "quay.io/rackspace/rackerlabs-rabbitmq:3.13-management"
1919
test: "quay.io/rackspace/rackerlabs-xrally-openstack:2.0.0"
@@ -111,6 +111,7 @@ conf:
111111
WSGIApplicationGroup %{GLOBAL}
112112
WSGIPassAuthorization On
113113
LimitRequestBody 114688
114+
114115
<IfVersion >= 2.4>
115116
ErrorLogFormat "%{cu}t %M"
116117
</IfVersion>

‎base-kustomize/keystone/federation/kustomization.yaml‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
---
2+
sortOptions:
3+
order: fifo
4+
resources:
5+
- ../base
6+
7+
images:
8+
- name: keystone-shib
9+
newName: ghcr.io/rackerlabs/keystone-rxt/shibd
10+
newTag: "1747958286"
11+
12+
patches:
13+
- target:
14+
kind: Deployment
15+
name: keystone-api
16+
patch: |-
17+
- op: add
18+
path: /spec/template/spec/volumes/-
19+
value:
20+
name: keystone-shibd-etc
21+
secret:
22+
secretName: keystone-shibd-etc
23+
- op: add
24+
path: /spec/template/spec/volumes/-
25+
value:
26+
name: run-shibd
27+
emptyDir: {}
28+
- op: add
29+
path: /spec/template/spec/containers/0/volumeMounts/-
30+
value:
31+
mountPath: "/etc/shibboleth"
32+
name: keystone-shibd-etc
33+
readOnly: true
34+
- op: add
35+
path: /spec/template/spec/containers/0/volumeMounts/-
36+
value:
37+
mountPath: "/var/run/shibboleth"
38+
name: run-shibd
39+
- op: add
40+
path: /spec/template/spec/containers/-
41+
value:
42+
command:
43+
- /usr/sbin/shibd
44+
- -f
45+
- -c
46+
- /etc/shibboleth/shibboleth2.xml
47+
- -p
48+
- /var/run/shibboleth/shibd.pid
49+
- -F
50+
name: keystone-shib
51+
securityContext:
52+
allowPrivilegeEscalation: false
53+
readOnlyRootFilesystem: false
54+
terminationMessagePath: /dev/termination-log
55+
terminationMessagePolicy: File
56+
image: keystone-shib
57+
imagePullPolicy: IfNotPresent
58+
volumeMounts:
59+
- mountPath: "/etc/shibboleth"
60+
name: keystone-shibd-etc
61+
readOnly: true
62+
- mountPath: /var/run/shibboleth
63+
name: run-shibd

‎base-kustomize/skyline/base/configmap-bin.yaml‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,9 @@ data:
5353
yq -yi ".openstack.system_project_domain=\"${SERVICE_PROJECT_DOMAIN}\"" /etc/skyline/skyline.yaml
5454
yq -yi ".openstack.keystone_url=\"${SKYLINE_KEYSTONE_ENDPOINT}\"" /etc/skyline/skyline.yaml
5555
yq -yi ".openstack.default_region=\"${SKYLINE_DEFAULT_REGION}\"" /etc/skyline/skyline.yaml
56+
yq -yi ".openstack.sso_enabled=${SKYLINE_SSO_ENABLED:-false}" /etc/skyline/skyline.yaml
57+
yq -yi ".openstack.sso_protocols=${SKYLINE_SSO_PROTOCOLS:-[]}" /etc/skyline/skyline.yaml
58+
yq -yi ".openstack.sso_region=\"${SKYLINE_SSO_REGION:-RegionOne}\"" /etc/skyline/skyline.yaml
5659
yq -yi ".default.secret_key=\"${SKYLINE_SECRET_KEY}\"" /etc/skyline/skyline.yaml
5760
yq -yi ".default.database_url=\"mysql://${DB_USERNAME}:${DB_PASSWORD}@${DB_ENDPOINT}/${DB_NAME}\"" /etc/skyline/skyline.yaml
5861
yq -yi ".default.prometheus_basic_auth_password=\"${PROMETHEUS_BASIC_AUTH_PASSWORD}\"" /etc/skyline/skyline.yaml
@@ -85,30 +88,32 @@ data:
8588
fwaas_v2: neutron_firewall
8689
qos: neutron_qos
8790
vpnaas: neutron_vpn
88-
interface_type: internal
91+
interface_type: public
8992
keystone_url: http://localhost:5000
9093
nginx_prefix: /api/openstack
9194
reclaim_instance_interval: 604800
9295
service_mapping:
9396
baremetal: ironic
97+
block-storage: cinder
9498
compute: nova
9599
container: zun
96100
container-infra: magnum
97101
database: trove
102+
dns: designate
98103
identity: keystone
99104
image: glance
105+
instance-ha: masakari
100106
key-manager: barbican
101107
load-balancer: octavia
102108
network: neutron
103109
object-store: swift
104110
orchestration: heat
105111
placement: placement
106112
sharev2: manilav2
107-
volumev3: cinder
108-
cloudformation: heat-cfn
109113
sso_enabled: false
110114
sso_protocols:
111115
- openid
116+
sso_region: RegionOne
112117
system_admin_roles:
113118
- admin
114119
system_project: 'service'

0 commit comments

Comments
 (0)