Skip to content

Commit 71fd91c

Browse files
cloudnullcloudnull
committed
feat: add SAML federation support
This change documents the process of setting up federation support within Keystone and Skyline. Signed-off-by: Kevin Carter <[email protected]>
1 parent a9caa99 commit 71fd91c

File tree

8 files changed

+659
-199
lines changed

8 files changed

+659
-199
lines changed

‎base-helm-configs/keystone/keystone-helm-overrides-saml.yaml.example‎

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
pod:
2+
security_context:
3+
keystone:
4+
container:
5+
keystone_api:
6+
runAsUser: 0
7+
readOnlyRootFilesystem: false
8+
9+
conf:
10+
software:
11+
apache2:
12+
a2enmod:
13+
- shib
14+
keystone:
15+
auth:
16+
methods: "password,token,saml2,application_credential,totp"
17+
saml2:
18+
remote_id_attribute: Shib-Identity-Provider
19+
federation:
20+
trusted_dashboard:
21+
type: multistring
22+
values:
23+
- https://skyline.api.example.com/api/openstack/skyline/api/v1/websso
24+
- https://horizon.api.example.com/auth/websso
25+
wsgi_keystone: |
26+
{{- $portInt := tuple "identity" "service" "api" $ | include "helm-toolkit.endpoints.endpoint_port_lookup" }}
27+
28+
Listen 0.0.0.0:{{ $portInt }}
29+
30+
LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
31+
LogFormat "%{X-Forwarded-For}i %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" proxy
32+
33+
SetEnvIf X-Forwarded-For "^.*\..*\..*\..*" forwarded
34+
CustomLog /dev/stdout combined env=!forwarded
35+
CustomLog /dev/stdout proxy env=forwarded
36+
37+
<VirtualHost *:{{ $portInt }}>
38+
WSGIDaemonProcess keystone-public processes={{ .Values.conf.keystone_api_wsgi.wsgi.processes }} threads={{ .Values.conf.keystone_api_wsgi.wsgi.threads }} user=keystone group=keystone display-name=%{GROUP}
39+
WSGIProcessGroup keystone-public
40+
WSGIScriptAlias / /var/www/cgi-bin/keystone/keystone-wsgi-public
41+
WSGIScriptAliasMatch ^(/v3/OS-FEDERATION/identity_providers/rackspace_saml2/protocols/saml2/auth)$ /var/www/cgi-bin/keystone/keystone-wsgi-public/$1
42+
WSGIApplicationGroup %{GLOBAL}
43+
WSGIPassAuthorization On
44+
LimitRequestBody 114688
45+
46+
<IfVersion >= 2.4>
47+
ErrorLogFormat "%{cu}t %M"
48+
</IfVersion>
49+
ErrorLog /dev/stdout
50+
51+
SetEnvIf X-Forwarded-For "^.*\..*\..*\..*" forwarded
52+
CustomLog /dev/stdout combined env=!forwarded
53+
CustomLog /dev/stdout proxy env=forwarded
54+
55+
<Location /Shibboleth.sso>
56+
SetHandler shib
57+
</Location>
58+
<Location /v3/OS-FEDERATION/identity_providers/IDENTITY_PROVIDER_NAME/protocols/saml2/auth>
59+
Require valid-user
60+
AuthType shibboleth
61+
ShibRequestSetting requireSession 1
62+
ShibExportAssertion off
63+
<IfVersion < 2.4>
64+
ShibRequireSession On
65+
ShibRequireAll On
66+
</IfVersion>
67+
</Location>
68+
<Location /v3/auth/OS-FEDERATION/websso/saml2>
69+
Require valid-user
70+
AuthType shibboleth
71+
ShibRequestSetting requireSession 1
72+
ShibExportAssertion off
73+
<IfVersion < 2.4>
74+
ShibRequireSession On
75+
ShibRequireAll On
76+
</IfVersion>
77+
</Location>
78+
<Location /v3/auth/OS-FEDERATION/identity_providers/IDENTITY_PROVIDER_NAME/protocols/saml2/websso>
79+
Require valid-user
80+
AuthType shibboleth
81+
ShibRequestSetting requireSession 1
82+
ShibExportAssertion off
83+
<IfVersion < 2.4>
84+
ShibRequireSession On
85+
ShibRequireAll On
86+
</IfVersion>
87+
</Location>
88+
</VirtualHost>

‎base-helm-configs/keystone/keystone-helm-overrides.yaml‎

Lines changed: 8 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -6,14 +6,14 @@ images:
66
db_init: "quay.io/rackspace/rackerlabs-heat:2024.1-ubuntu_jammy"
77
dep_check: "quay.io/rackspace/rackerlabs-kubernetes-entrypoint:latest-ubuntu_jammy"
88
image_repo_sync: "quay.io/rackspace/rackerlabs-docker:17.07.0"
9-
keystone_api: "quay.io/rackspace/rackerlabs-keystone-rxt:2024.1-ubuntu_jammy-1747934956"
9+
keystone_api: "ghcr.io/rackerlabs/keystone-rxt:2024.1-ubuntu_jammy-1747958291"
1010
keystone_credential_cleanup: "quay.io/rackspace/rackerlabs-heat:2024.1-ubuntu_jammy"
11-
keystone_credential_rotate: "quay.io/rackspace/rackerlabs-keystone-rxt:2024.1-ubuntu_jammy-1747934956"
12-
keystone_credential_setup: "quay.io/rackspace/rackerlabs-keystone-rxt:2024.1-ubuntu_jammy-1747934956"
13-
keystone_db_sync: "quay.io/rackspace/rackerlabs-keystone-rxt:2024.1-ubuntu_jammy-1747934956"
14-
keystone_domain_manage: "quay.io/rackspace/rackerlabs-keystone-rxt:2024.1-ubuntu_jammy-1747934956"
15-
keystone_fernet_rotate: "quay.io/rackspace/rackerlabs-keystone-rxt:2024.1-ubuntu_jammy-1747934956"
16-
keystone_fernet_setup: "quay.io/rackspace/rackerlabs-keystone-rxt:2024.1-ubuntu_jammy-1747934956"
11+
keystone_credential_rotate: "ghcr.io/rackerlabs/keystone-rxt:2024.1-ubuntu_jammy-1747958291"
12+
keystone_credential_setup: "ghcr.io/rackerlabs/keystone-rxt:2024.1-ubuntu_jammy-1747958291"
13+
keystone_db_sync: "ghcr.io/rackerlabs/keystone-rxt:2024.1-ubuntu_jammy-1747958291"
14+
keystone_domain_manage: "ghcr.io/rackerlabs/keystone-rxt:2024.1-ubuntu_jammy-1747958291"
15+
keystone_fernet_rotate: "ghcr.io/rackerlabs/keystone-rxt:2024.1-ubuntu_jammy-1747958291"
16+
keystone_fernet_setup: "ghcr.io/rackerlabs/keystone-rxt:2024.1-ubuntu_jammy-1747958291"
1717
ks_user: "quay.io/rackspace/rackerlabs-heat:2024.1-ubuntu_jammy"
1818
rabbit_init: "quay.io/rackspace/rackerlabs-rabbitmq:3.13-management"
1919
test: "quay.io/rackspace/rackerlabs-xrally-openstack:2.0.0"
@@ -111,6 +111,7 @@ conf:
111111
WSGIApplicationGroup %{GLOBAL}
112112
WSGIPassAuthorization On
113113
LimitRequestBody 114688
114+
114115
<IfVersion >= 2.4>
115116
ErrorLogFormat "%{cu}t %M"
116117
</IfVersion>

‎base-kustomize/keystone/federation/kustomization.yaml‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
---
2+
sortOptions:
3+
order: fifo
4+
resources:
5+
- ../base
6+
7+
images:
8+
- name: keystone-shib
9+
newName: ghcr.io/rackerlabs/keystone-rxt/shibd
10+
newTag: "1747958286"
11+
12+
patches:
13+
- target:
14+
kind: Deployment
15+
name: keystone-api
16+
patch: |-
17+
- op: add
18+
path: /spec/template/spec/volumes/-
19+
value:
20+
name: keystone-shibd-etc
21+
secret:
22+
secretName: keystone-shibd-etc
23+
- op: add
24+
path: /spec/template/spec/volumes/-
25+
value:
26+
name: run-shibd
27+
emptyDir: {}
28+
- op: add
29+
path: /spec/template/spec/containers/0/volumeMounts/-
30+
value:
31+
mountPath: "/etc/shibboleth"
32+
name: keystone-shibd-etc
33+
readOnly: true
34+
- op: add
35+
path: /spec/template/spec/containers/0/volumeMounts/-
36+
value:
37+
mountPath: "/var/run/shibboleth"
38+
name: run-shibd
39+
- op: add
40+
path: /spec/template/spec/containers/-
41+
value:
42+
command:
43+
- /usr/sbin/shibd
44+
- -f
45+
- -c
46+
- /etc/shibboleth/shibboleth2.xml
47+
- -p
48+
- /var/run/shibboleth/shibd.pid
49+
- -F
50+
name: keystone-shib
51+
securityContext:
52+
allowPrivilegeEscalation: false
53+
readOnlyRootFilesystem: false
54+
terminationMessagePath: /dev/termination-log
55+
terminationMessagePolicy: File
56+
image: keystone-shib
57+
imagePullPolicy: IfNotPresent
58+
volumeMounts:
59+
- mountPath: "/etc/shibboleth"
60+
name: keystone-shibd-etc
61+
readOnly: true
62+
- mountPath: /var/run/shibboleth
63+
name: run-shibd

‎base-kustomize/skyline/base/configmap-bin.yaml‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,9 @@ data:
5353
yq -yi ".openstack.system_project_domain=\"${SERVICE_PROJECT_DOMAIN}\"" /etc/skyline/skyline.yaml
5454
yq -yi ".openstack.keystone_url=\"${SKYLINE_KEYSTONE_ENDPOINT}\"" /etc/skyline/skyline.yaml
5555
yq -yi ".openstack.default_region=\"${SKYLINE_DEFAULT_REGION}\"" /etc/skyline/skyline.yaml
56+
yq -yi ".openstack.sso_enabled=${SKYLINE_SSO_ENABLED:-false}" /etc/skyline/skyline.yaml
57+
yq -yi ".openstack.sso_protocols=${SKYLINE_SSO_PROTOCOLS:-[]}" /etc/skyline/skyline.yaml
58+
yq -yi ".openstack.sso_region=\"${SKYLINE_SSO_REGION:-RegionOne}\"" /etc/skyline/skyline.yaml
5659
yq -yi ".default.secret_key=\"${SKYLINE_SECRET_KEY}\"" /etc/skyline/skyline.yaml
5760
yq -yi ".default.database_url=\"mysql://${DB_USERNAME}:${DB_PASSWORD}@${DB_ENDPOINT}/${DB_NAME}\"" /etc/skyline/skyline.yaml
5861
yq -yi ".default.prometheus_basic_auth_password=\"${PROMETHEUS_BASIC_AUTH_PASSWORD}\"" /etc/skyline/skyline.yaml
@@ -85,30 +88,32 @@ data:
8588
fwaas_v2: neutron_firewall
8689
qos: neutron_qos
8790
vpnaas: neutron_vpn
88-
interface_type: internal
91+
interface_type: public
8992
keystone_url: http://localhost:5000
9093
nginx_prefix: /api/openstack
9194
reclaim_instance_interval: 604800
9295
service_mapping:
9396
baremetal: ironic
97+
block-storage: cinder
9498
compute: nova
9599
container: zun
96100
container-infra: magnum
97101
database: trove
102+
dns: designate
98103
identity: keystone
99104
image: glance
105+
instance-ha: masakari
100106
key-manager: barbican
101107
load-balancer: octavia
102108
network: neutron
103109
object-store: swift
104110
orchestration: heat
105111
placement: placement
106112
sharev2: manilav2
107-
volumev3: cinder
108-
cloudformation: heat-cfn
109113
sso_enabled: false
110114
sso_protocols:
111115
- openid
116+
sso_region: RegionOne
112117
system_admin_roles:
113118
- admin
114119
system_project: 'service'

0 commit comments

Comments
 (0)