Add support to the keystone devstack plugin for setting enforce_scope in
the keystone config and setting up tempest to test it.
It may be better to move this to tempest proper at some point.
See also: https://review.opendev.org/686073https://review.opendev.org/698397
Change-Id: I1b71135547b7ce03afb5b44fbbab3f52d213a2ae
The openstack.org pages now support https and our references to
the site should by default be one signed by the organization.
Change-Id: I30a462e03d1fd7852511e22cac34c6bc0e8917f4
This patch adds a function to configure the settings for test cases. It
currently sets the needed settings for the first federation scenario
test (follow up patch). If needed, additional settings can be added.
Change-Id: I5f0d0b5eeee1d8f03b38a2eb4cdc2101d3dccaa1
In a previous patch, I implemented a Devstack plugin to enable
federation and idp features in keystone. The plugin was to be
configured from environment variables for the idp entityID, metadata,
sp_auth_url, sp_url, etc. Providing an endless and untestable matrix
of combinations. Therefore the review was gathering dust waiting for
brave reviewers.
This review extracts the meat of the previous patch and removes all
the configuration options. This plugin now does one thing only: It
installs mod_shibboleth and sets up testshib.org as the IdP for keystone.
While testshib.org will not be used in our functional testing, this
is a necessary first step to make such complex changes more testable
reproducible and reviewable.
A follow-up patch will install a shibboleth-idp, and either that one,
or a later one, will switch from testshib.org to the local shibboleth.
This plugin will not yet be run as part of the gate, as "enable_service
federation" needs to be added to the Devstack options.
To run add the following after the lines that set up keystone from a
gerrit review:
enable_plugin keystone $KEYSTONE_REPO
enable_service keystone-saml2-federation
Change-Id: I6f7491ff063359d7065c77b00fe5bfc76f8587d6
This review creates the structure for the Devstack plugin and
prints to the console to ensure its execution in the gate.
Follow-up reviews will do more useful stuff like setting up
the environment for our functional testing (ldap, federation).
Change-Id: I820ae355ae8f3183fee2b8207e3c17e8bd10dc17