fbafc06ac6
In a previous patch, I implemented a Devstack plugin to enable federation and idp features in keystone. The plugin was to be configured from environment variables for the idp entityID, metadata, sp_auth_url, sp_url, etc. Providing an endless and untestable matrix of combinations. Therefore the review was gathering dust waiting for brave reviewers. This review extracts the meat of the previous patch and removes all the configuration options. This plugin now does one thing only: It installs mod_shibboleth and sets up testshib.org as the IdP for keystone. While testshib.org will not be used in our functional testing, this is a necessary first step to make such complex changes more testable reproducible and reviewable. A follow-up patch will install a shibboleth-idp, and either that one, or a later one, will switch from testshib.org to the local shibboleth. This plugin will not yet be run as part of the gate, as "enable_service federation" needs to be added to the Devstack options. To run add the following after the lines that set up keystone from a gerrit review: enable_plugin keystone $KEYSTONE_REPO enable_service keystone-saml2-federation Change-Id: I6f7491ff063359d7065c77b00fe5bfc76f8587d6
78 lines
3.9 KiB
XML
78 lines
3.9 KiB
XML
<!--
|
|
This is an example shibboleth2.xml generated for you by TestShib. It's reduced and recommended
|
|
specifically for testing. You don't need to change anything, but you may want to explore the file
|
|
to learn about how your SP works. Uncomment attributes in your attribute-map.xml file to test them.
|
|
|
|
If you want to test advanced functionality, start from the distribution shibboleth2.xml and add the
|
|
MetadataProvider, the right entityID, and a properly configured SSO element. More information:
|
|
|
|
https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPConfiguration
|
|
-->
|
|
|
|
<SPConfig xmlns="urn:mace:shibboleth:2.0:native:sp:config" xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
|
|
clockSkew="1800">
|
|
|
|
<!-- The entityID is the name TestShib made for your SP. -->
|
|
<ApplicationDefaults entityID="http://%HOST_IP%/shibboleth">
|
|
|
|
<!-- You should use secure cookies if at all possible. See cookieProps in this Wiki article. -->
|
|
<!-- https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPSessions -->
|
|
<Sessions lifetime="28800" timeout="3600" checkAddress="false" relayState="ss:mem" handlerSSL="false">
|
|
|
|
<!-- Triggers a login request directly to the TestShib IdP. -->
|
|
<!-- https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPServiceSSO -->
|
|
<SSO entityID="https://idp.testshib.org/idp/shibboleth" ECP="true">
|
|
SAML2 SAML1
|
|
</SSO>
|
|
|
|
<!-- SAML and local-only logout. -->
|
|
<!-- https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPServiceLogout -->
|
|
<Logout>SAML2 Local</Logout>
|
|
|
|
<!--
|
|
Handlers allow you to interact with the SP and gather more information. Try them out!
|
|
Attribute values received by the SP through SAML will be visible at:
|
|
http://http@-HOSTNAME-@72@-HOSTNAME-@57@-HOSTNAME-@57128.31.25.69@-HOSTNAME-@725000/Shibboleth.sso/Session
|
|
-->
|
|
|
|
<!-- Extension service that generates "approximate" metadata based on SP configuration. -->
|
|
<Handler type="MetadataGenerator" Location="/Metadata" signing="false"/>
|
|
|
|
<!-- Status reporting service. -->
|
|
<Handler type="Status" Location="/Status" acl="127.0.0.1 ::1"/>
|
|
|
|
<!-- Session diagnostic service. -->
|
|
<Handler type="Session" Location="/Session" showAttributeValues="true"/>
|
|
|
|
<!-- JSON feed of discovery information. -->
|
|
<Handler type="DiscoveryFeed" Location="/DiscoFeed"/>
|
|
|
|
</Sessions>
|
|
|
|
<!-- Error pages to display to yourself if something goes horribly wrong. -->
|
|
<Errors supportContact="root@localhost" logoLocation="/shibboleth-sp/logo.jpg"
|
|
styleSheet="/shibboleth-sp/main.css"/>
|
|
|
|
<!-- Loads and trusts a metadata file that describes only the Testshib IdP and how to communicate with it. -->
|
|
<MetadataProvider type="XML" uri="http://www.testshib.org/metadata/testshib-providers.xml"
|
|
backingFilePath="testshib-two-idp-metadata.xml" reloadInterval="180000" />
|
|
|
|
<!-- Attribute and trust options you shouldn't need to change. -->
|
|
<AttributeExtractor type="XML" validate="true" path="attribute-map.xml"/>
|
|
<AttributeResolver type="Query" subjectMatch="true"/>
|
|
<AttributeFilter type="XML" validate="true" path="attribute-policy.xml"/>
|
|
|
|
<!-- Your SP generated these credentials. They're used to talk to IdP's. -->
|
|
<CredentialResolver type="File" key="sp-key.pem" certificate="sp-cert.pem"/>
|
|
|
|
</ApplicationDefaults>
|
|
|
|
<!-- Security policies you shouldn't change unless you know what you're doing. -->
|
|
<SecurityPolicyProvider type="XML" validate="true" path="security-policy.xml"/>
|
|
|
|
<!-- Low-level configuration about protocols and bindings available for use. -->
|
|
<ProtocolProvider type="XML" validate="true" reloadChanges="false" path="protocols.xml"/>
|
|
|
|
</SPConfig>
|
|
|