openstack/kolla-ansible
Code Issues Proposed changes

Merge "make OIDCClaimDelimiter configurable"

Browse Source
This commit is contained in:
Zuul 2024-09-18 14:33:21 +00:00 committed by Gerrit Code Review
commit 264aa14d6c
3 changed files with 11 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
ansible/roles/keystone/defaults/main.yml
View File

@ -234,6 +234,7 @@ keystone_enable_federation_openid: "{{ enable_keystone_federation | bool and key
keystone_should_remove_attribute_mappings: False
keystone_should_remove_identity_providers: False
keystone_federation_oidc_response_type: "id_token"
keystone_federation_oidc_claim_delimiter: ";"
keystone_federation_oidc_scopes: "openid email profile"
# OIDC caching

2
ansible/roles/keystone/templates/wsgi-keystone.conf.j2
View File

@ -59,7 +59,7 @@ LogLevel info
{% if keystone_enable_federation_openid | bool %}
OIDCClaimPrefix "OIDC-"
OIDCClaimDelimiter ";"
OIDCClaimDelimiter "{{ keystone_federation_oidc_claim_delimiter }}"
OIDCResponseType "{{ keystone_federation_oidc_response_type }}"
OIDCScope "{{ keystone_federation_oidc_scopes }}"
OIDCMetadataDir {{ keystone_container_federation_oidc_metadata_folder }}

9
releasenotes/notes/fix-hardcoded-oidc-claim-delimiter-06ca81b1fce0eba7.yaml Normal file
View File

@ -0,0 +1,9 @@
---
fixes:
- |
Fixes an issue with setting up OIDC based Keystone federation against IDP
where there are multiple OIDC groups that are separated by a custom
delimiter.
Add a variable ``keystone_federation_oidc_claim_delimiter`` to set the
custom value.
`LP#2080394 <https://bugs.launchpad.net/bugs/2080394>`__