openstack/openstack-ansible-os_keystone
Code Issues Proposed changes

Identity Providers support improvments

Browse Source 
Identity providers can be created with specified domain
IDPs are linked to a keystone domain. Currently when we provision a new IDP
it gets created within a new autogenerated domain. Provisioners can now
give a domain_id in an IDP entry within the trusted_idp_list and the IDP
will be created within that domain.

Add IDP display_name to defaults
Allows operator a name different to the one used in the backend
to display to the user in the horizon Identity Provider dropdown.

Change-Id: Iaf9f1b9198f14c903f9801e0ce7da86b74d9c5bd
This commit is contained in:
Georgina Shippey 2020-06-15 19:52:21 +01:00 committed by Dmitriy Rabotyagov (noonedeadpunk)
parent c9db38b60a
commit 4c9642765e
2 changed files with 3 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
defaults/main.yml
View File

@ -339,6 +339,8 @@ keystone_sp: {}
# trusted_idp_list:
# note that only one of these is supported at any one time for now
# - name: "keystone-idp"
# domain_id: "default"
# display_name: "Keystone IDP" # Optional, used in Horizon IDP dropdown
# entity_ids:
# - 'https://keystone-idp:5000/v3/OS-FEDERATION/saml2/idp'
# metadata_uri: 'https://keystone-idp:5000/v3/OS-FEDERATION/saml2/metadata'

1
tasks/keystone_federation_sp_idp_setup.yml
View File

@ -127,6 +127,7 @@
idp_name: "{{ item.name }}"
idp_remote_ids: "{{ item.entity_ids }}"
idp_enabled: true
idp_domain_id: "{{ item.domain_id | default(omit) }}"
login_user: "{{ keystone_admin_user_name }}"
login_password: "{{ keystone_auth_admin_password }}"
login_project_name: "{{ keystone_admin_tenant_name }}"