47fe909d54
This patch adds support for using mod_auth_openidc instead of shibboleth for supporting users who have a preference to use oidc for federation. A new variable called apache_mod is added to keystone_sp allowing the auth library to be selected. If left undefined shibboleth auth module will continue to be installed by default maintaining backward compatibility. This patch does not support simultaneous use of shibboleth and mod_auth_openidc primarily because shib2 depends on libcurl3 but mod_auth_openidc depends on libcurl4 which cannot coexist on Ubuntu. This can be resolved when there is a shib3 package available in a future release of Ubuntu. Change-Id: I80031f7d3f0fcc2029cd6861dcb6687e8a9f0a2e
17 lines
988 B
YAML
17 lines
988 B
YAML
---
|
|
features:
|
|
- Added support for using mod_auth_openidc instead of shibboleth as a
|
|
service provider for supporting users who have a preference to use OIDC
|
|
for federation. Mod_auth_openidc is the apache module that is recommended
|
|
in the keystone documentation for implementing openidc.
|
|
Added a variable to called apache_mod to keystone_sp, if left undefined
|
|
shibboleth will continue to be installed by default provided keystone_sp is
|
|
not empty. Mod_auth_openidc will not be installed unless it is spelled
|
|
correctly, any misspellings will result in a shibboleth install.
|
|
Note that installing shibboleth on Debian based metal distro deployments
|
|
may break services that depend on libcurl4, as shib2 requires libcurl3,
|
|
and they are unable to coexist. This can be resolved when there is a
|
|
shib3 package available in a future release of Ubuntu/Debian.
|
|
There is currently no support for simultaneous use of shibboleth2 and
|
|
mod_auth_openidc.
|