openstack/openstack-ansible-os_keystone
Code Issues Proposed changes
eea1a4853f
openstack-ansible-os_keystone/doc/source/configure-federation-wrapper.rst
Alexandra c0fa231c21 [DOCS] Move keystone federation role docs 
Also includes clean up of the pre-existing content.

Update the role documentation to match the newly proposed format.  In
the new format, each role project should maintain the configuration
variations for the role project itself.

Change-Id: I68ab9a5e8e305114e023ce23341bc9e11a5dbe7c
2016-08-16 08:46:08 +00:00

2.8 KiB
Raw Blame History

Configuring keystone-to-keystone federation

In keystone-to-keystone federation (k2k), the IdP and SP keystone instances exchange information securely to enable a user on the IdP cloud to access resources of the SP cloud.

Important

This section applies only to federation between keystone IdP and keystone SP. It does not apply to non-keystone IdP.

The k2k authentication flow involves the following steps:

  1. Log in to the IdP with your credentials.
  2. Send a request to the IdP to generate an assertion for a given SP.
  3. Submit the assertion to the SP on the configured sp_url endpoint. The Shibboleth service running on the SP receives the assertion and verifies it. If it is valid, a session with the client starts and returns the session ID in a cookie.
  4. Connect to the SP on the configured auth_url endpoint, providing the Shibboleth cookie with the session ID. The SP responds with an unscoped token that you use to access the SP.
  5. You connect to the keystone service on the SP with the unscoped token, and the desired domain and project, and receive a scoped token and the service catalog.
  6. With your token, you can now make API requests to the endpoints in the catalog.

Keystone-to-keystone federation authentication wrapper

The following steps above involve manually sending API requests.

Note

The infrastructure for the command line utilities that performs these steps for the user does not exist.

To obtain access to a SP cloud, OpenStack-Ansible provides a script that wraps the above steps. The script is called federated-login.sh and is used as follows:

# ./scripts/federated-login.sh -p project [-d domain] sp_id
  • project is the project in the SP cloud that you want to access.
  • domain is the domain in which the project lives (the default domain is used if this argument is not given).
  • sp_id is the unique ID of the SP. This is given in the IdP configuration.

The script outputs the results of all the steps in the authentication flow to the console. At the end, it prints the available endpoints from the catalog and the scoped token provided by the SP.

Use the endpoints and token with the openstack command line client as follows:

# openstack --os-token=<token> --os-url=<service-endpoint> [options]

Or, alternatively:

# export OS_TOKEN=<token>
# export OS_URL=<service-endpoint>
# openstack [options]

Ensure you select the appropriate endpoint for your operation. For example, if you want to work with servers, the OS_URL argument must be set to the compute endpoint.

Note

At this time, the OpenStack client is unable to find endpoints in the service catalog when using a federated login.