openstack-ansible/doc/source/install-guide/configure-federation.rst

Home OpenStack-Ansible Installation Guide

Configuring Identity Service federation (optional)

configure-federation-wrapper configure-federation-sp-overview.rst configure-federation-sp.rst configure-federation-idp.rst configure-federation-idp-adfs.rst configure-federation-mapping.rst configure-federation-use-case.rst

In Identity Service federation, the identity provider (IdP) and service provider (SP) exchange information securely to enable a user on the IdP cloud to access resources of the SP cloud.

Note

For the Kilo release of OpenStack, federation is only partially supported. It is possible to perform a federated login using command line clients and scripting, but Dashboard (horizon) does not support this functionality.

The following procedure describes how set up federation.

1. Configure Identity Service (keystone) service providers.

2. Configure the identity provider:

   • Configure Identity Service (keystone) as an identity provider.
   • Configure Active Directory Federation Services (ADFS) 3.0 as an identity provider.

3. Configure the service provider:

   • Configure Identity Service (keystone) as a federated service provider.
   • Configure Identity Service (keystone) Domain-Project-Group-Role mappings.

4. Run the authentication wrapper to use Identity Service to Identity Service federation.

   For examples of how to set up Identity Service to Identity Service federation, see the Identity Service to Identity Service federation example use-case.

---