openstack/puppet-keystone
Code Issues Proposed changes

Fix default OIDCRedirectURI hiding keystone federation auth endpoint

Browse Source 
This updates the default OIDCRedirectURI according to the change made
in the example file in keystone repo[1].

[1] https://review.opendev.org/925553

Conflicts:
	spec/classes/keystone_federation_openidc_spec.rb

Closes-Bug: #2075349
Change-Id: Ia0f3cbb842a4c01e6a3ca44ca66dc9a8a731720c
(cherry picked from commit fdf2a2b31a)
This commit is contained in:
Takashi Kajinami 2024-09-10 13:39:46 +09:00
parent 5512e49da2
commit 723cc8694d
2 changed files with 7 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
spec/classes/keystone_federation_openidc_spec.rb
View File

@ -79,7 +79,7 @@ describe 'keystone::federation::openidc' do
expect(content).to match('OIDCProviderMetadataURL "https://accounts.google.com/.well-known/openid-configuration"') expect(content).to match('OIDCProviderMetadataURL "https://accounts.google.com/.well-known/openid-configuration"')
expect(content).to match('OIDCClientID "openid_client_id"') expect(content).to match('OIDCClientID "openid_client_id"')
expect(content).to match('OIDCClientSecret "openid_client_secret"') expect(content).to match('OIDCClientSecret "openid_client_secret"')
expect(content).to match('OIDCRedirectURI "http://localhost:5000/v3/OS-FEDERATION/identity_providers/myidp/protocols/openid/auth"') expect(content).to match('OIDCRedirectURI "http://localhost:5000/v3/redirect_uri"')
end end
end end

7
templates/openidc.conf.erb
View File

@ -58,7 +58,7 @@
<%- if scope['::keystone::federation::openidc::openidc_redirect_uri'] != nil -%> <%- if scope['::keystone::federation::openidc::openidc_redirect_uri'] != nil -%>
OIDCRedirectURI "<%= scope['::keystone::federation::openidc::openidc_redirect_uri'] %>" OIDCRedirectURI "<%= scope['::keystone::federation::openidc::openidc_redirect_uri'] %>"
<% else %> <% else %>
OIDCRedirectURI "<%= @keystone_url -%>/v3/OS-FEDERATION/identity_providers/<%= scope['keystone::federation::openidc::idp_name']-%>/protocols/openid/auth" OIDCRedirectURI "<%= @keystone_url -%>/v3/redirect_uri"
<%- end -%> <%- end -%>
<%- if scope['::keystone::federation::openidc::openidc_enable_oauth'] -%> <%- if scope['::keystone::federation::openidc::openidc_enable_oauth'] -%>
@ -81,6 +81,11 @@
</Location> </Location>
<%- end -%> <%- end -%>
<Location "/v3/redirect_uri">
AuthType "openid-connect"
Require valid-user
</Location>
# The following directives are necessary to support websso from Horizon # The following directives are necessary to support websso from Horizon
# (Per https://docs.openstack.org/keystone/latest/admin/federation/configure_federation.html#id5) # (Per https://docs.openstack.org/keystone/latest/admin/federation/configure_federation.html#id5)
<Location "/v3/auth/OS-FEDERATION/websso/openid"> <Location "/v3/auth/OS-FEDERATION/websso/openid">