openstack/puppet-keystone
Code Issues Proposed changes

Fix default OIDCRedirectURI hiding keystone federation auth endpoint

Browse Source 
This updates the default OIDCRedirectURI according to the change made
in the example file in keystone repo[1].

[1] https://review.opendev.org/925553

Closes-Bug: #2075349
Change-Id: Ia0f3cbb842a4c01e6a3ca44ca66dc9a8a731720c
This commit is contained in:
Takashi Kajinami 2024-09-10 13:39:46 +09:00
parent c3c7c39e1c
commit fdf2a2b31a
2 changed files with 7 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
spec/classes/keystone_federation_openidc_spec.rb
View File

@ -90,7 +90,7 @@ describe 'keystone::federation::openidc' do
content = get_param('concat::fragment', 'keystone_wsgi-configure_openidc_keystone', 'content')
expect(content).to match('OIDCClientID "openid_client_id"')
expect(content).to match('OIDCClientSecret "openid_client_secret"')
expect(content).to match('OIDCRedirectURI "http://localhost:5000/v3/OS-FEDERATION/identity_providers/myidp/protocols/openid/auth"')
expect(content).to match('OIDCRedirectURI "http://localhost:5000/v3/redirect_uri"')
expect(content).to match('OIDCProviderMetadataURL "https://accounts.google.com/.well-known/openid-configuration"')
end
end

7
templates/openidc.conf.erb
View File

@ -62,7 +62,7 @@
<%- if scope['::keystone::federation::openidc::openidc_redirect_uri'] != nil -%>
OIDCRedirectURI "<%= scope['::keystone::federation::openidc::openidc_redirect_uri'] %>"
<% else %>
OIDCRedirectURI "<%= @keystone_url -%>/v3/OS-FEDERATION/identity_providers/<%= scope['keystone::federation::openidc::idp_name']-%>/protocols/openid/auth"
OIDCRedirectURI "<%= @keystone_url -%>/v3/redirect_uri"
<%- end -%>
<%- if scope['::keystone::federation::openidc::openidc_enable_oauth'] -%>
@ -85,6 +85,11 @@
</Location>
<%- end -%>
<Location "/v3/redirect_uri">
AuthType "openid-connect"
Require valid-user
</Location>
# The following directives are necessary to support websso from Horizon
# (Per https://docs.openstack.org/keystone/latest/admin/federation/configure_federation.html#id5)
<Location "/v3/auth/OS-FEDERATION/websso/openid">