279 lines
10 KiB
Puppet
279 lines
10 KiB
Puppet
# == Class: keystone::federation::openidc
|
|
#
|
|
# == Parameters
|
|
#
|
|
# [*keystone_url*]
|
|
# (Required) URL to keystone endpoint.
|
|
#
|
|
# [*methods*]
|
|
# A list of methods used for authentication separated by comma or an array.
|
|
# The allowed values are: 'external', 'password', 'token', 'oauth1', 'saml2',
|
|
# and 'openid'
|
|
# (Required) (string or array value).
|
|
# Note: The external value should be dropped to avoid problems.
|
|
#
|
|
# [*idp_name*]
|
|
# The name name associated with the IdP in Keystone.
|
|
# (Required) String value.
|
|
#
|
|
# [*openidc_provider_metadata_url*]
|
|
# (Optional) The url that points to your OpenID Connect metadata provider.
|
|
# Defaults to undef
|
|
#
|
|
# [*openidc_metadata_dir*]
|
|
# (Optional) Path of OIDCMetadataDir, directory that holds metadata in case of
|
|
# usage of multiple OIDC provider.
|
|
# Defaults to undef
|
|
#
|
|
# [*openidc_client_id*]
|
|
# The client ID to use when handshaking with your OpenID Connect provider
|
|
# (Required) String value.
|
|
#
|
|
# [*openidc_client_secret*]
|
|
# The client secret to use when handshaking with your OpenID Connect provider
|
|
# (Required) String value.
|
|
#
|
|
# [*openidc_crypto_passphrase*]
|
|
# Secret passphrase to use when encrypting data for OpenID Connect handshake
|
|
# (Optional) String value.
|
|
# Defaults to 'openstack'
|
|
#
|
|
# [*openidc_response_type*]
|
|
# Response type to be expected from the OpenID Connect provider.
|
|
# (Optional) String value.
|
|
# Defaults to 'id_token'
|
|
#
|
|
# [*openidc_response_mode*]
|
|
# (Optional) mod_auth_openidc response mode. Can be any response type
|
|
# supported by mod_auth_openidc (fragment, query, form_post).
|
|
# Defaults to undef
|
|
#
|
|
# [*openidc_cache_type*]
|
|
# (Optional) mod_auth_openidc cache type. Can be any cache type
|
|
# supported by mod_auth_openidc (shm, file, memcache, redis).
|
|
# Defaults to undef.
|
|
#
|
|
# [*openidc_scope*]
|
|
# (Optional) Array of mod_auth_openidc requested scope(s).
|
|
# Defaults to ['openid', 'email', 'profile'].
|
|
#
|
|
# [*openidc_cache_shm_max*]
|
|
# (Optional) The maximum number of name/value pair entries that can
|
|
# be cached when using the 'shm' cache type. Defaults to undef.
|
|
#
|
|
# [*openidc_cache_shm_entry_size*]
|
|
# (Optional) The maximum size for a single shm cache entry in bytes
|
|
# with a minimum of 8464 bytes. Defaults to undef.
|
|
#
|
|
# [*openidc_cache_dir*]
|
|
# (Optional) Directory that holds cache files; must be writable
|
|
# for the Apache process/user. Defaults to undef.
|
|
#
|
|
# [*openidc_cache_clean_interval*]
|
|
# (Optional) Cache file clean interval in seconds (only triggered
|
|
# on writes). Defaults to undef.
|
|
#
|
|
# [*openidc_claim_delimiter*]
|
|
# (Optional) The delimiter to use when setting multi-valued claims.
|
|
# Defaults to undef.
|
|
#
|
|
# [*openidc_enable_oauth*]
|
|
# (Optional) Set to true to enable oauthsupport.
|
|
# Defaults to false.
|
|
#
|
|
# [*openidc_introspection_endpoint*]
|
|
# (Required if oauth is enabled and configured for introspection)
|
|
# OAuth introspection endpoint url.
|
|
# Defaults to undef.
|
|
#
|
|
# [*openidc_verify_jwks_uri*]
|
|
# (Required if oauth is enabled and configured for JWKS based validation)
|
|
# The JWKS URL on which the Identity Provider
|
|
# publishes the keys used to sign its JWT access tokens.
|
|
# Defaults to undef.
|
|
#
|
|
# [*openidc_verify_method*]
|
|
# (Optional) The method used to verify OAuth tokens.
|
|
# Must be one of introspection or jwks
|
|
# Defaults to introspection
|
|
#
|
|
# [*openidc_pass_userinfo_as*]
|
|
# Define the way(s) in which the claims resolved from the userinfo endpoint
|
|
# are passed to the application according to OIDCPassClaimsAs.
|
|
# Defaults to undef
|
|
#
|
|
# [*openidc_pass_claim_as*]
|
|
# Define the way in which the claims and tokens are passed to the application environment:
|
|
# "none": no claims/tokens are passed
|
|
# "environment": claims/tokens are passed as environment variables
|
|
# "headers": claims/tokens are passed in headers (also useful in reverse proxy scenario's)
|
|
# "both": claims/tokens are passed as both headers as well as environment variables (default)
|
|
# Defaults to undef
|
|
#
|
|
# [*openidc_redirect_uri*]
|
|
# (Optional) An arbitrary URI for OIDCRedirectURI. Defaults to undef, in this
|
|
# case the URI is generated from keystone_url and idp_name.
|
|
#
|
|
# [*additional_locations*]
|
|
# (Optional) Array of hashes of additional Apache <Location> directives with
|
|
# mod_auth_openidc configuration. Accepted parameters are url, authtype,
|
|
# oidcdiscoverurl (optional), requireoidc, loglevel (optional)
|
|
# Example:
|
|
# additional_locations => [{
|
|
# url => "/v3/auth/OS-FEDERATION/a-custom-url-needed-somehow",
|
|
# authtype => "openid-connect",
|
|
# oidcdiscoverurl => "https://my-endpoint.example.com:40000",
|
|
# requireoidc => "claim iss:https://iam.example.com",
|
|
# loglevel => "debug"
|
|
# }]
|
|
#
|
|
# [*memcached_servers*]
|
|
# (Optional) A list of memcache servers. Defaults to undef.
|
|
#
|
|
# [*redis_server*]
|
|
# (Optional) Specifies the Redis server used for caching as
|
|
# <hostname>[:<port>]. Defaults to undef.
|
|
#
|
|
# [*redis_password*]
|
|
# (Optional) Password to be used if the Redis server requires
|
|
# authentication. When not specified, no authentication is
|
|
# performed. Defaults to undef.
|
|
#
|
|
# [*redis_username*]
|
|
# (Optional) Username to be used if the Redis server requires
|
|
# authentication.
|
|
# Defaults to undef
|
|
#
|
|
# [*redis_database*]
|
|
# (Optional) Logical database to select on the Redis server.
|
|
# Defaults to undef
|
|
#
|
|
# [*redis_connect_timeout*]
|
|
# (Optional) Timeout (in seconds) for connecting to the Redis servers.
|
|
# Defaults to undef
|
|
#
|
|
# [*redis_timeout*]
|
|
# (Optional) Timeout waiting for a response of the Redis servers after
|
|
# a request was sent.
|
|
# Defaults to undef
|
|
#
|
|
# [*remote_id_attribute*]
|
|
# (Optional) Value to be used to obtain the entity ID of the Identity
|
|
# Provider from the environment.
|
|
# Defaults to $facts['os_service_default'].
|
|
#
|
|
# [*template_order*]
|
|
# This number indicates the order for the concat::fragment that will apply
|
|
# the shibboleth configuration to Keystone VirtualHost. The value should
|
|
# The value should be greater than 330 an less then 999, according to:
|
|
# https://github.com/puppetlabs/puppetlabs-apache/blob/master/manifests/vhost.pp
|
|
# The value 330 corresponds to the order for concat::fragment "${name}-filters"
|
|
# and "${name}-limits".
|
|
# The value 999 corresponds to the order for concat::fragment "${name}-file_footer".
|
|
# (Optional) Defaults to 331.
|
|
#
|
|
class keystone::federation::openidc (
|
|
$keystone_url,
|
|
$methods,
|
|
$idp_name,
|
|
$openidc_client_id,
|
|
$openidc_client_secret,
|
|
Optional[Stdlib::HTTPUrl] $openidc_provider_metadata_url = undef,
|
|
Optional[Stdlib::Unixpath] $openidc_metadata_dir = undef,
|
|
$openidc_crypto_passphrase = 'openstack',
|
|
$openidc_response_type = 'id_token',
|
|
Array[String[1], 1] $openidc_scope = ['openid', 'email', 'profile'],
|
|
$openidc_response_mode = undef,
|
|
$openidc_cache_type = undef,
|
|
$openidc_cache_shm_max = undef,
|
|
$openidc_cache_shm_entry_size = undef,
|
|
$openidc_cache_dir = undef,
|
|
$openidc_cache_clean_interval = undef,
|
|
$openidc_claim_delimiter = undef,
|
|
Boolean $openidc_enable_oauth = false,
|
|
$openidc_introspection_endpoint = undef,
|
|
$openidc_verify_jwks_uri = undef,
|
|
Enum['introspection', 'jwks'] $openidc_verify_method = 'introspection',
|
|
Optional[Enum['claims', 'json', 'jwt']] $openidc_pass_userinfo_as = undef,
|
|
Optional[Enum['none', 'environment', 'headers', 'both']] $openidc_pass_claim_as = undef,
|
|
$openidc_redirect_uri = undef,
|
|
Optional[Array[Hash]] $additional_locations = undef,
|
|
$memcached_servers = undef,
|
|
$redis_server = undef,
|
|
$redis_password = undef,
|
|
$redis_username = undef,
|
|
$redis_database = undef,
|
|
$redis_connect_timeout = undef,
|
|
$redis_timeout = undef,
|
|
$remote_id_attribute = $facts['os_service_default'],
|
|
$template_order = 331,
|
|
) {
|
|
include apache
|
|
include apache::mod::auth_openidc
|
|
|
|
include keystone::deps
|
|
include keystone::params
|
|
|
|
if ! defined(Class['keystone::wsgi::apache']) {
|
|
fail('The keystone::wsgi::apache class should be included in the catalog')
|
|
}
|
|
# With a single provider, OIDCProviderMetadataURL should be set, with multiple
|
|
# providers OIDCMetadataDir should be used instead
|
|
if !$openidc_provider_metadata_url and !$openidc_metadata_dir {
|
|
fail('Set one openidc_provider_metadata_url or openidc_metadata_dir')
|
|
}
|
|
if $openidc_provider_metadata_url and $openidc_metadata_dir {
|
|
fail("openidc_provider_metadata_url and openidc_metadata_dir are mutually \
|
|
exclusive, set only one of the two.")
|
|
}
|
|
|
|
if $openidc_enable_oauth {
|
|
if ($openidc_verify_method == 'introspection') {
|
|
if !$openidc_introspection_endpoint {
|
|
fail("You must set openidc_introspection_endpoint when enabling oauth support \
|
|
and introspection.")
|
|
}
|
|
} else { # $openidc_verify_method == 'jwks'
|
|
if !$openidc_verify_jwks_uri {
|
|
fail("You must set openidc_verify_jwks_uri when enabling oauth support \
|
|
and local signature verification using a JWKS URL")
|
|
}
|
|
}
|
|
}
|
|
|
|
if $memcached_servers != undef {
|
|
$memcached_servers_real = join(any2array($memcached_servers), ' ')
|
|
} else {
|
|
$memcached_servers_real = undef
|
|
}
|
|
|
|
# Note: if puppet-apache modify these values, this needs to be updated
|
|
if $template_order <= 330 or $template_order >= 999 {
|
|
fail('The template order should be greater than 330 and less than 999.')
|
|
}
|
|
|
|
if ('external' in $methods ) {
|
|
fail('The external method should be dropped to avoid any interference with openid.')
|
|
}
|
|
|
|
if !('openid' in $methods ) {
|
|
fail('Methods should contain openid as one of the auth methods.')
|
|
}
|
|
|
|
keystone_config {
|
|
'auth/methods': value => join(any2array($methods),',');
|
|
'openid/remote_id_attribute': value => $remote_id_attribute;
|
|
}
|
|
|
|
apache::vhost::fragment { 'configure_openidc_keystone':
|
|
vhost => 'keystone_wsgi',
|
|
priority => $keystone::wsgi::apache::priority,
|
|
content => template('keystone/openidc.conf.erb'),
|
|
order => $template_order,
|
|
}
|
|
|
|
Concat<| title == "${keystone::wsgi::apache::priority}-keystone_wsgi.conf" |> {
|
|
show_diff => false,
|
|
}
|
|
}
|