d5a1b27a8f
This patch addresses the following issues in OpenID Connect federated authentication and enables WebSSO as well as non-WebSSO authentication flows. - WSGIScriptAliasMatch has been removed because default puppet-keystone defines a ScriptAlias for the root, effectively creating a redundant configuration. - Added a new parameter `openidc_response_type` to the `openidc` class which allows you to select the provider response type. This is useful for when providers don't support default `id_token`. - Removed `openidc_redirect_uri` from the `openidc_httpd_configuration` class in order to be able to build the entire URL in the template for both WebSSO and non-WebSSO OpenID connect flows With this patch, users have the ability to get a fully configured WebSSO setup out of the box. Change-Id: I00f57dc92e794aef826a023dcf92f0ce62ffed67
21 lines
1.2 KiB
Plaintext
21 lines
1.2 KiB
Plaintext
LoadModule auth_openidc_module modules/mod_auth_openidc.so
|
|
OIDCClaimPrefix "OIDC-"
|
|
OIDCResponseType "<%= scope['keystone::federation::openidc::openidc_response_type']-%>"
|
|
OIDCScope "openid email profile"
|
|
OIDCProviderMetadataURL "<%= scope['keystone::federation::openidc::openidc_provider_metadata_url']-%>"
|
|
OIDCClientID "<%= scope['keystone::federation::openidc::openidc_client_id']-%>"
|
|
OIDCClientSecret "<%= scope['keystone::federation::openidc::openidc_client_secret']-%>"
|
|
OIDCCryptoPassphrase "<%= scope['keystone::federation::openidc::openidc_crypto_passphrase']-%>"
|
|
|
|
OIDCRedirectURI "<%= @keystone_endpoint-%>/v3/OS-FEDERATION/identity_providers/<%= scope['keystone::federation::openidc::idp_name']-%>/protocols/openidc/auth/redirect"
|
|
<LocationMatch /v3/OS-FEDERATION/identity_providers/.*?/protocols/openidc/auth>
|
|
AuthType "openid-connect"
|
|
Require valid-user
|
|
</LocationMatch>
|
|
|
|
OIDCRedirectURI "<%= @keystone_endpoint-%>/v3/auth/OS-FEDERATION/identity_providers/<%= scope['keystone::federation::openidc::idp_name']-%>/protocols/openidc/websso/redirect"
|
|
<LocationMatch /v3/auth/OS-FEDERATION/identity_providers/.*?/protocols/openidc/websso>
|
|
AuthType "openid-connect"
|
|
Require valid-user
|
|
</LocationMatch>
|