openstack/kolla-ansible
Code Issues Proposed changes

make OIDCClaimDelimiter configurable

Browse Source 
Add a new variable keystone_federation_oidc_claim_delimiter
to make this configurable for keycloak OIDC federation.

Closes-Bug: #2080394

Signed-off-by: Sven Kieske <kieske@osism.tech>
Change-Id: If14285f033ed4914fd3b28d7efcc95e1c9f273a5
This commit is contained in:
Sven Kieske 2024-09-11 18:06:14 +02:00
parent 753a7e1a12
commit 4eddb2cb0e
No known key found for this signature in database
3 changed files with 11 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
ansible/roles/keystone/defaults/main.yml
View File

@ -234,6 +234,7 @@ keystone_enable_federation_openid: "{{ enable_keystone_federation | bool and key
keystone_should_remove_attribute_mappings: False
keystone_should_remove_identity_providers: False
keystone_federation_oidc_response_type: "id_token"
keystone_federation_oidc_claim_delimiter: ";"
keystone_federation_oidc_scopes: "openid email profile"
# OIDC caching

2
ansible/roles/keystone/templates/wsgi-keystone.conf.j2
View File

@ -59,7 +59,7 @@ LogLevel info
{% if keystone_enable_federation_openid | bool %}
OIDCClaimPrefix "OIDC-"
OIDCClaimDelimiter ";"
OIDCClaimDelimiter "{{ keystone_federation_oidc_claim_delimiter }}"
OIDCResponseType "{{ keystone_federation_oidc_response_type }}"
OIDCScope "{{ keystone_federation_oidc_scopes }}"
OIDCMetadataDir {{ keystone_container_federation_oidc_metadata_folder }}

9
releasenotes/notes/fix-hardcoded-oidc-claim-delimiter-06ca81b1fce0eba7.yaml Normal file
View File

@ -0,0 +1,9 @@
---
fixes:
- |
Fixes an issue with setting up OIDC based Keystone federation against IDP
where there are multiple OIDC groups that are separated by a custom
delimiter.
Add a variable ``keystone_federation_oidc_claim_delimiter`` to set the
custom value.
`LP#2080394 <https://bugs.launchpad.net/bugs/2080394>`__