23da164fe4
This patch adds the ability to configure Keystone as a Service Provider (SP) for a Federated Identity Provider (IdP). * New variables to configure Keystone as a service provider are now supported under a root `keystone_sp` variable. Example configurations can be seen in Keystone's defaults file. This configuration includes the list of identity providers and trusted dashboards. (At this time only one identity provider is supported). * Identity provider configuration includes the remote-to-local user mapping and the list of remote attributes the SP can obtain from the IdP. * Shibboleth is installed and configured in the Keystone containers when SP configuration is present. * Horizon is configured for SSO login DocImpact UpgradeImpact Implements: blueprint keystone-federation Change-Id: I78b3d740434ea4b3ca0bd9f144e4a07026be23c6 Co-Authored-By: Jesse Pretorius <jesse.pretorius@rackspace.co.uk>
105 lines
4.5 KiB
Django/Jinja
105 lines
4.5 KiB
Django/Jinja
<SPConfig xmlns="urn:mace:shibboleth:2.0:native:sp:config"
|
|
xmlns:conf="urn:mace:shibboleth:2.0:native:sp:config"
|
|
xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
|
|
xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
|
|
xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
|
|
clockSkew="180">
|
|
|
|
<!-- The entityID is the name by which your IdP will know your SP. -->
|
|
<ApplicationDefaults entityID="{{ keystone_service_publicuri }}/shibboleth">
|
|
|
|
<!-- You should use secure cookies if at all possible. See cookieProps in this Wiki article. -->
|
|
<!-- https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPSessions -->
|
|
<Sessions lifetime="28800"
|
|
timeout="3600"
|
|
relayState="ss:mem"
|
|
checkAddress="false"
|
|
handlerSSL="{% if keystone_ssl_enabled | bool %}true{% else %}false{% endif %}"
|
|
{% if keystone_service_publicuri_proto == "https" %}cookieProps="; path=/; secure"{% endif %}>
|
|
|
|
<!-- Triggers a login request directly to the IdP. -->
|
|
<!-- https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPServiceSSO -->
|
|
<SSO ECP="true" entityID="{{ keystone_sp.trusted_idp_list.0.entity_ids.0 }}">
|
|
SAML2 SAML1
|
|
</SSO>
|
|
|
|
<!-- SAML and local-only logout. -->
|
|
<!-- https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPServiceLogout -->
|
|
<Logout>SAML2 Local</Logout>
|
|
|
|
<!--
|
|
Handlers allow you to interact with the SP and gather more information.
|
|
Attribute values received by the SP through SAML will be visible at:
|
|
{{ keystone_service_publicuri }}/Shibboleth.sso/Session
|
|
-->
|
|
|
|
<!-- Extension service that generates "approximate" metadata based on SP configuration. -->
|
|
<Handler type="MetadataGenerator"
|
|
Location="/Metadata"
|
|
signing="false"/>
|
|
|
|
<!-- Status reporting service. -->
|
|
<Handler type="Status" Location="/Status" acl="127.0.0.1 ::1"/>
|
|
|
|
<!-- Session diagnostic service. -->
|
|
<Handler type="Session" Location="/Session" showAttributeValues="true"/>
|
|
|
|
<!-- JSON feed of discovery information. -->
|
|
<Handler type="DiscoveryFeed" Location="/DiscoFeed"/>
|
|
</Sessions>
|
|
|
|
<!--
|
|
Allows overriding of error template information/filenames. You can
|
|
also add attributes with values that can be plugged into the templates.
|
|
-->
|
|
<Errors supportContact="root@localhost"
|
|
helpLocation="/about.html"
|
|
styleSheet="/shibboleth-sp/main.css"/>
|
|
|
|
<!--
|
|
Loads and trusts a list of metadata files which describes
|
|
the trusted IdP's and how to communicate with them.
|
|
-->
|
|
{% if keystone_sp.trusted_idp_list is defined -%}
|
|
{% for item in keystone_sp.trusted_idp_list %}
|
|
<MetadataProvider type="XML"
|
|
uri="{{ item.metadata_uri }}"
|
|
backingFilePath="{{ item.metadata_file }}"
|
|
reloadInterval="{{ item.metadata_reload }}" />
|
|
{% endfor %}
|
|
{% endif %}
|
|
|
|
<!-- Map to extract attributes from SAML assertions. -->
|
|
<AttributeExtractor type="XML"
|
|
validate="true"
|
|
reloadChanges="false"
|
|
path="attribute-map.xml"/>
|
|
|
|
<!-- Use a SAML query if no attributes are supplied during SSO. -->
|
|
<AttributeResolver type="Query" subjectMatch="true"/>
|
|
|
|
<!-- Default filtering policy for recognized attributes, lets other data pass. -->
|
|
<AttributeFilter type="XML"
|
|
validate="true"
|
|
path="attribute-policy.xml"/>
|
|
|
|
<!-- Your SP generated these credentials. They're used to talk to IdP's. -->
|
|
<CredentialResolver type="File"
|
|
key="sp-key.pem"
|
|
certificate="sp-cert.pem"/>
|
|
|
|
</ApplicationDefaults>
|
|
|
|
<!-- Policies that determine how to process and authenticate runtime messages. -->
|
|
<SecurityPolicyProvider type="XML"
|
|
validate="true"
|
|
path="security-policy.xml"/>
|
|
|
|
<!-- Low-level configuration about protocols and bindings available for use. -->
|
|
<ProtocolProvider type="XML"
|
|
validate="true"
|
|
reloadChanges="false"
|
|
path="protocols.xml"/>
|
|
|
|
</SPConfig>
|