71554ca7cf
As per discussion in the OSA docs summit session, clean up of installation guide. This fixes typos, minor RST mark up changes, and passive voice. This patch also merges a some of the sections into the larger chapter. This is in an effort to remove multiple smaller files. This patch is the first of many to avoid major conflicts. Change-Id: I38daa515ba47fde7719cd0bd3e0e40c2cd0f39f1
94 lines
3.4 KiB
ReStructuredText
94 lines
3.4 KiB
ReStructuredText
`Home <index.html>`__ OpenStack-Ansible Installation Guide
|
|
|
|
Using Identity service to Identity service federation
|
|
=====================================================
|
|
|
|
In Identity service (keystone) to Identity service (keystone)
|
|
federation (K2K) the identity provider (IdP) and service provider (SP)
|
|
keystone instances exchange information securely to enable a user on
|
|
the IdP cloud to access resources of the SP cloud.
|
|
|
|
.. important::
|
|
|
|
This section applies only to federation between keystone IdP
|
|
and keystone SP. It does not apply to non-keystone IdP.
|
|
|
|
.. note::
|
|
|
|
For the Kilo release of OpenStack, K2K is only partially supported.
|
|
It is possible to perform a federated login using command line clients and
|
|
scripting. However, horizon does not support this functionality.
|
|
|
|
The K2K authentication flow involves the following steps:
|
|
|
|
#. You log in to the IdP with your credentials.
|
|
#. You sends a request to the IdP to generate an assertion for a given
|
|
SP. An assertion is a cryptographically signed XML document that identifies
|
|
the user to the SP.
|
|
#. You submit the assertion to the SP on the configured ``sp_url``
|
|
endpoint. The Shibboleth service running on the SP receives the assertion
|
|
and verifies it. If it is valid, a session with the client starts and
|
|
returns the session ID in a cookie.
|
|
#. You now connect to the SP on the configured ``auth_url`` endpoint,
|
|
providing the Shibboleth cookie with the session ID. The SP responds with
|
|
an unscoped token that you use to access the SP.
|
|
#. You connect to the keystone service on the SP with the unscoped
|
|
token, and the desired domain and project, and receive a scoped token
|
|
and the service catalog.
|
|
#. You, now in possession of a token, can make API requests to the
|
|
endpoints in the catalog.
|
|
|
|
Identity service to Identity service federation authentication wrapper
|
|
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
|
|
|
The following steps above involve manually sending API requests.
|
|
|
|
.. note::
|
|
|
|
The infrastructure for the command line utilities that performs these steps
|
|
for the user does not exist.
|
|
|
|
To obtain access to a SP cloud, OpenStack-Ansible provides a script that wraps the
|
|
above steps. The script is called ``federated-login.sh`` and is
|
|
used as follows:
|
|
|
|
.. code::
|
|
|
|
# ./scripts/federated-login.sh -p project [-d domain] sp_id
|
|
|
|
* ``project`` is the project in the SP cloud that you want to access.
|
|
* ``domain`` is the domain in which the project lives (the default domain is
|
|
used if this argument is not given).
|
|
* ``sp_id`` is the unique ID of the SP. This is given in the IdP configuration.
|
|
|
|
The script outputs the results of all the steps in the authentication flow to
|
|
the console. At the end, it prints the available endpoints from the catalog
|
|
and the scoped token provided by the SP.
|
|
|
|
Use the endpoints and token with the openstack command line client as follows:
|
|
|
|
.. code::
|
|
|
|
# openstack --os-token=<token> --os-url=<service-endpoint> [options]
|
|
|
|
Or, alternatively:
|
|
|
|
.. code::
|
|
|
|
# export OS_TOKEN=<token>
|
|
# export OS_URL=<service-endpoint>
|
|
# openstack [options]
|
|
|
|
Ensure you select the appropriate endpoint for your operation.
|
|
For example, if you want to work with servers, the ``OS_URL``
|
|
argument must be set to the compute endpoint.
|
|
|
|
.. note::
|
|
|
|
At this time, the OpenStack client is unable to find endpoints in
|
|
the service catalog when using a federated login.
|
|
|
|
--------------
|
|
|
|
.. include:: navigation.txt
|