Skip to content

Commit f00c5db

Browse files
openshift-merge-bot[bot]openshift-merge-bot[bot]
authored
Merge pull request #1397 from afaranha/oidc_adoption
Documentation for Federated (OIDC) Keystone adoption
2 parents 833b9f1 + 2451a7d commit f00c5db

2 files changed

Lines changed: 129 additions & 0 deletions

File tree

‎docs_user/assemblies/assembly_adopting-openstack-control-plane-services.adoc‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,8 @@ Adopt your {rhos_prev_long} {rhos_prev_ver} control plane services to deploy the
1212

1313
include::../modules/proc_adopting-the-identity-service.adoc[leveloffset=+1]
1414

15+
include::../modules/proc_configuring-federation-for-keystone.adoc[leveloffset=+1]
16+
1517
include::../modules/proc_configuring-ldap-with-domain-specific-drivers.adoc[leveloffset=+1]
1618

1719
include::../modules/proc_adopting-key-manager-service.adoc[leveloffset=+1]

‎docs_user/modules/proc_configuring-federation-for-keystone.adoc‎

Lines changed: 127 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,127 @@
1+
:_mod-docs-content-type: PROCEDURE
2+
[id="configuring-federation-for-keystone_{context}"]
3+
4+
= Configuring OIDC federation for the Identity service
5+
6+
[role="_abstract"]
7+
To allow the {identity_service_first_ref} to trust an external OpenID Connect (OIDC) identity provider, apply the federation configuration and verify that federated users can authenticate.
8+
9+
.Prerequisites
10+
11+
* Keycloak is reachable from your {rhos_long} cluster.
12+
* You have access to the Keycloak `keycloak-ca.crt` file that corresponds to its certificate chain.
13+
14+
.Procedure
15+
16+
. Create the `keycloakca` secret so that the {identity_service} pods trust the Keycloak certificate authority (CA):
17+
+
18+
----
19+
$ oc create secret generic keycloakca \
20+
--from-file=KeyCloakCA=<keycloak-ca.crt> -n openstack
21+
----
22+
+
23+
where:
24+
25+
`<keycloak-ca.crt>`:: Specifies the path to the CA file that you want to use.
26+
27+
. Create the `keystone-httpd-override` secret that provides the Apache HTTPD overrides that are required for OIDC:
28+
+
29+
[source,yaml]
30+
----
31+
apiVersion: v1
32+
kind: Secret
33+
metadata:
34+
name: keystone-httpd-override
35+
namespace: openstack
36+
type: Opaque
37+
stringData:
38+
federation.conf: |
39+
OIDCClaimPrefix "OIDC-"
40+
OIDCResponseType "code"
41+
OIDCScope "openid profile email"
42+
OIDCClaimDelimiter ","
43+
OIDCPassUserInfoAs "payload"
44+
OIDCPassClaimsAs "both"
45+
OIDCProviderMetadataURL "https://keycloak-openstack.apps-crc.testing/auth/realms/openstack/.well-known/openid-configuration"
46+
OIDCClientID "rhoso"
47+
OIDCClientSecret "<client_secret>"
48+
OIDCCryptoPassphrase "<crypto_passphrase>"
49+
OIDCOAuthClientID "rhoso"
50+
OIDCOAuthClientSecret "<client_secret>"
51+
OIDCOAuthIntrospectionEndpoint "https://keycloak-openstack.apps-crc.testing/auth/realms/openstack/protocol/openid-connect/token/introspect"
52+
OIDCRedirectURI "https://keystone-public-openstack.apps-crc.testing/v3/auth/OS-FEDERATION/identity_providers/kcIDP/protocols/openid/websso/"
53+
LogLevel debug
54+
55+
<LocationMatch "/v3/auth/OS-FEDERATION/identity_providers/kcIDP/protocols/openid/websso">
56+
AuthType "openid-connect"
57+
Require valid-user
58+
</LocationMatch>
59+
60+
<Location "/v3/OS-FEDERATION/identity_providers/kcIDP/protocols/openid/auth">
61+
AuthType oauth20
62+
Require valid-user
63+
</Location>
64+
65+
<LocationMatch "/v3/auth/OS-FEDERATION/websso/openid">
66+
AuthType "openid-connect"
67+
Require valid-user
68+
</LocationMatch>
69+
----
70+
+
71+
where:
72+
73+
`<client_secret>`:: Specifies the client ID to use for the OIDC provider handshake. You must get the client ID from your SSO administrator.
74+
`<crypto_passphrase>`:: Specifies the client secret to use for the OIDC provider handshake. You must get the client secret from your SSO administrator after providing your redirect URLs.
75+
`<LocationMatch>` and `<Location>`:: Specifies the chosen string that creates your unique redirect URL.
76+
77+
. Patch the `OpenStackControlPlane` custom resource (CR) to enable OIDC federation for Keystone. Ensure that you merge the patch with any existing custom configuration for the {identity_service}:
78+
+
79+
[source,yaml]
80+
----
81+
spec:
82+
tls:
83+
caBundleSecretName: keycloakca
84+
keystone:
85+
template:
86+
customServiceConfig: |
87+
[token]
88+
expiration = 360000
89+
[federation]
90+
trusted_dashboard=https://horizon-openstack.apps-crc.testing/dashboard/auth/websso/
91+
sso_callback_template=/etc/keystone/sso_callback_template.html
92+
[openid]
93+
remote_id_attribute=HTTP_OIDC_ISS
94+
[auth]
95+
methods = password,token,oauth1,mapped,application_credential,openid
96+
[trusted_ip]
97+
trusted_forwarded_for_header=True
98+
httpdCustomization:
99+
customConfigSecret: keystone-httpd-override
100+
----
101+
+
102+
103+
.Verification
104+
105+
. Request a federated token before adoption:
106+
+
107+
----
108+
$ openstack token issue
109+
----
110+
+
111+
This command should return an access token that is issued for the federated user.
112+
113+
. Verify the token against the newly adopted {identity_service} instance:
114+
+
115+
----
116+
$ oc exec -t openstackclient -- env -u OS_CLOUD - \
117+
OS_AUTH_URL=https://keystone-public-openstack.apps-crc.testing/v3 \
118+
OS_AUTH_TYPE=v3oidcaccesstoken \
119+
OS_ACCESS_TOKEN=$(openstack token issue -f value -c id) \
120+
openstack project show <project_id>
121+
----
122+
+
123+
where:
124+
125+
`<project_id>`:: Replace with the ID of your OpenStack project.
126+
+
127+
A successful response confirms that the federated OIDC configuration is active on the podified Keystone deployment.

0 commit comments

Comments
 (0)