Introduce schema_version in the federated attribute mapping API

Keystone add support to attribute mapping schema versioning. Therefore,
it is interesting to also support this mechanism in Kolla-ansible.
The use of "schema_version" option in the attribute mapping is optional;
if none is provided, the default defined in Keystoen will be used.

Depends-On: https://review.opendev.org/#/c/749572/
Change-Id: I4e6d751330effc0bfeaaded9280a6e64c080e40f
Signed-off-by: Rafael Weingärtner <rafael@apache.org>
Co-Authored-by: Taavi Ansper <taaviansperr@gmail.com>

Author: rafaelweingartner

ansible/group_vars/all/keystone.yml

@@ -68,13 +68,21 @@ keystone_default_user_role: "member"
 # The configuration of attribute mappings is a list of objects, where each
 # object must have a 'name' (that mapps to the 'attribute_mapping' to the IdP
 # object in the IdPs set), and the 'file' with a full qualified path to a mapping file.
+#
+# The "schema_version" attribute is optional. Here we just demonstrate a few examples of
+# configuration; before using them, one must check the supported version by Keystone. If
+# one wants to use the default of Keystone, she/he can omit the "schema_version" option.
+#
 # keystone_identity_mappings:
 #   - name: "mappingId1"
 #     file: "/full/qualified/path/to/mapping/json/file/to/mappingId1"
+#     schema_version: "1.0"
 #   - name: "mappingId2"
 #     file: "/full/qualified/path/to/mapping/json/file/to/mappingId2"
+#     schema_version: "2.0"
 #   - name: "mappingId3"
 #     file: "/full/qualified/path/to/mapping/json/file/to/mappingId3"
+#     schema_version: "3.0"
 keystone_identity_providers: []
 keystone_identity_mappings: []
 keystone_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else keystone_public_listen_port }}"

ansible/roles/keystone/tasks/register_identity_providers.yml

@@ -61,6 +61,7 @@
       ca_cert: "{{ openstack_cacert if openstack_cacert != '' else omit }}"
       name: "{{ item.name }}"
       rules: "{{ '{{ keystone_identity_mapping_rules | from_json }}' }}"
+      schema_version: "{{ item.schema_version | default(omit) }}"
       state: present
     module_extra_vars:
       keystone_identity_mapping_rules: "{{ lookup('ansible.builtin.file', item.file) }}"

doc/source/reference/shared-services/keystone-guide.rst

@@ -87,6 +87,7 @@ below:
     keystone_identity_mappings:
       - name: "mappingId1"
         file: "/full/qualified/path/to/mapping/json/file/to/mappingId1"
+        schema_version: "2.0"
 
 In some cases it's necessary to add JWKS (JSON Web Key Set) uri.
 It is required for auth-openidc endpoint - which is

releasenotes/notes/add_keystone_attribute_mapping_schema_version-7dff68169a306695.yaml

@@ -0,0 +1,5 @@
+---
+features:
+  - |
+    Add support to ``schema_version`` in the federated attribute mapping API
+    of Keystone.