• Dmitrii Shcherbakov's avatar
    add support for Federated IDentity (FID) and WebSSO · 6f3751cc
    Dmitrii Shcherbakov authored
    * add support for relating with subordinate charms providing Service
    Provider functionality via apache2 authentication modules;
    * enable additional authentication methods on the keystone side to
    accept parsed assertion data provided via apache2 authentication module
    variables exported to WSGI environment;
    * move https frontend and WSGI API apache config files to keystone
    instead of relying on charm-helpers as modifications are needed there to
    add IncludeOptional directives. openstack_https_frontend.conf is added
    on purpose as ServerName cannot be correctly determined after ProxyPass
    which results in TLS errors during SAML exchange process;
    * add an additional relation to openstack-dashboard to provide URL
    information necessary to trust 'origin' parameter in WebSSO URLs used by
    horizon during the authentication process. Also add a context to render
    the federation section that is used to render this information in
    keystone.conf;
    
    Subordinates can choose to use different apache2 authentication modules.
    If those modules support vhost-level variables then multiple
    subordinates for the same module can be used. For example,
    mod_auth_mellon can be used multiple times in different vhosts to
    protect federated token endpoints related to different identity provider
    and protocol combinations).
    
    Trusted dashboard relation could be used to provide dashboard origin URL
    from a different site via cross-model relations.
    
    NOTE: this functionality will be triggered only on Ocata+ (inclusive)
    
    Change-Id: I1ef623b0b0e2a9f68cec4be550965c5e15e5f561
    6f3751cc