1. 11 May, 2018 1 commit
    • Dmitrii Shcherbakov's avatar
      add support for Federated IDentity (FID) and WebSSO · 6f3751cc
      Dmitrii Shcherbakov authored
      * add support for relating with subordinate charms providing Service
      Provider functionality via apache2 authentication modules;
      * enable additional authentication methods on the keystone side to
      accept parsed assertion data provided via apache2 authentication module
      variables exported to WSGI environment;
      * move https frontend and WSGI API apache config files to keystone
      instead of relying on charm-helpers as modifications are needed there to
      add IncludeOptional directives. openstack_https_frontend.conf is added
      on purpose as ServerName cannot be correctly determined after ProxyPass
      which results in TLS errors during SAML exchange process;
      * add an additional relation to openstack-dashboard to provide URL
      information necessary to trust 'origin' parameter in WebSSO URLs used by
      horizon during the authentication process. Also add a context to render
      the federation section that is used to render this information in
      keystone.conf;
      
      Subordinates can choose to use different apache2 authentication modules.
      If those modules support vhost-level variables then multiple
      subordinates for the same module can be used. For example,
      mod_auth_mellon can be used multiple times in different vhosts to
      protect federated token endpoints related to different identity provider
      and protocol combinations).
      
      Trusted dashboard relation could be used to provide dashboard origin URL
      from a different site via cross-model relations.
      
      NOTE: this functionality will be triggered only on Ocata+ (inclusive)
      
      Change-Id: I1ef623b0b0e2a9f68cec4be550965c5e15e5f561
      6f3751cc
  2. 18 Mar, 2013 1 commit
  3. 28 Nov, 2012 1 commit
  4. 17 Sep, 2012 1 commit
  5. 08 Dec, 2011 1 commit