Skip to content

Commit eda4b8f

Browse files
jageejagee
committed
Add support for multiple IdP providers in Federation
This patch will setup two realms in keycloak. Keystone will be configured to work with these two realms as different IdPs. Each realm will get its own mapping in openstack. It will also enable these two IdP choices to the horizon UI. Jira: https://issues.redhat.com/browse/OSPRH-14033
1 parent e27fac3 commit eda4b8f

File tree

1 file changed

+201
-0
lines changed

1 file changed

+201
-0
lines changed

‎hooks/playbooks/federation-multirealm-controlplane-config.yml

Lines changed: 201 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,201 @@
1+
---
2+
- name: Create kustomization to update Keystone to use MultiRealm Federation
3+
hosts: "{{ cifmw_target_hook_host | default('localhost') }}"
4+
tasks:
5+
- name: Set urls for install type uni
6+
ansible.builtin.set_fact:
7+
cifmw_federation_keycloak_url: 'https://keycloak-openstack.apps.ocp.openstack.lab'
8+
cifmw_federation_keystone_url: 'https://keystone-public-openstack.apps.ocp.openstack.lab'
9+
cifmw_federation_horizon_url: 'https://horizon-openstack.apps.ocp.openstack.lab'
10+
when: cifmw_federation_deploy_type == "uni"
11+
12+
- name: Set urls for install type crc
13+
ansible.builtin.set_fact:
14+
cifmw_federation_keycloak_url: 'https://keycloak-openstack.apps-crc.testing'
15+
cifmw_federation_keystone_url: 'https://keystone-public-openstack.apps-crc.testing'
16+
cifmw_federation_horizon_url: 'https://horizon-openstack.apps-crc.testing'
17+
when: cifmw_federation_deploy_type == "crc"
18+
19+
- name: Create file to customize keystone for IPA deployed in the control plane
20+
ansible.builtin.copy:
21+
dest: "{{ cifmw_basedir }}/artifacts/manifests/kustomizations/controlplane/keystone_multirealm_federation.yaml"
22+
content: |-
23+
apiVersion: kustomize.config.k8s.io/v1beta1
24+
kind: Kustomization
25+
resources:
26+
- namespace: {{ namespace }}
27+
patches:
28+
- target:
29+
kind: OpenStackControlPlane
30+
name: .*
31+
patch: |-
32+
- op: add
33+
path: /spec/keystone/template/extraMounts
34+
value:
35+
- name: v1
36+
region: r1
37+
extraVol:
38+
- propagation:
39+
- Keystone
40+
extraVolType: Conf
41+
volumes:
42+
- name: keystone-OIDCMetadataDir
43+
secret: keystone-OIDCMetadataDir
44+
mounts:
45+
- name: keystone-OIDCMetadataDir
46+
mountPath: "/etc/keystone/OIDCMetadataDir"
47+
readOnly: true
48+
- op: add
49+
path: /spec/keystone/template/customServiceConfig
50+
value: |
51+
[DEFAULT]
52+
insecure_debug=true
53+
debug=true
54+
[federation]
55+
trusted_dashboard={{ cifmw_federation_horizon_url }}/dashboard/auth/websso/
56+
sso_callback_template=/etc/keystone/sso_callback_template.html
57+
[openid]
58+
remote_id_attribute=HTTP_OIDC_ISS
59+
[auth]
60+
methods = password,token,oauth1,mapped,application_credential,openid
61+
mode: "0644"
62+
63+
- name: Get ingress operator CA cert
64+
ansible.builtin.slurp:
65+
src: "{{ [ ansible_user_dir, 'ci-framework-data', 'tmp', 'ingress-operator-ca.crt'] | path_join }}"
66+
register: federation_sso_ca
67+
68+
- name: Add Keycloak CA secret
69+
kubernetes.core.k8s:
70+
kubeconfig: "{{ cifmw_openshift_kubeconfig }}"
71+
state: present
72+
definition:
73+
apiVersion: v1
74+
kind: Secret
75+
type: Opaque
76+
metadata:
77+
name: keycloakca
78+
namespace: "openstack"
79+
data:
80+
KeyCloakCA: "{{ federation_sso_ca.content }}"
81+
82+
- name: Create Keystone httpd override secret for Federation
83+
kubernetes.core.k8s:
84+
kubeconfig: "{{ cifmw_openshift_kubeconfig }}"
85+
state: present
86+
definition:
87+
apiVersion: v1
88+
kind: Secret
89+
metadata:
90+
name: keystone-httpd-override
91+
namespace: openstack
92+
type: Opaque
93+
stringData:
94+
federation.conf: |
95+
OIDCClaimPrefix "{{ cifmw_keystone_OIDC_ClaimPrefix }}"
96+
OIDCResponseType "{{ cifmw_keystone_OIDC_ResponseType }}"
97+
OIDCScope "{{ cifmw_keystone_OIDC_Scope }}"
98+
OIDCClaimDelimiter "{{ cifmw_keystone_OIDC_ClaimDelimiter }}"
99+
OIDCPassUserInfoAs "{{ cifmw_keystone_OIDC_PassUserInfoAs }}"
100+
OIDCPassClaimsAs "{{ cifmw_keystone_OIDC_PassClaimsAs }}"
101+
OIDCCryptoPassphrase "{{ cifmw_keystone_OIDC_CryptoPassphrase }}"
102+
OIDCOAuthIntrospectionEndpoint "{{ cifmw_keystone_OIDC_OAuthIntrospectionEndpoint }}"
103+
OIDCMetadataDir "/etc/keystone/OIDCMetadataDir"
104+
OIDCRedirectURI "{{ cifmw_federation_keystone_url }}/v3/redirect_uri"
105+
LogLevel debug
106+
107+
<LocationMatch "/v3/auth/OS-FEDERATION/identity_providers/{{ cifmw_keystone_OIDC_provider_name }}/protocols/openid/websso">
108+
AuthType "openid-connect"
109+
Require valid-user
110+
</LocationMatch>
111+
112+
<Location ~ "/v3/OS-FEDERATION/identity_providers/{{ cifmw_keystone_OIDC_provider_name }}/protocols/openid/auth">
113+
AuthType oauth20
114+
Require valid-user
115+
</Location>
116+
117+
<LocationMatch "/v3/auth/OS-FEDERATION/identity_providers/{{ cifmw_keystone_OIDC_provider_name2 }}/protocols/openid/websso">
118+
AuthType "openid-connect"
119+
Require valid-user
120+
</LocationMatch>
121+
122+
<Location ~ "/v3/OS-FEDERATION/identity_providers/{{ cifmw_keystone_OIDC_provider_name2 }}/protocols/openid/auth">
123+
AuthType oauth20
124+
Require valid-user
125+
</Location>
126+
127+
<Location ~ "/redirect_uri">
128+
Require valid-user
129+
AuthType openid-connect
130+
</Location>
131+
132+
<LocationMatch "/v3/auth/OS-FEDERATION/websso/openid">
133+
AuthType "openid-connect"
134+
Require valid-user
135+
</LocationMatch>
136+
137+
- name: Set Keystone metadata config key names
138+
ansible.builtin.set_fact:
139+
keystone_idp1_conf_key: "keycloak-openstack.apps-crc.testing%2Fauth%2Frealms%2F{{ cifmw_keystone_OIDC_provider_name }}.conf"
140+
keystone_idp1_client_key: "keycloak-openstack.apps-crc.testing%2Fauth%2Frealms%2F{{ cifmw_keystone_OIDC_provider_name }}.client"
141+
keystone_idp1_provider_key: "keycloak-openstack.apps-crc.testing%2Fauth%2Frealms%2F{{ cifmw_keystone_OIDC_provider_name }}.provider"
142+
keystone_idp2_conf_key: "keycloak-openstack.apps-crc.testing%2Fauth%2Frealms%2F{{ cifmw_keystone_OIDC_provider_name2 }}.conf"
143+
keystone_idp2_client_key: "keycloak-openstack.apps-crc.testing%2Fauth%2Frealms%2F{{ cifmw_keystone_OIDC_provider_name2 }}.client"
144+
keystone_idp2_provider_key: "keycloak-openstack.apps-crc.testing%2Fauth%2Frealms%2F{{ cifmw_keystone_OIDC_provider_name2 }}.provider"
145+
146+
- name: Download realm1 OpenID configuration
147+
ansible.builtin.uri:
148+
url: "{{ cifmw_federation_keycloak_url }}/auth/realms/{{ cifmw_keystone_OIDC_provider_name }}/.well-known/openid-configuration"
149+
method: GET
150+
return_content: true
151+
validate_certs: false
152+
register: openid_wellknow_config1
153+
154+
- name: Download realm2 OpenID configuration
155+
ansible.builtin.uri:
156+
url: "{{ cifmw_federation_keycloak_url }}/auth/realms/{{ cifmw_keystone_OIDC_provider_name2 }}/.well-known/openid-configuration"
157+
method: GET
158+
return_content: true
159+
validate_certs: false
160+
register: openid_wellknow_config2
161+
162+
- name: Create Keystone domain config secret for LDAP
163+
kubernetes.core.k8s:
164+
kubeconfig: "{{ cifmw_openshift_kubeconfig }}"
165+
state: present
166+
definition:
167+
apiVersion: v1
168+
kind: Secret
169+
metadata:
170+
name: keystone-OIDCMetadataDir
171+
namespace: openstack
172+
type: Opaque
173+
stringData: "{{ {keystone_idp1_conf_key: keystone_idp1_conf_content,
174+
keystone_idp1_client_key: keystone_idp1_client_content,
175+
keystone_idp1_provider_key: keystone_idp1_provider_content,
176+
keystone_idp2_conf_key: keystone_idp2_conf_content,
177+
keystone_idp2_client_key: keystone_idp2_client_content,
178+
keystone_idp2_provider_key: keystone_idp2_provider_content} }}"
179+
vars:
180+
keystone_idp1_conf_content: |
181+
{
182+
"scope" : "openid email profile"
183+
}
184+
keystone_idp1_client_content: |
185+
{
186+
"client_id":"{{ cifmw_keystone_OIDC_OAuthClientID }}",
187+
"client_secret":"{{ cifmw_keystone_OIDC_OAuthClientSecret }}"
188+
}
189+
keystone_idp1_provider_content: |
190+
{{ openid_wellknow_config1.content }}
191+
keystone_idp1_conf_content: |
192+
{
193+
"scope" : "openid email profile"
194+
}
195+
keystone_idp1_client_content: |
196+
{
197+
"client_id":"{{ cifmw_keystone_OIDC_OAuthClientID }}",
198+
"client_secret":"{{ cifmw_keystone_OIDC_OAuthClientSecret }}"
199+
}
200+
keystone_idp1_provider_content: |
201+
{{ openid_wellknow_config2.content }}

0 commit comments

Comments
 (0)