openstack/kolla-ansible.git/doc/source/reference/shared-services/keystone-guide.rst, branch stable/2026.1

Fix keystone with IDP configured.

2026-04-15T12:23:10+00:00

1. Add CI coverage for keystone_identity_providers under federation scenario. 2. Add fix for federation config in keystone role if keystone_identity_providers is defined. 3. Update Horizon tests with federation example. 4. Use openstack.cloud ansible modules instead of python-openstackclient in register_identity_providers.yml Closes-Bug: #2134455 Change-Id: Id03bc5770c3856c7c09a34e327b33786d7b7d859 Signed-off-by: Taavi Ansper

Remove deleted mod_auth_openidc option

2026-04-07T16:34:55+00:00

The option OIDCTokenBindingPolicy was deleted from mod_auth_openidc [1]. Remove it from our documentation. SSO with Keycloak was successfully tested without it. Keep documentation about keystone_federation_oidc_additional_options by using OIDCOutgoingProxy instead. [1] https://github.com/OpenIDC/mod_auth_openidc/commit/f9a52507acee0817b9cc91ec194bcea894f77ee0 Change-Id: Icfe4ef0f6070a97c4e43f691643169e71cc2772a Signed-off-by: Pierre Riteau

Customize the authentication error timeout page in modOIDC

2025-10-09T23:07:00+00:00

There is a situation that happens when a user triggers an authentication in OpenStack that uses Identity federation, which leads users to a blank page with an error message that might not be that clear to users. If the user takes too long to enter his/her credentials in the login page of the IdP, the user sees a page saying that the authentication took too much and that the user must try it again. However, if the user tries again, she/he is already logged in to the IdP, and then the user gets access direct to Horizon. This whole process can be a bit confusing for users, and they saw an error page after the login, which leads them to think that there was an error in the authentication, but then when he/she tries again, everything just works. Therefore, to handle such cases we propose Kolla-ansble to use a custom error page that has an automatic redirect if the error happens. The timeout is managed by "OIDCStateTimeout" variable. The default (which is what we have in place now) is 300 seconds (5 minutes): https://github.com/zmartzone/mod_auth_openidc/blob/d13ee0e4bd2cef94c4d2b55829310175288e0bdf/src/mod_auth_openidc.c#L651). I would not recommend the increase of this timeout though. I would rather decrease this value; 5 minutes to such an operation is already too much. This variable can be overridden via wsgi-keystone.conf file. To customize the error page we have the following variable "OIDCHTMLErrorTemplate". The template is processed in the following line: https://github.com/zmartzone/mod_auth_openidc/blob/f2b8315cd48faba04320e9a06fc52b57f0989dcb/src/util.c#L1619. As we can see, there is no default page. The default HTML is hardcoded in C++, and the template requires two "%s" placeholders that will receive the title of the error message and the full description of the error. Change-Id: Iebda3ca7a5f9cef7e5e0930fc4f70764774d6ed5 Signed-off-by: Rafael Weingärtner

CI: Add codespell to pep8

2024-04-22T13:19:23+00:00

Fix existing spelling errors Change-Id: Ie689cf5a344aaa630a4860448b09242333a8e119

keystone: Add support for OIDC options

2023-11-15T14:49:35+00:00

Introduce keystone_federation_oidc_additional_options variable Change-Id: I39b9f35dab6f4e3ac2fcb505aabd2589e6e2ca69

Keystone OIDC JWKS fix

2022-10-03T10:36:11+00:00

JWT failed to validate on auth-oidc endpoint used by openstack cli with "could not find key with kid: XX" error. To fix this we need to use jwks provided in "jwks_uri" by OIDC metadata endpoint. Missing "ServerName" directive from vhost config causes redirection to fail in some cases when external tls is enabled. - added "keystone_federation_oidc_jwks_uri" variable - added "OIDCOAuthVerifyJwksUri" to keystone vhost config - added "ServerName" to keystone vhost config - jinja templating additional whitespace trimmed to correct end result indentation and empty newlines Closes-bug: 1990375 Change-Id: I4f5c1bd8be8e23cf6299ca4bdfd79e9d98c9a9eb

Delete keystone_token_provider variable

2022-05-17T13:53:23+00:00

In the last PTG it was decided to drop the keystone_token_provider variable, because there is no other option anymore. Signed-off-by: Ramona Rautenberg Change-Id: I1ee2c3f9b7dbbbf4633c5874cdbb3c4f8c09e277

OpenID Connect certifiate file is optional

2022-01-09T21:55:34+00:00

Some ID provider configurations do not require a certificate file. Change the logic to allow this, and update documentation accordingly. Change-Id: I2c34a6b5894402bbebeb3fb96768789bc3c7fe84

Add support to OpenID Connect Authentication flow

2021-02-15T19:57:47+00:00

This pull request adds support for the OpenID Connect authentication flow in Keystone and enables both ID and access token authentication flows. The ID token configuration is designed to allow users to authenticate via Horizon using an identity federation; whereas the Access token is used to allow users to authenticate in the OpenStack CLI using a federated user. Without this PR, if one wants to configure OpenStack to use identity federation, he/she needs to do a lot of configurations in the keystone, Horizon, and register quite a good number of different parameters using the CLI such as mappings, identity providers, federated protocols, and so on. Therefore, with this PR, we propose a method for operators to introduce/present the IdP's metadata to Kolla-ansible, and based on the presented metadata, Kolla-ansible takes care of all of the configurations to prepare OpenStack to work in a federated environment. Implements: blueprint add-openid-support Co-Authored-By: Jason Anderson Change-Id: I0203a3470d7f8f2a54d5e126d947f540d93b8210

doc: Start using openstackdoctheme's extlink extension

2019-06-17T15:00:42+00:00

This ensures we have version-specific references to other projects [1]. Note that this doesn't mean the URLs are actually valid - we need to do more work (linkcheck?) here, but it's an improvement nonetheless. [1] https://docs.openstack.org/openstackdocstheme/latest/#external-link-helper Change-Id: I118e4d211617c5df66ff04dc04e308a1d2fc67ad