openstack/kolla-ansible.git/doc/source/reference/shared-services, branch stable/2026.1

Merge "Fix: Update outdated documentation"

2026-04-16T14:54:58+00:00

Fix keystone with IDP configured.

2026-04-15T12:23:10+00:00

1. Add CI coverage for keystone_identity_providers under federation scenario. 2. Add fix for federation config in keystone role if keystone_identity_providers is defined. 3. Update Horizon tests with federation example. 4. Use openstack.cloud ansible modules instead of python-openstackclient in register_identity_providers.yml Closes-Bug: #2134455 Change-Id: Id03bc5770c3856c7c09a34e327b33786d7b7d859 Signed-off-by: Taavi Ansper

Fix: Update outdated documentation

2026-04-12T15:31:35+00:00

Change-Id: I5dc53f74afd9a5b565201dc9d3039d82cb65dabc Signed-off-by: Piotr Milewski

Remove deleted mod_auth_openidc option

2026-04-07T16:34:55+00:00

The option OIDCTokenBindingPolicy was deleted from mod_auth_openidc [1]. Remove it from our documentation. SSO with Keycloak was successfully tested without it. Keep documentation about keystone_federation_oidc_additional_options by using OIDCOutgoingProxy instead. [1] https://github.com/OpenIDC/mod_auth_openidc/commit/f9a52507acee0817b9cc91ec194bcea894f77ee0 Change-Id: Icfe4ef0f6070a97c4e43f691643169e71cc2772a Signed-off-by: Pierre Riteau

Merge "Customize the authentication error timeout page in modOIDC"

2025-10-10T15:06:53+00:00

Customize the authentication error timeout page in modOIDC

2025-10-09T23:07:00+00:00

There is a situation that happens when a user triggers an authentication in OpenStack that uses Identity federation, which leads users to a blank page with an error message that might not be that clear to users. If the user takes too long to enter his/her credentials in the login page of the IdP, the user sees a page saying that the authentication took too much and that the user must try it again. However, if the user tries again, she/he is already logged in to the IdP, and then the user gets access direct to Horizon. This whole process can be a bit confusing for users, and they saw an error page after the login, which leads them to think that there was an error in the authentication, but then when he/she tries again, everything just works. Therefore, to handle such cases we propose Kolla-ansble to use a custom error page that has an automatic redirect if the error happens. The timeout is managed by "OIDCStateTimeout" variable. The default (which is what we have in place now) is 300 seconds (5 minutes): https://github.com/zmartzone/mod_auth_openidc/blob/d13ee0e4bd2cef94c4d2b55829310175288e0bdf/src/mod_auth_openidc.c#L651). I would not recommend the increase of this timeout though. I would rather decrease this value; 5 minutes to such an operation is already too much. This variable can be overridden via wsgi-keystone.conf file. To customize the error page we have the following variable "OIDCHTMLErrorTemplate". The template is processed in the following line: https://github.com/zmartzone/mod_auth_openidc/blob/f2b8315cd48faba04320e9a06fc52b57f0989dcb/src/util.c#L1619. As we can see, there is no default page. The default HTML is hardcoded in C++, and the template requires two "%s" placeholders that will receive the title of the error message and the full description of the error. Change-Id: Iebda3ca7a5f9cef7e5e0930fc4f70764774d6ed5 Signed-off-by: Rafael Weingärtner

Drop VMware support

2025-08-07T14:42:57+00:00

Change-Id: I20a669bf7796285df04723a9110f9c74788600e1 Signed-off-by: Michal Nasiadka

Remove Swift role

2025-03-21T16:30:59+00:00

Since Swift is broken and since deprecation nobody did pick up the work to make it working - let's remove swift role and associated integrations/CI scripts. Change-Id: I08e92aaeea644053fd25f80ce1f276a495cebbfc

Merge "Skyline: use an external object store (Swift) in the dashboard"

2024-11-27T20:52:02+00:00

Skyline: use an external object store (Swift) in the dashboard

2024-04-26T14:34:10+00:00

Change-Id: I0247877c245f12994ffab983a624844e1238de9b