Merge "Fix keystone with IDP configured."

15 files changed, 609 insertions, 198 deletions

diff --git a/ansible/roles/keystone/defaults/main.yml b/ansible/roles/keystone/defaults/main.yml
index 3727fdd3f..bb3b35286 100644
--- a/ansible/roles/keystone/defaults/main.yml
+++ b/ansible/roles/keystone/defaults/main.yml
@@ -48,7 +48,7 @@ keystone_services:
   keystone-httpd:
     container_name: "keystone_httpd"
     group: "keystone"
-    enabled: "{{ enable_keystone_federation | bool }}"
+    enabled: "{{ enable_keystone_federation | bool and keystone_wsgi_provider == 'uwsgi' }}"
     image: "{{ keystone_httpd_image_full }}"
     volumes: "{{ keystone_httpd_default_volumes + keystone_httpd_extra_volumes }}"
     dimensions: "{{ keystone_httpd_dimensions }}"
@@ -265,7 +265,10 @@ keystone_remote_id_attribute_oidc: "HTTP_OIDC_ISS"
 keystone_container_federation_oidc_metadata_folder: "{{ '/etc/apache2/metadata' if kolla_base_distro in ['debian', 'ubuntu'] else '/etc/httpd/metadata' }}"
 keystone_container_federation_oidc_idp_certificate_folder: "{{ '/etc/apache2/cert' if kolla_base_distro in ['debian', 'ubuntu'] else '/etc/httpd/cert' }}"
 keystone_container_federation_oidc_attribute_mappings_folder: "{{ container_config_directory }}/federation/oidc/attribute_maps"
-keystone_host_federation_base_folder: "{{ node_config_directory }}/keystone/federation"
+keystone_host_federation_base_folder: >-
+  {{ node_config_directory }}/{{
+  'keystone-httpd' if keystone_wsgi_provider == 'uwsgi' else 'keystone'
+  }}/federation
 keystone_host_federation_oidc_metadata_folder: "{{ keystone_host_federation_base_folder }}/oidc/metadata"
 keystone_host_federation_oidc_idp_certificate_folder: "{{ keystone_host_federation_base_folder }}/oidc/cert"
 keystone_host_federation_oidc_attribute_mappings_folder: "{{ keystone_host_federation_base_folder }}/oidc/attribute_maps"
diff --git a/ansible/roles/keystone/tasks/register_identity_providers.yml b/ansible/roles/keystone/tasks/register_identity_providers.yml
index 07ee8e436..ab00002fb 100644
--- a/ansible/roles/keystone/tasks/register_identity_providers.yml
+++ b/ansible/roles/keystone/tasks/register_identity_providers.yml
@@ -1,241 +1,167 @@
 ---
 - name: List configured attribute mappings (that can be used by IdPs)
-  ansible.builtin.command: >
-    {{ kolla_container_engine }} exec -t keystone openstack
-      --os-auth-url={{ keystone_internal_url }}
-      --os-password={{ keystone_admin_password }}
-      --os-username={{ keystone_admin_user }}
-      --os-identity-api-version=3
-      --os-interface={{ openstack_interface }}
-      --os-system-scope="all"
-      --os-user-domain-name={{ default_user_domain_name }}
-      --os-region-name={{ openstack_region_name }}
-      {% if openstack_cacert != '' %}--os-cacert={{ openstack_cacert }} {% endif %}
-    mapping list -c ID --format value
-  run_once: true
-  changed_when: false
   become: true
-  register: existing_mappings_register
-
-- name: Register existing mappings
-  ansible.builtin.set_fact:
-    existing_mappings: "{{ existing_mappings_register.stdout_lines | map('trim') | list }}"
+  kolla_toolbox:
+    container_engine: "{{ kolla_container_engine }}"
+    module_name: openstack.cloud.federation_mapping_info
+    module_args:
+      auth: "{{ openstack_auth }}"
+      cloud: "{{ openstack_auth_cloud }}"
+      region_name: "{{ openstack_region_name }}"
+      interface: "{{ openstack_interface }}"
+      ca_cert: "{{ openstack_cacert if openstack_cacert != '' else omit }}"
+  run_once: true
+  register: existing_mappings
 
 - name: Remove unmanaged attribute mappings
-  changed_when: true
-  ansible.builtin.command: >
-    {{ kolla_container_engine }} exec -t keystone openstack
-    --os-auth-url={{ keystone_internal_url }}
-    --os-password={{ keystone_admin_password }}
-    --os-username={{ keystone_admin_user }}
-    --os-identity-api-version=3
-    --os-interface={{ openstack_interface }}
-    --os-user-domain-name={{ default_user_domain_name }}
-    --os-system-scope="all"
-    --os-region-name={{ openstack_region_name }}
-    {% if openstack_cacert != '' %}--os-cacert={{ openstack_cacert }} {% endif %}
-    mapping delete {{ item }}
-  run_once: true
   become: true
-  with_items: "{{ existing_mappings }}"
+  kolla_toolbox:
+    container_engine: "{{ kolla_container_engine }}"
+    module_name: openstack.cloud.federation_mapping
+    module_args:
+      auth: "{{ openstack_auth }}"
+      cloud: "{{ openstack_auth_cloud }}"
+      region_name: "{{ openstack_region_name }}"
+      interface: "{{ openstack_interface }}"
+      ca_cert: "{{ openstack_cacert if openstack_cacert != '' else omit }}"
+      name: "{{ item.name }}"
+      state: absent
+  run_once: true
+  with_items: "{{ existing_mappings.mappings }}"
   when:
-    - item not in (keystone_identity_mappings | map(attribute='name') | list)
+    - item.name not in (keystone_identity_mappings | map(attribute='name') | list)
     - keystone_should_remove_attribute_mappings
 
 - name: Create unexisting domains
   become: true
-  changed_when: true
   kolla_toolbox:
     container_engine: "{{ kolla_container_engine }}"
-    module_name: "os_keystone_domain"
+    module_name: "openstack.cloud.identity_domain"
     module_args:
-      name: "{{ item.openstack_domain }}"
       auth: "{{ openstack_auth }}"
       cloud: "{{ openstack_auth_cloud }}"
-      endpoint_type: "{{ openstack_interface }}"
-      cacert: "{{ openstack_cacert }}"
       region_name: "{{ openstack_region_name }}"
+      interface: "{{ openstack_interface }}"
+      ca_cert: "{{ openstack_cacert if openstack_cacert != '' else omit }}"
+      name: "{{ item.openstack_domain }}"
+      state: present
   run_once: true
   with_items: "{{ keystone_identity_providers }}"
 
 - name: Register attribute mappings in OpenStack
   become: true
-  changed_when: true
-  ansible.builtin.command: >
-    {{ kolla_container_engine }} exec -t keystone openstack
-    --os-auth-url={{ keystone_internal_url }}
-    --os-password={{ keystone_admin_password }}
-    --os-username={{ keystone_admin_user }}
-    --os-identity-api-version=3
-    --os-interface {{ openstack_interface }}
-    --os-system-scope="all"
-    --os-user-domain-name={{ default_user_domain_name }}
-    --os-region-name={{ openstack_region_name }}
-    {% if openstack_cacert != '' %}--os-cacert={{ openstack_cacert }} {% endif %}
-    mapping create
-    --rules "{{ keystone_container_federation_oidc_attribute_mappings_folder }}/{{ item.file | basename }}"
-    {{ item.name }}
-  run_once: true
-  when:
-    - item.name not in existing_mappings
-  with_items: "{{ keystone_identity_mappings }}"
-
-- name: Update existing attribute mappings in OpenStack
-  become: true
-  changed_when: true
-  ansible.builtin.command: >
-    {{ kolla_container_engine }} exec -t keystone openstack
-    --os-auth-url={{ keystone_internal_url }}
-    --os-password={{ keystone_admin_password }}
-    --os-username={{ keystone_admin_user }}
-    --os-identity-api-version=3
-    --os-interface={{ openstack_interface }}
-    --os-system-scope="all"
-    --os-user-domain-name={{ default_user_domain_name }}
-    --os-region-name={{ openstack_region_name }}
-    {% if openstack_cacert != '' %}--os-cacert={{ openstack_cacert }} {% endif %}
-    mapping set
-    --rules="{{ keystone_container_federation_oidc_attribute_mappings_folder }}/{{ item.file | basename }}"
-    {{ item.name }}
+  kolla_toolbox:
+    container_engine: "{{ kolla_container_engine }}"
+    module_name: openstack.cloud.federation_mapping
+    module_args:
+      auth: "{{ openstack_auth }}"
+      cloud: "{{ openstack_auth_cloud }}"
+      region_name: "{{ openstack_region_name }}"
+      interface: "{{ openstack_interface }}"
+      ca_cert: "{{ openstack_cacert if openstack_cacert != '' else omit }}"
+      name: "{{ item.name }}"
+      rules: "{{ '{{ keystone_identity_mapping_rules | from_json }}' }}"
+      state: present
+    module_extra_vars:
+      keystone_identity_mapping_rules: "{{ lookup('ansible.builtin.file', item.file) }}"
   run_once: true
-  when:
-    - item.name in existing_mappings
   with_items: "{{ keystone_identity_mappings }}"
 
 - name: List configured IdPs
   become: true
-  ansible.builtin.command: >
-    {{ kolla_container_engine }} exec -t keystone openstack
-    --os-auth-url={{ keystone_internal_url }}
-    --os-password={{ keystone_admin_password }}
-    --os-username={{ keystone_admin_user }}
-    --os-identity-api-version=3
-    --os-interface={{ openstack_interface }}
-    --os-system-scope="all"
-    --os-user-domain-name={{ default_user_domain_name }}
-    --os-region-name={{ openstack_region_name }}
-    {% if openstack_cacert != '' %}--os-cacert={{ openstack_cacert }} {% endif %}
-    identity provider list -c ID --format value
+  kolla_toolbox:
+    container_engine: "{{ kolla_container_engine }}"
+    module_name: openstack.cloud.federation_idp_info
+    module_args:
+      auth: "{{ openstack_auth }}"
+      cloud: "{{ openstack_auth_cloud }}"
+      region_name: "{{ openstack_region_name }}"
+      interface: "{{ openstack_interface }}"
+      ca_cert: "{{ openstack_cacert if openstack_cacert != '' else omit }}"
   run_once: true
-  changed_when: false
-  register: existing_idps_register
-
-- name: Register existing idps
-  ansible.builtin.set_fact:
-    existing_idps: "{{ existing_idps_register.stdout.split('\n') | map('trim') | list }}"
+  register: existing_idps
 
 - name: Remove unmanaged identity providers
   become: true
-  changed_when: true
-  ansible.builtin.command: >
-    {{ kolla_container_engine }} exec -t keystone openstack
-    --os-auth-url={{ keystone_internal_url }}
-    --os-password={{ keystone_admin_password }}
-    --os-username={{ keystone_admin_user }}
-    --os-identity-api-version=3
-    --os-interface={{ openstack_interface }}
-    --os-system-scope="all"
-    --os-user-domain-name={{ default_user_domain_name }}
-    --os-region-name={ openstack_region_name }}
-    {% if openstack_cacert != '' %}--os-cacert={{ openstack_cacert }}{% endif %}
-    identity provider delete {{ item }}
+  kolla_toolbox:
+    container_engine: "{{ kolla_container_engine }}"
+    module_name: openstack.cloud.federation_idp
+    module_args:
+      auth: "{{ openstack_auth }}"
+      cloud: "{{ openstack_auth_cloud }}"
+      region_name: "{{ openstack_region_name }}"
+      interface: "{{ openstack_interface }}"
+      ca_cert: "{{ openstack_cacert if openstack_cacert != '' else omit }}"
+      name: "{{ item.name }}"
+      state: absent
   run_once: true
-  with_items: "{{ existing_idps }}"
+  with_items: "{{ existing_idps.identity_providers }}"
   when:
-    - item not in (keystone_identity_providers | map(attribute='name') | list)
+    - item.name not in (keystone_identity_providers | map(attribute='name') | list)
     - keystone_should_remove_identity_providers
 
-- name: Register Identity Providers in OpenStack
+- name: Gather Identity Domains information
   become: true
-  changed_when: true
-  ansible.builtin.command: >
-    {{ kolla_container_engine }} exec -t keystone openstack
-    --os-auth-url={{ keystone_internal_url }}
-    --os-password={{ keystone_admin_password }}
-    --os-username={{ keystone_admin_user }}
-    --os-identity-api-version=3
-    --os-interface={{ openstack_interface }}
-    --os-system-scope="all"
-    --os-user-domain-name={{ default_user_domain_name }}
-    --os-region-name={{ openstack_region_name }}
-    {% if openstack_cacert != '' %}--os-cacert={{ openstack_cacert }}{% endif %}
-    identity provider create
-    --description "{{ item.public_name }}"
-    --remote-id "{{ item.identifier }}"
-    --domain "{{ item.openstack_domain }}"
-    {{ item.name }}
+  kolla_toolbox:
+    container_engine: "{{ kolla_container_engine }}"
+    module_name: openstack.cloud.identity_domain_info
+    module_args:
+      auth: "{{ openstack_auth }}"
+      cloud: "{{ openstack_auth_cloud }}"
+      region_name: "{{ openstack_region_name }}"
+      interface: "{{ openstack_interface }}"
+      ca_cert: "{{ openstack_cacert if openstack_cacert != '' else omit }}"
   run_once: true
-  when:
-    - item.name not in existing_idps
-  with_items: "{{ keystone_identity_providers }}"
+  register: existing_identity_domains
 
-- name: Update Identity Providers in OpenStack according to Kolla-Ansible configurations
-  become: true
-  changed_when: true
-  ansible.builtin.command: >
-    {{ kolla_container_engine }} exec -t keystone openstack
-    --os-auth-url={{ keystone_internal_url }}
-    --os-password={{ keystone_admin_password }}
-    --os-username={{ keystone_admin_user }}
-    --os-identity-api-version=3
-    --os-interface {{ openstack_interface }}
-    --os-system-scope "all"
-    --os-user-domain-name {{ default_user_domain_name }}
-    --os-region-name {{ openstack_region_name }}
-    {% if openstack_cacert != '' %}--os-cacert {{ openstack_cacert }} {% endif %}
-    identity provider set
-    --description "{{ item.public_name }}"
-    --remote-id "{{ item.identifier }}"
-    "{{ item.name }}"
+- name: Verify that required Identity Domains exist
+  ansible.builtin.fail:
+    msg: >
+      Domain "{{ item.openstack_domain }}" was not found in OpenStack.
+      Please create it first or check your keystone_identity_providers configuration.
   run_once: true
-  when:
-    - item.name in existing_idps
-  with_items: "{{ keystone_identity_providers }}"
+  loop: "{{ keystone_identity_providers }}"
+  when: >
+    existing_identity_domains.domains |
+    selectattr('name', 'equalto', item.openstack_domain) |
+    list | length == 0
 
-- name: Configure attribute mappings for each Identity Provider. (We expect the mappings to be configured by the operator)
+- name: Register Identity Providers in OpenStack
   become: true
-  changed_when: true
-  ansible.builtin.command: >
-    {{ kolla_container_engine }} exec -t keystone openstack
-    --os-auth-url={{ keystone_internal_url }}
-    --os-password={{ keystone_admin_password }}
-    --os-username={{ keystone_admin_user }}
-    --os-identity-api-version=3
-    --os-interface={{ openstack_interface }}
-    --os-system-scope="all"
-    --os-user-domain-name={{ default_user_domain_name }}
-    --os-region-name={{ openstack_region_name }}
-    {% if openstack_cacert != '' %}--os-cacert={{ openstack_cacert }}{% endif %}
-    federation protocol create
-    --mapping {{ item.attribute_mapping }}
-    --identity-provider {{ item.name }}
-    {{ item.protocol }}
+  kolla_toolbox:
+    container_engine: "{{ kolla_container_engine }}"
+    module_name: openstack.cloud.federation_idp
+    module_args:
+      auth: "{{ openstack_auth }}"
+      cloud: "{{ openstack_auth_cloud }}"
+      region_name: "{{ openstack_region_name }}"
+      interface: "{{ openstack_interface }}"
+      ca_cert: "{{ openstack_cacert if openstack_cacert != '' else omit }}"
+      description: "{{ item.public_name }}"
+      remote_ids: "{{ '{{ keystone_identity_provider_remote_ids | from_json }}' }}"
+      domain_id: "{{ existing_identity_domains.domains | selectattr('name', 'equalto', item.openstack_domain) | map(attribute='id') | first }}"
+      name: "{{ item.name }}"
+      is_enabled: true
+      state: present
+    module_extra_vars:
+      keystone_identity_provider_remote_ids: "{{ [item.identifier] | to_json }}"
   run_once: true
-  when:
-    - item.name not in existing_idps
   with_items: "{{ keystone_identity_providers }}"
 
-- name: Update attribute mappings for each Identity Provider. (We expect the mappings to be configured by the operator).
+- name: Configure attribute mappings for each Identity Provider. (We expect the mappings to be configured by the operator)
   become: true
-  changed_when: true
-  ansible.builtin.command: >
-    {{ kolla_container_engine }} exec -t keystone openstack
-    --os-auth-url={{ keystone_internal_url }}
-    --os-password={{ keystone_admin_password }}
-    --os-username={{ keystone_admin_user }}
-    --os-identity-api-version=3
-    --os-interface={{ openstack_interface }}
-    --os-system-scope="all"
-    --os-user-domain-name={{ default_user_domain_name }}
-    --os-region-name={{ openstack_region_name }}
-    {% if openstack_cacert != '' %}--os-cacert={{ openstack_cacert }}{% endif %}
-    federation protocol set
-    --identity-provider {{ item.name }}
-    --mapping {{ item.attribute_mapping }}
-    {{ item.protocol }}
+  kolla_toolbox:
+    container_engine: "{{ kolla_container_engine }}"
+    module_name: openstack.cloud.keystone_federation_protocol
+    module_args:
+      auth: "{{ openstack_auth }}"
+      cloud: "{{ openstack_auth_cloud }}"
+      region_name: "{{ openstack_region_name }}"
+      interface: "{{ openstack_interface }}"
+      ca_cert: "{{ openstack_cacert if openstack_cacert != '' else omit }}"
+      idp: "{{ item.name }}"
+      mapping: "{{ item.attribute_mapping }}"
+      name: "{{ item.protocol }}"
+      state: present
   run_once: true
-  register: result
-  failed_when: result.rc not in [0, 1] # This command returns RC 1 on success, so we need to add this to avoid fails.
-  when:
-    - item.name in existing_idps
   with_items: "{{ keystone_identity_providers }}"
diff --git a/ansible/roles/keystone/templates/keystone-httpd.json.j2 b/ansible/roles/keystone/templates/keystone-httpd.json.j2
index b82376afc..e16cf98be 100644
--- a/ansible/roles/keystone/templates/keystone-httpd.json.j2
+++ b/ansible/roles/keystone/templates/keystone-httpd.json.j2
@@ -36,6 +36,12 @@
             "owner": "{{ apache_user }}:{{ apache_user }}",
             "perm": "0600",
             "merge": true
+        },
+        {
+            "source": "{{ container_config_directory }}/federation/modoidc-error-page.html",
+            "dest": "/var/www/html/modoidc-error-page.html",
+            "owner": "{{ apache_user }}:{{ apache_user }}",
+            "perm": "0600"
         }{% endif %}{% if kolla_copy_ca_into_containers | bool %},
         {
             "source": "{{ container_config_directory }}/ca-certificates",
diff --git a/ansible/roles/keystone/templates/keystone.json.j2 b/ansible/roles/keystone/templates/keystone.json.j2
index dda23b82b..a4cf8b7fa 100644
--- a/ansible/roles/keystone/templates/keystone.json.j2
+++ b/ansible/roles/keystone/templates/keystone.json.j2
@@ -58,7 +58,7 @@
             "dest": "/etc/keystone/certs/keystone-key.pem",
             "owner": "keystone",
             "perm": "0600"
-        }{% endif %}{% if keystone_enable_federation_openid | bool %},
+        }{% endif %}{% if keystone_enable_federation_openid | bool and keystone_wsgi_provider == 'apache' %},
         {
             "source": "{{ container_config_directory }}/federation/oidc/metadata",
             "dest": "{{ keystone_container_federation_oidc_metadata_folder }}",
@@ -95,7 +95,7 @@
         {
             "path": "/var/log/kolla/keystone/keystone.log",
             "owner": "keystone:keystone"
-        },{% if keystone_enable_federation_openid | bool %}
+        },{% if keystone_enable_federation_openid | bool and keystone_wsgi_provider == 'apache' %}
         {
             "path": "{{ keystone_container_federation_oidc_metadata_folder }}",
             "owner": "{{ apache_user }}:{{ apache_user }}",
diff --git a/doc/source/reference/shared-services/keystone-guide.rst b/doc/source/reference/shared-services/keystone-guide.rst
index 5f5bc60ac..173766022 100644
--- a/doc/source/reference/shared-services/keystone-guide.rst
+++ b/doc/source/reference/shared-services/keystone-guide.rst
@@ -131,6 +131,11 @@ openstack_domain
 
 The OpenStack domain that the Identity Provider belongs.
 
+.. note::
+   Kolla-Ansible does not support duplicate openstack_domain names,
+   where the ID of the domain is different, but the name is the same.
+   This is an edge case that is hard to take into account.
+
 protocol
 ********
 
diff --git a/releasenotes/notes/bug-2134455-idp-fixes-aa7064473be5e44d.yaml b/releasenotes/notes/bug-2134455-idp-fixes-aa7064473be5e44d.yaml
new file mode 100644
index 000000000..6c82cc178
--- /dev/null
+++ b/releasenotes/notes/bug-2134455-idp-fixes-aa7064473be5e44d.yaml
@@ -0,0 +1,20 @@
+---
+deprecations:
+  - |
+    Remove option to set OIDCHTMLErrorTemplate in Debian 13 and Rocky 10.
+    As this option was removed in 2.4.14 version of modoidc auth plugin.
+    It is still present in Ubuntu Noble and can be used there. This applies
+    only when using `keystone_wsgi_provider: apache`, which is not the default.
+fixes:
+  - |
+    Fixes federation path for new keystone-httpd container. Previously
+    the normal keystone container running apache wsgi was used. After
+    migration to the uwsgi container the federation logic remained in
+    the keystone-httpd container, but the federation files were never
+    mounted there.
+    `LP#2134455 <https://launchpad.net/bugs/2134455>`__.
+other:
+  - |
+    Add more CI coverage for Federation codepath. Migrate ansible to use
+    `openstack.cloud` ansible collection modules for configuring federation.
+    Previously it was done using python-openstackclient.
diff --git a/roles/kolla-ansible-test-dashboard/tasks/main.yml b/roles/kolla-ansible-test-dashboard/tasks/main.yml
index 02b218212..12950d77c 100644
--- a/roles/kolla-ansible-test-dashboard/tasks/main.yml
+++ b/roles/kolla-ansible-test-dashboard/tasks/main.yml
@@ -88,6 +88,7 @@
     - name: Run testinfra tests
       environment:
         HORIZON_PROTO: "{{ 'https' if tls_enabled | bool else 'http' }}"
+        SCENARIO: "{{ scenario }}"
       ansible.builtin.shell:
         cmd: >
           . {{ kolla_ansible_venv_path }}/bin/activate &&
diff --git a/tests/run.yml b/tests/run.yml
index b7c8fc702..78d34d8eb 100644
--- a/tests/run.yml
+++ b/tests/run.yml
@@ -164,6 +164,8 @@
         - neutron
         - nova
         - bifrost
+        - keystone-httpd/federation/oidc/metadata
+        - keystone-httpd/federation/oidc/attribute_maps
 
     - name: Generate configuration files
       template:
@@ -210,6 +212,19 @@
         - src: "tests/templates/tenks-deploy-config.yml.j2"
           dest: "{{ ansible_env.HOME }}/tenks.yml"
           when: "{{ scenario == 'ironic' }}"
+        # keystone-federation config
+        - src: "tests/templates/keystone-federation/idp.example.org%2Frealms%2Fexample.conf.j2"
+          dest: "/etc/kolla/config/keystone-httpd/federation/oidc/metadata/idp.example.org%2Frealms%2Fexample.conf"
+          when: "{{ scenario == 'federation' }}"
+        - src: "tests/templates/keystone-federation/idp.example.org%2Frealms%2Fexample.provider.j2"
+          dest: "/etc/kolla/config/keystone-httpd/federation/oidc/metadata/idp.example.org%2Frealms%2Fexample.provider"
+          when: "{{ scenario == 'federation' }}"
+        - src: "tests/templates/keystone-federation/idp.example.org%2Frealms%2Fexample.client.j2"
+          dest: "/etc/kolla/config/keystone-httpd/federation/oidc/metadata/idp.example.org%2Frealms%2Fexample.client"
+          when: "{{ scenario == 'federation' }}"
+        - src: "tests/templates/keystone-federation/attribute_mapping.json"
+          dest: "/etc/kolla/config/keystone-httpd/federation/oidc/attribute_maps/attribute_mapping.json"
+          when: "{{ scenario == 'federation' }}"
       when: item.when | default(true)
 
     - block:
diff --git a/tests/templates/globals-default.j2 b/tests/templates/globals-default.j2
index 80f34b0aa..313e7d5cf 100644
--- a/tests/templates/globals-default.j2
+++ b/tests/templates/globals-default.j2
@@ -282,6 +282,17 @@ enable_valkey: "yes"
 
 {% if scenario == "federation" %}
 enable_keystone_federation: true
+keystone_identity_providers:
+  - name: "example_provider"
+    openstack_domain: "Default"
+    protocol: "openid"
+    identifier: "https://idp.example.org/realms/example"
+    public_name: "Example Provider"
+    attribute_mapping: "sso_oidc_mapping"
+    metadata_folder: "/etc/kolla/config/keystone-httpd/federation/oidc/metadata"
+keystone_identity_mappings:
+  - name: "sso_oidc_mapping"
+    file: "/etc/kolla/config/keystone-httpd/federation/oidc/attribute_maps/attribute_mapping.json"
 {% endif %}
 
 mariadb_monitor_read_only_interval: "30000"
diff --git a/tests/templates/keystone-federation/attribute_mapping.json b/tests/templates/keystone-federation/attribute_mapping.json
new file mode 100644
index 000000000..022cbafd2
--- /dev/null
+++ b/tests/templates/keystone-federation/attribute_mapping.json
@@ -0,0 +1,42 @@
+[
+    {
+        "local": [
+            {
+                "user": {
+                    "name": "{0}",
+                    "email": "{1}",
+                    "domain": {
+                        "name": "{2}"
+                    }
+                },
+                "domain": {
+                    "name": "{2}"
+                },
+                "projects": [
+                    {
+                        "name": "{3}",
+                        "roles": [
+                            {
+                                "name": "member"
+                            }
+                        ]
+                    }
+                ]
+            }
+        ],
+        "remote": [
+            {
+                "type": "OIDC-preferred_username"
+            },
+            {
+                "type": "OIDC-email"
+            },
+            {
+                "type": "OIDC-openstack-user-domain"
+            },
+            {
+                "type": "OIDC-openstack-default-project"
+            }
+        ]
+    }
+]
diff --git a/tests/templates/keystone-federation/idp.example.org%2Frealms%2Fexample.client.j2 b/tests/templates/keystone-federation/idp.example.org%2Frealms%2Fexample.client.j2
new file mode 100644
index 000000000..253898f3a
--- /dev/null
+++ b/tests/templates/keystone-federation/idp.example.org%2Frealms%2Fexample.client.j2
@@ -0,0 +1,4 @@
+{
+  "client_id":"keystone",
+  "client_secret":"example_secret"
+}
diff --git a/tests/templates/keystone-federation/idp.example.org%2Frealms%2Fexample.conf.j2 b/tests/templates/keystone-federation/idp.example.org%2Frealms%2Fexample.conf.j2
new file mode 100644
index 000000000..0967ef424
--- /dev/null
+++ b/tests/templates/keystone-federation/idp.example.org%2Frealms%2Fexample.conf.j2
@@ -0,0 +1 @@
+{}
diff --git a/tests/templates/keystone-federation/idp.example.org%2Frealms%2Fexample.provider.j2 b/tests/templates/keystone-federation/idp.example.org%2Frealms%2Fexample.provider.j2
new file mode 100644
index 000000000..c45eb26f9
--- /dev/null
+++ b/tests/templates/keystone-federation/idp.example.org%2Frealms%2Fexample.provider.j2
@@ -0,0 +1,324 @@
+{
+  "issuer": "https://idp.example.org/realms/example",
+  "authorization_endpoint": "https://idp.example.org/realms/example/protocol/openid-connect/auth",
+  "token_endpoint": "https://idp.example.org/realms/example/protocol/openid-connect/token",
+  "introspection_endpoint": "https://idp.example.org/realms/example/protocol/openid-connect/token/introspect",
+  "userinfo_endpoint": "https://idp.example.org/realms/example/protocol/openid-connect/userinfo",
+  "end_session_endpoint": "https://idp.example.org/realms/example/protocol/openid-connect/logout",
+  "frontchannel_logout_session_supported": true,
+  "frontchannel_logout_supported": true,
+  "jwks_uri": "https://idp.example.org/realms/example/protocol/openid-connect/certs",
+  "check_session_iframe": "https://idp.example.org/realms/example/protocol/openid-connect/login-status-iframe.html",
+  "grant_types_supported": [
+    "authorization_code",
+    "implicit",
+    "refresh_token",
+    "password",
+    "client_credentials",
+    "urn:openid:params:grant-type:ciba",
+    "urn:ietf:params:oauth:grant-type:device_code"
+  ],
+  "acr_values_supported": [
+    "0",
+    "1"
+  ],
+  "response_types_supported": [
+    "code",
+    "none",
+    "id_token",
+    "token",
+    "id_token token",
+    "code id_token",
+    "code token",
+    "code id_token token"
+  ],
+  "subject_types_supported": [
+    "public",
+    "pairwise"
+  ],
+  "prompt_values_supported": [
+    "none",
+    "login",
+    "consent"
+  ],
+  "id_token_signing_alg_values_supported": [
+    "PS384",
+    "RS384",
+    "EdDSA",
+    "ES384",
+    "HS256",
+    "HS512",
+    "ES256",
+    "RS256",
+    "HS384",
+    "ES512",
+    "PS256",
+    "PS512",
+    "RS512"
+  ],
+  "id_token_encryption_alg_values_supported": [
+    "ECDH-ES+A256KW",
+    "ECDH-ES+A192KW",
+    "ECDH-ES+A128KW",
+    "RSA-OAEP",
+    "RSA-OAEP-256",
+    "RSA1_5",
+    "ECDH-ES"
+  ],
+  "id_token_encryption_enc_values_supported": [
+    "A256GCM",
+    "A192GCM",
+    "A128GCM",
+    "A128CBC-HS256",
+    "A192CBC-HS384",
+    "A256CBC-HS512"
+  ],
+  "userinfo_signing_alg_values_supported": [
+    "PS384",
+    "RS384",
+    "EdDSA",
+    "ES384",
+    "HS256",
+    "HS512",
+    "ES256",
+    "RS256",
+    "HS384",
+    "ES512",
+    "PS256",
+    "PS512",
+    "RS512",
+    "none"
+  ],
+  "userinfo_encryption_alg_values_supported": [
+    "ECDH-ES+A256KW",
+    "ECDH-ES+A192KW",
+    "ECDH-ES+A128KW",
+    "RSA-OAEP",
+    "RSA-OAEP-256",
+    "RSA1_5",
+    "ECDH-ES"
+  ],
+  "userinfo_encryption_enc_values_supported": [
+    "A256GCM",
+    "A192GCM",
+    "A128GCM",
+    "A128CBC-HS256",
+    "A192CBC-HS384",
+    "A256CBC-HS512"
+  ],
+  "request_object_signing_alg_values_supported": [
+    "PS384",
+    "RS384",
+    "EdDSA",
+    "ES384",
+    "HS256",
+    "HS512",
+    "ES256",
+    "RS256",
+    "HS384",
+    "ES512",
+    "PS256",
+    "PS512",
+    "RS512",
+    "none"
+  ],
+  "request_object_encryption_alg_values_supported": [
+    "ECDH-ES+A256KW",
+    "ECDH-ES+A192KW",
+    "ECDH-ES+A128KW",
+    "RSA-OAEP",
+    "RSA-OAEP-256",
+    "RSA1_5",
+    "ECDH-ES"
+  ],
+  "request_object_encryption_enc_values_supported": [
+    "A256GCM",
+    "A192GCM",
+    "A128GCM",
+    "A128CBC-HS256",
+    "A192CBC-HS384",
+    "A256CBC-HS512"
+  ],
+  "response_modes_supported": [
+    "query",
+    "fragment",
+    "form_post",
+    "query.jwt",
+    "fragment.jwt",
+    "form_post.jwt",
+    "jwt"
+  ],
+  "registration_endpoint": "https://idp.example.org/realms/example/clients-registrations/openid-connect",
+  "token_endpoint_auth_methods_supported": [
+    "private_key_jwt",
+    "client_secret_basic",
+    "client_secret_post",
+    "tls_client_auth",
+    "client_secret_jwt"
+  ],
+  "token_endpoint_auth_signing_alg_values_supported": [
+    "PS384",
+    "RS384",
+    "EdDSA",
+    "ES384",
+    "HS256",
+    "HS512",
+    "ES256",
+    "RS256",
+    "HS384",
+    "ES512",
+    "PS256",
+    "PS512",
+    "RS512"
+  ],
+  "introspection_endpoint_auth_methods_supported": [
+    "private_key_jwt",
+    "client_secret_basic",
+    "client_secret_post",
+    "tls_client_auth",
+    "client_secret_jwt"
+  ],
+  "introspection_endpoint_auth_signing_alg_values_supported": [
+    "PS384",
+    "RS384",
+    "EdDSA",
+    "ES384",
+    "HS256",
+    "HS512",
+    "ES256",
+    "RS256",
+    "HS384",
+    "ES512",
+    "PS256",
+    "PS512",
+    "RS512"
+  ],
+  "authorization_signing_alg_values_supported": [
+    "PS384",
+    "RS384",
+    "EdDSA",
+    "ES384",
+    "HS256",
+    "HS512",
+    "ES256",
+    "RS256",
+    "HS384",
+    "ES512",
+    "PS256",
+    "PS512",
+    "RS512"
+  ],
+  "authorization_encryption_alg_values_supported": [
+    "ECDH-ES+A256KW",
+    "ECDH-ES+A192KW",
+    "ECDH-ES+A128KW",
+    "RSA-OAEP",
+    "RSA-OAEP-256",
+    "RSA1_5",
+    "ECDH-ES"
+  ],
+  "authorization_encryption_enc_values_supported": [
+    "A256GCM",
+    "A192GCM",
+    "A128GCM",
+    "A128CBC-HS256",
+    "A192CBC-HS384",
+    "A256CBC-HS512"
+  ],
+  "claims_supported": [
+    "aud",
+    "sub",
+    "iss",
+    "auth_time",
+    "name",
+    "given_name",
+    "family_name",
+    "preferred_username",
+    "email",
+    "acr"
+  ],
+  "claim_types_supported": [
+    "normal"
+  ],
+  "claims_parameter_supported": true,
+  "scopes_supported": [
+    "openid",
+    "roles",
+    "acr",
+    "profile",
+    "address",
+    "basic",
+    "offline_access",
+    "groups",
+    "email",
+    "phone",
+    "service_account",
+    "web-origins",
+    "microprofile-jwt"
+  ],
+  "request_parameter_supported": true,
+  "request_uri_parameter_supported": true,
+  "require_request_uri_registration": true,
+  "code_challenge_methods_supported": [
+    "plain",
+    "S256"
+  ],
+  "tls_client_certificate_bound_access_tokens": true,
+  "revocation_endpoint": "https://idp.example.org/realms/example/protocol/openid-connect/revoke",
+  "revocation_endpoint_auth_methods_supported": [
+    "private_key_jwt",
+    "client_secret_basic",
+    "client_secret_post",
+    "tls_client_auth",
+    "client_secret_jwt"
+  ],
+  "revocation_endpoint_auth_signing_alg_values_supported": [
+    "PS384",
+    "RS384",
+    "EdDSA",
+    "ES384",
+    "HS256",
+    "HS512",
+    "ES256",
+    "RS256",
+    "HS384",
+    "ES512",
+    "PS256",
+    "PS512",
+    "RS512"
+  ],
+  "backchannel_logout_supported": true,
+  "backchannel_logout_session_supported": true,
+  "device_authorization_endpoint": "https://idp.example.org/realms/example/protocol/openid-connect/auth/device",
+  "backchannel_token_delivery_modes_supported": [
+    "poll",
+    "ping"
+  ],
+  "backchannel_authentication_endpoint": "https://idp.example.org/realms/example/protocol/openid-connect/ext/ciba/auth",
+  "backchannel_authentication_request_signing_alg_values_supported": [
+    "PS384",
+    "RS384",
+    "EdDSA",
+    "ES384",
+    "ES256",
+    "RS256",
+    "ES512",
+    "PS256",
+    "PS512",
+    "RS512"
+  ],
+  "require_pushed_authorization_requests": false,
+  "pushed_authorization_request_endpoint": "https://idp.example.org/realms/example/protocol/openid-connect/ext/par/request",
+  "mtls_endpoint_aliases": {
+    "token_endpoint": "https://idp.example.org/realms/example/protocol/openid-connect/token",
+    "revocation_endpoint": "https://idp.example.org/realms/example/protocol/openid-connect/revoke",
+    "introspection_endpoint": "https://idp.example.org/realms/example/protocol/openid-connect/token/introspect",
+    "device_authorization_endpoint": "https://idp.example.org/realms/example/protocol/openid-connect/auth/device",
+    "registration_endpoint": "https://idp.example.org/realms/example/clients-registrations/openid-connect",
+    "userinfo_endpoint": "https://idp.example.org/realms/example/protocol/openid-connect/userinfo",
+    "pushed_authorization_request_endpoint": "https://idp.example.org/realms/example/protocol/openid-connect/ext/par/request",
+    "backchannel_authentication_endpoint": "https://idp.example.org/realms/example/protocol/openid-connect/ext/ciba/auth"
+  },
+  "authorization_response_iss_parameter_supported": true
+}
+
diff --git a/tests/testinfra/test_horizon.py b/tests/testinfra/test_horizon.py
index 9b27e4700..0c1527a9d 100644
--- a/tests/testinfra/test_horizon.py
+++ b/tests/testinfra/test_horizon.py
@@ -12,13 +12,17 @@
 # License for the specific language governing permissions and limitations
 # under the License.
 
+import os
+import pytest
 import time
 import yaml
 
 from pathlib import Path
 from selenium.common.exceptions import TimeoutException
+from selenium.common.exceptions import WebDriverException
 from selenium import webdriver
 from selenium.webdriver.common.by import By
+from selenium.webdriver.support.ui import Select
 from selenium.webdriver.support.ui import WebDriverWait
 
 home = Path.home()
@@ -122,3 +126,50 @@ def test_horizon_login(host):
         raise e
     finally:
         driver.quit()
+
+
+@pytest.mark.skipif(
+    os.getenv("SCENARIO") != "federation",
+    reason=(
+        "Current scenario is not federation. "
+        "Not running test."
+    )
+)
+def test_horizon_login_federation(host):
+
+    firefox_options = webdriver.FirefoxOptions()
+    selenium_url = host.environment().get(
+        'SELENIUM_REMOTE_URL', 'http://localhost:4500/wd/hub')
+
+    driver = webdriver.Remote(
+        command_executor=selenium_url,
+        options=firefox_options)
+
+    horizon_proto = host.environment().get('HORIZON_PROTO')
+    horizon_url = horizon_proto + "://192.0.2.10"
+    login_url = '/'.join((
+                horizon_url,
+                'auth',
+                'login'))
+
+    try:
+        driver.get(login_url)
+        auth_type_field = driver.find_element(By.ID, 'id_auth_type')
+        select = Select(auth_type_field)
+        select.select_by_value('example_provider_openid')
+        button = driver.find_element(By.CSS_SELECTOR, '.btn-primary')
+
+        try:
+            button.click()
+        except WebDriverException as e:
+            if "Reached error page" in str(e) or "dnsNotFound" in str(e):
+                pass  # This is expected behavior, so we ignore the exception
+            else:
+                raise  # Re-raise if it failed for an unexpected reason
+
+        assert "idp.example.org" in driver.current_url  # nosec B101
+
+    except TimeoutException as e:
+        raise e
+    finally:
+        driver.quit()
diff --git a/zuul.d/scenarios/keystone-federation.yaml b/zuul.d/scenarios/keystone-federation.yaml
index 2f43e15ef..f319880e9 100644
--- a/zuul.d/scenarios/keystone-federation.yaml
+++ b/zuul.d/scenarios/keystone-federation.yaml
@@ -6,6 +6,8 @@
     files: !inherit
       - ^ansible/group_vars/all/keystone.yml
       - ^ansible/roles/keystone/
+      - ^tests/templates/keystone-federation/
+      - ^tests/testinfra/test_horizon.py
     vars:
       scenario: federation
       scenario_images_extra: