diff options
| author | Zuul <zuul@review.opendev.org> | 2022-10-04 14:21:17 +0000 |
|---|---|---|
| committer | Gerrit Code Review <review@openstack.org> | 2022-10-04 14:21:17 +0000 |
| commit | 1cddf8050dd7a87e317a74d17e0680e9fdfd438b (patch) | |
| tree | dba99a93996b7db19c8158c2570fad930c5a2baf /ansible | |
| parent | 0052deac23c8e31c1dcbf47cc0c4664643303c13 (diff) | |
| parent | 98929761191e265474459a0b73fdbeb07afd2bb4 (diff) | |
| download | kolla-ansible-1cddf8050dd7a87e317a74d17e0680e9fdfd438b.tar.gz kolla-ansible-1cddf8050dd7a87e317a74d17e0680e9fdfd438b.zip | |
Merge "Keystone OIDC JWKS fix"
Diffstat (limited to 'ansible')
| -rw-r--r-- | ansible/roles/keystone/defaults/main.yml | 1 | ||||
| -rw-r--r-- | ansible/roles/keystone/templates/wsgi-keystone.conf.j2 | 12 |
2 files changed, 11 insertions, 2 deletions
diff --git a/ansible/roles/keystone/defaults/main.yml b/ansible/roles/keystone/defaults/main.yml index 83ae28dc7..b6d148b2b 100644 --- a/ansible/roles/keystone/defaults/main.yml +++ b/ansible/roles/keystone/defaults/main.yml @@ -220,6 +220,7 @@ keystone_container_federation_oidc_attribute_mappings_folder: "{{ container_conf keystone_host_federation_oidc_metadata_folder: "{{ node_config_directory }}/keystone/federation/oidc/metadata" keystone_host_federation_oidc_idp_certificate_folder: "{{ node_config_directory }}/keystone/federation/oidc/cert" keystone_host_federation_oidc_attribute_mappings_folder: "{{ node_config_directory }}/keystone/federation/oidc/attribute_maps" +keystone_federation_oidc_jwks_uri: "" # These variables are used to define multiple trusted Horizon dashboards. # keystone_trusted_dashboards: ['<https://dashboardServerOne/auth/websso/>', '<https://dashboardServerTwo/auth/websso/>', '<https://dashboardServerN/auth/websso/>'] diff --git a/ansible/roles/keystone/templates/wsgi-keystone.conf.j2 b/ansible/roles/keystone/templates/wsgi-keystone.conf.j2 index 5ece77026..a78266bd7 100644 --- a/ansible/roles/keystone/templates/wsgi-keystone.conf.j2 +++ b/ansible/roles/keystone/templates/wsgi-keystone.conf.j2 @@ -39,6 +39,11 @@ LogLevel info <VirtualHost *:{{ keystone_public_listen_port }}> +{# NOTE(darmach): with external tls enabled OIDC redirection fails, as TLS terminated on haproxy keystone is not aware that redirection should use https. -#} +{# With missing ServerName Keystone Apache uses fqdn, with http. Adding ServerName pointing to keystone_public_url corrects this. -#} +{% if kolla_enable_tls_external | bool %} + ServerName {{ keystone_public_url }} +{% endif %} WSGIDaemonProcess keystone-public processes={{ keystone_api_workers }} threads=1 user=keystone group=keystone display-name=keystone-public WSGIProcessGroup keystone-public WSGIScriptAlias / {{ binary_path }}/keystone-wsgi-public @@ -55,7 +60,7 @@ LogLevel info SSLEngine on SSLCertificateFile /etc/keystone/certs/keystone-cert.pem SSLCertificateKeyFile /etc/keystone/certs/keystone-key.pem -{% endif %} +{% endif -%} {% if keystone_enable_federation_openid %} OIDCClaimPrefix "OIDC-" @@ -63,6 +68,9 @@ LogLevel info OIDCResponseType "{{ keystone_federation_oidc_response_type }}" OIDCScope "{{ keystone_federation_oidc_scopes }}" OIDCMetadataDir {{ keystone_container_federation_oidc_metadata_folder }} +{% if keystone_federation_oidc_jwks_uri | length > 0 %} + OIDCOAuthVerifyJwksUri {{ keystone_federation_oidc_jwks_uri }} +{% endif %} {% if keystone_federation_openid_certificate_key_ids | length > 0 %} OIDCOAuthVerifyCertFiles {{ keystone_federation_openid_certificate_key_ids | join(" ") }} {% endif %} @@ -96,7 +104,7 @@ LogLevel info {# CLI / API authentication endpoint -#} {% for idp in keystone_identity_providers %} -{% if idp.protocol == 'openid' %} +{% if idp.protocol == 'openid' -%} <LocationMatch /v3/OS-FEDERATION/identity_providers/{{ idp.name }}/protocols/{{ idp.protocol }}/auth> Require valid-user {# Note(jasonanderson): `auth-openidc` is a special auth type that can -#} |