diff options
| author | Jakub Darmach <jakub@stackhpc.com> | 2022-09-21 14:36:53 +0200 |
|---|---|---|
| committer | Jakub Darmach <jakub@stackhpc.com> | 2022-10-03 12:36:11 +0200 |
| commit | 98929761191e265474459a0b73fdbeb07afd2bb4 (patch) | |
| tree | 75a46e898194d7f363be2470a367d956f1b999c8 /doc | |
| parent | 81d4d26279d639734263e68da4cf01b28af83d2c (diff) | |
| download | kolla-ansible-98929761191e265474459a0b73fdbeb07afd2bb4.tar.gz kolla-ansible-98929761191e265474459a0b73fdbeb07afd2bb4.zip | |
Keystone OIDC JWKS fix
JWT failed to validate on auth-oidc endpoint used by openstack cli
with "could not find key with kid: XX" error. To fix this we need
to use jwks provided in "jwks_uri" by OIDC metadata endpoint.
Missing "ServerName" directive from vhost config causes redirection
to fail in some cases when external tls is enabled.
- added "keystone_federation_oidc_jwks_uri" variable
- added "OIDCOAuthVerifyJwksUri" to keystone vhost config
- added "ServerName" to keystone vhost config
- jinja templating additional whitespace trimmed to
correct end result indentation and empty newlines
Closes-bug: 1990375
Change-Id: I4f5c1bd8be8e23cf6299ca4bdfd79e9d98c9a9eb
Diffstat (limited to 'doc')
| -rw-r--r-- | doc/source/reference/shared-services/keystone-guide.rst | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/doc/source/reference/shared-services/keystone-guide.rst b/doc/source/reference/shared-services/keystone-guide.rst index 9a51c9331..dc3d766c5 100644 --- a/doc/source/reference/shared-services/keystone-guide.rst +++ b/doc/source/reference/shared-services/keystone-guide.rst @@ -88,6 +88,14 @@ below: - name: "mappingId1" file: "/full/qualified/path/to/mapping/json/file/to/mappingId1" +In some cases it's necessary to add JWKS (JSON Web Key Set) uri. +It is required for auth-openidc endpoint - which is +used by OpenStack command line client. Example config shown below: + +.. code-block:: yaml + + keystone_federation_oidc_jwks_uri: "https://<AUTH PROVIDER>/<ID>/discovery/v2.0/keys" + Identity providers configurations ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ |