Merge "Fix keystone with IDP configured."

5 files changed, 382 insertions, 0 deletions

diff --git a/tests/templates/globals-default.j2 b/tests/templates/globals-default.j2
index 80f34b0aa..313e7d5cf 100644
--- a/tests/templates/globals-default.j2
+++ b/tests/templates/globals-default.j2
@@ -282,6 +282,17 @@ enable_valkey: "yes"
 
 {% if scenario == "federation" %}
 enable_keystone_federation: true
+keystone_identity_providers:
+  - name: "example_provider"
+    openstack_domain: "Default"
+    protocol: "openid"
+    identifier: "https://idp.example.org/realms/example"
+    public_name: "Example Provider"
+    attribute_mapping: "sso_oidc_mapping"
+    metadata_folder: "/etc/kolla/config/keystone-httpd/federation/oidc/metadata"
+keystone_identity_mappings:
+  - name: "sso_oidc_mapping"
+    file: "/etc/kolla/config/keystone-httpd/federation/oidc/attribute_maps/attribute_mapping.json"
 {% endif %}
 
 mariadb_monitor_read_only_interval: "30000"
diff --git a/tests/templates/keystone-federation/attribute_mapping.json b/tests/templates/keystone-federation/attribute_mapping.json
new file mode 100644
index 000000000..022cbafd2
--- /dev/null
+++ b/tests/templates/keystone-federation/attribute_mapping.json
@@ -0,0 +1,42 @@
+[
+    {
+        "local": [
+            {
+                "user": {
+                    "name": "{0}",
+                    "email": "{1}",
+                    "domain": {
+                        "name": "{2}"
+                    }
+                },
+                "domain": {
+                    "name": "{2}"
+                },
+                "projects": [
+                    {
+                        "name": "{3}",
+                        "roles": [
+                            {
+                                "name": "member"
+                            }
+                        ]
+                    }
+                ]
+            }
+        ],
+        "remote": [
+            {
+                "type": "OIDC-preferred_username"
+            },
+            {
+                "type": "OIDC-email"
+            },
+            {
+                "type": "OIDC-openstack-user-domain"
+            },
+            {
+                "type": "OIDC-openstack-default-project"
+            }
+        ]
+    }
+]
diff --git a/tests/templates/keystone-federation/idp.example.org%2Frealms%2Fexample.client.j2 b/tests/templates/keystone-federation/idp.example.org%2Frealms%2Fexample.client.j2
new file mode 100644
index 000000000..253898f3a
--- /dev/null
+++ b/tests/templates/keystone-federation/idp.example.org%2Frealms%2Fexample.client.j2
@@ -0,0 +1,4 @@
+{
+  "client_id":"keystone",
+  "client_secret":"example_secret"
+}
diff --git a/tests/templates/keystone-federation/idp.example.org%2Frealms%2Fexample.conf.j2 b/tests/templates/keystone-federation/idp.example.org%2Frealms%2Fexample.conf.j2
new file mode 100644
index 000000000..0967ef424
--- /dev/null
+++ b/tests/templates/keystone-federation/idp.example.org%2Frealms%2Fexample.conf.j2
@@ -0,0 +1 @@
+{}
diff --git a/tests/templates/keystone-federation/idp.example.org%2Frealms%2Fexample.provider.j2 b/tests/templates/keystone-federation/idp.example.org%2Frealms%2Fexample.provider.j2
new file mode 100644
index 000000000..c45eb26f9
--- /dev/null
+++ b/tests/templates/keystone-federation/idp.example.org%2Frealms%2Fexample.provider.j2
@@ -0,0 +1,324 @@
+{
+  "issuer": "https://idp.example.org/realms/example",
+  "authorization_endpoint": "https://idp.example.org/realms/example/protocol/openid-connect/auth",
+  "token_endpoint": "https://idp.example.org/realms/example/protocol/openid-connect/token",
+  "introspection_endpoint": "https://idp.example.org/realms/example/protocol/openid-connect/token/introspect",
+  "userinfo_endpoint": "https://idp.example.org/realms/example/protocol/openid-connect/userinfo",
+  "end_session_endpoint": "https://idp.example.org/realms/example/protocol/openid-connect/logout",
+  "frontchannel_logout_session_supported": true,
+  "frontchannel_logout_supported": true,
+  "jwks_uri": "https://idp.example.org/realms/example/protocol/openid-connect/certs",
+  "check_session_iframe": "https://idp.example.org/realms/example/protocol/openid-connect/login-status-iframe.html",
+  "grant_types_supported": [
+    "authorization_code",
+    "implicit",
+    "refresh_token",
+    "password",
+    "client_credentials",
+    "urn:openid:params:grant-type:ciba",
+    "urn:ietf:params:oauth:grant-type:device_code"
+  ],
+  "acr_values_supported": [
+    "0",
+    "1"
+  ],
+  "response_types_supported": [
+    "code",
+    "none",
+    "id_token",
+    "token",
+    "id_token token",
+    "code id_token",
+    "code token",
+    "code id_token token"
+  ],
+  "subject_types_supported": [
+    "public",
+    "pairwise"
+  ],
+  "prompt_values_supported": [
+    "none",
+    "login",
+    "consent"
+  ],
+  "id_token_signing_alg_values_supported": [
+    "PS384",
+    "RS384",
+    "EdDSA",
+    "ES384",
+    "HS256",
+    "HS512",
+    "ES256",
+    "RS256",
+    "HS384",
+    "ES512",
+    "PS256",
+    "PS512",
+    "RS512"
+  ],
+  "id_token_encryption_alg_values_supported": [
+    "ECDH-ES+A256KW",
+    "ECDH-ES+A192KW",
+    "ECDH-ES+A128KW",
+    "RSA-OAEP",
+    "RSA-OAEP-256",
+    "RSA1_5",
+    "ECDH-ES"
+  ],
+  "id_token_encryption_enc_values_supported": [
+    "A256GCM",
+    "A192GCM",
+    "A128GCM",
+    "A128CBC-HS256",
+    "A192CBC-HS384",
+    "A256CBC-HS512"
+  ],
+  "userinfo_signing_alg_values_supported": [
+    "PS384",
+    "RS384",
+    "EdDSA",
+    "ES384",
+    "HS256",
+    "HS512",
+    "ES256",
+    "RS256",
+    "HS384",
+    "ES512",
+    "PS256",
+    "PS512",
+    "RS512",
+    "none"
+  ],
+  "userinfo_encryption_alg_values_supported": [
+    "ECDH-ES+A256KW",
+    "ECDH-ES+A192KW",
+    "ECDH-ES+A128KW",
+    "RSA-OAEP",
+    "RSA-OAEP-256",
+    "RSA1_5",
+    "ECDH-ES"
+  ],
+  "userinfo_encryption_enc_values_supported": [
+    "A256GCM",
+    "A192GCM",
+    "A128GCM",
+    "A128CBC-HS256",
+    "A192CBC-HS384",
+    "A256CBC-HS512"
+  ],
+  "request_object_signing_alg_values_supported": [
+    "PS384",
+    "RS384",
+    "EdDSA",
+    "ES384",
+    "HS256",
+    "HS512",
+    "ES256",
+    "RS256",
+    "HS384",
+    "ES512",
+    "PS256",
+    "PS512",
+    "RS512",
+    "none"
+  ],
+  "request_object_encryption_alg_values_supported": [
+    "ECDH-ES+A256KW",
+    "ECDH-ES+A192KW",
+    "ECDH-ES+A128KW",
+    "RSA-OAEP",
+    "RSA-OAEP-256",
+    "RSA1_5",
+    "ECDH-ES"
+  ],
+  "request_object_encryption_enc_values_supported": [
+    "A256GCM",
+    "A192GCM",
+    "A128GCM",
+    "A128CBC-HS256",
+    "A192CBC-HS384",
+    "A256CBC-HS512"
+  ],
+  "response_modes_supported": [
+    "query",
+    "fragment",
+    "form_post",
+    "query.jwt",
+    "fragment.jwt",
+    "form_post.jwt",
+    "jwt"
+  ],
+  "registration_endpoint": "https://idp.example.org/realms/example/clients-registrations/openid-connect",
+  "token_endpoint_auth_methods_supported": [
+    "private_key_jwt",
+    "client_secret_basic",
+    "client_secret_post",
+    "tls_client_auth",
+    "client_secret_jwt"
+  ],
+  "token_endpoint_auth_signing_alg_values_supported": [
+    "PS384",
+    "RS384",
+    "EdDSA",
+    "ES384",
+    "HS256",
+    "HS512",
+    "ES256",
+    "RS256",
+    "HS384",
+    "ES512",
+    "PS256",
+    "PS512",
+    "RS512"
+  ],
+  "introspection_endpoint_auth_methods_supported": [
+    "private_key_jwt",
+    "client_secret_basic",
+    "client_secret_post",
+    "tls_client_auth",
+    "client_secret_jwt"
+  ],
+  "introspection_endpoint_auth_signing_alg_values_supported": [
+    "PS384",
+    "RS384",
+    "EdDSA",
+    "ES384",
+    "HS256",
+    "HS512",
+    "ES256",
+    "RS256",
+    "HS384",
+    "ES512",
+    "PS256",
+    "PS512",
+    "RS512"
+  ],
+  "authorization_signing_alg_values_supported": [
+    "PS384",
+    "RS384",
+    "EdDSA",
+    "ES384",
+    "HS256",
+    "HS512",
+    "ES256",
+    "RS256",
+    "HS384",
+    "ES512",
+    "PS256",
+    "PS512",
+    "RS512"
+  ],
+  "authorization_encryption_alg_values_supported": [
+    "ECDH-ES+A256KW",
+    "ECDH-ES+A192KW",
+    "ECDH-ES+A128KW",
+    "RSA-OAEP",
+    "RSA-OAEP-256",
+    "RSA1_5",
+    "ECDH-ES"
+  ],
+  "authorization_encryption_enc_values_supported": [
+    "A256GCM",
+    "A192GCM",
+    "A128GCM",
+    "A128CBC-HS256",
+    "A192CBC-HS384",
+    "A256CBC-HS512"
+  ],
+  "claims_supported": [
+    "aud",
+    "sub",
+    "iss",
+    "auth_time",
+    "name",
+    "given_name",
+    "family_name",
+    "preferred_username",
+    "email",
+    "acr"
+  ],
+  "claim_types_supported": [
+    "normal"
+  ],
+  "claims_parameter_supported": true,
+  "scopes_supported": [
+    "openid",
+    "roles",
+    "acr",
+    "profile",
+    "address",
+    "basic",
+    "offline_access",
+    "groups",
+    "email",
+    "phone",
+    "service_account",
+    "web-origins",
+    "microprofile-jwt"
+  ],
+  "request_parameter_supported": true,
+  "request_uri_parameter_supported": true,
+  "require_request_uri_registration": true,
+  "code_challenge_methods_supported": [
+    "plain",
+    "S256"
+  ],
+  "tls_client_certificate_bound_access_tokens": true,
+  "revocation_endpoint": "https://idp.example.org/realms/example/protocol/openid-connect/revoke",
+  "revocation_endpoint_auth_methods_supported": [
+    "private_key_jwt",
+    "client_secret_basic",
+    "client_secret_post",
+    "tls_client_auth",
+    "client_secret_jwt"
+  ],
+  "revocation_endpoint_auth_signing_alg_values_supported": [
+    "PS384",
+    "RS384",
+    "EdDSA",
+    "ES384",
+    "HS256",
+    "HS512",
+    "ES256",
+    "RS256",
+    "HS384",
+    "ES512",
+    "PS256",
+    "PS512",
+    "RS512"
+  ],
+  "backchannel_logout_supported": true,
+  "backchannel_logout_session_supported": true,
+  "device_authorization_endpoint": "https://idp.example.org/realms/example/protocol/openid-connect/auth/device",
+  "backchannel_token_delivery_modes_supported": [
+    "poll",
+    "ping"
+  ],
+  "backchannel_authentication_endpoint": "https://idp.example.org/realms/example/protocol/openid-connect/ext/ciba/auth",
+  "backchannel_authentication_request_signing_alg_values_supported": [
+    "PS384",
+    "RS384",
+    "EdDSA",
+    "ES384",
+    "ES256",
+    "RS256",
+    "ES512",
+    "PS256",
+    "PS512",
+    "RS512"
+  ],
+  "require_pushed_authorization_requests": false,
+  "pushed_authorization_request_endpoint": "https://idp.example.org/realms/example/protocol/openid-connect/ext/par/request",
+  "mtls_endpoint_aliases": {
+    "token_endpoint": "https://idp.example.org/realms/example/protocol/openid-connect/token",
+    "revocation_endpoint": "https://idp.example.org/realms/example/protocol/openid-connect/revoke",
+    "introspection_endpoint": "https://idp.example.org/realms/example/protocol/openid-connect/token/introspect",
+    "device_authorization_endpoint": "https://idp.example.org/realms/example/protocol/openid-connect/auth/device",
+    "registration_endpoint": "https://idp.example.org/realms/example/clients-registrations/openid-connect",
+    "userinfo_endpoint": "https://idp.example.org/realms/example/protocol/openid-connect/userinfo",
+    "pushed_authorization_request_endpoint": "https://idp.example.org/realms/example/protocol/openid-connect/ext/par/request",
+    "backchannel_authentication_endpoint": "https://idp.example.org/realms/example/protocol/openid-connect/ext/ciba/auth"
+  },
+  "authorization_response_iss_parameter_supported": true
+}
+