aboutsummaryrefslogtreecommitdiff
path: root/doc/source/reference/shared-services
AgeCommit message (Collapse)AuthorFilesLines
2026-04-16Merge "Fix: Update outdated documentation"Zuul2-8/+8
2026-04-15Fix keystone with IDP configured.Taavi Ansper1-0/+5
1. Add CI coverage for keystone_identity_providers under federation scenario. 2. Add fix for federation config in keystone role if keystone_identity_providers is defined. 3. Update Horizon tests with federation example. 4. Use openstack.cloud ansible modules instead of python-openstackclient in register_identity_providers.yml Closes-Bug: #2134455 Change-Id: Id03bc5770c3856c7c09a34e327b33786d7b7d859 Signed-off-by: Taavi Ansper <taaviansperr@gmail.com>
2026-04-12Fix: Update outdated documentationPiotr Milewski2-8/+8
Change-Id: I5dc53f74afd9a5b565201dc9d3039d82cb65dabc Signed-off-by: Piotr Milewski <vurmil@gmail.com>
2026-04-07Remove deleted mod_auth_openidc optionPierre Riteau1-3/+3
The option OIDCTokenBindingPolicy was deleted from mod_auth_openidc [1]. Remove it from our documentation. SSO with Keycloak was successfully tested without it. Keep documentation about keystone_federation_oidc_additional_options by using OIDCOutgoingProxy instead. [1] https://github.com/OpenIDC/mod_auth_openidc/commit/f9a52507acee0817b9cc91ec194bcea894f77ee0 Change-Id: Icfe4ef0f6070a97c4e43f691643169e71cc2772a Signed-off-by: Pierre Riteau <pierre@stackhpc.com>
2025-10-10Merge "Customize the authentication error timeout page in modOIDC"Zuul1-0/+14
2025-10-09Customize the authentication error timeout page in modOIDCRafael Weingärtner1-0/+14
There is a situation that happens when a user triggers an authentication in OpenStack that uses Identity federation, which leads users to a blank page with an error message that might not be that clear to users. If the user takes too long to enter his/her credentials in the login page of the IdP, the user sees a page saying that the authentication took too much and that the user must try it again. However, if the user tries again, she/he is already logged in to the IdP, and then the user gets access direct to Horizon. This whole process can be a bit confusing for users, and they saw an error page after the login, which leads them to think that there was an error in the authentication, but then when he/she tries again, everything just works. Therefore, to handle such cases we propose Kolla-ansble to use a custom error page that has an automatic redirect if the error happens. The timeout is managed by "OIDCStateTimeout" variable. The default (which is what we have in place now) is 300 seconds (5 minutes): https://github.com/zmartzone/mod_auth_openidc/blob/d13ee0e4bd2cef94c4d2b55829310175288e0bdf/src/mod_auth_openidc.c#L651). I would not recommend the increase of this timeout though. I would rather decrease this value; 5 minutes to such an operation is already too much. This variable can be overridden via wsgi-keystone.conf file. To customize the error page we have the following variable "OIDCHTMLErrorTemplate". The template is processed in the following line: https://github.com/zmartzone/mod_auth_openidc/blob/f2b8315cd48faba04320e9a06fc52b57f0989dcb/src/util.c#L1619. As we can see, there is no default page. The default HTML is hardcoded in C++, and the template requires two "%s" placeholders that will receive the title of the error message and the full description of the error. Change-Id: Iebda3ca7a5f9cef7e5e0930fc4f70764774d6ed5 Signed-off-by: Rafael Weingärtner <rafael@apache.org>
2025-08-07Drop VMware supportMichal Nasiadka1-14/+0
Change-Id: I20a669bf7796285df04723a9110f9c74788600e1 Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2025-03-21Remove Swift roleMichal Nasiadka1-15/+0
Since Swift is broken and since deprecation nobody did pick up the work to make it working - let's remove swift role and associated integrations/CI scripts. Change-Id: I08e92aaeea644053fd25f80ce1f276a495cebbfc
2024-11-27Merge "Skyline: use an external object store (Swift) in the dashboard"Zuul1-0/+15
2024-04-26Skyline: use an external object store (Swift) in the dashboardUwe Jäger1-0/+15
Change-Id: I0247877c245f12994ffab983a624844e1238de9b
2024-04-25Merge "CI: Add codespell to pep8"Zuul1-2/+2
2024-04-23Allow overriding of Skyline logosUwe Jäger1-0/+57
Change-Id: I3975b5266c8700c81439b4d891d446eba2a52e54
2024-04-22CI: Add codespell to pep8Michal Nasiadka1-2/+2
Fix existing spelling errors Change-Id: Ie689cf5a344aaa630a4860448b09242333a8e119
2024-03-15Update Skyline configuration to enable SSOUwe Jäger2-0/+27
Change-Id: I5b4a30e605bb143cf342f83f0c811c25046269ef
2024-02-07Rework horizon role to support local_settings.dMichal Arbet1-2/+2
This patch implements horizon's preferred way how to configure itself described in docs [1], [1] https://docs.openstack.org/horizon/latest/configuration/settings.html Depends-On: https://review.opendev.org/c/openstack/kolla/+/906339 Change-Id: I60ab4634bf4333c47d00b12fc4ec00570062bd18
2023-11-17Merge "Deploy Glance and Cinder Backup with S3 backend support"Zuul1-0/+28
2023-11-15keystone: Add support for OIDC optionsfzakfeld1-0/+8
Introduce keystone_federation_oidc_additional_options variable Change-Id: I39b9f35dab6f4e3ac2fcb505aabd2589e6e2ca69
2023-10-25Deploy Glance and Cinder Backup with S3 backend supportSergei Raiskii1-0/+28
Kolla Ansible should deploy Glance and Cinder Backup with S3 backend support working out-of-the-box. The S3 backend had been re-introduced in Ussuri after being deprecated around the Mitaka timeframe, and having some local object storage options is nice for testing.. Closes-Bug: #1977515 Change-Id: I4ca58382d1ee568bfca2ad108495422163f81260 Co-authored-by: Juan Pablo Suazo <jsuazo@whitestack.com> Co-authored-by: Maksim Malchuk <maksim.malchuk@gmail.com>
2022-10-03Keystone OIDC JWKS fixJakub Darmach1-0/+8
JWT failed to validate on auth-oidc endpoint used by openstack cli with "could not find key with kid: XX" error. To fix this we need to use jwks provided in "jwks_uri" by OIDC metadata endpoint. Missing "ServerName" directive from vhost config causes redirection to fail in some cases when external tls is enabled. - added "keystone_federation_oidc_jwks_uri" variable - added "OIDCOAuthVerifyJwksUri" to keystone vhost config - added "ServerName" to keystone vhost config - jinja templating additional whitespace trimmed to correct end result indentation and empty newlines Closes-bug: 1990375 Change-Id: I4f5c1bd8be8e23cf6299ca4bdfd79e9d98c9a9eb
2022-05-17Delete keystone_token_provider variableRamona Rautenberg1-7/+1
In the last PTG it was decided to drop the keystone_token_provider variable, because there is no other option anymore. Signed-off-by: Ramona Rautenberg <rautenberg@osism.tech> Change-Id: I1ee2c3f9b7dbbbf4633c5874cdbb3c4f8c09e277
2022-01-31horizon: Support custom themesMichal Nasiadka1-0/+24
Custom themes support for horizon deployment. - horizon role task added for copying theme files - added theme copying into the container in templates - docs and reno updated Change-Id: If9982c8e18be31772cb031ef72b7eebd4d768be5 Co-Authored-By: Jakub Darmach <jakub@stackhpc.com> Depends-On: https://review.opendev.org/c/openstack/kayobe/+/824565 Depends-On: https://review.opendev.org/c/openstack/kolla/+/826672
2022-01-09OpenID Connect certifiate file is optionalStig Telfer1-2/+2
Some ID provider configurations do not require a certificate file. Change the logic to allow this, and update documentation accordingly. Change-Id: I2c34a6b5894402bbebeb3fb96768789bc3c7fe84
2021-02-15Add support to OpenID Connect Authentication flowPedro Henrique1-0/+238
This pull request adds support for the OpenID Connect authentication flow in Keystone and enables both ID and access token authentication flows. The ID token configuration is designed to allow users to authenticate via Horizon using an identity federation; whereas the Access token is used to allow users to authenticate in the OpenStack CLI using a federated user. Without this PR, if one wants to configure OpenStack to use identity federation, he/she needs to do a lot of configurations in the keystone, Horizon, and register quite a good number of different parameters using the CLI such as mappings, identity providers, federated protocols, and so on. Therefore, with this PR, we propose a method for operators to introduce/present the IdP's metadata to Kolla-ansible, and based on the presented metadata, Kolla-ansible takes care of all of the configurations to prepare OpenStack to work in a federated environment. Implements: blueprint add-openid-support Co-Authored-By: Jason Anderson <jasonanderson@uchicago.edu> Change-Id: I0203a3470d7f8f2a54d5e126d947f540d93b8210
2020-08-06Enable glance role to copy extra configurationnikparasyr1-0/+29
Glance role copies glance-image-import.conf when enabled to allow configuration of glance interoperable image import. Property protection can be enabled and file is copied. Change-Id: I5106675da5228a5d7e630871f0882269603e6571 Closesl-Bug: #1889272 Signed-off-by: nikparasyr <nik.parasyr@protonmail.com>
2020-02-11Remove kolla-cephMichal Nasiadka1-3/+3
Kolla-Ansible Ceph deployment mechanism has been deprecated in Train [1]. This change removes the Ansible code and associated CI jobs. [1]: https://review.opendev.org/669214 Change-Id: Ie2167f02ad2f525d3b0f553e2c047516acf55bc2
2019-06-17doc: Start using openstackdoctheme's extlink extensionchenxing2-5/+4
This ensures we have version-specific references to other projects [1]. Note that this doesn't mean the URLs are actually valid - we need to do more work (linkcheck?) here, but it's an improvement nonetheless. [1] https://docs.openstack.org/openstackdocstheme/latest/#external-link-helper Change-Id: I118e4d211617c5df66ff04dc04e308a1d2fc67ad
2019-05-17Fix keystone fernet key rotation schedulingMark Goddard2-0/+44
Right now every controller rotates fernet keys. This is nice because should any controller die, we know the remaining ones will rotate the keys. However, we are currently over-rotating the keys. When we over rotate keys, we get logs like this: This is not a recognized Fernet token <token> TokenNotFound Most clients can recover and get a new token, but some clients (like Nova passing tokens to other services) can't do that because it doesn't have the password to regenerate a new token. With three controllers, in crontab in keystone-fernet we see the once a day correctly staggered across the three controllers: ssh ctrl1 sudo cat /etc/kolla/keystone-fernet/crontab 0 0 * * * /usr/bin/fernet-rotate.sh ssh ctrl2 sudo cat /etc/kolla/keystone-fernet/crontab 0 8 * * * /usr/bin/fernet-rotate.sh ssh ctrl3 sudo cat /etc/kolla/keystone-fernet/crontab 0 16 * * * /usr/bin/fernet-rotate.sh Currently with three controllers we have this keystone config: [token] expiration = 86400 (although, keystone default is one hour) allow_expired_window = 172800 (this is the keystone default) [fernet_tokens] max_active_keys = 4 Currently, kolla-ansible configures key rotation according to the following: rotation_interval = token_expiration / num_hosts This means we rotate keys more quickly the more hosts we have, which doesn't make much sense. Keystone docs state: max_active_keys = ((token_expiration + allow_expired_window) / rotation_interval) + 2 For details see: https://docs.openstack.org/keystone/stein/admin/fernet-token-faq.html Rotation is based on pushing out a staging key, so should any server start using that key, other servers will consider that valid. Then each server in turn starts using the staging key, each in term demoting the existing primary key to a secondary key. Eventually you prune the secondary keys when there is no token in the wild that would need to be decrypted using that key. So this all makes sense. This change adds new variables for fernet_token_allow_expired_window and fernet_key_rotation_interval, so that we can correctly calculate the correct number of active keys. We now set the default rotation interval so as to minimise the number of active keys to 3 - one primary, one secondary, one buffer. This change also fixes the fernet cron job generator, which was broken in the following cases: * requesting an interval of more than 1 day resulted in no jobs * requesting an interval of more than 60 minutes, unless an exact multiple of 60 minutes, resulted in no jobs It should now be possible to request any interval up to a week divided by the number of hosts. Change-Id: I10c82dc5f83653beb60ddb86d558c5602153341a Closes-Bug: #1809469
2018-11-23Rework documentation into more specific folderEduardo Gonzalez3-0/+189
Change index to ease identify what service want to look. Split docs into more specific folder such as networking and storage. Change-Id: Ic7ac12b3dd555fa5c018eeb897ccd4a5a2dfe8f3
generated by cgit v1.2.3 (git 2.39.1) at 2026-11-05 20:07:10 +0000