From 2e9f2caaf8a8eb19563a1085e6a23d778b279dbc Mon Sep 17 00:00:00 2001 From: Pierre Riteau Date: Tue, 7 Apr 2026 18:34:55 +0200 Subject: Remove deleted mod_auth_openidc option The option OIDCTokenBindingPolicy was deleted from mod_auth_openidc [1]. Remove it from our documentation. SSO with Keycloak was successfully tested without it. Keep documentation about keystone_federation_oidc_additional_options by using OIDCOutgoingProxy instead. [1] https://github.com/OpenIDC/mod_auth_openidc/commit/f9a52507acee0817b9cc91ec194bcea894f77ee0 Change-Id: Icfe4ef0f6070a97c4e43f691643169e71cc2772a Signed-off-by: Pierre Riteau --- doc/source/reference/shared-services/keystone-guide.rst | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/doc/source/reference/shared-services/keystone-guide.rst b/doc/source/reference/shared-services/keystone-guide.rst index b92230dcb..5f5bc60ac 100644 --- a/doc/source/reference/shared-services/keystone-guide.rst +++ b/doc/source/reference/shared-services/keystone-guide.rst @@ -96,13 +96,13 @@ used by OpenStack command line client. Example config shown below: keystone_federation_oidc_jwks_uri: "https:////discovery/v2.0/keys" -Some identity providers need additional mod_auth_openidc config. -Example for Keycloak shown below: +Some identity providers need additional ``mod_auth_openidc`` config, which can +be passed with the ``keystone_federation_oidc_additional_options`` variable: .. code-block:: yaml keystone_federation_oidc_additional_options: - OIDCTokenBindingPolicy: disabled + OIDCOutgoingProxy: "http://proxy.example.com" When using OIDC, operators can also use the following variable to customize the delay to retry authenticating in the IdP if the -- cgit v1.2.3