Chapter 4. Configuring Red Hat OpenStack Platform for Federation

1. Confirm this value in overcloudrc:

   export OS_AUTH_URL=https://10.0.0.101:13000/v2.0

   Copy to Clipboard Toggle word wrap

2. Assign the IP address a fully qualified domain name (FQDN), and write it to the /etc/hosts file. This example uses overcloud.localdomain:

   10.0.0.101 overcloud.localdomain # FQDN of the external VIP

   Copy to Clipboard Toggle word wrap
   Note

   Although Red Hat OpenStack Platform director configures the hosts files on the overcloud nodes, you might need to add the host entry on any external hosts that participate.

3. Set the $FED_KEYSTONE_HOST and $FED_KEYSTONE_HTTPS_PORT in the fed_variables file. This example uses the same values:

   FED_KEYSTONE_HOST="overcloud.localdomain"
   FED_KEYSTONE_HTTPS_PORT=13000

   Copy to Clipboard Toggle word wrap

1. On the undercloud node, as the stack user, create the fed_deployment directory. This location is the file stash:

   $ su - stack
   $ mkdir fed_deployment

   Copy to Clipboard Toggle word wrap
   Note

   You can use the configure-federation script to perform the previous step:

   $ ./configure-federation initialize

   Copy to Clipboard Toggle word wrap

2. Use SSH to connect to controller-0, and create the ~/fed_deployment directory as the head-admin user. This location is the file stash:

   $ ssh heat-admin@controller-0
   $ mkdir fed_deployment

   Copy to Clipboard Toggle word wrap
   Note

   You can use the configure-federation script to perform the previous step. From the controller-0 node:

   $ ./configure-federation initialize

   Copy to Clipboard Toggle word wrap

Procedure

1. Open the v3_mellon_keycloak_openstack.conf configuration file for editing:

1. Add the MellonMergeEnvVars parameter to the <Location /v3> block:

     <Location /v3>
         ...
         MellonMergeEnvVars On ";"
     </Location>

   Copy to Clipboard Toggle word wrap

1. Create the compressed archive:

   mkdir fed_deployment && cd fed_deployment
   tar -czvf rhsso_config.tar.gz \
     --exclude '*.orig' \
     --exclude '*~' \
     /var/lib/config-data/puppet-generated/keystone/etc/httpd/saml2 \
     /var/lib/config-data/puppet-generated/keystone/etc/httpd/conf.d/v3_mellon_keycloak_openstack.conf

   Copy to Clipboard Toggle word wrap

1. Create the fed_deployment/puppet_override_apache.yaml environment file and add the following content:

     parameter_defaults:
       ControllerExtraConfig:
         apache::purge_configs: false

   Copy to Clipboard Toggle word wrap

2. Add puppet_override_apache.yaml as the last environment file in the overcloud_deploy.sh script:

   ...
     -e /home/stack/fed_deployment/puppet_override_apache.yaml \
     --log-file overcloud_deployment_14.log &> overcloud_install.log

   Copy to Clipboard Toggle word wrap

Procedure

1. To enable persistence in the keystone_public block of the /var/lib/config-data/puppet-generated/haproxy/etc/haproxy/haproxy.cfg configuration file, add the following line:

   cookie SERVERID insert indirect nocache

   Copy to Clipboard Toggle word wrap

   This setting states that SERVERID is the name of the persistence cookie.

2. Edit each server line and add cookie <server-name> as an additional option:

   server controller-0 cookie controller-0
   server controller-1 cookie controller-1

   Copy to Clipboard Toggle word wrap

Procedure

1. Source the overcloudrc file on the undercloud as the stack user, and run the following commands:

   $ openstack domain create federated_domain
   $ openstack project create  --domain federated_domain federated_project
   $ openstack group create federated_users --domain federated_domain
   $ openstack role add --group federated_users --group-domain federated_domain --domain federated_domain _member_
   $ openstack role add --group federated_users --group-domain federated_domain --project federated_project _member_

   Copy to Clipboard Toggle word wrap

Procedure

1. Locate the entityID of the RH-SSO IdP, which is located in the IdP metadata. The IdP metadata is stored in the /var/lib/config-data/puppet-generated/keystone/etc/httpd/saml2/v3_keycloak_$FED_RHSSO_REALM_idp_metadata.xml file. You can also find the IdP metadata in the fed_deployment/var/lib/config-data/puppet-generated/keystone/etc/httpd/saml2/v3_keycloak_$FED_RHSSO_REALM_idp_metadata.xml file.
2. Note the value of the entityID attribute, which is in the IdP metadata file within the <EntityDescriptor> element. Assign the $FED_IDP_ENTITY_ID variable this value.

3. Name your IdP rhsso, which is assigned to the variable $FED_OPENSTACK_IDP_NAME:

   $ openstack identity provider create --remote-id $FED_IDP_ENTITY_ID $FED_OPENSTACK_IDP_NAME

   Copy to Clipboard Toggle word wrap

1. These are the mapping rules used in this example (as described in the introduction):

   [
       {
           "local": [
               {
                   "user": {
                       "name": "{0}"
                   },
                   "group": {
                       "domain": {
                           "name": "federated_domain"
                       },
                       "name": "federated_users"
                   }
               }
           ],
           "remote": [
               {
                   "type": "MELLON_NAME_ID"
               },
               {
                   "type": "MELLON_groups",
                   "any_one_of": ["openstack-users"]
               }
           ]
       }
   ]

   Copy to Clipboard Toggle word wrap

1. The assertion must contain a value called MELLON_NAME_ID.
2. The assertion must contain a values called MELLON_groups and at least one of the groups in the group list must be openstack-users.

1. The keystone user name will be assigned the value from MELLON_NAME_ID.
2. The user will be assigned to the keystone group federated_users in the federated_domain domain.

1. Keystone uses the Mapped protocol to bind an IdP to a mapping. To establish this binding:

   $ openstack federation protocol create \
   --identity-provider $FED_OPENSTACK_IDP_NAME \
   --mapping $FED_OPENSTACK_MAPPING_NAME \
   mapped"

   Copy to Clipboard Toggle word wrap

1. On each controller node, edit /var/lib/config-data/puppet-generated/keystone/etc/httpd/conf.d/10-keystone_wsgi_main.conf to confirm that the ServerName directive inside the VirtualHost block includes the HTTPS scheme, the public hostname, and the public port. You must also enable the UseCanonicalName directive. For example:

   <VirtualHost>
     ServerName https:$FED_KEYSTONE_HOST:$FED_KEYSTONE_HTTPS_PORT
     UseCanonicalName On
     ...
   </VirtualHost>

   Copy to Clipboard Toggle word wrap

1. On each controller node, edit /var/lib/config-data/puppet-generated/horizon/etc/openstack-dashboard/local_settings and make sure the following configuration values are set:

   OPENSTACK_KEYSTONE_URL = "https://$FED_KEYSTONE_HOST:$FED_KEYSTONE_HTTPS_PORT/v3"
   OPENSTACK_KEYSTONE_DEFAULT_ROLE = "_member_"
   WEBSSO_ENABLED = True
   WEBSSO_INITIAL_CHOICE = "mapped"
   WEBSSO_CHOICES = (
       ("mapped", _("RH-SSO")),
       ("credentials", _("Keystone Credentials")),
   )

   Copy to Clipboard Toggle word wrap

1. On each controller node, edit /var/lib/config-data/puppet-generated/horizon/etc/openstack-dashboard/local_settings and uncomment the line:

   #SECURE_PROXY_SSL_HEADER = ('HTTP_X_FORWARDED_PROTO', 'https')

   Copy to Clipboard Toggle word wrap