Federate with Identity Service

1. Use SSH to connect to Red Hat OpenStack director:

   # ssh undercloud-0

   Copy to Clipboard Toggle word wrap

2. Become the stack user:

   $ su - stack

   Copy to Clipboard Toggle word wrap

3. Source the stackrc configuration to enable the required OpenStack environment variables:

   $ source stackrc

   Copy to Clipboard Toggle word wrap

4. After you source stackrc, you can issue commands using the openstack command line tool, which operates against Red Hat OpenStack Platform director. To directly access one of the overcloud nodes, retrieve the ip address by using openstack server list and then using SSH to connect:

   (undercloud) [stack@director ~]$ openstack server list -c Name -c Networks
   +----------------------+-----------------------+
   | Name                 | Networks              |
   +----------------------+-----------------------+
   | rhosp-controller-0   | ctlplane=10.94.101.11 |
   | rhosp-controller-1   | ctlplane=10.94.101.14 |
   | rhosp-controller-2   | ctlplane=10.94.101.17 |
   | rhosp-hypervisor-0   | ctlplane=10.94.101.18 |
   | rhosp-hypervisor-1   | ctlplane=10.94.101.20 |
   +----------------------+-----------------------+
   
   $ ssh heat-admin@10.94.101.11

   Copy to Clipboard Toggle word wrap

Procedure

1. Create a user jdoe in IdM:

   $ipa user-add --first John --last Doe --email jdoe@example.com jdoe

   Copy to Clipboard Toggle word wrap

2. Assign a password to the user:

   $ipa passwd jdoe

   Copy to Clipboard Toggle word wrap

Procedure

1. Ensure that the openstack-users group does not exist:

   $ ipa group-show openstack-users
   ipa: ERROR: openstack-users: group not found

   Copy to Clipboard Toggle word wrap

2. Add the openstack-users group to IdM:

   ipa group-add openstack-users

   Copy to Clipboard Toggle word wrap

3. Add the test users to the openstack-users group:

   ipa group-add-member --users jdoe openstack-users

   Copy to Clipboard Toggle word wrap

4. Verify that the openstack-users group exists and has the test user as a member:

   $ ipa group-show openstack-users
     Group name: openstack-users
     GID: 331400001
     Member users: jdoe

   Copy to Clipboard Toggle word wrap

Procedure

1. From the drop-down list in the uppper left corner, select your RH-SSO realm.
2. From the Configure panel, select User Federation.
3. From the Add provider drop-down list in the User Federation panel, select ldap.

4. Provide values for the following parameters. Substitute all site-specific values with values relevant to your environment.

   Expand

   Property	Value
   Console Display Name	Red Hat IDM
   Edit Mode	READ_ONLY
   Sync Registrations	Off
   Vendor	Red Hat Directory Server
   Username LDAP attribute	uid
   RDN LDAP attribute	uid
   UUID LDAP attribute	ipaUniqueID
   User Object Classes	inetOrgPerson, organizationalPerson
   Connection URL	LDAPS://<_FED_IPA_HOST_>
   Users DN	cn=users,cn=accounts,<_FED_IPA_BASE_DN_>
   Authentication Type	simple
   Bind DN	uid=rhsso,cn=sysaccounts,cn=etc,<_FED_IPA_BASE_DN_>
   Bind Credential	<_FED_IPA_RHSSO_SERVICE_PASSWD_>

   Show more
5. Use the Test connection and Test authentication buttons to ensure that user federation is working.
6. Click Save to save the new user federation provider.
7. Click the Mappers tab at the top of the Red Hat IdM user federation page you created.
8. Create a mapper to retrieve the user group information. A user’s group membership returns the SAM assertion. Use group membership later to provide authorization in OpenStack.
9. Click Create in the Mappers page.

10. On the Add user federation mapper page, select group-ldap-mapper from the Mapper Type drop-down list, and name it Group Mapper. Provide values for the following parameters. Substitute all site-specific values with values relevant to your environment.

    Expand

    Property	Value
    LDAP Groups DN	cn=groups,cn=accounts„<_FED_IPA_BASE_DN_>
    Group Name LDAP Attribute	cn
    Group Object Classes	groupOfNames
    Membership LDAP Attribute	member
    Membership Attribute Type	DN
    Mode	READ_ONLY
    User Groups Retrieve Strategy	GET_GROUPS_FROM_USER_MEMBEROF_ATTRIBUTE

    Show more
11. Click Save.

Procedure

1. In the RH-SSO administration web console, select <_FED_RHSSO_REALM_> from the drop-down list in the upper left corner.
2. Select Clients from the Configure panel.
3. Select the service provider client that keycloak-httpd-client-install configured. You can identify the client with the SAML EntityId.
4. Select the mappers tab from the horizontal list of tabs.
5. In the Mappers panel, select Create or Add Builtin to add a protocol mapper to the client.

Procedure

1. Click the Create button in the Mappers Panel.
2. In the Create Protocol Mapper panel, select Group list from the Mapper tpe drop-down list.
3. Enter Group List as a name in the Name field.

4. Enter groups as the name of the SAML attribute in the Group attribute Name field.

   Note

   This is the name of the attribute as it appears in the SAML assertion. When the keystone mapper searches for names in the Remote section of the mapping declaration, it searches for the SAML attrubute name. When you add an attribute in RH-SSO to be passed in the assertion, specify the SAML attribute name. You define the name in the RH-SSO protocol mapper.

5. In the SAML Attribute NameFormat parameter, select Basic.
6. In the Single Group Attribute toggle box, select On.
7. Click Save.

1. Confirm this value in overcloudrc:

   export OS_AUTH_URL=https://10.0.0.101:13000/v2.0

   Copy to Clipboard Toggle word wrap

2. Assign the IP address a fully qualified domain name (FQDN), and write it to the /etc/hosts file. This example uses overcloud.localdomain:

   10.0.0.101 overcloud.localdomain # FQDN of the external VIP

   Copy to Clipboard Toggle word wrap
   Note

   Although Red Hat OpenStack Platform director configures the hosts files on the overcloud nodes, you might need to add the host entry on any external hosts that participate.

3. Set the $FED_KEYSTONE_HOST and $FED_KEYSTONE_HTTPS_PORT in the fed_variables file. This example uses the same values:

   FED_KEYSTONE_HOST="overcloud.localdomain"
   FED_KEYSTONE_HTTPS_PORT=13000

   Copy to Clipboard Toggle word wrap

1. On the undercloud node, as the stack user, create the fed_deployment directory. This location is the file stash:

   $ su - stack
   $ mkdir fed_deployment

   Copy to Clipboard Toggle word wrap
   Note

   You can use the configure-federation script to perform the previous step:

   $ ./configure-federation initialize

   Copy to Clipboard Toggle word wrap

2. Use SSH to connect to controller-0, and create the ~/fed_deployment directory as the head-admin user. This location is the file stash:

   $ ssh heat-admin@controller-0
   $ mkdir fed_deployment

   Copy to Clipboard Toggle word wrap
   Note

   You can use the configure-federation script to perform the previous step. From the controller-0 node:

   $ ./configure-federation initialize

   Copy to Clipboard Toggle word wrap

Procedure

1. Open the v3_mellon_keycloak_openstack.conf configuration file for editing:

1. Add the MellonMergeEnvVars parameter to the <Location /v3> block:

     <Location /v3>
         ...
         MellonMergeEnvVars On ";"
     </Location>

   Copy to Clipboard Toggle word wrap

1. Create the compressed archive:

   mkdir fed_deployment && cd fed_deployment
   tar -czvf rhsso_config.tar.gz \
     --exclude '*.orig' \
     --exclude '*~' \
     /var/lib/config-data/puppet-generated/keystone/etc/httpd/saml2 \
     /var/lib/config-data/puppet-generated/keystone/etc/httpd/conf.d/v3_mellon_keycloak_openstack.conf

   Copy to Clipboard Toggle word wrap

1. Create the fed_deployment/puppet_override_apache.yaml environment file and add the following content:

     parameter_defaults:
       ControllerExtraConfig:
         apache::purge_configs: false

   Copy to Clipboard Toggle word wrap

2. Add puppet_override_apache.yaml as the last environment file in the overcloud_deploy.sh script:

   ...
     -e /home/stack/fed_deployment/puppet_override_apache.yaml \
     --log-file overcloud_deployment_14.log &> overcloud_install.log

   Copy to Clipboard Toggle word wrap

Procedure

1. To enable persistence in the keystone_public block of the /var/lib/config-data/puppet-generated/haproxy/etc/haproxy/haproxy.cfg configuration file, add the following line:

   cookie SERVERID insert indirect nocache

   Copy to Clipboard Toggle word wrap

   This setting states that SERVERID is the name of the persistence cookie.

2. Edit each server line and add cookie <server-name> as an additional option:

   server controller-0 cookie controller-0
   server controller-1 cookie controller-1

   Copy to Clipboard Toggle word wrap

Procedure

1. Source the overcloudrc file on the undercloud as the stack user, and run the following commands:

   $ openstack domain create federated_domain
   $ openstack project create  --domain federated_domain federated_project
   $ openstack group create federated_users --domain federated_domain
   $ openstack role add --group federated_users --group-domain federated_domain --domain federated_domain _member_
   $ openstack role add --group federated_users --group-domain federated_domain --project federated_project _member_

   Copy to Clipboard Toggle word wrap

Procedure

1. Locate the entityID of the RH-SSO IdP, which is located in the IdP metadata. The IdP metadata is stored in the /var/lib/config-data/puppet-generated/keystone/etc/httpd/saml2/v3_keycloak_$FED_RHSSO_REALM_idp_metadata.xml file. You can also find the IdP metadata in the fed_deployment/var/lib/config-data/puppet-generated/keystone/etc/httpd/saml2/v3_keycloak_$FED_RHSSO_REALM_idp_metadata.xml file.
2. Note the value of the entityID attribute, which is in the IdP metadata file within the <EntityDescriptor> element. Assign the $FED_IDP_ENTITY_ID variable this value.

3. Name your IdP rhsso, which is assigned to the variable $FED_OPENSTACK_IDP_NAME:

   $ openstack identity provider create --remote-id $FED_IDP_ENTITY_ID $FED_OPENSTACK_IDP_NAME

   Copy to Clipboard Toggle word wrap

1. These are the mapping rules used in this example (as described in the introduction):

   [
       {
           "local": [
               {
                   "user": {
                       "name": "{0}"
                   },
                   "group": {
                       "domain": {
                           "name": "federated_domain"
                       },
                       "name": "federated_users"
                   }
               }
           ],
           "remote": [
               {
                   "type": "MELLON_NAME_ID"
               },
               {
                   "type": "MELLON_groups",
                   "any_one_of": ["openstack-users"]
               }
           ]
       }
   ]

   Copy to Clipboard Toggle word wrap

1. The assertion must contain a value called MELLON_NAME_ID.
2. The assertion must contain a values called MELLON_groups and at least one of the groups in the group list must be openstack-users.

1. The keystone user name will be assigned the value from MELLON_NAME_ID.
2. The user will be assigned to the keystone group federated_users in the federated_domain domain.

1. Keystone uses the Mapped protocol to bind an IdP to a mapping. To establish this binding:

   $ openstack federation protocol create \
   --identity-provider $FED_OPENSTACK_IDP_NAME \
   --mapping $FED_OPENSTACK_MAPPING_NAME \
   mapped"

   Copy to Clipboard Toggle word wrap

1. On each controller node, edit /var/lib/config-data/puppet-generated/keystone/etc/httpd/conf.d/10-keystone_wsgi_main.conf to confirm that the ServerName directive inside the VirtualHost block includes the HTTPS scheme, the public hostname, and the public port. You must also enable the UseCanonicalName directive. For example:

   <VirtualHost>
     ServerName https:$FED_KEYSTONE_HOST:$FED_KEYSTONE_HTTPS_PORT
     UseCanonicalName On
     ...
   </VirtualHost>

   Copy to Clipboard Toggle word wrap

1. On each controller node, edit /var/lib/config-data/puppet-generated/horizon/etc/openstack-dashboard/local_settings and make sure the following configuration values are set:

   OPENSTACK_KEYSTONE_URL = "https://$FED_KEYSTONE_HOST:$FED_KEYSTONE_HTTPS_PORT/v3"
   OPENSTACK_KEYSTONE_DEFAULT_ROLE = "_member_"
   WEBSSO_ENABLED = True
   WEBSSO_INITIAL_CHOICE = "mapped"
   WEBSSO_CHOICES = (
       ("mapped", _("RH-SSO")),
       ("credentials", _("Keystone Credentials")),
   )

   Copy to Clipboard Toggle word wrap

1. On each controller node, edit /var/lib/config-data/puppet-generated/horizon/etc/openstack-dashboard/local_settings and uncomment the line:

   #SECURE_PROXY_SSL_HEADER = ('HTTP_X_FORWARDED_PROTO', 'https')

   Copy to Clipboard Toggle word wrap

1. The file mapping_rules.json has this content:

   [
       {
           "local": [
               {
                   "user": {
                       "name": "{0}"
                   },
                   "group": {
                       "domain": {
                           "name": "Default"
                       },
                       "name": "federated_users"
                   }
               }
           ],
           "remote": [
               {
                   "type": "MELLON_NAME_ID"
               },
               {
                   "type": "MELLON_groups",
                   "any_one_of": ["openstack-users"]
               }
           ]
       }
   ]

   Copy to Clipboard Toggle word wrap

2. The file assertion_data.txt has this content:

   MELLON_NAME_ID: 'G-90eb44bc-06dc-4a90-aa6e-fb2aa5d5b0de
   MELLON_groups: openstack-users;ipausers

   Copy to Clipboard Toggle word wrap

3. If you then run this command:

   $ keystone-manage mapping_engine --rules mapping_rules.json --input assertion_data.txt

   Copy to Clipboard Toggle word wrap

4. You should get this mapped result:

   {
     "group_ids": [],
     "user": {
       "domain": {
         "id": "Federated"
       },
       "type": "ephemeral",
       "name": "'G-90eb44bc-06dc-4a90-aa6e-fb2aa5d5b0de"
     },
     "group_names": [
       {
         "domain": {
           "name": "Default"
         },
         "name": "federated_users"
       }
     ]
   }

   Copy to Clipboard Toggle word wrap

1. Create the following test script in /var/www/cgi-bin/keystone/test with the following content:

   import pprint
   import webob
   import webob.dec
   
   
   @webob.dec.wsgify
   def application(req):
       return webob.Response(pprint.pformat(req.environ),
                             content_type='application/json')

   Copy to Clipboard Toggle word wrap

2. Edit the /var/lib/config-data/puppet-generated/keystone/etc/httpd/conf.d/10-keystone_wsgi_main.conf file setting it to run the test script by temporarily modifying the WSGIScriptAlias directive:

   WSGIScriptAlias "/v3/auth/OS-FEDERATION/websso/mapped" "/var/www/cgi-bin/keystone/test"

   Copy to Clipboard Toggle word wrap

3. Restart the container:

   podman restart keystone

   Copy to Clipboard Toggle word wrap
4. Attempt to login, and review the information that the script dumps out. When finished, remember to restore the WSGIScriptAlias directive, and restart the HTTPD service again.

1. Install SAMLTracer from this URL: https://addons.mozilla.org/en-US/firefox/addon/saml-tracer/
2. Enable SAMLTracer from the Firefox menu. A SAMLTracer pop-up window will appear in which all browser requests are displayed. If a request is detected as a SAML message a special SAML icon is added to the request.
3. Initiate a SSO login from the Firefox browser.
4. In the SAMLTracer window find the first SAML message and click on it. Use the SAML tab in the window to see the decoded SAML message (note, the tool is not capable of decrypting encrypted content in the body of the message, if you need to see encrypted content you must disable encryption in the metadata). The first SAML message should be an AuthnRequest sent by the SP to the IdP. The second SAML message should be the assertion response sent by the IdP. Since the SAML HTTP-Redirect profile is being used the Assertion response will be wrapped in a POST. Click on the SAML tab to see the contents of the assertion.