Skip to content

Commit 7937d3f

Browse files
jageejagee
committed
Add support for federation in the horizon UI
This adds a openidc dropbox to the horizon login screen so a user can select openidc as a login type. The horzion UI will the be redirected to the keycloak server for the user authentication and then be passed back to the horizon dashboard as the federated user.
1 parent e12cc67 commit 7937d3f

5 files changed

+71
-2
lines changed

‎hooks/playbooks/federation-controlplane-config.yml

+16-2
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,20 @@
22
- name: Create kustomization to update Keystone to use Federation
33
hosts: "{{ cifmw_target_hook_host | default('localhost') }}"
44
tasks:
5+
- name: Set urls for install type uni
6+
ansible.builtin.set_fact:
7+
cifmw_federation_keycloak_url: 'https://keycloak-openstack.apps.ocp.openstack.lab'
8+
cifmw_federation_keystone_url: 'https://keystone-public-openstack.apps.ocp.openstack.lab'
9+
cifmw_federation_horizon_url: 'https://horizon-openstack.apps.ocp.openstack.lab'
10+
when: cifmw_federation_deploy_type == "uni"
11+
12+
- name: Set urls for install type crc
13+
ansible.builtin.set_fact:
14+
cifmw_federation_keycloak_url: 'https://keycloak-openstack.apps-crc.testing'
15+
cifmw_federation_keystone_url: 'https://keystone-public-openstack.apps-crc.testing'
16+
cifmw_federation_horizon_url: 'https://horizon-openstack.apps-crc.testing'
17+
when: cifmw_federation_deploy_type == "crc"
18+
519
- name: Create file to customize keystone for Federation resources deployed in the control plane
620
ansible.builtin.copy:
721
dest: "{{ cifmw_basedir }}/artifacts/manifests/kustomizations/controlplane/keystone_federation.yaml"
@@ -32,7 +46,7 @@
3246
insecure_debug=true
3347
debug=true
3448
[federation]
35-
trusted_dashboard={{ '{{ .KeystoneEndpointPublic }}' }}/dashboard/auth/websso/
49+
trusted_dashboard={{ cifmw_federation_horizon_url }}/dashboard/auth/websso/
3650
[openid]
3751
remote_id_attribute=HTTP_OIDC_ISS
3852
[auth]
@@ -85,7 +99,7 @@
8599
OIDCOAuthClientID "{{ cifmw_keystone_OIDC_OAuthClientID }}"
86100
OIDCOAuthClientSecret "{{ cifmw_keystone_OIDC_OAuthClientSecret }}"
87101
OIDCOAuthIntrospectionEndpoint "{{ cifmw_keystone_OIDC_OAuthIntrospectionEndpoint }}"
88-
OIDCRedirectURI "{{ '{{ .KeystoneEndpointPublic }}' }}/v3/auth/OS-FEDERATION/identity_providers/{{ cifmw_keystone_OIDC_provider_name }}/protocols/openid/websso"
102+
OIDCRedirectURI "{{ cifmw_federation_keystone_url }}/v3/auth/OS-FEDERATION/identity_providers/{{ cifmw_keystone_OIDC_provider_name }}/protocols/openid/websso"
89103
90104
<LocationMatch "/v3/auth/OS-FEDERATION/identity_providers/{{ cifmw_keystone_OIDC_provider_name }}/protocols/openid/websso">
91105
AuthType "openid-connect"

‎hooks/playbooks/federation-horizon-controlplane-config.yml

+49
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
---
2+
- name: Create kustomization to update Horizon to use Federation
3+
hosts: "{{ cifmw_target_hook_host | default('localhost') }}"
4+
tasks:
5+
- name: Set urls for install type uni
6+
ansible.builtin.set_fact:
7+
cifmw_federation_keycloak_url: 'https://keycloak-openstack.apps.ocp.openstack.lab'
8+
cifmw_federation_keystone_url: 'https://keystone-public-openstack.apps.ocp.openstack.lab'
9+
cifmw_federation_horizon_url: 'https://horizon-openstack.apps.ocp.openstack.lab'
10+
when: cifmw_federation_deploy_type == "uni"
11+
12+
- name: Set urls for install type crc
13+
ansible.builtin.set_fact:
14+
cifmw_federation_keycloak_url: 'https://keycloak-openstack.apps-crc.testing'
15+
cifmw_federation_keystone_url: 'https://keystone-public-openstack.apps-crc.testing'
16+
cifmw_federation_horizon_url: 'https://horizon-openstack.apps-crc.testing'
17+
when: cifmw_federation_deploy_type == "crc"
18+
19+
- name: Create file to customize horizon for Federation resources deployed in the control plane
20+
ansible.builtin.copy:
21+
dest: "{{ cifmw_basedir }}/artifacts/manifests/kustomizations/controlplane/horizon_federation.yaml"
22+
content: |-
23+
apiVersion: kustomize.config.k8s.io/v1beta1
24+
kind: Kustomization
25+
resources:
26+
- namespace: {{ namespace }}
27+
patches:
28+
- target:
29+
kind: OpenStackControlPlane
30+
name: .*
31+
patch: |-
32+
- op: add
33+
path: /spec/horizon/enabled
34+
value: true
35+
- op: add
36+
path: /spec/horizon/template/memcachedInstance
37+
value: memcached
38+
- op: add
39+
path: /spec/horizon/template/customServiceConfig
40+
value: |
41+
OPENSTACK_KEYSTONE_URL = "{{ cifmw_federation_keystone_url }}/v3"
42+
WEBSSO_ENABLED = True
43+
WEBSSO_CHOICES = (
44+
("credentials", _("Keystone Credentials")),
45+
("OIDC", _("OpenID Connect")),
46+
)
47+
WEBSSO_IDP_MAPPING = {
48+
"OIDC": ("{{ cifmw_keystone_OIDC_provider_name }}", "openid"),
49+
}

‎hooks/playbooks/federation-post-deploy.yml

+2
Original file line numberDiff line numberDiff line change
@@ -22,12 +22,14 @@
2222
ansible.builtin.set_fact:
2323
cifmw_federation_keycloak_url: 'https://keycloak-openstack.apps.ocp.openstack.lab'
2424
cifmw_federation_keystone_url: 'https://keystone-public-openstack.apps.ocp.openstack.lab'
25+
cifmw_federation_horizon_url: 'https://horizon-openstack.apps.ocp.openstack.lab'
2526
when: cifmw_federation_deploy_type == "uni"
2627

2728
- name: Set urls for install type crc
2829
ansible.builtin.set_fact:
2930
cifmw_federation_keycloak_url: 'https://keycloak-openstack.apps-crc.testing'
3031
cifmw_federation_keystone_url: 'https://keystone-public-openstack.apps-crc.testing'
32+
cifmw_federation_horizon_url: 'https://horizon-openstack.apps-crc.testing'
3133
when: cifmw_federation_deploy_type == "crc"
3234

3335
- name: Run federation setup on OSP

‎hooks/playbooks/federation-pre-deploy.yml

+2
Original file line numberDiff line numberDiff line change
@@ -22,12 +22,14 @@
2222
ansible.builtin.set_fact:
2323
cifmw_federation_keycloak_url: 'https://keycloak-openstack.apps.ocp.openstack.lab'
2424
cifmw_federation_keystone_url: 'https://keystone-public-openstack.apps.ocp.openstack.lab'
25+
cifmw_federation_horizon_url: 'https://horizon-openstack.apps.ocp.openstack.lab'
2526
when: cifmw_federation_deploy_type == "uni"
2627

2728
- name: Set urls for install type crc
2829
ansible.builtin.set_fact:
2930
cifmw_federation_keycloak_url: 'https://keycloak-openstack.apps-crc.testing'
3031
cifmw_federation_keystone_url: 'https://keystone-public-openstack.apps-crc.testing'
32+
cifmw_federation_horizon_url: 'https://horizon-openstack.apps-crc.testing'
3133
when: cifmw_federation_deploy_type == "crc"
3234

3335
- name: Run SSO pod setup on Openshift

‎roles/federation/tasks/run_keycloak_realm_setup.yml

+2
Original file line numberDiff line numberDiff line change
@@ -50,8 +50,10 @@
5050
redirect_uris:
5151
- "{{ cifmw_federation_keystone_url }}/v3/auth/OS-FEDERATION/identity_providers/kcIDP/protocols/openid/websso"
5252
- "{{ cifmw_federation_keystone_url }}/v3/auth/OS-FEDERATION/websso/openid"
53+
- "{{ cifmw_federation_horizon_url }}/dashboard/auth/websso/"
5354
web_origins:
5455
- "{{ cifmw_federation_keystone_url }}"
56+
- "{{ cifmw_federation_horizon_url }}"
5557
bearer_only: false
5658
public_client: false
5759
protocol: openid-connect

0 commit comments

Comments
 (0)