Home OpenStack-Ansible Installation Guide
In OpenStack-Ansible, the Identity Service (keystone) is set up to use Apache with mod_wsgi. The additional configuration of keystone as a federation service provider adds Apache mod_shib and configures it to respond to specific locations requests from a client.
Note
There are alternative methods of implementing federation, but at this time only SAML2-based federation using the Shibboleth SP is instrumented in OA.
When requests are sent to those locations, Apache hands off the request to the shibd service.
Note
Handing off happens only with requests pertaining to authentication.
Handle the shibd service configuration through the following files in /etc/shibboleth/ in the keystone containers:
uses these files generated on the first keystone container to replicate them to the other keystone containers. The SP and the IdP use these files as signing credentials in communications.
shibboleth2.xml: The os-keystone-install.yml playbook writes the file’s contents, basing on the structure of the configuration of the keystone_sp attribute in the /etc/openstack_deploy/user_variables.yml file. It contains the list of trusted IdP’s, the entityID by which the SP is known, and other facilitating configurations.
attribute-map.xml: The os-keystone-install.yml playbook writes the file’s contents, basing on the structure of the configuration of the keystone_sp attribute in the /etc/openstack_deploy/user_variables.yml file. It contains the default attribute mappings that work for any basic Shibboleth-type IDP setup, but also contains any additional attribute mappings set out in the structure of the keystone_sp attribute.
shibd.logger: This file is left alone by Ansible. It is useful when troubleshooting issues with federated authentication, or when discovering what attributes published by an IdP are not currently being understood by your SP’s attribute map. To enable debug logging, change log4j.rootCategory=INFO to log4j.rootCategory=DEBUG at the top of the file. The log file is output to /var/log/shibboleth/shibd.log.