<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">On 04/19/2015 06:05 PM, Diogenes S.
Jesus wrote:<br>
</div>
<blockquote
cite="mid:CAD8MJvAe-0ae893QEDh1Eygw6-KtjwzEejdVTXpbOqBoSsHrXw@mail.gmail.com"
type="cite">
<div dir="ltr">Hi man.
<div><br>
</div>
<div>I've seen your <a moz-do-not-send="true"
href="http://lists.openstack.org/pipermail/openstack-dev/2014-June/036733.html">thread</a>
on OpenStack mailing list regarding using Kerberos on
Horizon.</div>
<div><br>
</div>
<div>I've been pulling my hair around this topic, however I'm
trying to authenticate using X.509.</div>
<div><br>
</div>
<div>I've googled around and found only topics related to
keystone external auth - but that doesn't really solve the
problem, because horizon is the one handling the request.</div>
<div><br>
</div>
<div>If you've reached good level on this topic or can point
out to some third-party solution I would be glad.</div>
<div><br>
</div>
</div>
</blockquote>
Diogenes,<br>
<br>
Thanks for asking this. It is a question that has come up a few
times, and should be addressed.<br>
<br>
I think the right approach is to use Federation, in the same way
that I protoyped here:<br>
<br>
<a class="moz-txt-link-freetext" href="http://adam.younglogic.com/2015/04/horizon-websso-sssd/">http://adam.younglogic.com/2015/04/horizon-websso-sssd/</a><br>
<br>
The short of it is that you would use the Mapped plugin for the
'X509' protocol instead of Kerberos (maybe `clientcert` is a better
name?) and Have a section in your httpd section for Keystone that
has (among other settings)<br>
<br>
<code class="spaces"> </code><code class="plain"><location ~ </code><code
class="string">"x509"</code> <code class="plain">></code><br>
Require valid-user <br>
SSLRequireSSL<br>
<code>SSLVerifyClient require<br>
</code></location><br>
<br>
<br>
You would then provide values in the mapping that use the SSL
Variables, such as SSL_CLIENT_S_DN
instead of REMOTE_USER<br>
<br>
<br>
For the user database, we have support coming in Kilo for mapping to
an existing user, so you should be able to work with some version of
the LDAP backend for that, but I would suggest you look at the SSSD
approach for LDAP integration instead, as it will be usable both for
Keystone and for the VMs running managed by Nova (both Undercloud
AND cloud Authentication)<br>
<br>
I haven't prototyped Client Cert authentication yet, unfortunately.
I would love to know if it does work, and would be willing to help
work through the gotcha's.<br>
<br>
<br>
<br>
<blockquote
cite="mid:CAD8MJvAe-0ae893QEDh1Eygw6-KtjwzEejdVTXpbOqBoSsHrXw@mail.gmail.com"
type="cite">
<div dir="ltr">
<div>Thanks! </div>
<div><br clear="all">
<div><br>
</div>
-- <br>
<div class="gmail_signature"><br>
--------<br>
<br>
Diogenes S. de Jesus</div>
</div>
</div>
</blockquote>
<br>
</body>
</html>