<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#FFFFFF">
Hello,<br>
<br>
<div class="moz-cite-prefix">On 14.10.2015 13:10, wyw wrote:<br>
</div>
<blockquote cite="mid:tencent_793D69EF1E5DFEA24B7DD583@qq.com"
type="cite">
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<div>hello, keystoners. please help me</div>
<div><span style="line-height: 1.5;"><br>
</span></div>
<div><span style="line-height: 1.5;">Here is my use case:</span></div>
<div>1. use keystone as IDP , supported with SAML</div>
</blockquote>
<br>
Remember that Keystone is not a fully fledged Identity Provider. For
instance it cannot handle WebSSO. To be even more specific it will
only handle "IdP Initiated authentication workflow" and it's one of
the variant SAML2 authentication work.<br>
<br>
<blockquote cite="mid:tencent_793D69EF1E5DFEA24B7DD583@qq.com"
type="cite">
<div>2. keystone integrates with LDAP</div>
<div>3. we use a java application as Service Provider, and to
integrate it with keystone IDP.</div>
<div>4. we use a keystone as Service Provider, and to integrate it
withe keystone IDP.</div>
</blockquote>
<br>
Did you try that already? Did it work?<br>
<br>
<br>
<blockquote cite="mid:tencent_793D69EF1E5DFEA24B7DD583@qq.com"
type="cite">
<div>The problems:</div>
<div>in the k2k federation case, keystone service provider
requests authentication info with IDP via Shibboleth ECP. <br>
</div>
</blockquote>
<br>
Yes. Why is that a problem? K2K architecture assumes two Keystones -
Keystone-IdP and Keystone-SP . Communication between them leverages
on SAML2 and ECP.<br>
<br>
<blockquote cite="mid:tencent_793D69EF1E5DFEA24B7DD583@qq.com"
type="cite">
<div>in the java application, we use websso to request IDP, for
example：</div>
</blockquote>
<br>
as mentioned earlier - no websso in keystone-idp.<br>
<br>
<blockquote cite="mid:tencent_793D69EF1E5DFEA24B7DD583@qq.com"
type="cite">
<div><span style="line-height: 1.5;">idp_sso_endpoint =
<a class="moz-txt-link-freetext" href="http://10.111.131.83:5000/v3/OS-FEDERATION/saml2/sso">http://10.111.131.83:5000/v3/OS-FEDERATION/saml2/sso</a></span></div>
<div><span style="line-height: 1.5;">but, the java redirect the
sso url , it will return 404 error.</span></div>
<div>so, if we want to integrate a java application with keystone
IDP, should we need to support ECP in the java application?</div>
</blockquote>
<br>
pretty much - yes! Luckily for you the reference libraries
(shibboleth) are written in Java so it should be easier to integrate
with your application. <br>
<br>
<blockquote cite="mid:tencent_793D69EF1E5DFEA24B7DD583@qq.com"
type="cite">
<div><br>
</div>
<div>here is my some references:</div>
<div>1. <a class="moz-txt-link-freetext" href="http://docs.openstack.org/developer/keystone/configure_federation.html">http://docs.openstack.org/developer/keystone/configure_federation.html</a></div>
<div>2. <a moz-do-not-send="true"
href="http://blog.rodrigods.com/it-is-time-to-play-with-keystone-to-keystone-federation-in-kilo"
style="line-height: 1.5;"><span class="s2">http://blog.rodrigods.com/it-is-time-to-play-with-keystone-to-keystone-federation-in-kilo</span></a></div>
<div>3. <span style="line-height: 1.5;"><a class="moz-txt-link-freetext" href="http://docs.openstack.org/developer/keystone/extensions/federation.html">http://docs.openstack.org/developer/keystone/extensions/federation.html</a></span></div>
<div><a moz-do-not-send="true"
href="https://gist.githubusercontent.com/zaccone/3c3d4c8f39a19709bcd7/raw/d938f2f9d1cf06d29a81d57c8069c291fed66cab/k2k-env.sh"
style="color: rgb(50, 108, 166); text-decoration: none;
font-family: Arial, FreeSans, Helvetica, sans-serif;
font-size: 13px; line-height: 17.0001px; background-color:
rgb(240, 240, 240);">https://gist.githubusercontent.com/zaccone/3c3d4c8f39a19709bcd7/raw/d938f2f9d1cf06d29a81d57c8069c291fed66cab/k2k-env.sh</a><span
style="font-family: Arial, FreeSans, Helvetica, sans-serif;
font-size: 13px; line-height: 17.0001px; background-color:
rgb(240, 240, 240);"></span><br style="font-family: Arial,
FreeSans, Helvetica, sans-serif; font-size: 13px; line-height:
17.0001px; background-color: rgb(240, 240, 240);">
<a moz-do-not-send="true"
href="https://gist.githubusercontent.com/zaccone/4bbc07d215c0047738b4/raw/75295fe32df88b24576ece69994270dc4eb19a6e/k2k-ecp-client.py"
style="color: rgb(50, 108, 166); text-decoration: none;
font-family: Arial, FreeSans, Helvetica, sans-serif;
font-size: 13px; line-height: 17.0001px; background-color:
rgb(240, 240, 240);">https://gist.githubusercontent.com/zaccone/4bbc07d215c0047738b4/raw/75295fe32df88b24576ece69994270dc4eb19a6e/k2k-ecp-client.py</a><span
style="font-family: Arial, FreeSans, Helvetica, sans-serif;
font-size: 13px; line-height: 17.0001px; background-color:
rgb(240, 240, 240);"> </span></div>
<div><span style="line-height: 1.5;">my keystone version is kilo</span></div>
<div><br>
</div>
<div>help me, thanks</div>
</blockquote>
<br>
I hope I did! :-)<br>
<br>
-- <br>
Marek Denis<br>
<br>
</body>
</html>