<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<div class="moz-cite-prefix">On 05/25/2016 07:26 AM, OpenStack
Mailing List Archive wrote:<br>
</div>
<blockquote
cite="mid:a730e5b453b061b71eb539d149c31d32@openstack.nimeyo.com"
type="cite">
Link: <a class="moz-txt-link-freetext" href="https://openstack.nimeyo.com/85057/?show=85707#c85707">https://openstack.nimeyo.com/85057/?show=85707#c85707</a><br>
From: imocha <a class="moz-txt-link-rfc2396E" href="mailto:Imocha@gmail.com"><Imocha@gmail.com></a><br>
<br>
<p>I am trying to follow the steps. I am able to install ADFS and
would like to proceed further.</p>
<p>However, I am having issues with setting up SSL endpoints for
Keystone V3. I am using Mitaka. Is there any step that I can
use. </p>
<p>I am using packstack to install the Mitaka and wanted to enable
SSL for the identity endpoints to work with ADFS for SAML2 flow.</p>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">__________________________________________________________________________
OpenStack Development Mailing List (not for usage questions)
Unsubscribe: <a class="moz-txt-link-abbreviated" href="mailto:OpenStack-dev-request@lists.openstack.org?subject:unsubscribe">OpenStack-dev-request@lists.openstack.org?subject:unsubscribe</a>
<a class="moz-txt-link-freetext" href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a>
</pre>
</blockquote>
We went through a proof of concept for this last summer (FreeIPA and
Ipsilon, not ADFS)<br>
<br>
<br>
<a class="moz-txt-link-freetext" href="https://github.com/admiyo/rippowam">https://github.com/admiyo/rippowam</a><br>
<br>
Right now I'm working on updating for Keycloak instead of Ipsilon.<br>
<br>
The SSL stuff I would like to recommend using Certmonger to manage,
but I don't know how to tie that in with the ADFS CA. We do it using
IPA's CA. You can set up a trust between IPA and and AD, which
might be your easiest path forward.<br>
<br>
With a trust, the Keystone server would be registered as a host on
the FreeIPA server, but would accept Kerberos tickets from ADFS. If
you want to completely federate the two, you can do so as well, and
then you do not need the trust, you just let ADFS issue SAML.<br>
</body>
</html>