<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<p>I've made a patch to correct this module name which it would be
great if you could test and leave a comment if it's OK</p>
<p><a href="https://review.opendev.org/c/openstack/openstack-ansible-os_keystone/+/790018" class="link" rel="noreferrer" target="_blank" style="display: inline; width: auto; overflow: visible; padding: 0px; border: 0px; cursor: pointer; color: rgb(255, 255, 255); text-decoration: underline; background: none rgb(38, 38, 38); outline: none; font-family: "Source Sans Pro", sans-serif; font-size: 15px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: pre-wrap; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px;">https://review.opendev.org/c/openstack/openstack-ansible-os_keystone/+/790018</a></p>
<p>Are you able to debug any further why the shib module is being
enabled, maybe through using -vv on the openstack-ansible command
to show the task parameters, or adding some debug tasks in
os_keystone to show the values of keystone_sp_apache_mod_shib and
keystone_sp_apache_mod_auth_openidc?<br>
</p>
<div class="moz-cite-prefix">On 06/05/2021 09:17, Taltavull
Jean-Francois wrote:<br>
</div>
<blockquote type="cite"
cite="mid:f55a788b1ee94c2cb05ea8d289946fe6@elca.ch">
<pre class="moz-quote-pre" wrap="">I forgot to mention: in Ubuntu 20.04, the apache shibboleth module is named "shib" and not "sib2". So, I had to supersede the variable
" keystone_apache_modules". If you don't do this, os-keystone playbook fails with " "Failed to set module shib2 to disabled:\n\nMaybe the module identifier (mod_shib) was guessed incorrectly.Consider setting the \"identifier\" option.", "rc": 1, "stderr": "ERROR: Module shib2 does not exist!\n"".
So, apache modules enabled are:
- shib
- auth_openidc
- proxy_uwsgi
- headers
</pre>
<blockquote type="cite">
<pre class="moz-quote-pre" wrap="">-----Original Message-----
From: Jonathan Rosser <a class="moz-txt-link-rfc2396E" href="mailto:jonathan.rosser@rd.bbc.co.uk"><jonathan.rosser@rd.bbc.co.uk></a>
Sent: mercredi, 5 mai 2021 19:19
To: <a class="moz-txt-link-abbreviated" href="mailto:openstack-discuss@lists.openstack.org">openstack-discuss@lists.openstack.org</a>
Subject: Re: [openstack-ansible] Keystone federation with OpenID needs
shibboleth
Could you check which apache modules are enabled?
The set is defined in the code here
<a class="moz-txt-link-freetext" href="https://github.com/openstack/openstack-ansible">https://github.com/openstack/openstack-ansible</a>-
os_keystone/blob/master/vars/ubuntu-20.04.yml#L85-L95
On 05/05/2021 17:41, Taltavull Jean-Francois wrote:
</pre>
<blockquote type="cite">
<pre class="moz-quote-pre" wrap="">I've got keystone_sp.apache_mod = mod_auth_openidc
</pre>
</blockquote>
</blockquote>
</blockquote>
</body>
</html>