<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">On 08/06/2013 08:37 AM, Rok Kralj
wrote:<br>
</div>
<blockquote
cite="mid:CAMWF=HRdAVCxUNLt_nBT5p4zD+yz1STit8odEWMKAApbQOejrQ@mail.gmail.com"
type="cite">
<div dir="ltr">As far as I know, the ability to log in to
OpenStack via arbitrary Identity Provider (IdP) is a widely
desired feature. Therefore, we have decided to integrate
Keystone & Horizon with <b>Simple Saml PHP</b>, </div>
</blockquote>
<br>
Why PHP? THis is a very interesting approach, but the
multi-languange thing makes it a non-starter for upstream
integration.<br>
<br>
<blockquote
cite="mid:CAMWF=HRdAVCxUNLt_nBT5p4zD+yz1STit8odEWMKAApbQOejrQ@mail.gmail.com"
type="cite">
<div dir="ltr">since it provides a lot of AUTH sources (aka.
IdPs), for example LDAP, database, facebook, etc... Check out
our effort in this short video (40s):
<div>
<br>
</div>
<div><a moz-do-not-send="true"
href="http://www.youtube.com/watch?v=qmJAumoh4U8">http://www.youtube.com/watch?v=qmJAumoh4U8</a><br>
</div>
</div>
</blockquote>
<br>
I video is really not the way to present this to the OpenStack
community. A clear write up is preferred. PDFs make it hard to
comment. What is not clear from the document is if you are using
the Keystoine Identity with SAML, instead of Keystone tokens, or if
you are integrating in with some other IdP.<br>
<br>
<blockquote
cite="mid:CAMWF=HRdAVCxUNLt_nBT5p4zD+yz1STit8odEWMKAApbQOejrQ@mail.gmail.com"
type="cite">
<div dir="ltr">
<div>
<div><br>
</div>
<div>
<div>For more, the instructions and a short introduction is
available in the attached readme.pdf.</div>
</div>
</div>
</div>
</blockquote>
<br>
<br>
I've inlined it here:<br>
<br>
<br>
1<br>
Introduction<br>
You are about to setup the OpenStack as Serice (TYPO) provider. This
is going to enable you to make a single sign-on<br>
service and log users to the Horizon, the OpenStack dashboard in a
seamless way.<br>
Estimated deployment duration: 10-25 minutes (depends on many
factors)<br>
1.1<br>
The module functionality<br>
Basically, the module works like this:<br>
1. Present the user with the available Identity providers. Let the
user choose one.<br>
2. If user doesn’t yet have an account in Keystone, register it. Map
the user to the appropriate tenant,<br>
depending on the auth source and IdP attributes. This enables you,
for example, to give demo accounts<br>
to random facebook users and full-fledged accounts to the people
listed in your company’s LDAP, etc...<br>
3. Seamlessly login the user to the Horizon web dashboard.<br>
2<br>
Deployment at SimpleSamlPHP side<br>
1. First, you have to extract the ssp.tar.gz archive to a location
which is publicly accessible via your web<br>
server of choice. A good example might be /var/www/login, but you
can chose anything.<br>
2. Next, you have to open the config.php file, where all
configurable options reside.<br>
• The first and most important config option is sspPath, this is the
relative (or absolute) path to the<br>
lib/ autoload.php file in your SSP installation.<br>
const sspPath = ’../simplesamlphp-1.11.0/lib/_autoload.php’;<br>
• The module also has to know about the user and admin Keystone API
endpoints. They<br>
usually reside on the different ports on the same host.<br>
const adminUrl = ’<a class="moz-txt-link-freetext" href="http://localhost:35357/v2.0/’">http://localhost:35357/v2.0/’</a>;<br>
const userUrl = ’<a class="moz-txt-link-freetext" href="http://localhost:5000/v2.0/’">http://localhost:5000/v2.0/’</a>;<br>
• Point the module to the Horizon dashboard. The redirect and
auto-login will be made to this URL.<br>
const horizon = ’<a class="moz-txt-link-freetext" href="http://localhost/auth/login/’">http://localhost/auth/login/’</a>;<br>
• Last but not least, you have to supply the Keystone AUTH token
secret. You can find it in keystone’s<br>
configuration file.<br>
const secret = ’65e005728156f456cf20’;<br>
3. As you probably noticed, not only Config class resides in
config.php. There is also a Mapper class,<br>
which contains functions, named by the auth sources. Using these
function, you can decide how you want<br>
to map IdP attributes to user names.<br>
Functions accept one parameter (IdP attribute hash) and return a
3-tuple in the form (username, email,<br>
default tenant). Example you might use for LDAP is below:<br>
function example_ldap($attr) {<br>
return [ $attr[’uid’][0], $attr[’mail’][0], ’admin’ ];<br>
}<br>
4. Lastly, you are free to modify index.php to your liking. You can
customise it with your company’s logo<br>
or give it a design overhaul, if you wish.<br>
3<br>
Deployment at the Horizon side<br>
1. Overwrite the /usr/lib/python2.7/dist-packages/openstack
auth/views.py with the file provided<br>
in our archive. It is advised to keep the backup of the old file, if
you want to restore old functionality.<br>
2. Append the logout callback url to the openstack
dashboard/settings.py configuration file.<br>
SSP_LOGOUT_URL = ’<a class="moz-txt-link-freetext" href="http://localhost/login/logout.php’">http://localhost/login/logout.php’</a><br>
<br>
<br>
<blockquote
cite="mid:CAMWF=HRdAVCxUNLt_nBT5p4zD+yz1STit8odEWMKAApbQOejrQ@mail.gmail.com"
type="cite">
<div dir="ltr">
<div>
<div>
</div>
</div>
<div><br>
</div>
<div>Feedback is really appreciated.</div>
</div>
</blockquote>
<br>
This is a neat concept, but it lacks some context.<br>
<br>
<br>
<br>
<blockquote
cite="mid:CAMWF=HRdAVCxUNLt_nBT5p4zD+yz1STit8odEWMKAApbQOejrQ@mail.gmail.com"
type="cite">
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
Mailing list: <a class="moz-txt-link-freetext" href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack</a>
Post to : <a class="moz-txt-link-abbreviated" href="mailto:openstack@lists.openstack.org">openstack@lists.openstack.org</a>
Unsubscribe : <a class="moz-txt-link-freetext" href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack</a>
</pre>
</blockquote>
<br>
</body>
</html>