Application Credentials with federated users

Alexander Dibbo - UKRI STFC alexander.dibbo at stfc.ac.uk
Tue Sep 8 15:28:01 UTC 2020


Hi All,

Is it possible for a user logging in via an oidc provider to generate application credentials?

When I try it I get an error about there being no role for the user in the project.

We map the users to groups based on assertions in their tokens.

It looks like it would work if we mapped users individually to local users in keystone and then gave those roles. I would prefer to avoid using per user mappings for this if possible as it would be a lot of extra work for my team.

Regards

Alexander Dibbo - Cloud Architect / Cloud Operations Group Leader
For STFC Cloud Documentation visit https://stfc-cloud-docs.readthedocs.io<https://stfc-cloud-docs.readthedocs.io/>
To raise a support ticket with the cloud team please email cloud-support at gridpp.rl.ac.uk<mailto:cloud-support at gridpp.rl.ac.uk>
To receive notifications about the service please subscribe to our mailing list at: https://www.jiscmail.ac.uk/cgi-bin/webadmin?A0=STFC-CLOUD
To receive fast notifications or to discuss usage of the cloud please join our Slack: https://stfc-cloud.slack.com/


This email and any attachments are intended solely for the use of the named recipients. If you are not the intended recipient you must not use, disclose, copy or distribute this email or any of its attachments and should notify the sender immediately and delete this email from your system. UK Research and Innovation (UKRI) has taken every reasonable precaution to minimise risk of this email or any attachments containing viruses or malware but the recipient should carry out its own virus and malware checks before opening the attachments. UKRI does not accept any liability for any losses or damages which the recipient may sustain due to presence of any viruses. Opinions, conclusions or other information in this message and attachments that are not related directly to UKRI business are solely those of the author and do not represent the views of UKRI.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openstack.org/pipermail/openstack-discuss/attachments/20200908/1a6a9502/attachment-0001.html>


More information about the openstack-discuss mailing list