Package: keystoneauth-oidc
OpenID Connect support for OpenStack clientsThis is a set of authentication plugins for the OpenStack clients (namely for
thekeystoneauth1library) which
provides client support for authentication against an OpenStack Keystone server
configured to support OpenID Connect using theKeystone Open ID Connect
pluginor the Apache'smod_auth_openidc, as described
below.Available pluginsv3oidcpluginThis plugin allows you to authenticate with a Keystone server configured to use
theKeystone Open ID Connect plugin.
It will perform out-of-bound authentication with the sever, meaning that the
only OpenID Connect client (Relying Party) is the Keystone Server.No OpenID Connect credentials are required in this case.v3oidccodeplugin (old method)This plugin allows to authenticate against Keystone using the Authorization
Code grant type of OpenID Connect and OAuth 2.0, using the OpenStack client as
an OpenID Connect Relying Party. This plugin is compatible with Keystone
configured with the Apache HTTP server and themod_auth_openidcand theKeystone Open ID Connect plugin.This plugin requires that you configure an OpenID Connect client in your OpenID
Connect Provider and pass the client credentials to the plugin. The OpenStack
CLI will handle the authentication with the OpenID Connect Provider, obtaining
and access token, that will be exchanged with the Keystone server in order to
obtain a Keystone token.InstallationInstall it via pip:pip install keystoneauth-oidcOr clone the repo and install it:git clone https://github.com/IFCA/keystoneauth-oidc
cd keystoneauth-oidc
pip install .Usagev3oidcpluginYou have to specify thev3oidcin the--os-auth-type. The<identity-provider>and<protocol>must be provided by the OpenStack cloud
provider.Unscoped token:openstack --os-auth-urlhttps://keystone.example.org:5000/v3--os-auth-type v3oidccode--os-identity-provider--os-protocol--os-identity-api-version 3--os-discovery-endpointhttps://idp.example.org/.well-known/openid-configuration--os-openid-scope "openid profile email"token issueScoped token:openstack --os-auth-urlhttps://keystone.example.org:5000/v3--os-auth-type v3oidc--os-identity-provider--os-protocol--os-project-name--os-project-domain-id--os-identity-api-version 3--os-openid-scope "openid profile email"token issuev3oidccodeplugin (old method)First of all, you need to create an OpenID Connect client in your OpenID Connect Provider.
Then, you have to specify thev3oidccodein the--os-auth-typeoption and provide a
valid autorization endpoint with--os-authorization-endpointor a valid discovery
endpoint with--os-discovery-endpoint. The<identity-provider>and<protocol>must be provided by the OpenStack cloud provider.Unscoped token:openstack --os-auth-urlhttps://keystone.example.org:5000/v3--os-auth-type v3oidccode--os-identity-provider--os-protocol--os-identity-api-version 3--os-client-id--os-client-secret--os-discovery-endpointhttps://idp.example.org/.well-known/openid-configuration--os-openid-scope "openid profile email"token issueScoped token:openstack --os-auth-urlhttps://keystone.example.org:5000/v3--os-auth-type v3oidccode--os-identity-provider--os-protocol--os-project-name--os-project-domain-id--os-identity-api-version 3--os-client-id--os-client-secret--os-discovery-endpointhttps://idp.example.org/.well-known/openid-configuration--os-openid-scope "openid profile email"token issueAPITo be documented