Chapter 4. Federation using Red Hat OpenStack Platform and other vendors Red Hat does not provide direct support for federation when integrated with vendors outside of Red Hat Single Sign-on (RH-SSO) and Active Directory Federation Services (ADFS). If you would like to use another vendor, please contact Red Hat for a support exception. 4.1. Customizing federation for other vendors Other vendors may have different ways of delimiting an OpenIDC claim, or of formatting user information, for example. These are features that can be adjusted in heat. Prerequisites You have installed Red Hat OpenStack Platform (RHOSP) director You have a federation solution available in your environment RHOSP is at version 17.1.3 or higher Procedure Provide your SSO administrator with appropriate redirect URIs. In response, your SSO administrator provides you with a ClientID and a Client secret . Copy the enable-federation-openidc.yaml environment file heat template to the /home/stack/templates/ directory. Modify the enable-federation-openidc.yaml environment file to meet the requirements of your federation solution. The following are parameters that are commonly required for the configuration of Federation: KeystoneAuthMethods A comma delimited list of acceptable methods for authentication. KeystoneOpenIdcClientId Your client ID to use for the OpenID Connect provider handshake. You must get this from your SSO administrator. KeystoneOpenIdcClientSecret The client secret to use for the OpenID Connect provider handshake. You must get this from your SSO administrator after providing your redirect URLs. KeystoneOpenIdcCryptoPassphrase Choose a passphrase to use when encrypting data for OpenID Connect handshake. KeystoneOpenIdcIdpName The name associated with the IdP in the Identity service (keystone). KeystoneOpenIdcIntrospectionEndpoint The Identity service introspection endpoint: https://<fqdn>/realms/<realm>/protocol/openid-connect/token/introspect KeystoneOpenIdcProviderMetadataUrl The URL that points to your OpenID Connect provider metadata. KeystoneOpenIdcRemoteIdAttribute Attribute to be used to obtain the entity ID of the Identity Provider from the environment. KeystoneOpenIdcResponseType Response type to be expected from the OpenID Connect provider. KeystoneTrustedDashboards A dashboard URL trusted for single sign-on, this can also be a comma delimited list. WebSSOChoices Specifies the list of SSO authentication choices to present. Each item is a list of an SSO choice identifier and a display message. WebSSOIDPMapping Specifies a mapping from SSO authentication choice to identity provider and protocol. The identity provider and protocol names must match the resources defined in keystone. You can use the following three parameters to customize the interaction between RHOSP and your federation solution. 1 Use the KeystoneOpenIdcClaimDelimiter parameter to set the delimiter when setting multivalue claims. The default delimiter is a semi-colon. 2 Use the KeystoneOpenIdcPassUserInfoAs parameter to define the way in which the claims, once resolved, are passed to the federation application. Allowed values are claims , json , and jwt . 3 Use the KeystoneOpenIdcPassClaimsAs parameter to define the way in which the claims and tokens are passed to the application environment. The options are: none : Claims and tokens are not are passed to the application. environment : Claims and tokens are passed as environment variables. headers : Claims and tokens are passed in headers. both : Claims and headers are passed as both headers and variables. This is the default. Note For a sample configuration of a supported Federation configuration, see Deploying Red Hat OpenStack Platform with Red Hat Single Sign-on . Add the enable-federation-openidc.yaml to the stack with your other environment files and deploy the overcloud: Additional information Deploying Red Hat OpenStack Platform with Red Hat Single Sign-On Deploying Red Hat OpenStack Platform with Active Directory Federation Services

Commands:
cp /usr/share/openstack-tripleo-heat-templates/environments/enable-federation-openidc.yaml /home/stack/templates
parameter_defaults: KeystoneOpenIdcClaimDelimiter: ';' 1 KeystoneOpenIdcPassUserInfoAs: 'claims' 2 KeystoneOpenIdcPassClaimsAs: 'both' 3
(undercloud)USD openstack overcloud deploy --templates -e [your environment files] -e /home/stack/templates/enable-federation-openidc.yaml