Mailing List Archive: OpenStack: Dev

Openstack login via SimpleSamlPHP (LDAP, OAuth, OpenID, etc..)

Index | Next | Previous | View Threaded

os at rok-kralj

Aug 6, 2013, 5:37 AM

Post #1 of 8 (65 views)
Permalink

Openstack login via SimpleSamlPHP (LDAP, OAuth, OpenID, etc..)

As far as I know, the ability to log in to OpenStack via arbitrary Identity
Provider (IdP) is a widely desired feature. Therefore, we have decided to
integrate Keystone & Horizon with *Simple Saml PHP*, since it provides a
lot of AUTH sources (aka. IdPs), for example LDAP, database, facebook,
etc... Check out our effort in this short video (40s):

http://www.youtube.com/watch?v=qmJAumoh4U8

For more, the instructions and a short introduction is available in the
attached readme.pdf.

Feedback is really appreciated.

Attachments:

readme.pdf (93.6 KB)

ssp.tar.gz (101 KB)

ayoung at redhat

Aug 6, 2013, 6:34 AM

Post #2 of 8 (61 views)
Permalink

Re: Openstack login via SimpleSamlPHP (LDAP, OAuth, OpenID, etc..) [In reply to]

On 08/06/2013 08:37 AM, Rok Kralj wrote:
> As far as I know, the ability to log in to OpenStack via arbitrary
> Identity Provider (IdP) is a widely desired feature. Therefore, we
> have decided to integrate Keystone & Horizon with *Simple Saml PHP*,

Why PHP? THis is a very interesting approach, but the multi-languange
thing makes it a non-starter for upstream integration.

> since it provides a lot of AUTH sources (aka. IdPs), for example LDAP,
> database, facebook, etc... Check out our effort in this short video
> (40s):
>
> http://www.youtube.com/watch?v=qmJAumoh4U8

I video is really not the way to present this to the OpenStack
community. A clear write up is preferred. PDFs make it hard to
comment. What is not clear from the document is if you are using the
Keystoine Identity with SAML, instead of Keystone tokens, or if you are
integrating in with some other IdP.

>
> For more, the instructions and a short introduction is available in
> the attached readme.pdf.

I've inlined it here:

1
Introduction
You are about to setup the OpenStack as Serice (TYPO) provider. This is
going to enable you to make a single sign-on
service and log users to the Horizon, the OpenStack dashboard in a
seamless way.
Estimated deployment duration: 10-25 minutes (depends on many factors)
1.1
The module functionality
Basically, the module works like this:
1. Present the user with the available Identity providers. Let the user
choose one.
2. If user doesn't yet have an account in Keystone, register it. Map the
user to the appropriate tenant,
depending on the auth source and IdP attributes. This enables you, for
example, to give demo accounts
to random facebook users and full-fledged accounts to the people listed
in your company's LDAP, etc...
3. Seamlessly login the user to the Horizon web dashboard.
2
Deployment at SimpleSamlPHP side
1. First, you have to extract the ssp.tar.gz archive to a location which
is publicly accessible via your web
server of choice. A good example might be /var/www/login, but you can
chose anything.
2. Next, you have to open the config.php file, where all configurable
options reside.
. The first and most important config option is sspPath, this is the
relative (or absolute) path to the
lib/ autoload.php file in your SSP installation.
const sspPath = '../simplesamlphp-1.11.0/lib/_autoload.php';
. The module also has to know about the user and admin Keystone API
endpoints. They
usually reside on the different ports on the same host.
const adminUrl = 'http://localhost:35357/v2.0/';
const userUrl = 'http://localhost:5000/v2.0/';
. Point the module to the Horizon dashboard. The redirect and auto-login
will be made to this URL.
const horizon = 'http://localhost/auth/login/';
. Last but not least, you have to supply the Keystone AUTH token secret.
You can find it in keystone's
configuration file.
const secret = '65e005728156f456cf20';
3. As you probably noticed, not only Config class resides in config.php.
There is also a Mapper class,
which contains functions, named by the auth sources. Using these
function, you can decide how you want
to map IdP attributes to user names.
Functions accept one parameter (IdP attribute hash) and return a 3-tuple
in the form (username, email,
default tenant). Example you might use for LDAP is below:
function example_ldap($attr) {
return [ $attr['uid'][0], $attr['mail'][0], 'admin' ];
}
4. Lastly, you are free to modify index.php to your liking. You can
customise it with your company's logo
or give it a design overhaul, if you wish.
3
Deployment at the Horizon side
1. Overwrite the /usr/lib/python2.7/dist-packages/openstack
auth/views.py with the file provided
in our archive. It is advised to keep the backup of the old file, if you
want to restore old functionality.
2. Append the logout callback url to the openstack dashboard/settings.py
configuration file.
SSP_LOGOUT_URL = 'http://localhost/login/logout.php'

>
> Feedback is really appreciated.

This is a neat concept, but it lacks some context.

>
>
> _______________________________________________
> Mailing list: http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack
> Post to : openstack [at] lists
> Unsubscribe : http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack

mark.m.miller at hp

Aug 6, 2013, 10:05 AM

Post #3 of 8 (60 views)
Permalink

Re: Openstack login via SimpleSamlPHP (LDAP, OAuth, OpenID, etc..) [In reply to]

How is this different than the new H-2 split backend functionality?

From: Rok Kralj [mailto:os [at] rok-kralj]
Sent: Tuesday, August 06, 2013 5:38 AM
To: openstack [at] lists
Subject: [Openstack] Openstack login via SimpleSamlPHP (LDAP, OAuth, OpenID, etc..)

As far as I know, the ability to log in to OpenStack via arbitrary Identity Provider (IdP) is a widely desired feature. Therefore, we have decided to integrate Keystone & Horizon with Simple Saml PHP, since it provides a lot of AUTH sources (aka. IdPs), for example LDAP, database, facebook, etc... Check out our effort in this short video (40s):

http://www.youtube.com/watch?v=qmJAumoh4U8

For more, the instructions and a short introduction is available in the attached readme.pdf.

Feedback is really appreciated.

Tim.Bell at cern

Aug 6, 2013, 11:04 AM

Post #4 of 8 (58 views)
Permalink

Re: Openstack login via SimpleSamlPHP (LDAP, OAuth, OpenID, etc..) [In reply to]

I would be very interested in a native SAML for single sign on implementation with Horizon login. This would mean Python rather than
PHP along with potentially (I think) creating a situation where a user can use the Web GUI through single sign on but not able to use
CLI.

Depending on the use cases, this may not be an issue but as far as I understand, it is a limitation of the technology at present.

Tim

From: Miller, Mark M (EB SW Cloud - R&D - Corvallis) [mailto:mark.m.miller [at] hp]
Sent: 06 August 2013 19:06
To: Rok Kralj; openstack [at] lists
Subject: Re: [Openstack] Openstack login via SimpleSamlPHP (LDAP, OAuth, OpenID, etc..)

How is this different than the new H-2 split backend functionality?

From: Rok Kralj [mailto:os [at] rok-kralj]
Sent: Tuesday, August 06, 2013 5:38 AM
To: openstack [at] lists <mailto:openstack [at] lists>
Subject: [Openstack] Openstack login via SimpleSamlPHP (LDAP, OAuth, OpenID, etc..)

As far as I know, the ability to log in to OpenStack via arbitrary Identity Provider (IdP) is a widely desired feature. Therefore, we
have decided to integrate Keystone & Horizon with Simple Saml PHP, since it provides a lot of AUTH sources (aka. IdPs), for example
LDAP, database, facebook, etc... Check out our effort in this short video (40s):

http://www.youtube.com/watch?v=qmJAumoh4U8

For more, the instructions and a short introduction is available in the attached readme.pdf.

Feedback is really appreciated.

Attachments:

smime.p7s (7.24 KB)

joe.savak at RACKSPACE

Aug 6, 2013, 12:56 PM

Post #5 of 8 (57 views)
Permalink

Re: Openstack login via SimpleSamlPHP (LDAP, OAuth, OpenID, etc..) [In reply to]

If we allow Keystone to handle the identity federation (both with an incoming SAML to token exchange and an outgoing token to SAML exchange), then wouldn’t both GUI and CLI SSO be possible?
See here for more information:
https://blueprints.launchpad.net/keystone/+spec/virtual-idp

And a pretty picture:
https://wiki.openstack.org/wiki/File:Virtual_Identity_Providers.png

Rok – thank you for starting this. I do think your GUI-SSO solution has benefits regardless of the language it uses.

From: Tim Bell [mailto:Tim.Bell [at] cern]
Sent: Tuesday, August 06, 2013 1:05 PM
To: Miller, Mark M (EB SW Cloud - R&D - Corvallis); Rok Kralj; openstack [at] lists
Subject: Re: [Openstack] Openstack login via SimpleSamlPHP (LDAP, OAuth, OpenID, etc..)

I would be very interested in a native SAML for single sign on implementation with Horizon login. This would mean Python rather than PHP along with potentially (I think) creating a situation where a user can use the Web GUI through single sign on but not able to use CLI.

Depending on the use cases, this may not be an issue but as far as I understand, it is a limitation of the technology at present.

Tim

From: Miller, Mark M (EB SW Cloud - R&D - Corvallis) [mailto:mark.m.miller [at] hp]
Sent: 06 August 2013 19:06
To: Rok Kralj; openstack [at] lists<mailto:openstack [at] lists>
Subject: Re: [Openstack] Openstack login via SimpleSamlPHP (LDAP, OAuth, OpenID, etc..)

How is this different than the new H-2 split backend functionality?

From: Rok Kralj [mailto:os [at] rok-kralj]
Sent: Tuesday, August 06, 2013 5:38 AM
To: openstack [at] lists<mailto:openstack [at] lists>
Subject: [Openstack] Openstack login via SimpleSamlPHP (LDAP, OAuth, OpenID, etc..)

As far as I know, the ability to log in to OpenStack via arbitrary Identity Provider (IdP) is a widely desired feature. Therefore, we have decided to integrate Keystone & Horizon with Simple Saml PHP, since it provides a lot of AUTH sources (aka. IdPs), for example LDAP, database, facebook, etc... Check out our effort in this short video (40s):

http://www.youtube.com/watch?v=qmJAumoh4U8

For more, the instructions and a short introduction is available in the attached readme.pdf.

Feedback is really appreciated.

btopol at us

Aug 7, 2013, 4:55 AM

Post #6 of 8 (49 views)
Permalink

Re: Openstack login via SimpleSamlPHP (LDAP, OAuth, OpenID, etc..) [In reply to]

Joe, Tim,

I am seeing a strong interest in keystone federated identity support from
customers. I was planning on submitting a keystone design summit session
proposal on this topic where we could discuss the use cases and
requirements that customers are bringing forward and make sure we get all
the bases covered. Sounds like you are seeing interest in this as well.

Thanks,

Brad

Brad Topol, Ph.D.
IBM Distinguished Engineer
OpenStack
(919) 543-0646
Internet: btopol [at] us
Assistant: Cindy Willman (919) 268-5296

From: Joe Savak <joe.savak [at] RACKSPACE>
To: Tim Bell <Tim.Bell [at] cern>, "Miller, Mark M (EB SW Cloud - R&D -
Corvallis)" <mark.m.miller [at] hp>, Rok Kralj <os [at] rok-kralj>,
"openstack [at] lists" <openstack [at] lists>
Date: 08/06/2013 04:06 PM
Subject: Re: [Openstack] Openstack login via SimpleSamlPHP (LDAP,
OAuth, OpenID, etc..)

If we allow Keystone to handle the identity federation (both with an
incoming SAML to token exchange and an outgoing token to SAML exchange),
then wouldn’t both GUI and CLI SSO be possible?
See here for more information:
https://blueprints.launchpad.net/keystone/+spec/virtual-idp

And a pretty picture:
https://wiki.openstack.org/wiki/File:Virtual_Identity_Providers.png

Rok – thank you for starting this. I do think your GUI-SSO solution has
benefits regardless of the language it uses.

From: Tim Bell [mailto:Tim.Bell [at] cern]
Sent: Tuesday, August 06, 2013 1:05 PM
To: Miller, Mark M (EB SW Cloud - R&D - Corvallis); Rok Kralj;
openstack [at] lists
Subject: Re: [Openstack] Openstack login via SimpleSamlPHP (LDAP, OAuth,
OpenID, etc..)

I would be very interested in a native SAML for single sign on
implementation with Horizon login. This would mean Python rather than PHP
along with potentially (I think) creating a situation where a user can use
the Web GUI through single sign on but not able to use CLI.

Depending on the use cases, this may not be an issue but as far as I
understand, it is a limitation of the technology at present.

Tim

From: Miller, Mark M (EB SW Cloud - R&D - Corvallis) [
mailto:mark.m.miller [at] hp]
Sent: 06 August 2013 19:06
To: Rok Kralj; openstack [at] lists
Subject: Re: [Openstack] Openstack login via SimpleSamlPHP (LDAP, OAuth,
OpenID, etc..)

How is this different than the new H-2 split backend functionality?

From: Rok Kralj [mailto:os [at] rok-kralj]
Sent: Tuesday, August 06, 2013 5:38 AM
To: openstack [at] lists
Subject: [Openstack] Openstack login via SimpleSamlPHP (LDAP, OAuth,
OpenID, etc..)

As far as I know, the ability to log in to OpenStack via arbitrary
Identity Provider (IdP) is a widely desired feature. Therefore, we have
decided to integrate Keystone & Horizon with Simple Saml PHP, since it
provides a lot of AUTH sources (aka. IdPs), for example LDAP, database,
facebook, etc... Check out our effort in this short video (40s):

http://www.youtube.com/watch?v=qmJAumoh4U8

For more, the instructions and a short introduction is available in the
attached readme.pdf.

Feedback is really appreciated.
_______________________________________________
Mailing list:
http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack
Post to : openstack [at] lists
Unsubscribe :
http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack

Tim.Bell at cern

Aug 7, 2013, 5:16 AM

Post #7 of 8 (49 views)
Permalink

Re: Openstack login via SimpleSamlPHP (LDAP, OAuth, OpenID, etc..) [In reply to]

Yes, this is something we’re very interested in. Joe’s blueprint (https://blueprints.launchpad.net/keystone/+spec/virtual-idp) has a number of the user stories and would be a good place to start to add others.

Tim

From: Brad Topol [mailto:btopol [at] us]
Sent: 07 August 2013 13:55
To: Joe Savak
Cc: Miller, Mark M (EB SW Cloud - R&D - Corvallis); openstack [at] lists; Rok Kralj; Tim Bell; Dolph Mathews
Subject: Re: [Openstack] Openstack login via SimpleSamlPHP (LDAP, OAuth, OpenID, etc..)

Joe, Tim,

I am seeing a strong interest in keystone federated identity support from customers. I was planning on submitting a keystone design summit session proposal on this topic where we could discuss the use cases and requirements that customers are bringing forward and make sure we get all the bases covered. Sounds like you are seeing interest in this as well.

Thanks,

Brad

Brad Topol, Ph.D.
IBM Distinguished Engineer
OpenStack
(919) 543-0646
Internet: btopol [at] us
Assistant: Cindy Willman (919) 268-5296

From: Joe Savak <joe.savak [at] RACKSPACE>
To: Tim Bell <Tim.Bell [at] cern>, "Miller, Mark M (EB SW Cloud - R&D - Corvallis)" <mark.m.miller [at] hp>, Rok Kralj <os [at] rok-kralj>, "openstack [at] lists" <openstack [at] lists>
Date: 08/06/2013 04:06 PM
Subject: Re: [Openstack] Openstack login via SimpleSamlPHP (LDAP, OAuth, OpenID, etc..)
________________________________________

If we allow Keystone to handle the identity federation (both with an incoming SAML to token exchange and an outgoing token to SAML exchange), then wouldn’t both GUI and CLI SSO be possible?
See here for more information:
https://blueprints.launchpad.net/keystone/+spec/virtual-idp

And a pretty picture:
https://wiki.openstack.org/wiki/File:Virtual_Identity_Providers.png

Rok – thank you for starting this. I do think your GUI-SSO solution has benefits regardless of the language it uses.

From: Tim Bell [mailto:Tim.Bell [at] cern]
Sent: Tuesday, August 06, 2013 1:05 PM
To: Miller, Mark M (EB SW Cloud - R&D - Corvallis); Rok Kralj; openstack [at] lists
Subject: Re: [Openstack] Openstack login via SimpleSamlPHP (LDAP, OAuth, OpenID, etc..)

I would be very interested in a native SAML for single sign on implementation with Horizon login. This would mean Python rather than PHP along with potentially (I think) creating a situation where a user can use the Web GUI through single sign on but not able to use CLI.

Depending on the use cases, this may not be an issue but as far as I understand, it is a limitation of the technology at present.

Tim

From: Miller, Mark M (EB SW Cloud - R&D - Corvallis) [mailto:mark.m.miller [at] hp]
Sent: 06 August 2013 19:06
To: Rok Kralj; openstack [at] lists
Subject: Re: [Openstack] Openstack login via SimpleSamlPHP (LDAP, OAuth, OpenID, etc..)

How is this different than the new H-2 split backend functionality?

From: Rok Kralj [mailto:os [at] rok-kralj]
Sent: Tuesday, August 06, 2013 5:38 AM
To: openstack [at] lists
Subject: [Openstack] Openstack login via SimpleSamlPHP (LDAP, OAuth, OpenID, etc..)

As far as I know, the ability to log in to OpenStack via arbitrary Identity Provider (IdP) is a widely desired feature. Therefore, we have decided to integrate Keystone & Horizon with Simple Saml PHP, since it provides a lot of AUTH sources (aka. IdPs), for example LDAP, database, facebook, etc... Check out our effort in this short video (40s):

http://www.youtube.com/watch?v=qmJAumoh4U8

For more, the instructions and a short introduction is available in the attached readme.pdf.

Feedback is really appreciated._______________________________________________
Mailing list: http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack
Post to : openstack [at] lists
Unsubscribe : http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack

Attachments:

smime.p7s (7.24 KB)

ayoung at redhat

Aug 7, 2013, 9:57 AM

Post #8 of 8 (48 views)
Permalink

Re: Openstack login via SimpleSamlPHP (LDAP, OAuth, OpenID, etc..) [In reply to]

On 08/07/2013 08:16 AM, Tim Bell wrote:
> Yes, this is something we're very interested in. Joe's blueprint (https://blueprints.launchpad.net/keystone/+spec/virtual-idp) has a number of the user stories and would be a good place to start to add others.

Work is underway under two approaches.

1. is the OAuth Support. It is in the final stages, and should merge
by H3.
2. is the U of Kent Federaion blueprint, which is also well underway,
and will have pieces of it in by H3 as well\\\

The split of Identity from Assignments was essential to a consistant
approach here. Henry Nash is taking this to the next with the ability
to have multiple LDAP IdP, one per domain.

There are three pieces to keep clear.

1. Mechanism for Identity Attribute delivery. SQL and LDAP are "pull
mechanisms" where as SAML etc are push. The end result is the same,
though: we have some data that we can trust to use as the basis of
authorization decisions.

2. Mapping. This is the focus of the current Kent work. We need a way
to get the attributes, whatever they are, into a format that Keystone
understands.

3. Assignments. These are owned by Keystone. This consumes the
mapping in order to actually give the token the attributes.

In addition, we need rules for registering domains. Currently, each
domain is limited to one mechanism. For example, a domain cannot do
both LDAP and SQL. If a given domain will use SAML, it will be limited
to only SAML. I suspect that this limitation will be acceptable for the
near future. Please let me know if this is not the case.

>
> Tim
>
> From: Brad Topol [mailto:btopol [at] us]
> Sent: 07 August 2013 13:55
> To: Joe Savak
> Cc: Miller, Mark M (EB SW Cloud - R&D - Corvallis); openstack [at] lists; Rok Kralj; Tim Bell; Dolph Mathews
> Subject: Re: [Openstack] Openstack login via SimpleSamlPHP (LDAP, OAuth, OpenID, etc..)
>
> Joe, Tim,
>
> I am seeing a strong interest in keystone federated identity support from customers. I was planning on submitting a keystone design summit session proposal on this topic where we could discuss the use cases and requirements that customers are bringing forward and make sure we get all the bases covered. Sounds like you are seeing interest in this as well.
>
> Thanks,
>
> Brad
>
> Brad Topol, Ph.D.
> IBM Distinguished Engineer
> OpenStack
> (919) 543-0646
> Internet: btopol [at] us
> Assistant: Cindy Willman (919) 268-5296
>
>
>
> From: Joe Savak <joe.savak [at] RACKSPACE>
> To: Tim Bell <Tim.Bell [at] cern>, "Miller, Mark M (EB SW Cloud - R&D - Corvallis)" <mark.m.miller [at] hp>, Rok Kralj <os [at] rok-kralj>, "openstack [at] lists" <openstack [at] lists>
> Date: 08/06/2013 04:06 PM
> Subject: Re: [Openstack] Openstack login via SimpleSamlPHP (LDAP, OAuth, OpenID, etc..)
> ________________________________________
>
>
>
> If we allow Keystone to handle the identity federation (both with an incoming SAML to token exchange and an outgoing token to SAML exchange), then wouldn't both GUI and CLI SSO be possible?
> See here for more information:
> https://blueprints.launchpad.net/keystone/+spec/virtual-idp
>
> And a pretty picture:
> https://wiki.openstack.org/wiki/File:Virtual_Identity_Providers.png
>
> Rok -- thank you for starting this. I do think your GUI-SSO solution has benefits regardless of the language it uses.
>
> From: Tim Bell [mailto:Tim.Bell [at] cern]
> Sent: Tuesday, August 06, 2013 1:05 PM
> To: Miller, Mark M (EB SW Cloud - R&D - Corvallis); Rok Kralj; openstack [at] lists
> Subject: Re: [Openstack] Openstack login via SimpleSamlPHP (LDAP, OAuth, OpenID, etc..)
>
>
> I would be very interested in a native SAML for single sign on implementation with Horizon login. This would mean Python rather than PHP along with potentially (I think) creating a situation where a user can use the Web GUI through single sign on but not able to use CLI.
>
> Depending on the use cases, this may not be an issue but as far as I understand, it is a limitation of the technology at present.
>
> Tim
>
>
>
> From: Miller, Mark M (EB SW Cloud - R&D - Corvallis) [mailto:mark.m.miller [at] hp]
> Sent: 06 August 2013 19:06
> To: Rok Kralj; openstack [at] lists
> Subject: Re: [Openstack] Openstack login via SimpleSamlPHP (LDAP, OAuth, OpenID, etc..)
>
> How is this different than the new H-2 split backend functionality?
>
> From: Rok Kralj [mailto:os [at] rok-kralj]
> Sent: Tuesday, August 06, 2013 5:38 AM
> To: openstack [at] lists
> Subject: [Openstack] Openstack login via SimpleSamlPHP (LDAP, OAuth, OpenID, etc..)
>
> As far as I know, the ability to log in to OpenStack via arbitrary Identity Provider (IdP) is a widely desired feature. Therefore, we have decided to integrate Keystone & Horizon with Simple Saml PHP, since it provides a lot of AUTH sources (aka. IdPs), for example LDAP, database, facebook, etc... Check out our effort in this short video (40s):
>
> http://www.youtube.com/watch?v=qmJAumoh4U8
>
> For more, the instructions and a short introduction is available in the attached readme.pdf.
>
> Feedback is really appreciated._______________________________________________
> Mailing list: http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack
> Post to : openstack [at] lists
> Unsubscribe : http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack
>
>
> _______________________________________________
> Mailing list: http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack
> Post to : openstack [at] lists
> Unsubscribe : http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack

Index | Next | Previous | View Threaded

Interested in having your list archived? Contact Gossamer Threads