Hi John,
It indeed looks interesting and enhancing the mapping engine is on ours
to-do list for a long time. I'd be happy to talk this through during the
summit. Do you think you will be able to come for a Keystone
websso/federation Design Session on Wednesday at 16.30?
Thanks,
Marek
On 02.11.2014 18:29, John Dennis wrote:
While working on federated authentication for a different project
(OpenDaylight) we discovered we needed to map from the assertion
provided by an external federated IdP to local values. This is
essentially the same requirement which exists in Keystone's federated
support. It was hoped we could simply borrow the Keystone mapping
implementation but it was found to be too limiting and not sufficiently
expressive. We could not find another alternative so we designed a new
mapper which is described in this PDF.
https://jdennis.fedorapeople.org/doc/mapping.pdf
The mapper as described in the document has implementations in both Java
and Python. The Java implementation is currently in use in OpenDaylight
(a Java based project). For those interested I can provide a pointer to
OpenDaylight specific documentation on how this mapper is used in
conjunction with the Apache web server providing authentication and SSSD
providing identity attributes to a Java servlet container.
My goal here is to make Keystone developers aware of an alternative
mapper which may provide needed mapping features not currently available
and for which different language implementations already exist. Note,
the mapper is easily extended should a need arise.
Source code and documentation can be found here by cloning this git repo:
git clone git://fedorapeople.org/~jdennis/federated-mapping.git
Note, I put this git repo together quickly by pulling together things
from a variety of sources, as such there may be things needing to be
cleaned up in the repo, at the moment it's really just meant to browse.
Over the next few days I'll make sure everything builds and executes
cleanly. Posting this now in case folks want to have conversations at
the Paris Summit.
_______________________________________________
OpenStack-dev mailing list
OpenStack-dev@lists.openstack.org
http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev
