forked from docs/doc-exports
Wei, Hongmin
80f18fd272
Reviewed-by: Kabai, Zoltán Gábor <zoltan-gabor.kabai@t-systems.com> Co-authored-by: Wei, Hongmin <weihongmin1@huawei.com> Co-committed-by: Wei, Hongmin <weihongmin1@huawei.com>
148 lines
16 KiB
HTML
148 lines
16 KiB
HTML
<a name="iam_02_0001"></a><a name="iam_02_0001"></a>
|
|
|
|
<h1 class="topictitle1">SP Initiated</h1>
|
|
<div id="body1529043536727"><p id="iam_02_0001__p47510470145643">OpenStack and Shibboleth are widely used open-source federated identity authentication solutions. They provide powerful SSO capabilities and connect users to various applications both inside and outside enterprises. This section describes how to use OpenStackClient and Shibboleth ECP Client to obtain the federated authentication token.</p>
|
|
<div class="section" id="iam_02_0001__section59576151105219"><h4 class="sectiontitle">Flowchart</h4><p id="iam_02_0001__p131582331551">The following figure shows the SP-initiated federation authentication process.</p>
|
|
<div class="fignone" id="iam_02_0001__fig28153389558"><span class="figcap"><b>Figure 1 </b>Flowchart (SP-initiated)</span><br><span><img class="imgResize" id="iam_02_0001__image31745880112746" src="en-us_image_0147658886.png" height="176.82953853607106" width="507.8937094116213" title="Click to enlarge"></span></div>
|
|
</div>
|
|
<div class="section" id="iam_02_0001__section27567425105336"><h4 class="sectiontitle">Description</h4><ol id="iam_02_0001__ol8032524105644"><li id="iam_02_0001__li11556026111232">The client calls the API (federated token obtained in the SP-initiated mode) provided by the cloud system.</li><li id="iam_02_0001__li50619744111337">The cloud system searches for the metadata file based on the user and IdP information in the URL and sends the SAML request to the client.</li><li id="iam_02_0001__li17239239105644">The client encapsulates the SAML request and forwards the SAML request to the IdP.</li><li id="iam_02_0001__li20935427105644">A user enters a username and password on the IdP server for identity authentication.</li><li id="iam_02_0001__li54201118105644">After the user passes the authentication, IdP constructs an assertion carrying the user identity information and sends the SAML response. The response passes through the client.</li><li id="iam_02_0001__li18048017105644">The client encapsulates the SAML response and forwards the SAML response to the cloud platform.</li><li id="iam_02_0001__li28214429105644">The cloud platform verifies and authenticates the assertion, and generates a temporary access credential according to the identity conversion rule configured by users in the identity provider.</li><li id="iam_02_0001__li52603276105644">Users can access cloud resources according to their permissions.</li></ol>
|
|
</div>
|
|
<div class="section" id="iam_02_0001__section4882433491913"><h4 class="sectiontitle">OpenStackClient</h4><p id="iam_02_0001__p3421952093935">You must have permissions of user <strong id="iam_02_0001__b842352706175552">root</strong> to install the unified command-line client. To perform the following operations, you only need to have the permissions of a common user.</p>
|
|
<div class="notice" id="iam_02_0001__note4336590491920"><span class="noticetitle"><img src="public_sys-resources/notice_3.0-en-us.png"> </span><div class="noticebody"><p id="iam_02_0001__p5474882391920">The API calling operation must be performed in a secure network environment (in a VPN or a cloud server of a domain). Otherwise, this operation may be under the man-in-the-middle (MITM) attack.</p>
|
|
</div></div>
|
|
</div>
|
|
<ol id="iam_02_0001__ol6247703611159"><li id="iam_02_0001__li5258172011159"><span>Create an environment variable file under the installation directory of OpenStackClient. Modify the environment variable file in a text editor. Add parameters, such as the username, password, region, SAML protocol version, and the IP address and port number of IAM, to the file. <a href="#iam_02_0001__table2616118811159">Table 1</a> describes the parameters.</span><p><p id="iam_02_0001__p4594125511159">For example:</p>
|
|
<p id="iam_02_0001__p1142959611159"><strong id="iam_02_0001__b977266811159">export OS_IDENTITY_API_VERSION=3</strong></p>
|
|
<p id="iam_02_0001__p5204077911159"><strong id="iam_02_0001__b1730366111159">export OS_AUTH_TYPE=v3samlpassword</strong></p>
|
|
<p id="iam_02_0001__p4284922211159"><strong id="iam_02_0001__b101068111159">export OS_AUTH_URL=https://iam.eu-de.otc.t-systems.com:443/v3</strong></p>
|
|
<p id="iam_02_0001__p115439511159"><strong id="iam_02_0001__b300144111159">export OS_IDENTITY_PROVIDER=idpid</strong></p>
|
|
<p id="iam_02_0001__p6149317411159"><strong id="iam_02_0001__b1265599811159">export OS_PROTOCOL=saml</strong></p>
|
|
<p id="iam_02_0001__p2551926111159"><strong id="iam_02_0001__b2061535011159">export OS_IDENTITY_PROVIDER_URL=https://idp.example.com/idp/profile/SAML2/SOAP/ECP</strong></p>
|
|
<p id="iam_02_0001__p2503838211159"><strong id="iam_02_0001__b260868111159">export OS_USERNAME=username</strong></p>
|
|
<p id="iam_02_0001__p5908340211159"><strong id="iam_02_0001__b5588837511159">export OS_PASSWORD=userpassword</strong></p>
|
|
<p id="iam_02_0001__p2723937811159"><strong id="iam_02_0001__b13676119144420">export OS_DOMAIN_NAME=</strong><strong id="iam_02_0001__b124216383512">example-domain-name</strong></p>
|
|
|
|
<div class="tablenoborder"><a name="iam_02_0001__table2616118811159"></a><a name="table2616118811159"></a><table cellpadding="4" cellspacing="0" summary="" id="iam_02_0001__table2616118811159" frame="border" border="1" rules="all"><caption><b>Table 1 </b>Parameter description</caption><thead align="left"><tr id="iam_02_0001__row964009311159"><th align="left" class="cellrowborder" valign="top" width="41.410000000000004%" id="mcps1.3.5.1.2.11.2.3.1.1"><p id="iam_02_0001__p2459196311159"><strong id="iam_02_0001__b842352706183148">Parameter</strong></p>
|
|
</th>
|
|
<th align="left" class="cellrowborder" valign="top" width="58.589999999999996%" id="mcps1.3.5.1.2.11.2.3.1.2"><p id="iam_02_0001__p3186528411159"><strong id="iam_02_0001__b20601766145329">Description</strong></p>
|
|
</th>
|
|
</tr>
|
|
</thead>
|
|
<tbody><tr id="iam_02_0001__row6315442511159"><td class="cellrowborder" valign="top" width="41.410000000000004%" headers="mcps1.3.5.1.2.11.2.3.1.1 "><p id="iam_02_0001__p6145384811159">OS_IDENTITY_API_VERSION</p>
|
|
</td>
|
|
<td class="cellrowborder" valign="top" width="58.589999999999996%" headers="mcps1.3.5.1.2.11.2.3.1.2 "><p id="iam_02_0001__p141497811159">Indicates the authentication API version. The value is fixed at <strong id="iam_02_0001__b842352706163656">3</strong>.</p>
|
|
</td>
|
|
</tr>
|
|
<tr id="iam_02_0001__row4912462111159"><td class="cellrowborder" valign="top" width="41.410000000000004%" headers="mcps1.3.5.1.2.11.2.3.1.1 "><p id="iam_02_0001__p1770061211159">OS_AUTH_TYPE</p>
|
|
</td>
|
|
<td class="cellrowborder" valign="top" width="58.589999999999996%" headers="mcps1.3.5.1.2.11.2.3.1.2 "><p id="iam_02_0001__p2195067811159">Indicates the authentication type. The value is fixed at <strong id="iam_02_0001__b842352706163941">v3samlpassword</strong>.</p>
|
|
</td>
|
|
</tr>
|
|
<tr id="iam_02_0001__row6006483511159"><td class="cellrowborder" valign="top" width="41.410000000000004%" headers="mcps1.3.5.1.2.11.2.3.1.1 "><p id="iam_02_0001__p3868335311159">OS_AUTH_URL</p>
|
|
</td>
|
|
<td class="cellrowborder" valign="top" width="58.589999999999996%" headers="mcps1.3.5.1.2.11.2.3.1.2 "><p id="iam_02_0001__p5892303511159">Indicates the authentication URL. The value format is <strong id="iam_02_0001__b842352706164022">https://</strong><em id="iam_02_0001__i896633800164012">IAM</em> <em id="iam_02_0001__i1159210620164012">IP address</em>:<em id="iam_02_0001__i2129740593164012">Port number</em>/<em id="iam_02_0001__i523599690164012">API version</em>.</p>
|
|
<ul id="iam_02_0001__ul6607261211159"><li id="iam_02_0001__li1791004811159"><em id="iam_02_0001__i84235269716419">Port number</em> is fixed at <strong id="iam_02_0001__b842352706164123">443</strong>.</li><li id="iam_02_0001__li1596204011159"><em id="iam_02_0001__i842352697164143">API version</em> is fixed at <strong id="iam_02_0001__b842352706163656_1">v3</strong>.</li></ul>
|
|
</td>
|
|
</tr>
|
|
<tr id="iam_02_0001__row670881411159"><td class="cellrowborder" valign="top" width="41.410000000000004%" headers="mcps1.3.5.1.2.11.2.3.1.1 "><p id="iam_02_0001__p6258503011159">OS_IDENTITY_PROVIDER</p>
|
|
</td>
|
|
<td class="cellrowborder" valign="top" width="58.589999999999996%" headers="mcps1.3.5.1.2.11.2.3.1.2 "><p id="iam_02_0001__en-us_topic_0117430799_p673860111159">Indicates the name of an identity provider created by a user in the cloud system. For example: Publiccloud-Shibboleth.</p>
|
|
</td>
|
|
</tr>
|
|
<tr id="iam_02_0001__row5188181311159"><td class="cellrowborder" valign="top" width="41.410000000000004%" headers="mcps1.3.5.1.2.11.2.3.1.1 "><p id="iam_02_0001__p2864808511159">OS_DOMAIN_NAME</p>
|
|
</td>
|
|
<td class="cellrowborder" valign="top" width="58.589999999999996%" headers="mcps1.3.5.1.2.11.2.3.1.2 "><p id="iam_02_0001__p191566411159">Indicates the domain name to be authenticated.</p>
|
|
</td>
|
|
</tr>
|
|
<tr id="iam_02_0001__row352821311159"><td class="cellrowborder" valign="top" width="41.410000000000004%" headers="mcps1.3.5.1.2.11.2.3.1.1 "><p id="iam_02_0001__p710320411159">OS_PROTOCOL</p>
|
|
</td>
|
|
<td class="cellrowborder" valign="top" width="58.589999999999996%" headers="mcps1.3.5.1.2.11.2.3.1.2 "><p id="iam_02_0001__p331103911159">Indicates the SAML protocol version. The value is fixed at <strong id="iam_02_0001__b842352706173913">saml</strong>.</p>
|
|
</td>
|
|
</tr>
|
|
<tr id="iam_02_0001__row4918301011159"><td class="cellrowborder" valign="top" width="41.410000000000004%" headers="mcps1.3.5.1.2.11.2.3.1.1 "><p id="iam_02_0001__p3501460111159">OS_IDENTITY_PROVIDER_URL</p>
|
|
</td>
|
|
<td class="cellrowborder" valign="top" width="58.589999999999996%" headers="mcps1.3.5.1.2.11.2.3.1.2 "><p id="iam_02_0001__p5623476111318">Indicates the URL of the identity provider used to handle the authentication request initialized by the ECP.</p>
|
|
</td>
|
|
</tr>
|
|
<tr id="iam_02_0001__row5886868711159"><td class="cellrowborder" valign="top" width="41.410000000000004%" headers="mcps1.3.5.1.2.11.2.3.1.1 "><p id="iam_02_0001__p1132443811159">OS_USERNAME</p>
|
|
</td>
|
|
<td class="cellrowborder" valign="top" width="58.589999999999996%" headers="mcps1.3.5.1.2.11.2.3.1.2 "><p id="iam_02_0001__p4587034311159">Indicates the name of a user who is authenticated in the identity provider.</p>
|
|
</td>
|
|
</tr>
|
|
<tr id="iam_02_0001__row6598712211159"><td class="cellrowborder" valign="top" width="41.410000000000004%" headers="mcps1.3.5.1.2.11.2.3.1.1 "><p id="iam_02_0001__p2199843211159">OS_PASSWORD</p>
|
|
</td>
|
|
<td class="cellrowborder" valign="top" width="58.589999999999996%" headers="mcps1.3.5.1.2.11.2.3.1.2 "><p id="iam_02_0001__p4795367211159">Indicates the password of a user who is authenticated in the identity provider.</p>
|
|
</td>
|
|
</tr>
|
|
</tbody>
|
|
</table>
|
|
</div>
|
|
</p></li><li id="iam_02_0001__li4158702011159"><span>Run the following command to set environment variables:</span><p><p id="iam_02_0001__p4603647411159"><strong id="iam_02_0001__b2828346711159">source keystonerc</strong></p>
|
|
</p></li><li id="iam_02_0001__li4011779411159"><span>Run the following command to obtain a token:</span><p><p id="iam_02_0001__p41395063112216"><strong id="iam_02_0001__b5702131711263">openstack token issue</strong></p>
|
|
<pre class="screen" id="iam_02_0001__screen128280711248">>>openstack token issue
|
|
command: token issue -> openstackclient.identity.v3.token.IssueToken (auth=True)
|
|
Using auth plugin: v3samlpassword
|
|
+-----------------------------------------------------------------------------------------------------------
|
|
| Field | Value
|
|
| expires | 2018-04-16T03:46:51+0000
|
|
| id | MIIDbQYJKoZIhvcNAQcCoIIDXjXXX...
|
|
| user_id | 9B7CJy5ME14f0fQKhb6HJVQdpXXX...</pre>
|
|
<p id="iam_02_0001__p60682725114144">In the command output, <strong id="iam_02_0001__b842352706214043">id</strong> is the obtained federated authentication token.</p>
|
|
</p></li></ol>
|
|
<div class="section" id="iam_02_0001__section4918283814425"><h4 class="sectiontitle">Shibboleth ECP Client</h4><ol id="iam_02_0001__ol5460427014443"><li id="iam_02_0001__li5826292414443"><span>Configure the <strong id="iam_02_0001__b842352706214524">metadata-providers.xml</strong> file in Shibboleth IdP v3 and save the <strong id="iam_02_0001__b842352706214547">metadata.xml</strong> file in the corresponding path.</span><p><pre class="screen" id="iam_02_0001__screen6687757144339"><MetadataProvider id="LocalMetadata1"xsi:type="FilesystemMetadataProvider" metadataFile="C:\Program Files (x86)\Shibboleth\IdP\metadata\web_metadata.xml"/>
|
|
<MetadataProvider id="LocalMetadata2"xsi:type="FilesystemMetadataProvider" metadataFile="C:\Program Files (x86)\Shibboleth\IdP\metadata\api_metadata.xml"/></pre>
|
|
<div class="note" id="iam_02_0001__note58307042162444"><img src="public_sys-resources/note_3.0-en-us.png"><span class="notetitle"> </span><div class="notebody"><ul id="iam_02_0001__ul3173043817553"><li id="iam_02_0001__li4162028217553"><strong id="iam_02_0001__b842352706214615_1">MetadataProvider id</strong> indicates the name of the downloaded metadata file of the SP system.</li><li id="iam_02_0001__li470362317553"><strong id="iam_02_0001__b842352706214632">metadataFile</strong> indicates the path for storing the metadata file of the SP system in the enterprise IdP.</li></ul>
|
|
</div></div>
|
|
</p></li><li id="iam_02_0001__li15577527145716"><span>Configure the <strong id="iam_02_0001__b842352706214714">attribute-filter.xml</strong> file in Shibboleth IdP v3.</span><p><pre class="screen" id="iam_02_0001__screen2893107145755"><afp:AttributeFilterPolicy id="example1">
|
|
<afp:PolicyRequirementRule xsi:type="basic:AttributeRequesterString" value="https://auth.example.com/" />
|
|
<afp:AttributeRule attributeID="eduPersonPrincipalName">
|
|
<afp:PermitValueRule xsi:type="basic:ANY" />
|
|
</afp:AttributeRule>
|
|
<afp:AttributeRule attributeID="uid">
|
|
<afp:PermitValueRule xsi:type="basic:ANY" />
|
|
</afp:AttributeRule>
|
|
<afp:AttributeRule attributeID="mail">
|
|
<afp:PermitValueRule xsi:type="basic:ANY" />
|
|
</afp:AttributeRule>
|
|
</afp:AttributeFilterPolicy>
|
|
|
|
<afp:AttributeFilterPolicy id="example2">
|
|
<afp:PolicyRequirementRule xsi:type="basic:AttributeRequesterString" value="https://iam.{region_id}.example.com" />
|
|
<afp:AttributeRule attributeID="eduPersonPrincipalName">
|
|
<afp:PermitValueRule xsi:type="basic:ANY" />
|
|
</afp:AttributeRule>
|
|
<afp:AttributeRule attributeID="uid">
|
|
<afp:PermitValueRule xsi:type="basic:ANY" />
|
|
</afp:AttributeRule>
|
|
<afp:AttributeRule attributeID="mail">
|
|
<afp:PermitValueRule xsi:type="basic:ANY" />
|
|
</afp:AttributeRule>
|
|
</afp:AttributeFilterPolicy></pre>
|
|
<div class="note" id="iam_02_0001__note23279258173454"><img src="public_sys-resources/note_3.0-en-us.png"><span class="notetitle"> </span><div class="notebody"><p id="iam_02_0001__p48801575173519"><strong id="iam_02_0001__b842352706214615_3">AttributeFilterPolicy id</strong> indicates the name of the downloaded metadata file of the SP system.</p>
|
|
<p id="iam_02_0001__p8186731173454"><strong id="iam_02_0001__b842352706214741">value</strong> indicates the <strong id="iam_02_0001__b842352706214752">EntityID</strong> in the metadata file of the SP system.</p>
|
|
</div></div>
|
|
</p></li><li id="iam_02_0001__li614905661545"><span>Configure the endpoint address of the enterprise IdP in the <a href="https://wiki.shibboleth.net/confluence/display/SHIB2/Contributions#Contributions-simplepython" target="_blank" rel="noopener noreferrer">ecp.py</a> script.</span><p><pre class="screen" id="iam_02_0001__screen5623919515446"># mapping from user friendly names or tags to IdP ECP enpoints
|
|
IDP_ENDPOINTS = {
|
|
"idp1": "https://idp.example.com/idp/profile/SAML2/SOAP/ECP"
|
|
}</pre>
|
|
</p></li><li id="iam_02_0001__li431015801552"><span>Run the <strong id="iam_02_0001__b842352706214835">ecp.py</strong> script to obtain the federated authentication token.</span><p><pre class="screen" id="iam_02_0001__screen6276841915744">>>python ecp.py
|
|
Usage: ecp.py [options] IdP_tag target_url login
|
|
>>python ecp.py -d idp1 https://iam.{region_id}.example.com/v3/OS-FEDERATION/identity_providers/idp_example/protocols/saml/auth {username}
|
|
X-Subject-Token: MIIDbQYJKoZIhvcNAQcCoIIDXXX...</pre>
|
|
<p id="iam_02_0001__p45862854175041"><strong id="iam_02_0001__b842352706214856">X-Subject-Token</strong> is the obtained federated authentication token.</p>
|
|
</p></li></ol>
|
|
</div>
|
|
</div>
|
|
<div>
|
|
<div class="familylinks">
|
|
<div class="parentlink"><strong>Parent topic:</strong> <a href="en-us_topic_0057845646.html">Obtaining a Token in Federated Identity Authentication Mode</a></div>
|
|
</div>
|
|
</div>
|
|
|
|
|
|
<script language="JavaScript">
|
|
<!--
|
|
image_size('.imgResize');
|
|
var msg_imageMax = "view original image";
|
|
var msg_imageClose = "close";
|
|
//--></script> |