This repository provides a fully automated script to install and configure OpenStack (DevStack) and Shibboleth Service Provider (SP), along with the required integrations for SAML-based federation. The script simplifies the process of setting up a federated environment for OpenStack.
- Automated Installation: Install and configure DevStack and Shibboleth-SP.
- Dependency Verification: Ensures required components are installed before executing dependent functions.
- SAML Federation Configuration: Automates the setup of Identity Providers (IdPs) and related federation resources in Keystone.
- Horizon WebSSO Configuration: Configures the Horizon dashboard for SSO authentication.
- Apache Configuration: Updates the Keystone Apache configuration for SAML federation.
- State Management: Tracks installation status across script runs to prevent redundant operations.
We tested the system on:
- OS: Ubuntu:22.04
- Hardware:
- Memory: 4096 MB
- Prcessors: 2
- HDD: 100 GB
- Devstack version: 2023.2
- Installed tools:
bash,python3,git,curl, and other dependencies handled by the script. - A valid list of Identity Providers (IdPs) provided in a CSV file (
sp3_supporting_files/idp_list.csv). Samples are provided.
-
Clone the Repository:
git clone git@github.com:bakursait/sp3_installer.git cd sp3_supporting_files/ -
Run the Script:
./install_local_sp3.sh <option>
The script supports the following operations:
devstack: Install and configure OpenStack DevStack.shibsp: Install and configure Shibboleth Service Provider (SP).configure_shibsp: Configure Shibboleth-SP for federation.configure_keystone_debugging: Enable debugging in Keystone.horizon_websso: Configure Horizon for WebSSO.configure_keystone_cli: Create federation resources in Keystone CLI.configure_keystone_federation: Complete federation configuration in Keystone.configure_keystone_apache: Update the Keystone Apache vhost configuration. -- MUST run withsudoprivileges.
# Install DevStack
./install_local_sp3.sh devstack
# Install Shibboleth SP
./install_local_sp3.sh shibsp
# Configure Horizon for WebSSO
./install_local_sp3.sh horizon_websso
# Configure Keystone endpoints for Apache
sudo ./install_local_sp3.sh configure_keystone_apacheThe following diagram illustrates the relationship between independent and dependent functions in the script:
setup_devstack()
└── configure_keystone_debugging()
└── horizon_websso()
└── configure_keystone_cli()
└── configure_keystone_federation()
└── configure_keystone_apache()
install_shib_sp()
└── configure_shib_sp()To install the dependent functions such as configure_keystone_debugging() you need to install its parent function first: setup_devstack()
- Add your IdPs to the CSV file at
sp3_supporting_files/idp_list.csvin the following format:fqdn;idp_entity_id;idp_backup_file;idp_keystone_name;idp_horizon_name;idp_mapping_rules - Column Descriptions:
fqdn: The FQDN (hostname) of the IdP (e.g., idp.localtest).idp_entity_id: The SAML Entity ID of the IdP (e.g., https://idp.localtest/idp/shibboleth).idp_backup_file: File name for Shib-SP caching the IdP's metadata (e.g., idp.localtest-metadata.xml) in/etc/cache/shibboleth/.idp_keystone_name: Unique name for the IdP in Keystone (e.g., demoidp).idp_horizon_name: Display name for the IdP in Horizon's WebSSO (e.g., demoidp-websso).idp_mapping_rules: Name for the mapping rules to link the IdP to Keystone (e.g., demoidp).
- Many functions depend on the existance of the file:
sp3_supporting_files/idp_list.csv. Please add your IdPs there.
- Ensure all Identity Providers (IdPs) are added to the Service Provider's (SP's)
/etc/hostsfile. Example:192.168.4.101 idp.localtest 192.168.4.102 idp.localtest1
The script ensures dependent components are installed before executing:
- Independent functions like
setup_devstack()andinstall_shib_sp()verify their own prerequisites. - Dependent functions (e.g.,
configure_shibsp()) check the installation state of their parent components before proceeding.
- By using
typecommand, we determine if the dependent function is allowed to be installed or not. - The condition is set to test if the parent functions like
setup_devstack()is installed or not. - preventing the user by mistakenly reinstall the parent functions.
- Fixed and IDP-Specific Directives: Updates Keystone Apache configuration with both fixed and IdP-specific directives.
- Federation Resources: Automates creation of Identity Provider objects, mappings, groups, projects, and roles in Keystone.
Contributions to improve the script or add new features are welcome. Please submit a pull request or open an issue for discussion.
- Ensure the script is executed with appropriate privileges (root or sudo).
- Verify the
/etc/hostsfile includes all required IdPs. - Use the logs in
/var/logfor debugging issues.
mainly focused on the following resources: