Enabling Federation ExtensionΒΆ

To enable the federation extension:

  1. Add the federation extension driver to the [federation] section in keystone.conf. For example:

    [federation]
    driver = keystone.contrib.federation.backends.sql.Federation
    
  2. Add the saml2 authentication method to the [auth] section in keystone.conf:

    [auth]
    methods = external,password,token,saml2
    saml2 = keystone.auth.plugins.saml2.Saml2
    

Note

The external method should be dropped to avoid any interference with some Apache + Shibboleth SP setups, where a REMOTE_USER env variable is always set, even as an empty value.

  1. Add the federation_extension middleware to the api_v3 pipeline in keystone-paste.ini. For example:

    [pipeline:api_v3]
    pipeline = access_log sizelimit url_normalize token_auth admin_token_auth
    xml_body json_body ec2_extension s3_extension federation_extension
    service_v3
    
  2. Create the federation extension tables if using the provided SQL backend. For example:

    ./bin/keystone-manage db_sync --extension federation
    

Previous topic

Enabling Endpoint Filter Extension

Next topic

Enabling the Revocation Extension

This Page