{"id":20111254,"url":"https://github.com/openstack/charm-keystone-openidc","last_synced_at":"2026-02-18T18:31:52.436Z","repository":{"id":66174644,"uuid":"537275409","full_name":"openstack/charm-keystone-openidc","owner":"openstack","description":"Juju Charm - Keystone OpenID Connect. Mirror of code maintained at opendev.org.","archived":false,"fork":false,"pushed_at":"2025-04-15T05:23:57.000Z","size":96,"stargazers_count":2,"open_issues_count":0,"forks_count":0,"subscribers_count":8,"default_branch":"master","last_synced_at":"2025-09-19T06:18:51.171Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"https://opendev.org/openstack/charm-keystone-openidc","language":"Python","has_issues":false,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/openstack.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2022-09-16T02:19:33.000Z","updated_at":"2025-04-03T00:10:48.000Z","dependencies_parsed_at":"2023-11-07T09:30:32.209Z","dependency_job_id":"3f8afbf1-677c-4a9a-ad44-ea68edee6f9e","html_url":"https://github.com/openstack/charm-keystone-openidc","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/openstack/charm-keystone-openidc","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/openstack%2Fcharm-keystone-openidc","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/openstack%2Fcharm-keystone-openidc/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/openstack%2Fcharm-keystone-openidc/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/openstack%2Fcharm-keystone-openidc/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/openstack","download_url":"https://codeload.github.com/openstack/charm-keystone-openidc/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/openstack%2Fcharm-keystone-openidc/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":29589486,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-02-18T16:55:40.614Z","status":"ssl_error","status_checked_at":"2026-02-18T16:55:37.558Z","response_time":162,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.6:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-13T18:15:08.809Z","updated_at":"2026-02-18T18:31:52.422Z","avatar_url":"https://github.com/openstack.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Overview\n\nThis subordinate charm provides a way to integrate an Open ID Connect based\nidentity provider with Keystone using\n[mod_auth_openidc][mod_auth_openidc]. Apache\noperates as an OpenID Connect Relaying Party towards an OpenID Connect\nProvider.\n\n# Usage\n\n## Configuration\n\nTo display all configuration option information run `juju config\nkeystone-openidc`. If the application is not deployed then see the charm's\n[Configure tab][keystone-openidc-configure] in the\nCharmhub. Finally, the [Juju documentation][juju-docs-config-apps] provides\ngeneral guidance on configuring applications.\n\n## Deployment\n\nThese deployment instructions assume the following applications are present:\n[keystone][keystone-charm] and\n[openstack-dashboard][openstack-dashboard-charm]\n\nTo deploy keystone-openidc:\n\n    juju deploy keystone-openidc\n\nJoin keystone-openidc to keystone:\n\n    juju add-relation keystone:keystone-fid-service-provider keystone-openidc:keystone-fid-service-provider\n\nJoin keystone-openidc to openstack-dashboard to provide SSO access through Horizon:\n\n    juju add-relation openstack-dashboard:websso-fid-service-provider keystone-openidc:websso-fid-service-provider\n\nEnable Horizon as a trusted dashboard for Web Single Single-On for Keystone:\n\n    juju add-relation openstack-dashboard:websso-trusted-dashboard keystone:websso-trusted-dashboard\n\n**You must add this relation for Horizon and Keystone. If you do not, Keystone will return a 401 error that the login domain for Horizon is not a trusted domain.**\n\nNow provide an OpenID Connect client credentials and the URL for autodiscovery\nof the backend's configuration:\n\n    juju config keystone-openidc \\\n        oidc-client-id=\"\u003cCLIENT_ID\u003e\" \\\n        oidc-client-secret=\"\u003cCLIENT_SECRET\u003e\" \\\n        oidc-provider-metadata-url=\"https://example.com/.well-known/openid-configuration\"\n\nHere is a bundle representation of the deployment:\n\n```yaml\napplications:\n  keystone-openidc:\n    charm: ch:keystone-openid\n    num_units: 0\n    options:\n      oidc-client-id: \"\u003cCLIENT_ID\u003e\"\n      oidc-client-secret: \"\u003cCLIENT_SECRET\u003e\"\n      oidc-provider-metadata-url: \"https://example.com/.well-known/openid-configuration\"\nrelations:\n- - keystone:keystone-fid-service-provider\n  - keystone-openidc:keystone-fid-service-provider\n- - openstack-dashboard:websso-fid-service-provider\n  - keystone-openidc:websso-fid-service-provider\n```\n\n## OpenStack CLI Authentication\n\nThe [OpenStack client][openstackclient-homepage] supports authentication\nagainst an OpenID Connect identity provider using [Bearer Access Token\nauthentication flow][bearer-access-token-flow] only. This requires the\nkeystone-openidc charm to have its configuration option `auth-type` set to\n'auth-openidc' (the default).\n\nHere is an example of the environment variables that need to be set for the\nOpenStack client to authenticate successfully:\n\n```bash\nexport OS_AUTH_TYPE=v3oidcpassword\nexport OS_DISCOVERY_ENDPOINT=\"https://example.com/.well-known/openid-configuration\"\n\nexport OS_OPENID_SCOPE=\"openid email profile\"\nexport OS_CLIENT_ID=\"\u003cCLIENT_SECRET\u003e\"\nexport OS_CLIENT_SECRET=\"\u003cCLIENT_SECRET\u003e\"\nexport OS_IDENTITY_PROVIDER=openid\nexport OS_PROTOCOL=openid\n\n# At the end include openstack specific config, like OS_USERNAME, OS_PASSWORD, etc.\n# ...\n```\n\n\u003c!-- To test the example above run the following commands in a local copy of\nthe keystone-openidc git repo:\n\n  tox -e build\n  tox -e func-target -- noble-caracal --keep-model\n--\u003e\n\n## Proxies\n\nThe keystone-openidc charm uses the `juju-https-proxy` model configuration when\nset and its value is passed to\n[OIDCOutgoingProxy in Apache mod_auth_openidc module](https://github.com/OpenIDC/mod_auth_openidc/blob/v2.4.12.3/auth_openidc.conf#L839-L842).\n\n# Bugs\n\nPlease report bugs on [Launchpad][keystone-openidc-filebug].\n\nFor general charm questions refer to the [OpenStack Charm Guide][cg].\n\n\u003c!-- LINKS --\u003e\n\n[bearer-access-token-flow]: https://www.rfc-editor.org/rfc/rfc6750\n[cg]: https://docs.openstack.org/charm-guide\n[juju-docs-config-apps]: https://juju.is/docs/olm/configure-an-application\n[keystone-openidc-configure]: https://charmhub.io/keystone-openidc/configure\n[keystone-openidc-filebug]: https://bugs.launchpad.net/charm-keystone-openidc/+filebug\n[keystone-charm]: https://charmhub.io/keystone\n[mod_auth_openidc]: https://github.com/zmartzone/mod_auth_openidc\n[openstackclient-homepage]: https://docs.openstack.org/python-openstackclient/latest/\n[openstack-dashboard-charm]: https://charmhub.io/openstack-dashboard\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fopenstack%2Fcharm-keystone-openidc","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fopenstack%2Fcharm-keystone-openidc","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fopenstack%2Fcharm-keystone-openidc/lists"}