{"id":27359306,"url":"https://github.com/rackerlabs/keystone-rxt","last_synced_at":"2025-06-11T17:38:46.856Z","repository":{"id":196767902,"uuid":"697029443","full_name":"rackerlabs/keystone-rxt","owner":"rackerlabs","description":"Federated Keystone RXT tokens using Rackspace Global Auth","archived":false,"fork":false,"pushed_at":"2024-04-26T16:03:29.000Z","size":87,"stargazers_count":2,"open_issues_count":0,"forks_count":2,"subscribers_count":4,"default_branch":"main","last_synced_at":"2024-04-26T16:46:26.951Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/rackerlabs.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2023-09-26T22:59:52.000Z","updated_at":"2024-07-08T23:47:06.002Z","dependencies_parsed_at":"2024-04-26T16:44:43.764Z","dependency_job_id":"9502f9a2-3735-45a8-a77c-9a9b21dcee01","html_url":"https://github.com/rackerlabs/keystone-rxt","commit_stats":null,"previous_names":["cloudnull/rackspace-rxt","rackerlabs/keystone-rxt"],"tags_count":4,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rackerlabs%2Fkeystone-rxt","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rackerlabs%2Fkeystone-rxt/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rackerlabs%2Fkeystone-rxt/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rackerlabs%2Fkeystone-rxt/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/rackerlabs","download_url":"https://codeload.github.com/rackerlabs/keystone-rxt/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":248650829,"owners_count":21139670,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2025-04-13T00:28:03.291Z","updated_at":"2025-06-11T17:38:46.847Z","avatar_url":"https://github.com/rackerlabs.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Keystone-RXT Authentication Plugin\n\nThis repo is a simple authentication plugin for Rackspace Global Auth that will allow an OpenStack environment to use\nRackspace Global Auth as an IDP.\n\nWhen the plugin is installed the `password` authentication method is required, and the plugin value needs to be be set\nto `rxt`. Once activated, the plugin will run normally allowing both local users and remote users to authenticate to\nthe cloud. The RXT authentication plugin presents a federated token and conforms to the mapping authentication driver.\n\n### Why?\n\nThe answer is quite simple, Rackspace Public Cloud Identity provides a powerful set of tools which can allow folks\nto make use of their existing users within an OpenStack environment; additionally, this setup allows us to use\nOpenStack natively.\n\n### How?\n\nTo bridge the authentication gap between Keystone and Rackspace Identity the keystone-rxt authentication driver\neffectively acts as a [reverse proxy](https://en.wikipedia.org/wiki/Reverse_proxy) to Rackspace Identity and\nthen presents the returned data as a federated token.\n\n![Capstone Diagram](files/capstone.png \"Capstone reverse proxy image https://github.com/rackerlabs/capstone\")\n\n#### History\n\nThis plugin was inspired by the [Capstone](https://github.com/rackerlabs/capstone) project. Process wise, Capstone\nand Keystone-RXT perform similar actions using Rackspace Identity as an IDP compatible with OpenStack. While\nKeystone-RXT was inspired by Capstone, the two projects serve different purposes.\n\n### Mapping\n\nWithin this repository is an example mapping file `mapping.json` which will create different users based on the roles\na user has within Rackspace Identity. This file is just an example and can be customized to meet the demands of the\nOpenStack environment following the typical mapping setup. See more about Keystone Mapping and Federation\n[here](https://docs.openstack.org/keystone/latest/admin/federation/mapping_combinations.html).\n\n----\n\n## Deploying the `keystone-rxt` plugin.\n\nBefore we can do anything you need to install the plugin within your keystone environment, for development purposes\nthe example here is using `pip`.\n\n``` shell\npip install --force --upgrade git+https://github.com/rackerlabs/keystone-rxt\n```\n\n\u003e This plugin is not yet on PyPi, but that will change with time.\n\n### Setup your environment\n\nOnce the authentication plugin is installed, update your `keystone.conf` to use the new password plugin named `rxt`.\n\nThe configuration file entry will look something like this\n\n``` conf\n[auth]\nmethods = password,token,application_credential\npassword = rxt\n```\n\n\u003e Take note that the `password` method is defined and that the password plugin is set to use `rxt`.\n\nIf you have multifactor auth enabled, and want to support users that are running work loads with it\nthe plugin also supports TOTP. To enable TOPT make sure `totp` is in your allowed authentication\nmethods and that the `totp` plugin is using the `rxt` plugin.\n\n``` conf\n[auth]\nmethods = password,token,application_credential,totp\npassword = rxt\ntotp = rxt\n```\n\nIf you are using the `saml2` federation protocol, you will also need to add the `saml2` plugin to your\n`keystone.conf` file.\n\n``` conf\n[auth]\nmethods = password,token,application_credential,saml2\npassword = rxt\ntotp = rxt\nsaml2 = rxt\n```\n\nYes, just a couple of lines is all that's required in config. After the configuration edit, be sure to restart\nkeystone.\n\n#### Rackspace Configurations\n\nThe `[rackspace]` section can also be used in your `keystone.conf` to allow you to configure how to anchor on\nroles.\n\n| key               | value |\n| ----------------- | ----- |\n| `role_attribute` | A string option used as an anchor to discover roles attributed to a given user |\n| `role_attribute_enforcement` | When set `true` will limit a users project to only the discovered GUID for the defined `role_attribute` |\n\n### Identity mapping, project, and domain setup\n\nOnce the plugin is setup and running, everything will be operating normally. The plugin is passive until\nthe Keystone is informed about the identity provider and we have the `rackspace_cloud_domain` created.\n\n#### Mapping Setup\n\nAvailable environment variables.\n\n| Environment Variable | Explanation |\n| ----------------- | ----- |\n| `RXT_UserName` | Username to be mapped |\n| `RXT_Email` | Email address from the user name |\n| `RXT_DomainID` | Domain ID for the federated assignment |\n| `RXT_TenantName` | Semicolon separated list of tenants mapped to the user |\n| `RXT_TenantID` | Tenant ID for the project |\n| `RXT_orgPersonType` | RBAC association |\n\n#### SAML Mapping Setup\n\nAvailable environment variables.\n\n| Environment Variable | Explanation |\n| ----------------- | ----- |\n| `REMOTE_ACCOUNT_NAME` | Account Name |\n| `REMOTE_AUTH_TOKEN` | Account Auth Token |\n| `REMOTE_AUTH_URL` | Auth URL |\n| `REMOTE_DDI` | Account DDI |\n| `REMOTE_DOMAIN` | Account Domain |\n| `REMOTE_SCOPED_TOKEN` | Scoped Auth Token |\n| `REMOTE_SESSION_CREATION` | Session creation time |\n| `REMOTE_EMAIL` | Remote user Email Address |\n| `uid` | Remote user ID |\n| `REMOTE_USERNAME` | Remote Username |\n\n##### Create the domain\n\n``` shell\nopenstack domain create rackspace_cloud_domain\n```\n\n#### Create the identity provider\n\n``` shell\nopenstack identity provider create --remote-id rackspace --domain rackspace_cloud_domain rackspace\n```\n\n##### Create the mapping for our identity provider\n\n``` shell\nopenstack mapping create --rules files/mapping.json --schema-version 2.0 rackspace_mapping\n```\n\n##### Create the federation protocol\n\n``` shell\nopenstack federation protocol create rackspace --mapping rackspace_mapping --identity-provider rackspace\n```\n\n## Using The RXT Authentication Plugin\n\nUsing the plugin is no different that a typical day in the cloud. Simply authenticate using your favorite method,\njust make sure you include the `rackspace_cloud_domain` domain.\n\n### Authentication using `openstacksdk`\n\nThis setup requires a federated token to work. The clouds yaml will not pull a token by default.\n\n``` yaml\nclouds:\n  local:\n    auth:\n      auth_url: http://localhost:5000/v3\n      project_name: 67890_Development\n      project_domain_name: rackspace_cloud_domain\n      username: test\n      password: secrete\n      user_domain_name: rackspace_cloud_domain\n    region_name: RegionOne\n    interface: internal\n    identity_api_version: \"3\"\n```\n\nIf you're running the CLI tools with a TOTP enabled user and you don't want to use your API key,\nsetup your `clouds.yaml` with the following options so that it knows to run with `password` and\n`totp`.\n\n``` yaml\nclouds:\n  rxt-local-mfa:\n    auth_type: \"v3multifactor\"\n    auth_methods:\n      - v3password\n      - v3totp\n    auth:\n      auth_url: http://localhost:5000/v3\n      project_name: 67890_Development\n      project_domain_name: rackspace_cloud_domain\n      username: test\n      password: secrete\n      user_domain_name: rackspace_cloud_domain\n    region_name: RegionOne\n    interface: internal\n    identity_api_version: \"3\"\n```\n\n\u003e Enabling TOTP will require you to use your one time token to run commands, this token can be\n  defined on the CLI with the `--os-passcode` flag; for example the simple image list would look\n  like so `openstack --os-cloud local --os-passcode 123456 image list`\n\nOnce you have the clouds CLI setup, run commands normally.\n\n```shell\nopenstack --os-cloud local image list\n+--------------------------------------+-------------------------------------------------+--------+\n| ID                                   | Name                                            | Status |\n+--------------------------------------+-------------------------------------------------+--------+\n| 6af793ec-d5d2-4a70-a284-cbbb223365f3 | debian-10-openstack-amd64.qcow2                 | active |\n| 4ee2c1b4-1055-40b8-ad6b-eb3c9eb7b4d7 | debian-11-genericcloud-amd64.qcow2              | active |\n| f16a1332-a5fb-46d5-b2ae-caa136cf9432 | jammy-server-cloudimg-amd64-disk-kvm.img        | active |\n| 9e2c968c-c5b3-4a1b-9355-261fa9907e16 | ubuntu-bionic-server-cloudimg-amd64.img         | active |\n| 0ee7d71b-2043-49a0-b107-56ebbbcd6b95 | ubuntu-focal-server-cloudimg-amd64-disk-kvm.img | active |\n| 804cc228-251c-4081-97df-f609c0e568e7 | ubuntu-jammy-server-cloudimg-amd64-disk-kvm.img | active |\n| da9923a8-ac4b-4036-ac14-46264247eb27 | ubuntu-xenial-server-cloudimg-amd64-disk1.img   | active |\n+--------------------------------------+-------------------------------------------------+--------+\n```\n\n##### Authentication using `cURL`\n\nYou can also use `cURL` to great effect.\n\n\u003e Example POST json files can be found in the files directory.\n\n``` shell\ncurl -sS -D - -H \"Content-Type: application/json\" --data-binary \"@get-scoped-token\" \"http://172.16.27.211:5000/v3/auth/tokens\" -o /dev/null\nHTTP/1.1 201 CREATED\nContent-Type: application/json\nContent-Length: 5594\nX-Subject-Token: OS_TOKEN\nVary: X-Auth-Token\nx-openstack-request-id: req-5a0eb098-eecc-41e1-a10d-d872dc867561\nConnection: close\n```\n\nWith the about command we can pull out the value of `X-Subject-Token` and store it as `OS_TOKEN` so that we can\nauthenticate to the various APIs supported by our service catalog.\n\n``` shell\ncurl -H \"Accept: application/json\" -H \"X-Auth-Token: $OS_TOKEN\" http://localhost:9292/v2/images\n```\n\n#### Create the SAML identity provider\n\n``` shell\nopenstack --os-cloud default identity provider create \\\n          --remote-id \"https://login.rackspace.com\" \\\n          --domain rackspace_cloud_domain \\\n          Rackspace-Federation\n```\n\n\u003e The `keystone-rxt` plugin will use the provider name `Rackspace-Federation` to identify the SAML identity provider.\n\n##### Create the SAML mapping for our identity provider\n\n``` shell\nopenstack --os-cloud default mapping create \\\n          --rules files/rackspace-saml-mapping.json \\\n          --schema-version 2.0 \\\n          saml_mapping\n```\n\n##### Create the SAML federation protocol\n\n``` shell\nopenstack --os-cloud default federation protocol create saml2 \\\n          --mapping saml_mapping \\\n          --identity-provider Rackspace-Federation\n```\n\nOnce the SAML identity provider is ready, and deployed; you can use the SAML authentication via WebSSO.\n\nTo use the openstack API, it is required to first create an application credential for the user within the UI. This will\nallow the user to authenticate using the SAML identity provider and then use the application credential to\nauthenticate to the OpenStack API.\n\n### Authentication using `openstacksdk` and Application Credentials\n\nThis setup requires a federated token to work. The clouds yaml will not pull a token by default.\n\n``` yaml\n  rxt-application-credential:\n    auth_type: v3applicationcredential\n    auth:\n      auth_url: http://localhost:5000/v3\n      application_credential_id: ${APP_CRED_ID}\n      application_credential_secret: ${APP_CRED_SECRET}\n    region_name: RegionOne\n    interface: internal\n    identity_api_version: \"3\"\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Frackerlabs%2Fkeystone-rxt","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Frackerlabs%2Fkeystone-rxt","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Frackerlabs%2Fkeystone-rxt/lists"}