openstack
/
keystone
Code Issues Proposed changes

Merge "Use osc in k2k example"

This commit is contained in:
Zuul 2018-08-20 14:03:55 +00:00 committed by Gerrit Code Review
parent 06b024a223 22c22f2005
commit c896f911ef
1 changed files with 8 additions and 21 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

29
doc/source/advanced-topics/federation/configure_federation.rst
View File

@ -534,30 +534,17 @@ described in `Get an unscoped token`_.
Testing it all out
------------------
Use keystoneauth to create a password session with the IdP, then use the
session to authenticate with the SP, and get a scoped token from the SP.
Use ``python-openstackclient`` to authenticate with the IdP and then get a
scoped token from the SP.
.. NOTE::
ECP stands for Enhanced Client or Proxy, an extension from the SAML2
protocol used in non-browser interfaces, like in the following example.
.. code-block:: python
.. code-block:: bash
import os
from keystoneauth1 import session
from keystoneauth1.identity import v3
from keystoneauth1.identity.v3 import k2k
auth = v3.Password(auth_url=os.environ.get('OS_AUTH_URL'),
username=os.environ.get('OS_USERNAME'),
password=os.environ.get('OS_PASSWORD'),
user_domain_name=os.environ.get('OS_USER_DOMAIN_NAME'),
project_name=os.environ.get('OS_PROJECT_NAME'),
project_domain_name=os.environ.get('OS_PROJECT_DOMAIN_NAME'))
password_session = session.Session(auth=auth)
k2ksession = k2k.Keystone2Keystone(password_session.auth, 'mysp',
domain_name='federated_domain')
auth_ref = k2ksession.get_auth_ref(password_session)
scoped_token_id = auth_ref.auth_token
print('Scoped token id: %s' % scoped_token_id)
$ openstack \
--os-service-provider mysp \
--os-remote-project-name federated_project \
--os-remote-project-domain-name federated_domain \
token issue