91 lines
3.7 KiB
XML
91 lines
3.7 KiB
XML
<?xml version='1.0' encoding='UTF-8'?>
|
|
<para xmlns="http://docbook.org/ns/docbook" version="5.0">
|
|
<!-- Warning: Do not edit this file. It is automatically
|
|
generated and your changes will be overwritten.
|
|
The tool to do so lives in openstack-doc-tools repository. -->
|
|
<table rules="all" xml:id="config_table_keystone_saml">
|
|
<caption>Description of SAML configuration options</caption>
|
|
<col width="50%"/>
|
|
<col width="50%"/>
|
|
<thead>
|
|
<tr>
|
|
<th>Configuration option = Default value</th>
|
|
<th>Description</th>
|
|
</tr>
|
|
</thead>
|
|
<tbody>
|
|
<tr>
|
|
<th colspan="2">[saml]</th>
|
|
</tr>
|
|
<tr>
|
|
<td>assertion_expiration_time = 3600</td>
|
|
<td>(IntOpt) Default TTL, in seconds, for any generated SAML assertion created by Keystone.</td>
|
|
</tr>
|
|
<tr>
|
|
<td>certfile = /etc/keystone/ssl/certs/signing_cert.pem</td>
|
|
<td>(StrOpt) Path of the certfile for SAML signing. For non-production environments, you may be interested in using `keystone-manage pki_setup` to generate self-signed certificates. Note, the path cannot contain a comma.</td>
|
|
</tr>
|
|
<tr>
|
|
<td>idp_contact_company = None</td>
|
|
<td>(StrOpt) Company of contact person.</td>
|
|
</tr>
|
|
<tr>
|
|
<td>idp_contact_email = None</td>
|
|
<td>(StrOpt) Email address of contact person.</td>
|
|
</tr>
|
|
<tr>
|
|
<td>idp_contact_name = None</td>
|
|
<td>(StrOpt) Given name of contact person</td>
|
|
</tr>
|
|
<tr>
|
|
<td>idp_contact_surname = None</td>
|
|
<td>(StrOpt) Surname of contact person.</td>
|
|
</tr>
|
|
<tr>
|
|
<td>idp_contact_telephone = None</td>
|
|
<td>(StrOpt) Telephone number of contact person.</td>
|
|
</tr>
|
|
<tr>
|
|
<td>idp_contact_type = other</td>
|
|
<td>(StrOpt) Contact type. Allowed values are: technical, support, administrative billing, and other</td>
|
|
</tr>
|
|
<tr>
|
|
<td>idp_entity_id = None</td>
|
|
<td>(StrOpt) Entity ID value for unique Identity Provider identification. Usually FQDN is set with a suffix. A value is required to generate IDP Metadata. For example: https://keystone.example.com/v3/OS-FEDERATION/saml2/idp</td>
|
|
</tr>
|
|
<tr>
|
|
<td>idp_lang = en</td>
|
|
<td>(StrOpt) Language used by the organization.</td>
|
|
</tr>
|
|
<tr>
|
|
<td>idp_metadata_path = /etc/keystone/saml2_idp_metadata.xml</td>
|
|
<td>(StrOpt) Path to the Identity Provider Metadata file. This file should be generated with the keystone-manage saml_idp_metadata command.</td>
|
|
</tr>
|
|
<tr>
|
|
<td>idp_organization_display_name = None</td>
|
|
<td>(StrOpt) Organization name to be displayed.</td>
|
|
</tr>
|
|
<tr>
|
|
<td>idp_organization_name = None</td>
|
|
<td>(StrOpt) Organization name the installation belongs to.</td>
|
|
</tr>
|
|
<tr>
|
|
<td>idp_organization_url = None</td>
|
|
<td>(StrOpt) URL of the organization.</td>
|
|
</tr>
|
|
<tr>
|
|
<td>idp_sso_endpoint = None</td>
|
|
<td>(StrOpt) Identity Provider Single-Sign-On service value, required in the Identity Provider's metadata. A value is required to generate IDP Metadata. For example: https://keystone.example.com/v3/OS-FEDERATION/saml2/sso</td>
|
|
</tr>
|
|
<tr>
|
|
<td>keyfile = /etc/keystone/ssl/private/signing_key.pem</td>
|
|
<td>(StrOpt) Path of the keyfile for SAML signing. Note, the path cannot contain a comma.</td>
|
|
</tr>
|
|
<tr>
|
|
<td>xmlsec1_binary = xmlsec1</td>
|
|
<td>(StrOpt) Binary to be called for XML signing. Install the appropriate package, specify absolute path or adjust your PATH environment variable if the binary cannot be found.</td>
|
|
</tr>
|
|
</tbody>
|
|
</table>
|
|
</para>
|