Mapping openstack_project attribute in k2k assertions with different domains

[Iury Gregory Melo Ferreira]

We can have two projects with the same name in different domains. So if we have a "Project A" in "Domain X" and a "Project A" in "Domain Y", there is no way to differ what "Project A" is being used in a SAML assertion generated by this IdP (we have only the openstack_project attribute in the SAML assertion).

[Morgan Fainberg (mdrnstm)]

We need to include the domain information in the assertion and/or the entire hierarchy (reseller).

[Adam Young (ayoung)]

Assertions need not just the project name, but the domain and all parent projects.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/172536

[Dolph Mathews (dolph)]

Changing this to Wishlist for the reasoning described in a related bug: https://bugs.launchpad.net/keystone/+bug/1442787/comments/2

[Rodrigo Duarte (rodrigodsousa)]

As per the comment in the related bug report, we can't address this issue by some workaround in the mapping rules. The possibility to map different entities from the IdP in the same local entity in the SP can only be fixed by providing all information necessary to differ the IdP entities (in the case of project: project name and project's domain name or project id).

[Rodrigo Duarte (rodrigodsousa)]

created a spec for this new attributes: https://review.openstack.org/#/c/174462/

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/172536
Committed: https://git.openstack.org/cgit/openstack/keystone/commit/?id=fa844bc88edb417f9513d19c749886a61d7b26ce
Submitter: Jenkins
Branch: master

commit fa844bc88edb417f9513d19c749886a61d7b26ce
Author: Rodrigo Duarte Sousa <email address hidden>
Date: Fri Apr 10 14:59:34 2015 -0300

    Add openstack_project_domain to assertion

    Currently, a keystone IdP does not provide the domain of the project
    when generating SAML assertions. Since it is possible to have two
    projects with the same name but in different domains, this patch
    adds an additional attribute called "openstack_project_domain"
    in the assertion to identify the domain of the project.

    Closes-Bug: 1442343
    bp assertion-extra-attributes

    Change-Id: I62ed73d87f268c73294738845421deb87088326b

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/kilo
Review: https://review.openstack.org/179195

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/179195
Committed: https://git.openstack.org/cgit/openstack/keystone/commit/?id=0c0bf69ceff55d81054a61123cccabb721b96b09
Submitter: Jenkins
Branch: stable/kilo

commit 0c0bf69ceff55d81054a61123cccabb721b96b09
Author: Rodrigo Duarte Sousa <email address hidden>
Date: Fri Apr 10 14:59:34 2015 -0300

    Add openstack_project_domain to assertion

    Currently, a keystone IdP does not provide the domain of the project
    when generating SAML assertions. Since it is possible to have two
    projects with the same name but in different domains, this patch
    adds an additional attribute called "openstack_project_domain"
    in the assertion to identify the domain of the project.

    Closes-Bug: 1442343
    bp assertion-extra-attributes

    Change-Id: I62ed73d87f268c73294738845421deb87088326b
    (cherry picked from commit fa844bc88edb417f9513d19c749886a61d7b26ce)