kolla-ansible

  1. Bug #2030816
  2. Comment #0

Comment 0 for bug 2030816

Revision history for this message
Freerk-Ole Zakfeld (freerkzakfeld) wrote : mod_auth_openidc config requires additional option for Keycloak

When using mod_auth_openidc to authenticate against a Keycloak IDP, there needs to be the additional option `OIDCTokenBindingPolicy "disabled"` set. This will prevent mod_auth_openidc from including the field `id_token_token_binding_cnf ` which, as of now, is not supported by Keycloak (see https://github.com/keycloak/keycloak/issues/22323 for reference).

Since wsgi-keystone.conf is not merged with custom config, it is not very easy to change this option without creating an entire own full config.