keystone_config provider does not support multi-valued config values

[Lars Kellogg-Stedman]

Certain keystone config options require the use of OpenStack's weird and unnatural multi-value configuration syntax. Specifically, trusted_dashboard:

  # A list of trusted dashboard hosts. Before accepting a Single Sign-On request
  # to return a token, the origin host must be a member of this list. This
  # configuration option may be repeated for multiple values. You must set this
  # in order to use web-based SSO flows. For example:
  # trusted_dashboard=https://acme.example.com/auth/websso
  # trusted_dashboard=https://beta.example.com/auth/websso (multi valued)

And trusted_user:

  # The list of distinguished names which identify trusted issuers of client
  # certificates allowed to use X.509 tokenless authorization. If the option is
  # absent then no certificates will be allowed. The format for the values of a
  # distinguished name (DN) must be separated by a comma and contain no spaces.
  # Furthermore, because an individual DN may contain commas, this configuration
  # option may be repeated multiple times to represent multiple values. For
  # example, keystone.conf would include two consecutive lines in order to trust
  # two different DNs, such as `trusted_issuer = CN=john,OU=keystone,O=openstack`
  # and `trusted_issuer = CN=mary,OU=eng,O=abc`. (multi valued)
  #trusted_issuer =

Currently, setting $keystone::federation::trusted_dashboards to a list value will result in only the first value being placed into keystone.conf.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.opendev.org/681313

[OpenStack Infra (hudson-openstack)]

Change abandoned by Lars Kellogg-Stedman (<email address hidden>) on branch: master
Review: https://review.opendev.org/681313

[Takashi Kajinami (kajinamit)]

This was already fixed by https://review.opendev.org/c/openstack/puppet-keystone/+/800600