SAML protocol must always be called 'saml2'

[Matthieu Huin]

In the v3unscopedsaml plugin in python-keystoneclient, the token url is built with "saml2" as the default protocol value. However, this value is a class property and isn't meant to be set at plugin instantiation : https://github.com/openstack/python-keystoneclient/blob/master/keystoneclient/contrib/auth/v3/saml2.py#L28

Therefore every auth token url should be of the form http://X.Y.Z.A:5000/v3/OS-FEDERATION/identity_providers/.*?/protocols/saml2/auth in order for the plugin to be usable out of the box.

Short term fix: modify keystone's doc on federation so that administrators always create protocols called 'saml2'. This makes sense anyway, since SAML2 is used to authenticate and authorize the users.

Long term fix: allow the protocol name to be an argument when instantiating the plugin.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/128093

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/128103

[OpenStack Infra (hudson-openstack)]

Change abandoned by Matthieu Huin (<email address hidden>) on branch: master
Review: https://review.openstack.org/128093

[OpenStack Infra (hudson-openstack)]

Change abandoned by Jamie Lennox (<email address hidden>) on branch: master
Review: https://review.openstack.org/128103
Reason: This would now be a part of the keystoneclient-federation repo. Feel free to reopen if you still require it.

[David Stanek (dstanek)]

Unassigning since all of the proposed changes have been abandoned.

[Steve Martinelli (stevemar)]

this should be fixed, you can now name a protocol whatever you want and leverage the remote-id-attribute in the HTTP headers to find the right identity provider

[Steve Martinelli (stevemar)]

See earlier comment