SAML 2.0 Service Provider Support for Keystone#11230

Open

bbobrov wants to merge 31 commits intomasterfrom

007-wp3-implementation

Commits on Mar 30, 2026

Item 02: Add Shibboleth SP (mod_shib) configuration to Keystone Helm chart
bbobrov
committed
Item 04: Add SAML SP key/certificate Kubernetes secret template
bbobrov
committed
Item 12: Add Prometheus alert for SAML assertion validation failures
bbobrov
committed
Bump Keystone chart version to 0.13.0 for SAML federation support
bbobrov
committed
Fix: Add missing metadataConfigMap default to federation.saml.idp values
bbobrov
committed
Add noop init container for SAML SP key decryption (SF.Sem.2 pattern)
bbobrov
committed
Implement per-tenant SAML SP key pairs for cryptographic tenant isolation
bbobrov
committed
Fix: Use 'saml2' as federation protocol name instead of 'mapped'
bbobrov
committed
Fix: Use 'saml2' auth method in keystone.conf instead of 'mapped'
bbobrov
committed
PLAN_C: Runtime SAML config generation from federation chart ConfigMaps
bbobrov
committed
Fix: Use Docker Hub mirror for SAML init container busybox image
bbobrov
committed
Fix: Remove redundant subPath mount for generate-saml-config.py
bbobrov
committed
Fix: Resolve Shibboleth startup warnings
bbobrov
committed
Fix: Move SAML IncludeOptional inside VirtualHost block
bbobrov
committed
Fix: Move Shibboleth handler and LoadModule directly into VirtualHost config
bbobrov
committed
Fix: Use WSGIScriptAliasMatch to exclude /Shibboleth.sso from WSGI routing
bbobrov
committed
Fix: Follow upstream Keystone pattern for mod_shib + WSGIScriptAlias coexistence
bbobrov
committed
Fix: Add UseCanonicalName On for mod_shib hostname matching
bbobrov
committed
Fix: Set handlerSSL=false in shibboleth2.xml for TLS-terminated ingress
bbobrov
committed
Clean up: Remove experimental Apache config, keep only essential SAML changes
bbobrov
committed
Clean up: Fix stale comment about LoadModule in generated federation-saml.conf
bbobrov
committed
Fix: Add MetadataProviders and CredentialResolver to ApplicationDefaults
bbobrov
committed
Per-tenant Shibboleth handlerURL for correct ACS applicationId routing
bbobrov
committed
Fix: Add RequestMapper for per-tenant Shibboleth handler URL routing
bbobrov
committed
Fix: Include all handlers in per-tenant ApplicationOverride Sessions block
bbobrov
committed
Fix: Extract SAML NameID as attribute for REMOTE_USER population
bbobrov
committed
Fix: Add unspecified NameID format decoder and SAP IAS plain-name attributes
bbobrov
committed
Add Chaining CredentialResolver for SP key rotation
bbobrov
committed
Fix: Use nested Path elements in RequestMapper for multi-tenant support
bbobrov
committed
Replace busybox init container with distroless Go binary (keystone-saml-sp-init)
bbobrov
committed
Fix: Set SP key Secret volume defaultMode to 0444 for nonroot init container
bbobrov
committed