Repository navigation
kolla: Enable Horizon multi-domain support - #331
Merged
Merged
Conversation
Upstream defaults horizon_keystone_multidomain to false (001-horizon.yml). Horizon then has no domain field at login and authenticates every password login against the default domain, so users of any other Keystone domain (an LDAP-backed domain, or domains run by domain managers) cannot log in to Horizon with a password. Federated logins through WebSSO do not use this field. osism/testbed has set the option since 7286bd1b (osism/testbed#1845). Set it to "yes" in 099-kolla.yml. kolla-ansible renders it as OPENSTACK_KEYSTONE_MULTIDOMAIN_SUPPORT (_9998-kolla-settings.py.j2), which in the 2026.1 Horizon image: - adds a required Domain field to the login form. It is free text, because horizon_keystone_domain_choices has only one entry (a dropdown appears with more than one), and it is prefilled only from the login_domain cookie of an earlier login (openstack_auth/forms.py); - makes identity administration use domain-scoped tokens (api/keystone.py): the Users, Groups, Roles and Credentials panels require a domain admin, and the Domains panel offers "Set Domain Context" and a domain filter. Domain-scoped tokens do not fit into cookie-backed sessions; Horizon then logs an error and disables identity operations (openstack_auth/backend.py). OSISM already sets horizon_backend_database, which keeps sessions in the database, and the new comment points at that dependency. Sites that want the previous behaviour set horizon_keystone_multidomain: "no" in their configuration. Assisted-by: Claude:claude-opus-5-5 Signed-off-by: Roger Luethi <luethi@osism.tech>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Upstream defaults
horizon_keystone_multidomaintofalse. Horizon then has no domain field at login and authenticates every password login against the default domain, so users of any other Keystone domain (an LDAP-backed domain, or domains run by domain managers) cannot log in to Horizon with a password. Federated logins through WebSSO do not use this field. osism/testbed has set the option since 2023:This sets
horizon_keystone_multidomain: "yes"inall/099-kolla.yml. kolla-ansible renders it asOPENSTACK_KEYSTONE_MULTIDOMAIN_SUPPORT, which in the 2026.1 Horizon image:horizon_keystone_domain_choiceshas a single entry; prefilled from thelogin_domaincookie of an earlier login);Domain-scoped tokens do not fit into cookie-backed sessions. OSISM already sets
horizon_backend_database, which keeps sessions in the database; the new comment points at that dependency.Sites that want the previous behaviour set
horizon_keystone_multidomain: "no".🤖 Generated with Claude Code