I'm configuring federative access to openstack based on http://docs.openstack.org/developer/keystone/configure_federation.html (this document). What I would like to see if I open <server-address>/horizon I got a discovery choose IdP and after auth I'm redirected into Horizon. This works, but now I'm redirected to Horizon login screen after auth, because I protect /horizon with Shibboleth. I don't understand why code in documentation protects REST path with Shibboleth. Or if it is correct how can I reach horizon with federated auth?

Docs says not to set REMOTE_USER and I removed that part from shibboleth config.