How to map a user to a domain other than Federated domain?

asked 2016-09-30 03:17:48 -0500

spsingh gravatar image

I am trying to understand direct mapping on OpenStack. I want to map a user to a domain other than Federated domain. But I always get user mapped to Federated domain. Here follows the link for direct mapping that I am using:

https://specs.openstack.org/openstack/keystone-specs/specs/kilo/federated-direct-user-mapping.html (https://specs.openstack.org/openstack...)

Here follows the rule for mapping that I am using:

[
  {
    "local": [
      {
        "user": {
          "name": "{0}",
          "domain": {"name": "Default"}
        }
      },
      {
        "group": {
          "id": "GROUP_ID"
        }
      }
    ],
    "remote": [
      {
        "type": "HTTP_OIDC_SUB"
      }
    ]
  }
]

I am using OpenID connect Idp for federation authentication and Liberty OpenStack version.

I have created user named as admin in Identity Provider. As the user admin also exists in the Keystone backend, I think it should be mapped to local admin user. But it does not happen. It is considered ephemeral user and mapped to Federated domain.

Could someone help me how I can do direct mapping to map a federated user to a domain other than Federated domain?

edit retag flag offensive close merge delete