Skip to content

Commit 9320f68

Browse files
Jessica41Jessica41
authored
Merge pull request #8671 from ovh/jf-en-opcp
EN version - OPCP - Comment utiliser les API et obtenir les informations d'identification
2 parents ccd0900 + dd2ca47 commit 9320f68

File tree

2 files changed

+202
-4
lines changed

2 files changed

+202
-4
lines changed

‎pages/hosted_private_cloud/opcp/how-to-use-api-and-get-credentials/guide.en-gb.md‎

Lines changed: 199 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,199 @@
1+
---
2+
title: "OPCP - How to use the APIs and obtain the credentials"
3+
excerpt: "Discover the steps required to configure Keycloak and the OpenStack CLI to allow authentication via Keycloak"
4+
updated: 2025-11-07
5+
---
6+
7+
## Objective
8+
9+
**OPCP** integrates a centralized authentication with **Keycloak**. It is therefore necessary to configure the **OpenStack CLI** so that it uses Keycloak as the identity provider (Identity Provider).
10+
11+
**This guide describes the steps required to configure Keycloak and the OpenStack CLI to allow authentication via Keycloak.**
12+
13+
## Requirements
14+
15+
- Be an administrator of the [OPCP](/links/hosted-private-cloud/onprem-cloud-platform) infrastructure and have access to the administration interface (admin.dashboard).
16+
- Have access to the Keyloack admin interface.
17+
- Have a user with sufficient rights to log in to Horizon on the OPCP offer.
18+
19+
## Instructions
20+
21+
### Creating a Keycloak client for the OpenStack CLI
22+
23+
A **dedicated Keycloak client** is required to allow the OpenStack CLI to securely communicate with the Keycloak server.
24+
25+
#### Steps
26+
27+
1\. **Log in to the Keycloak administration interface**
28+
29+
- Log in to your Keycloak instance and select the *realm* in which the OpenStack users are defined.
30+
31+
2\. **Create a new client**
32+
33+
- Go to the `Clients` section and click on `Create a client`{.action}.
34+
- Enter a **Client ID**, for example:
35+
36+
```console
37+
openstack-cli
38+
```
39+
40+
- Click on `Next`{.action}.
41+
42+
3\. **Enable client authentication**
43+
44+
- Enable **Client Authentication** (set to **ON**).
45+
- Click on `Next`{.action}, then on `Save`{.action}.
46+
47+
4\. **Configure scopes (Client Scopes)**
48+
49+
- Open the `Client Scopes` tab.
50+
- Select the scope named:
51+
52+
```console
53+
[your-client-id]-dedicated
54+
```
55+
56+
- Click on `Configure a new mapper`{.action}.
57+
58+
5\. **Add a user group attribute mapper**
59+
60+
- Choose the mapper type **aggregated-user-group-attribute-mapper**.
61+
- Configure the following fields:
62+
63+
| Field | Value |
64+
|--------|--------|
65+
| **Name** | `projects` |
66+
| **User Attribute** | `project` |
67+
| **Token Claim Name** | `projects` |
68+
69+
- Click on `Save`{.action}.
70+
71+
6\. **Retrieve the client credentials**
72+
73+
- Go to the `Credentials` tab of the client you just created.
74+
- Copy and securely store the **Client Secret** — it will be needed when configuring the OpenStack CLI.
75+
76+
### Configuration of the OpenStack CLI
77+
78+
Once the Keycloak client is created, the OpenStack CLI must be configured to use this client as the OIDC (OpenID Connect) identity provider.
79+
80+
#### Steps
81+
82+
1\. **Install the OpenStack CLI tools**
83+
84+
If not already done:
85+
86+
```bash
87+
sudo pip install python-openstackclient
88+
```
89+
90+
2\. **Set environment variables for Keycloak authentication**
91+
92+
Example:
93+
94+
```bash
95+
export OS_INTERFACE=public
96+
export OS_IDENTITY_API_VERSION=3
97+
export OS_AUTH_URL="https://keystone.domain.ovh"
98+
export OS_AUTH_TYPE="v3oidcpassword"
99+
export OS_PROTOCOL="openid"
100+
export OS_IDENTITY_PROVIDER="keycloak-admin"
101+
export OS_CLIENT_ID="keycloak-client-id"
102+
export OS_CLIENT_SECRET="keycloak-client-credentials"
103+
export OS_DISCOVERY_ENDPOINT="https://admin.keycloak.domain.ovh/realms/master/.well-known/openid-configuration"
104+
export OS_USERNAME="keycloak-user-username"
105+
export OS_PASSWORD="keycloak-user-password"
106+
export OS_PROJECT_ID="project-id"
107+
```
108+
109+
> **Tip**
110+
> You can use the following script to easily generate the openrc.sh configuration file:
111+
112+
```bash
113+
#!/usr/bin/env bash
114+
115+
read -p "Your environment's base FQDN (e.g. example.bmp.ovhgoldorack.ovh): " FQDN_ENV
116+
117+
read -p 'master or pod realm ? (master/pod): ' REALM
118+
if [ "$REALM" != "master" ] && [ "$REALM" != "pod" ]; then
119+
echo "Invalid input. Please enter either 'master' or 'pod'."
120+
exit 1
121+
fi
122+
123+
read -p 'Keycloak client ID: ' KC_CLIENT_ID
124+
read -srp 'Keycloak client secret: ' KC_CLIENT_SECRET && echo
125+
126+
read -p 'Keycloak username: ' KC_USERNAME_INPUT
127+
read -srp 'Keycloak password: ' KC_PASSWORD_INPUT && echo
128+
129+
read -p 'Openstack Project ID (not the name): ' PROJECT_ID
130+
131+
printf "\n\nHere is your configuration, paste it to your shell or use the generate openrc.sh file\n\n"
132+
cat << EOM
133+
export OS_INTERFACE=public
134+
export OS_IDENTITY_API_VERSION=3
135+
export OS_AUTH_URL="https://keystone.${FQDN_ENV}"
136+
export OS_AUTH_TYPE="v3oidcpassword"
137+
export OS_PROTOCOL="openid"
138+
export OS_IDENTITY_PROVIDER=$([ "$REALM" = "master" ] && echo "keycloak-admin" || echo "keycloak")
139+
export OS_CLIENT_ID="$KC_CLIENT_ID"
140+
export OS_CLIENT_SECRET="$KC_CLIENT_SECRET"
141+
export OS_DISCOVERY_ENDPOINT="https://$([ "$REALM" = "master" ] && echo "admin.keycloak" || echo "keycloak").${FQDN_ENV}/realms/$REALM/.well-known/openid-configuration"
142+
export OS_USERNAME="$KC_USERNAME_INPUT"
143+
export OS_PASSWORD="$KC_PASSWORD_INPUT"
144+
export OS_PROJECT_ID="$PROJECT_ID"
145+
EOM
146+
147+
echo "#!/usr/bin/env bash
148+
149+
export OS_INTERFACE=public
150+
export OS_IDENTITY_API_VERSION=3
151+
export OS_AUTH_URL="https://keystone.${FQDN_ENV}"
152+
export OS_AUTH_TYPE="v3oidcpassword"
153+
export OS_PROTOCOL="openid"
154+
export OS_IDENTITY_PROVIDER=$([ "$REALM" = "master" ] && echo "keycloak-admin" || echo "keycloak")
155+
export OS_CLIENT_ID="$KC_CLIENT_ID"
156+
export OS_CLIENT_SECRET="$KC_CLIENT_SECRET"
157+
export OS_DISCOVERY_ENDPOINT="https://$([ "$REALM" = "master" ] && echo "admin.keycloak" || echo "keycloak").${FQDN_ENV}/realms/$REALM/.well-known/openid-configuration"
158+
export OS_USERNAME="$KC_USERNAME_INPUT"
159+
export OS_PASSWORD="$KC_PASSWORD_INPUT"
160+
export OS_PROJECT_ID="$PROJECT_ID > $PROJECT_ID."-openrc.sh"
161+
```
162+
163+
> **Tip: Proxy configuration**
164+
> If you are using a proxy to access your service, you must configure your environment variables to take this proxy into account.
165+
166+
To do this, add the following commands lines:
167+
168+
```bash
169+
export https_proxy=http://your-adress-ip:port/
170+
export http_proxy=http://your-adress-ip:port/
171+
```
172+
173+
### Configuration verification
174+
175+
You can test your configuration using a few simple commands:
176+
177+
```bash
178+
openstack token issue
179+
openstack project list
180+
openstack server list
181+
```
182+
183+
If these commands return results, the **Keycloak ↔ OpenStack** integration is correctly configured.
184+
185+
186+
### Troubleshooting
187+
188+
| Problem | Possible cause | Solution |
189+
|-----------|----------------|-----------|
190+
| `Invalid client credentials` | Wrong or missing `Client Secret` | Check the secret in the **Credentials** tab of the Keycloak client |
191+
| `Unauthorized` | The user is not associated with the correct group or project | Check the `project` attributes of the user in Keycloak |
192+
| `OIDC discovery failed` | Wrong URL in `DISCOVERY_ENDPOINT` | Make sure it points to the correct Keycloak *realm* |
193+
194+
195+
### References
196+
197+
- [Keycloak Documentation – OpenID Connect](https://www.keycloak.org/docs/latest/server_admin/#_oidc)
198+
- [OpenStack Keystone Documentation](https://docs.openstack.org/keystone/latest/)
199+
- [OVHcloud OPCP Documentation](https://docs.opcp.ovh)

‎pages/hosted_private_cloud/opcp/how-to-use-api-and-get-credentials/guide.fr-fr.md‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ updated: 2025-11-07
1414

1515
- Être administrateur de l'infrastructure [OPCP](/links/hosted-private-cloud/onprem-cloud-platform) et avoir accès à l'interface d'administration (admin.dashboard).
1616
- Avoir accès à l'interface d'administration Keyloack admin.
17-
- Avoir un utilisateur avec les droits suffisants pour se connecter à [Horizon](https://horizon.cloud.ovh.net/auth/login/) sur l'offre OPCP.
17+
- Avoir un utilisateur avec les droits suffisants pour se connecter à Horizon sur l'offre OPCP.
1818

1919
## En pratique
2020

@@ -72,7 +72,6 @@ Un client **Keycloak dédié** est nécessaire pour permettre à la CLI OpenStac
7272

7373
- Allez dans l’onglet `Credentials` du client que vous venez de créer.
7474
- Copiez et conservez de manière sécurisée la **Client Secret** — il sera nécessaire lors de la configuration du CLI OpenStack.
75-
7675

7776
### Configuration de la CLI OpenStack
7877

@@ -107,7 +106,7 @@ export OS_PASSWORD="keycloak-user-password"
107106
export OS_PROJECT_ID="project-id"
108107
```
109108

110-
> **Tips 1**
109+
> **Conseil**
111110
> Vous pouvez utiliser le script suivant afin de générer le fichier de configuration openrc.sh facilement :
112111
113112
```bash
@@ -161,7 +160,7 @@ export OS_PASSWORD="$KC_PASSWORD_INPUT"
161160
export OS_PROJECT_ID="$PROJECT_ID > $PROJECT_ID."-openrc.sh"
162161
```
163162

164-
> **Tips: Configuration d'un proxy**
163+
> **Conseil: Configuration d'un proxy**
165164
> Si vous utilisez un proxy pour accéder a votre service, vous devez configurer vos variables d'environnement pour prendre en compte ce proxy.
166165
167166
Pour ce faire, ajoutez les lignes de commande suivantes :

0 commit comments

Comments
 (0)