From 8ce0849378316c288d0206fe5cb68a842985e5c8 Mon Sep 17 00:00:00 2001 From: Roger Luethi Date: Sat, 17 Oct 2026 09:23:24 +0200 Subject: [PATCH] kolla: Enable Horizon multi-domain support Upstream defaults horizon_keystone_multidomain to false (001-horizon.yml). Horizon then has no domain field at login and authenticates every password login against the default domain, so users of any other Keystone domain (an LDAP-backed domain, or domains run by domain managers) cannot log in to Horizon with a password. Federated logins through WebSSO do not use this field. osism/testbed has set the option since 7286bd1b (osism/testbed#1845). Set it to "yes" in 099-kolla.yml. kolla-ansible renders it as OPENSTACK_KEYSTONE_MULTIDOMAIN_SUPPORT (_9998-kolla-settings.py.j2), which in the 2026.1 Horizon image: - adds a required Domain field to the login form. It is free text, because horizon_keystone_domain_choices has only one entry (a dropdown appears with more than one), and it is prefilled only from the login_domain cookie of an earlier login (openstack_auth/forms.py); - makes identity administration use domain-scoped tokens (api/keystone.py): the Users, Groups, Roles and Credentials panels require a domain admin, and the Domains panel offers "Set Domain Context" and a domain filter. Domain-scoped tokens do not fit into cookie-backed sessions; Horizon then logs an error and disables identity operations (openstack_auth/backend.py). OSISM already sets horizon_backend_database, which keeps sessions in the database, and the new comment points at that dependency. Sites that want the previous behaviour set horizon_keystone_multidomain: "no" in their configuration. Assisted-by: Claude:claude-opus-5-5 Signed-off-by: Roger Luethi --- all/099-kolla.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/all/099-kolla.yml b/all/099-kolla.yml index ac7d9be..6bf2880 100644 --- a/all/099-kolla.yml +++ b/all/099-kolla.yml @@ -100,6 +100,10 @@ mariadb_backup_target: active # horizon horizon_backend_database: "yes" +# Ask for the domain at login and manage identity per domain. The domain +# tokens this needs do not fit into cookie sessions; horizon_backend_database +# keeps sessions in the database. +horizon_keystone_multidomain: "yes" # 2025.2 switched Horizon to uWSGI (horizon_wsgi_provider defaults to uwsgi); # behind HAProxy the uWSGI backend must listen on the unprivileged 8080, not # the privileged 80. Match upstream for 2025.2+, keep the pre-uWSGI value for