--- title: Charmhub | Deploy Keystone OpenID Connect using Charmhub - The Open Operator Collection description: Deploy the latest version of Keystone OpenID Connect on any cloud. url: https://charmhub.io/keystone-openidc/configurations --- # Keystone OpenID Connect [OpenStack Charmers](https://charmhub.io/publisher/openstack-charmers "View all packages from OpenStack Charmers") * [OpenStack Charmers](https://charmhub.io/publisher/openstack-charmers "View all packages from OpenStack Charmers") Platform: 24.04 23.10 23.04 22.04 20.04 edge 60 ``` juju deploy keystone-openidc --channel edge ``` [Learn to deploy on juju >](https://juju.is/docs/juju/manage-applications) * [auth-type](https://charmhub.io/keystone-openidc/configurations#auth-type) * [debug](https://charmhub.io/keystone-openidc/configurations#debug) * [enable-oauth](https://charmhub.io/keystone-openidc/configurations#enable-oauth) * [idp\_id](https://charmhub.io/keystone-openidc/configurations#idp_id) * [oidc-client-id](https://charmhub.io/keystone-openidc/configurations#oidc-client-id) * [oidc-client-secret](https://charmhub.io/keystone-openidc/configurations#oidc-client-secret) * [oidc-oauth-introspection-endpoint](https://charmhub.io/keystone-openidc/configurations#oidc-oauth-introspection-endpoint) * [oidc-oauth-verify-jwks-uri](https://charmhub.io/keystone-openidc/configurations#oidc-oauth-verify-jwks-uri) * [oidc-provider-auth-endpoint](https://charmhub.io/keystone-openidc/configurations#oidc-provider-auth-endpoint) * [oidc-provider-issuer](https://charmhub.io/keystone-openidc/configurations#oidc-provider-issuer) * [oidc-provider-jwks-uri](https://charmhub.io/keystone-openidc/configurations#oidc-provider-jwks-uri) * [oidc-provider-metadata-url](https://charmhub.io/keystone-openidc/configurations#oidc-provider-metadata-url) * [oidc-provider-token-endpoint](https://charmhub.io/keystone-openidc/configurations#oidc-provider-token-endpoint) * [oidc-provider-token-endpoint-auth](https://charmhub.io/keystone-openidc/configurations#oidc-provider-token-endpoint-auth) * [oidc-provider-user-info-endpoint](https://charmhub.io/keystone-openidc/configurations#oidc-provider-user-info-endpoint) * [oidc-remote-user-claim](https://charmhub.io/keystone-openidc/configurations#oidc-remote-user-claim) * [oidc-response-type](https://charmhub.io/keystone-openidc/configurations#oidc-response-type) * [oidc-session-type](https://charmhub.io/keystone-openidc/configurations#oidc-session-type) * [oidc-state-input-headers](https://charmhub.io/keystone-openidc/configurations#oidc-state-input-headers) * [oidc-x-forwarded-headers](https://charmhub.io/keystone-openidc/configurations#oidc-x-forwarded-headers) * [protocol\_id](https://charmhub.io/keystone-openidc/configurations#protocol_id) * [remote-id-attribute](https://charmhub.io/keystone-openidc/configurations#remote-id-attribute) * [user-facing-name](https://charmhub.io/keystone-openidc/configurations#user-facing-name) [Learn about configurations >](https://juju.is/docs/juju/configuration#heading--application-configuration) * auth-type | string Default: auth-openidc To add support to Bearer Access Token authentication flow that is used by applications that do not adopt the browser flow, such the OpenStack CLI, the auth-type must be set to auth-openidc (the default) otherwise to openid-connect. * debug | boolean Enable debug logging. * enable-oauth | boolean Default: True Set to true to enable OAuth2 support. * idp\_id | string The ID of the Identity Provider defined in Keystone. * oidc-client-id | string Client identifier used to connect to the OpenID Connect Provider. * oidc-client-secret | string Password used to authenticate with the OpenID Connect Provider. * oidc-oauth-introspection-endpoint | string OAuth 2.0 Authorization Server token introspection endpoint. When `enable-oauth` is set to true and this option unset (the default), the introspection endpoint available in the metadata will be used. * oidc-oauth-verify-jwks-uri | string The JWKs URL on which the Authorization Server publishes the keys used to sign its JWT access tokens. * oidc-provider-auth-endpoint | string Open ID Connect Provider authorization endpoint (e.g. https://example.com/as/authorization.oauth2). Used when oidc-provider-metadata-url is not set or the metadata obtained from that URL does not set it. * oidc-provider-issuer | string Open ID Connect Provider issuer identifier (e.g. https://example.com ). Used when oidc-provider-metadata-url is not set or the metadata obtained from that URL does not set it. * oidc-provider-jwks-uri | string . * oidc-provider-metadata-url | string URL to discover the OpenID Connect Provider and obtain information needed to interact with it, including its OAuth 2.0 endpoint locations. Example: https://example.com/.well-known/openid-configuration * oidc-provider-token-endpoint | string Open ID Connect Provider token endpoint (e.g. https://example.com/as/token.oauth2). Used when oidc-provider-metadata-url is not set or the metadata obtained from that URL does not set it. * oidc-provider-token-endpoint-auth | string Authentication method for the Open ID Connect Provider token endpoint, possible options are: client\_secret\_basic, client\_secret\_post, client\_secret\_jwt, private\_key\_jwt or none. Used when oidc-provider-metadata-url is not set or the metadata obtained from that URL does not set it. * oidc-provider-user-info-endpoint | string Open ID Connect Provider user info endpoint (e.g. https://example.com/idp/userinfo.openid). Used when oidc-provider-metadata-url is not set or the metadata obtained from that URL does not set it. * oidc-remote-user-claim | string The claim that is used when setting the REMOTE\_USER variable on OpenID Connect protected paths, for example: email. * oidc-response-type | string Default: id\_token Define the OIDCResponseType for mod\_auth\_openidc uses limit the responses type. It must be one of the following: code|id\_token|id\_token token|code id\_token|code token|code id\_token token Empty string will remove that option completely. * oidc-session-type | string Default: server-cache Set where OpenID Connect session cookies are stored. BY default cookies are stored on the web server. Can be one of 'server-cache', 'server-cache:persistent', 'client-cookie', 'client-cookie:persistent', 'client-cookie:store\_id\_token', or 'client-cookie:persistent:store\_id\_token'. When using multiple units of Keystone behind a proxy, use 'client-cookie:persistent' if you are not using shared session storage for Keystone. * oidc-state-input-headers | string Default: user-agent Define the headers mod\_auth\_openidc uses to calculate the browser fingerprint during authentication. Set to "none" if using multiple units of Keystone behind a load balancer or proxy. * oidc-x-forwarded-headers | string X-Forwarded-\* headers from reverse proxies that mod\_auth\_openidc should look for. Must be one or more of "X-Forwarded-Host", "X-Forwarded-Port", "X-Forwarded-Proto", "Forwarded", or "none". mod\_auth\_openidc ignores this setting if it is "none" or undefined. Use this setting when using a proxy that changes the protocol, host, or port when handling the authentication workflow. * protocol\_id | string Default: openid Federation protocol name. * remote-id-attribute | string Default: HTTP\_OIDC\_ISS Attribute used to obtain the entity ID of the OpenID Connect Provider. * user-facing-name | string Default: OpenID Connect via mapped A user-facing name to be used for the identity provider and protocol combination. Used in the OpenStack dashboard.