---
title: Charmhub | Deploy Keystone Saml Mellon using Charmhub - The Open Operator Collection
description: Deploy the latest version of Keystone Saml Mellon on any cloud. Federated
  identity with SAML via Mellon Service Provider
url: https://charmhub.io/keystone-saml-mellon
---

# Keystone Saml Mellon

[OpenStack Charmers](https://charmhub.io/publisher/openstack-charmers "View all packages from OpenStack Charmers")

* [OpenStack Charmers](https://charmhub.io/publisher/openstack-charmers "View all packages from OpenStack Charmers")
* [Cloud](https://charmhub.io/?filter=cloud)
* [Security](https://charmhub.io/?filter=security)

Platform:

24.04

23.10

23.04

22.10

22.04

21.10

21.04

20.10

20.04

+2

yoga/stable 9ea240a

```
juju deploy keystone-saml-mellon --channel yoga/stable
```

[Learn to deploy on juju >](https://juju.is/docs/juju/manage-applications)

Share your thoughts on this charm with the community on discourse.

[Join the discussion](https://discourse.charmhub.io/)

---

[Add docs to a charm](https://juju.is/docs/sdk/add-docs-to-your-charmhub-page)

#### Federated identity with SAML via Mellon Service Provider

The main goal of this charm is to generate the necessary configuration for use in the Keystone charm related to Service Provider config generation, trust establishment between a remote idP and SP via certificates and signaling Keystone service restart. Keystone has a concept of a federated backend which serves multiple purposes including being a backend part of a Service Provider in an authentication scenario where SAML is used. Unless ECP is used on a keystone client side, SAML-related exchange is performed in an Apache authentication module (Mellon in case of this charm) and SAML assertions are converted to WSGI environment variables passed down to a particular mod\_wsgi interpreter running Keystone code. Keystone has an authentication plug-in called "mapped" which does the rest of the work of resolving symbolic attributes and using them in mappings defined by an operator or validating the existence of referenced IDs.