--- title: Charmhub | Deploy Keystone Saml Mellon using Charmhub - The Open Operator Collection description: Deploy the latest version of Keystone Saml Mellon on any cloud. url: https://charmhub.io/keystone-saml-mellon/configurations --- # Keystone Saml Mellon [OpenStack Charmers](https://charmhub.io/publisher/openstack-charmers "View all packages from OpenStack Charmers") * [OpenStack Charmers](https://charmhub.io/publisher/openstack-charmers "View all packages from OpenStack Charmers") * [Cloud](https://charmhub.io/?filter=cloud) * [Security](https://charmhub.io/?filter=security) Platform: 24.04 23.10 23.04 22.10 22.04 21.10 21.04 20.10 20.04 +2 yoga/stable 9ea240a ``` juju deploy keystone-saml-mellon --channel yoga/stable ``` [Learn to deploy on juju >](https://juju.is/docs/juju/manage-applications) * [allow-cross-site-cookies](https://charmhub.io/keystone-saml-mellon/configurations#allow-cross-site-cookies) * [authn-requests-signed](https://charmhub.io/keystone-saml-mellon/configurations#authn-requests-signed) * [debug](https://charmhub.io/keystone-saml-mellon/configurations#debug) * [idp-discovery-service-url](https://charmhub.io/keystone-saml-mellon/configurations#idp-discovery-service-url) * [idp-metadata-url](https://charmhub.io/keystone-saml-mellon/configurations#idp-metadata-url) * [idp-name](https://charmhub.io/keystone-saml-mellon/configurations#idp-name) * [nameid-formats](https://charmhub.io/keystone-saml-mellon/configurations#nameid-formats) * [protocol-name](https://charmhub.io/keystone-saml-mellon/configurations#protocol-name) * [saml-encryption](https://charmhub.io/keystone-saml-mellon/configurations#saml-encryption) * [ssl\_ca](https://charmhub.io/keystone-saml-mellon/configurations#ssl_ca) * [ssl\_cert](https://charmhub.io/keystone-saml-mellon/configurations#ssl_cert) * [ssl\_key](https://charmhub.io/keystone-saml-mellon/configurations#ssl_key) * [subject-confirmation-data-address-check](https://charmhub.io/keystone-saml-mellon/configurations#subject-confirmation-data-address-check) * [use-internal-endpoints](https://charmhub.io/keystone-saml-mellon/configurations#use-internal-endpoints) * [use-syslog](https://charmhub.io/keystone-saml-mellon/configurations#use-syslog) * [user-facing-name](https://charmhub.io/keystone-saml-mellon/configurations#user-facing-name) * [verbose](https://charmhub.io/keystone-saml-mellon/configurations#verbose) * [want-assertions-signed](https://charmhub.io/keystone-saml-mellon/configurations#want-assertions-signed) [Learn about configurations >](https://juju.is/docs/juju/configuration#heading--application-configuration) * allow-cross-site-cookies | boolean Relaxes cross-site cookie security requirements to improve compatibility with IDP providers. However, enabling this options requires that the connection to the IDP provider is HTTPS-Secure to avoid cookie rejection by some modern browsers. * authn-requests-signed | boolean Default: True Indicates whether the [samlp:AuthnRequest](https://charmhub.io/keystone-saml-mellon/configurations#harmful-link) messages sent by the service provider (mellon) will be signed. * debug | boolean Enable debug logging * idp-discovery-service-url | string IDP discovery service URL. If set to "" (default) no discovery service will be used. If used, the resource "idp-metadata" must be an XML file containing descriptors for multiple IDPs * idp-metadata-url | string An optional URL to retrieve IDP metadata from. If set, takes priority over the "idp-metadata" resource. Auto-updates of metadata occur during any hook execution, including update-status. * idp-name | string Default: myidp Identity provider name to use for URL generation. Must match the one that will be configured via OS-FEDERATION API. * nameid-formats | string Default: urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified,urn:oasis:names:tc:SAML:2.0:nameid-format:transient,urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress,urn:oasis:names:tc:SAML:2.0:nameid-format:persistent,urn:mace:shibboleth:1.0:nameIdentifier NameIDFormat entries to be used in Service Provider metadata file and in SAML requests (comma-separated). Different NameID formats could be used like transient, persistent, X509SubjectName, emailAddress, unspecified and so on. * protocol-name | string Default: mapped Protocol name to use for URL and generation. Must match the one that will be configured via OS-FEDERATION API. * saml-encryption | boolean (optional) Specifies whether SAML assertion encryption should be used. In many cases this option is not needed as TLS is used to encrypt data at the transport level. This option results in Service Provider metadata rendered with the same KeyInfo used for both signing and encryption. In practice, this means that the private key specified in sp-private-key will be used for both signing SAML messages to an idP and decryption of messages sent by idP. idP has to receive the SP metadata file with a public key (or a cert) present with use="encryption" specified. * ssl\_ca | string TLS CA to use to communicate with other components in a deployment. . **NOTE**: This configuration option will take precedence over any certificates received over the `certificates` relation. * ssl\_cert | string TLS certificate to install and use for any listening services. . **NOTE**: This configuration option will take precedence over any certificates received over the `certificates` relation. * ssl\_key | string TLS key to use with certificate specified as `ssl_cert`. . **NOTE**: This configuration option will take precedence over any certificates received over the `certificates` relation. * subject-confirmation-data-address-check | boolean Default: True This option is used to control the checking of client IP address against the address returned by the IdP in Address attribute of the SubjectConfirmationData node. Can be useful if your SP is behind a reverse proxy or any kind of strange network topology making IP address of client different for the IdP and the SP. Default is on. This can be used for testing with something like testshib if you are behind a NAT. * use-internal-endpoints | boolean Openstack mostly defaults to using public endpoints for internal communication between services. If set to True this option will configure services to use internal endpoints where possible. * use-syslog | boolean Setting this to True will allow supporting services to log to syslog. * user-facing-name | string Default: myidp via mapped A user-facing name to be used for the identity provider and protocol combination. Used in the OpenStack dashboard. * verbose | boolean Enable verbose logging * want-assertions-signed | boolean Default: True Indicates a requirement for the [saml:Assertion](https://charmhub.io/keystone-saml-mellon/configurations#harmful-link) elements received by this service provider to be signed.