OpenStack Horizon: Invalid Path Redirect to Web SSO Login (Keystone API)
OpenStack Horizon is the canonical implementation of OpenStack’s Dashboard, providing a web-based user interface to OpenStack services such as Nova, Swift, and Neutron. One of the ways to authenticate to Horizon is through OpenID Connect, a simple identity layer on top of the OAuth 2.0 protocol, which allows Horizon to leverage an external identity provider for authentication.
Prerequisites
In this article, we will assume that you have a working OpenStack cluster installed using Kolla-Ansible version 14.1.0. We will also assume that you have followed the instructions to enable OpenID Connect login for Horizon.
Invalid Path Redirect to Web SSO Login
When attempting to access Horizon, you may encounter the following error:
Invalid path redirect to Web SSO login.
This error is caused by a misconfiguration in the Keystone API, which is responsible for handling authentication requests in OpenStack. Specifically, the issue is related to the openid-connect configuration option in the keystone.conf file.
Resolving the Issue
To resolve the issue, you will need to modify the openid-connect configuration option in the keystone.conf file. The option should be set to the URL of your OpenID Connect provider, for example:
openid-connect = https://your-openid-connect-provider.com
Once you have made this change, you will need to restart the Keystone service for the changes to take effect. You can do this using the following command:
sudo systemctl restart openstack-keystone
After restarting the Keystone service, you should be able to access Horizon without encountering the “Invalid path redirect to Web SSO login” error.
In this article, we have covered the steps to resolve the “Invalid path redirect to Web SSO login” error in OpenStack Horizon. This error is caused by a misconfiguration in the Keystone API and can be resolved by modifying the openid-connect configuration option in the keystone.conf file. Once the change has been made, you will need to restart the Keystone service for the changes to take effect.
References
- OpenStack Documentation: OpenID Connect
- Kolla-Ansible Documentation: Keystone Configuration