...
User Workflow for interested users:
| 1. |
...
| Access the Openstack Dashboard to use the Openstack cluster configured as a SAML SP |
...
| at |
...
| https://am02.pilots.aarc-project.eu/horizon |  |
| 2. | Click Connect and select your Identity Provider from the discovery page (WAYF). |
...
You may select any of the following options:
|  |
| 3. | You will be |
...
| redirected to the Sign In page of |
...
| your IdP (e.g. Google) |  | |
| 4. | If this is your first time logging in, you will be redirected to the AARC Pilot User Community Sign Up page after succesful authentication. Alternatively, you may access the sign up page directly by visiting: |  |
| 5. | Depending on the LoA and/or attributes released by your Home IdP, there are two sign up workflows:
|
...
|
...
|
...
| ||
| 6. | If your sign up request requires approval (second workflow), the Sponsors of the VO will be notified via email | |
| 7. | One of the Sponsor users has to approve your request via the COmanage Registry at https://aai-dev.egi.eu/registry | |
| 8. | After approval, your account will be activated in COmanage |
...
- Subject Identifier retained by Google - Unique, Persistent, non-Reassignable (not the email address of google) |
...
| 9. | Relogin to OpenStack's dashboard at |
...
- Mapped to keystone: Mapping is based on eduPersonEntitlement or MemberOf(). We also add the membership to specific collaborations inside COMANAGE in the mapping.
- In the pilot we mapped user afiflitation to a keystone Group ; next experiment: map Entitlement to a Group. What if a user does not have nor Entitlement or Affiliation
- ---> no registration finished ==> no service for him
...
You will be mapped to a Keystone group based on the values of the eduPersonEntitlement attribute |