the detail description is here https://bugs.launchpad.net/keystoneauth/+bug/1989354 i have tow questions
(1) when access the idp ,the certification is wrong (2)the access flow has some problems, the last response is not json,that's a xml
the federation identity document dosen't use a certificate.but i got a lot of problems.when i get the shibboleth's metadata ,i found i cant use the default controller:5000,i got 404 error.so i use ssl ,change 5000 to 443 then the https://controller/Shibboleth.sso/Metadata works.
i execute these commands
export OS_CACERT=/etc/keystone/ssl/ca.crt
export OS_AUTH_TYPE=v3samlpassword
export OS_IDENTITY_PROVIDER=samltest
export OS_IDENTITY_PROVIDER_URL=https://samltest.id/idp/profile/SAML2/SOAP/ECP
export OS_PROTOCOL=saml2
export OS_USERNAME=morty
export OS_PASSWORD=panic
export OS_AUTH_URL=https://controller/v3
export OS_IDENTITY_API_VERSION=3
openstack federation project list
but it doesnt work well it firstly access https://controller:443 "GET /v3/OS-FEDERATION/identity_providers/samltest/protocols/saml2/auth HTTP/1.1" 302 424 then redirect to https://samltest.id:443 "GET /saml/idp?entityID=https%3A%2F%2Fcontroller%2Fshibboleth&return=https%3A%2F%2Fcontroller%2FShibboleth.sso%2FLogin%3FSAMLDS%3D1%26target%3Dss%253Amem%253A21db77b874f0794ffbb617149c260a0bf11ca1655154d63eba78247fa7e1e7ee HTTP/1.1" 200 7458
i change verify=None,it can return 200.if not,it'll return SSL verified error,i think this is a bug.it doesnt work well when i set ssl on.
i dont know the process of this feature. the diagram of the document is not same as the process i meet.