As of the Icehouse release, the only federation protocol that is supported is SAML, the purpose of this specification is to enable support for IETF ABFAB as a federation protocol.
An identity provider that issues and handles ABFAB requests wishes to allow its users access to an OpenStack Cloud. Currently this is not possible as the only federation protocol supported is SAML.
Add an authentication plugin to Keystone that directly handles the ABFAB protocol. From the plugin we can send an ABFAB request to the IdP through the encrypted EAP tunnel, then handle the response within the plugin.
This will also work as ABFAB was designed to work in this mode, but it will mean that there is much more code that needs to be supported inside Keystone.
None, providing the Apache ABFAB plugin is implemented correctly and follows the IETF specifications.
Another python-keystoneclient spec should be made.
Extensive documentation will have to be provided to describe any new configurations necessary.