<VirtualHost *:{{ keystone_public_port }}>

    ServerName https://{{ kolla_external_fqdn }}
    WSGIScriptAliasMatch ^(/v3/OS-FEDERATION/identity_providers/.*?/protocols/.*?/auth)$ /usr/bin/keystone-wsgi-public/$1
    <Location /v3>
        MellonEnable "info"
        MellonMergeEnvVars On ";"
        MellonSPPrivateKeyFile /etc/httpd/saml2/mellon.key
        MellonSPCertFile /etc/httpd/saml2/mellon.cert
        MellonSPMetadataFile /etc/httpd/saml2/sp-metadata.xml
        MellonIdPMetadataFile /etc/httpd/saml2/idp-metadata.xml
        MellonEndpointPath /v3/OS-FEDERATION/identity_providers/{{ federation_identity_provider }}/protocols/saml2/auth/mellon
        MellonIdP "IDP"
    </Location>

    <Location /v3/OS-FEDERATION/identity_providers/{{ federation_identity_provider }}/protocols/saml2/auth>
        Require valid-user
        AuthType Mellon
        MellonEnable auth
    </Location>

    <Location /v3/auth/OS-FEDERATION/websso/saml2>
        Require valid-user
        AuthType Mellon
        MellonEnable auth
    </Location>

    <Location /v3/auth/OS-FEDERATION/identity_providers/{{ federation_identity_provider }}/protocols/saml2/websso>
        Require valid-user
        AuthType Mellon
        MellonEnable auth
    </Location>

    WSGIDaemonProcess keystone-public processes={{ openstack_service_workers }} threads=1 user=keystone group=keystone display-name=%{GROUP} python-path={{ python_path }}
    WSGIProcessGroup keystone-public
    WSGIScriptAlias / {{ binary_path }}/keystone-wsgi-public
    WSGIApplicationGroup %{GLOBAL}
    WSGIPassAuthorization On
    <IfVersion >= 2.4>
      ErrorLogFormat "%{cu}t %M"
    </IfVersion>
    ErrorLog "{{ keystone_log_dir }}/keystone-apache-public-error.log"
    LogFormat "%{X-Forwarded-For}i %l %u %t \"%r\" %>s %b %D \"%{Referer}i\" \"%{User-Agent}i\"" logformat
    CustomLog "{{ keystone_log_dir }}/keystone-apache-public-access.log" logformat
</VirtualHost>