Skip to content

Commit 1d07376

Browse files
oharstabaszoetekouw
oharsta
authored and
baszoetekouw
committed
Stepup configuration in manage (#629)
See OpenConext/OpenConext-manage#627
1 parent 185743e commit 1d07376

File tree

7 files changed

+272
-0
lines changed

7 files changed

+272
-0
lines changed

‎roles/manage/defaults/main.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,8 @@ manage_tabs_enabled:
3232
- provisioning
3333
- sram
3434
- organisation
35+
- sfo
36+
- institution
3537
manage_docker_networks:
3638
- name: loadbalancer
3739
manage_server_restart_policy: always

‎roles/manage/files/metadata_templates/institution.template.json‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
{
2+
"entityid": "",
3+
"metaDataFields": {},
4+
"identifier": "",
5+
"use_ra_locations": true,
6+
"show_raa_contact_information": true,
7+
"verify_email": true,
8+
"allowed_second_factors": [
9+
"tiqr"
10+
],
11+
"number_of_tokens_per_identity": 3,
12+
"use_ra": [],
13+
"use_raa": [],
14+
"select_raa": [],
15+
"self_vet": true,
16+
"allow_self_asserted_tokens": false,
17+
"sso_on_2fa": false,
18+
"stepup-client": "full"
19+
}

‎roles/manage/files/metadata_templates/sfo.template.json‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
{
2+
"name": "",
3+
"entityid": "",
4+
"metaDataFields": {},
5+
"public_key": "",
6+
"acs": [],
7+
"loa": "{{ stepup_loa_values_supported[0] }}",
8+
"assertion_encryption_enabled": false,
9+
"second_factor_only": true,
10+
"second_factor_only_nameid_patterns": [],
11+
"blacklisted_encryption_algorithms": [],
12+
"allow_sso_on_2fa": true,
13+
"set_sso_cookie_on_2fa": true
14+
}

‎roles/manage/tasks/main.yml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,15 @@
1111
- "/opt/openconext/manage/metadata_templates"
1212
- "/opt/openconext/manage/policies"
1313

14+
- name: Copy Stepup stepup_config.json from inventory
15+
ansible.builtin.copy:
16+
src: "{{ inventory_dir }}/files/manage/stepup_config.json"
17+
dest: "/opt/openconext/manage/stepup_config.json"
18+
owner: "root"
19+
group: "root"
20+
mode: "0644"
21+
notify: restart manageserver
22+
1423
- name: Import the mongo CA file
1524
ansible.builtin.copy:
1625
src: "{{ inventory_dir }}/secrets/mongo/mongoca.pem"
@@ -114,6 +123,10 @@
114123
- source: /opt/openconext/manage/__cacert_entrypoint.sh
115124
target: /__cacert_entrypoint.sh
116125
type: bind
126+
- source: /opt/openconext/manage/stepup_config.json
127+
target: /stepup_config.json
128+
type: bind
129+
117130
command: "java -jar /app.jar -Xmx512m --spring.config.location=./config/"
118131
etc_hosts:
119132
host.docker.internal: host-gateway

‎roles/manage/templates/application.yml.j2‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -53,11 +53,20 @@ push:
5353
user: {{ pdp.username }}
5454
password: "{{ pdp.password }}"
5555
enabled: {{ manage.pdp_push_enabled }}
56+
stepup:
57+
url: https://middleware.{{ base_domain }}
58+
user: {{ manage.middleware_user }}
59+
configuration_file: "file:///stepup_config.json"
60+
password: {{ manage_middleware_password }}
61+
enabled: {{ manage.stepup_push_enabled }}
62+
5663

5764
product:
5865
name: Manage
5966
organization: {{ instance_name }}
6067
service_provider_feed_url: {{ manage_service_provider_feed_url }}
68+
jira_base_url: https://servicedesk.surf.nl/jira/browse/
69+
jira_ticket_prefixes: CXT,SD
6170
supported_languages: {{ supported_language_codes }}
6271
show_oidc_rp: {{ manage_show_oidc_rp_tab }}
6372

‎roles/manage/templates/metadata_configuration/institution.schema.json.j2‎

Lines changed: 116 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,116 @@
1+
{
2+
"$schema": "http://json-schema.org/draft-04/schema#",
3+
"title": "institution",
4+
"order": 11,
5+
"type": "object",
6+
"properties": {
7+
"eid": {
8+
"type": "number"
9+
},
10+
"name": {
11+
"type": "string",
12+
"minLength": 1
13+
},
14+
"entityid": {
15+
"type": "string",
16+
"minLength": 1
17+
},
18+
"identifier": {
19+
"type": "string",
20+
"info": "The unique identifier of the institution."
21+
},
22+
"use_ra_locations": {
23+
"type": "boolean"
24+
},
25+
"show_raa_contact_information": {
26+
"type": "boolean"
27+
},
28+
"verify_email": {
29+
"type": "boolean"
30+
},
31+
"allowed_second_factors": {
32+
"type": "array",
33+
"items": {
34+
"type": "string",
35+
"enum": [
36+
"yubikey",
37+
"tiqr",
38+
"webauthn",
39+
"sms"
40+
]
41+
}
42+
},
43+
"number_of_tokens_per_identity": {
44+
"type": "number"
45+
},
46+
"use_ra": {
47+
"type": "array",
48+
"items": {
49+
"type": "string"
50+
}
51+
},
52+
"use_raa": {
53+
"type": "array",
54+
"items": {
55+
"type": "string"
56+
}
57+
},
58+
"select_raa": {
59+
"type": "array",
60+
"items": {
61+
"type": "string"
62+
}
63+
},
64+
"self_vet": {
65+
"type": "boolean"
66+
},
67+
"allow_self_asserted_tokens": {
68+
"type": "boolean"
69+
},
70+
"sso_on_2fa": {
71+
"type": "boolean"
72+
},
73+
"stepup-client": {
74+
"type": "string",
75+
"enum": [
76+
"freerider",
77+
"full"
78+
],
79+
"default": "freerider"
80+
},
81+
82+
"revisionid": {
83+
"type": "number"
84+
},
85+
"created": {
86+
"type": [
87+
"string",
88+
"null"
89+
]
90+
},
91+
"revisionnote": {
92+
"type": "string"
93+
},
94+
"notes": {
95+
"type": [
96+
"string",
97+
"null"
98+
]
99+
},
100+
"metaDataFields": {
101+
"type": "object",
102+
"properties": {},
103+
"patternProperties": {},
104+
"required": [],
105+
"additionalProperties": false
106+
}
107+
},
108+
"required": [
109+
"name",
110+
"entityid",
111+
"identifier",
112+
"stepup-client"
113+
],
114+
"additionalProperties": false,
115+
"indexes": []
116+
}

‎roles/manage/templates/metadata_configuration/sfo.schema.json.j2‎

Lines changed: 99 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,99 @@
1+
{
2+
"$schema": "http://json-schema.org/draft-04/schema#",
3+
"title": "sfo",
4+
"order": 10,
5+
"type": "object",
6+
"properties": {
7+
"eid": {
8+
"type": "number"
9+
},
10+
"name": {
11+
"type": "string",
12+
"minLength": 1
13+
},
14+
"entityid": {
15+
"type": "string",
16+
"minLength": 1
17+
},
18+
"public_key": {
19+
"type": "string",
20+
"format": "certificate",
21+
"info": "The supplied public certificate of the institution. This must be a PEM encoded certificate. DER, CRT or CER are not supported."
22+
},
23+
"acs": {
24+
"type": "array",
25+
"items": {
26+
"type": "string",
27+
"format": "url"
28+
},
29+
"info": "The ACS locations of this institution."
30+
},
31+
"loa": {
32+
"type": "string",
33+
"enum": [
34+
{% for loa in [stepup_intrinsic_loa] + stepup_loa_values_supported %}
35+
"{{ loa }}"{{ "," if not loop.last else ""}}
36+
{% endfor %}
37+
],
38+
"default": "{{ stepup_loa_values_supported[0] }}",
39+
},
40+
"assertion_encryption_enabled": {
41+
"type": "boolean"
42+
},
43+
"second_factor_only": {
44+
"type": "boolean"
45+
},
46+
"second_factor_only_nameid_patterns": {
47+
"type": "array",
48+
"items": {
49+
"type": "string"
50+
}
51+
},
52+
"blacklisted_encryption_algorithms": {
53+
"type": "array",
54+
"items": {
55+
"type": "string"
56+
}
57+
},
58+
"allow_sso_on_2fa": {
59+
"type": "boolean"
60+
},
61+
"set_sso_cookie_on_2fa": {
62+
"type": "boolean"
63+
},
64+
"revisionid": {
65+
"type": "number"
66+
},
67+
"created": {
68+
"type": [
69+
"string",
70+
"null"
71+
]
72+
},
73+
"revisionnote": {
74+
"type": "string"
75+
},
76+
"notes": {
77+
"type": [
78+
"string",
79+
"null"
80+
]
81+
},
82+
"metaDataFields": {
83+
"type": "object",
84+
"properties": {},
85+
"patternProperties": {},
86+
"required": [],
87+
"additionalProperties": false
88+
}
89+
},
90+
"required": [
91+
"name",
92+
"entityid",
93+
"public_key",
94+
"acs",
95+
"loa"
96+
],
97+
"additionalProperties": false,
98+
"indexes": []
99+
}

0 commit comments

Comments
 (0)