Merge branch 'master' into feature/stepup_docker_deploy

OpenConext · Jun 20, 2024 · 1e7fff9 · 1e7fff9
2 parents 0c6a9e4 + 0a346ad
commit 1e7fff9
Show file tree

Hide file tree

Showing 183 changed files with 2,385 additions and 4,288 deletions.
diff --git a/environments/template/group_vars/template.yml b/environments/template/group_vars/template.yml
@@ -268,6 +268,7 @@ teams:
   spdashboard_person_urn: "urn:collab:person:surfnet.nl:sp-dashboard-C133A36F-CFCA-4F3D-87CE-7ECE29773FE0"
   product_name: "OpenConext Teams"
   default_stem_name: "demo:openconext:org"
+  feature_invite_migration_on: False
   super_admins_team_urns:
     - "nl:surfnet:diensten:teams_super_users"
     - "nl:surfnet:diensten:teams_super_admin_users"
@@ -359,6 +360,9 @@ aa:
   sab_username: coin-test
   sab_password: "{{ aa_sab_password }}"
   sab_endpoint: https://sab-ng.surfnet.nl/simplesaml/module.php/attributes/server.php
+  sab_rest_username: surfconexttest
+  sab_rest_password: "{{ aa_sab_rest_password }}"
+  sab_rest_endpoint: https://sab-ng.surfnet.nl
   surfmarket_url: https://example.org
   surfmarket_username: [email protected]
   surfmarket_password: "{{ aa_surfmarket_password }}"
@@ -386,6 +390,7 @@ oidcng:
   key_rollover_cron_expression: "0 0 0 * * *"
   acr_values_supported:
     - https://eduid.nl/trust/validate-names
+    - https://eduid.nl/trust/validate-names-external
     - https://eduid.nl/trust/linked-institution
     - https://eduid.nl/trust/affiliation-student
     - https://refeds.org/profile/mfa
@@ -405,11 +410,12 @@ myconext:
   mongo_password: "{{ mongo_passwords.myconext }}"
   rp_client_id: myconext.ala.eduid
   rs_client_id: myconext.rs
-  idp_external_validation_entity_id: http://mock-idp
+  verify_base_uri: "https://validate.test.eduid.nl"
   feature_webauthn: false
   feature_warning_educational_email_domain: false
   feature_show_connections: false
-  feature_use_external_validation: false
+  feature_id_verify: true
+  feature_remote_creation_api: true
   feature_deny_disposable_email_providers: true
   feature_create_eduid_institution_enabled: true
   feature_create_eduid_institution_landing: true
@@ -449,6 +455,7 @@ manage:
   backdoor_api_user: backdoor_api_user
   oidcng_name: "OpenConext OIDC-NG"
   oidc_push_enabled: false
+  pdp_name: "PdP"
   run_migrations: false
   push_after_migration: false
   features: push, validation, push_preview, orphans, find_my_data, edugain, auto_refresh
@@ -458,7 +465,7 @@ manage:
     - {
         name: "dashboard",
         password: "{{ manage_dashboard_secret }}",
-        scopes: ["READ", "CHANGE_REQUEST"]
+        scopes: ["READ", "CHANGE_REQUEST_IDP", "CHANGE_REQUEST_SP", "POLICIES"]
       }
     - {
         name: "myconext",
@@ -473,7 +480,7 @@ manage:
     - {
         name: "sysadmin",
         password: "{{ manage_sysadmin_secret }}",
-        scopes: ["READ", "WRITE", "PUSH", "SYSTEM"]
+        scopes: ["READ", "WRITE_IDP", "WRITE_SP", "PUSH", "SYSTEM"]
       }
     - {
         name: "invite",

diff --git a/environments/template/secrets/skeleton.yml b/environments/template/secrets/skeleton.yml
@@ -27,12 +27,15 @@ engine_api_metadata_push_password: secret
 oidcng_api_metadata_push_password: secret
 oidcng_api_tokens_profile_password: secret
 oidcng_api_tokens_eduid_password: secret
-myconext_api_attribute_manipulation_password: secret
+myconext_api_attribute_manipulation_password: "{noop}secret"
 myconext_oidcng_rs_client_secret: secret
-myconext_api_attribute_aggregation_password: secret
+myconext_api_attribute_aggregation_password: "{noop}secret"
+myconext_api_studielink_password: "{noop}secret"
 myconext_client_secret: secret
 myconext_rs_client_secret: secret
 myconext_geo2lite_license_key: secret
+myconext_verify_client_id: secret
+myconext_verify_secret: secret
 engine_api_profile_password: secret
 engine_api_deprovision_password: secret
 engine_parameters_secret: secret
@@ -63,6 +66,7 @@ pdp_sab_password: secret
 aa_eb_password: secret
 aa_authz_client_secret: secret
 aa_sab_password: secret
+aa_sab_rest_password: secret
 aa_idin_client_secret: secret
 aa_orcid_password: secret
 aa_surfmarket_password: secret
@@ -138,11 +142,12 @@ myconext_private_key: |
 
 invite_oidc_secret: secretsecret
 invite_rs_secret: secretsecret
-invite_voot_secret: secret
-invite_teams_secret: secret
-invite_attribute_aggregation_secret: secret
+invite_voot_secret: "{noop}secret"
+invite_teams_secret: "{noop}secret"
+invite_attribute_aggregation_secret: "{noop}secret"
 invite_manage_secret: secret
-invite_lifecycle_secret: secret
+invite_lifecycle_secret: "{noop}secret"
+invite_profile_secret: "{noop}secret"
 invite_private_key_pkcs8: |
   -----BEGIN PRIVATE KEY-----
   MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQCfpYYMgKYDICkp

diff --git a/environments/vm/group_vars/vm.yml b/environments/vm/group_vars/vm.yml
@@ -157,6 +157,7 @@ teams:
   spdashboard_person_urn: "urn:collab:person:surfnet.nl:sp-dashboard-C133A36F-CFCA-4F3D-87CE-7ECE29773FE0"
   product_name: "OpenConext Teams"
   default_stem_name: "demo:openconext:org"
+  feature_invite_migration_on: False
   super_admins_team_urns:
     - "nl:surfnet:diensten:teams_super_users"
     - "nl:surfnet:diensten:teams_super_admin_users"
@@ -249,6 +250,9 @@ aa:
   sab_username: coin-test
   sab_password: "{{ aa_sab_password }}"
   sab_endpoint: https://sab-ng.surfnet.nl/simplesaml/module.php/attributes/server.php
+  sab_rest_username: surfconexttest
+  sab_rest_password: "{{ aa_sab_rest_password }}"
+  sab_rest_endpoint: https://sab-ng.surfnet.nl
   surfmarket_url: https://example.org
   surfmarket_username: [email protected]
   surfmarket_password: "{{ aa_surfmarket_password }}"
@@ -276,6 +280,7 @@ oidcng:
   key_rollover_cron_expression: "0 0 0 * * *"
   acr_values_supported:
     - https://eduid.nl/trust/validate-names
+    - https://eduid.nl/trust/validate-names-external
     - https://eduid.nl/trust/linked-institution
     - https://eduid.nl/trust/affiliation-student
     - https://refeds.org/profile/mfa
@@ -294,10 +299,11 @@ myconext:
   mongo_password: "{{ mongo_passwords.myconext }}"
   rp_client_id: myconext.ala.eduid
   rs_client_id: myconext.rs
-  idp_external_validation_entity_id: http://mock-idp
+  verify_base_uri: "https://validate.test.eduid.nl"
   feature_webauthn: false
   feature_warning_educational_email_domain: false
-  feature_use_external_validation: false
+  feature_id_verify: true
+  feature_remote_creation_api: true
   feature_deny_disposable_email_providers: true
   feature_create_eduid_institution_enabled: true
   feature_create_eduid_institution_landing: true
@@ -336,14 +342,15 @@ manage:
   backdoor_api_user: backdoor_api_user
   oidcng_name: "OpenConext OIDC-NG"
   oidc_push_enabled: true
+  pdp_name: "PdP"
   features: push, validation, push_preview, orphans, find_my_data, edugain, auto_refresh
   environment: vm
   super_user_team_names: "urn:collab:group:vm.surfteams.nl:nl:surfnet:diensten:surfconext_tpm_core"
   apiUsers:
     - {
         name: "dashboard",
         password: "{{ manage_dashboard_secret }}",
-        scopes: ["READ", "CHANGE_REQUEST"]
+        scopes: [ "READ", "CHANGE_REQUEST_SP", "CHANGE_REQUEST_IDP", "POLICIES"]
       }
     - {
         name: "myconext",
@@ -358,7 +365,7 @@ manage:
     - {
         name: "sp-dashboard",
         password: "{{ manage_sp_dashboard_secret }}",
-        scopes: ["READ", "WRITE", "PUSH", "DELETE"]
+        scopes: [ "READ", "WRITE_SP", "DELETE_SP", "CHANGE_REQUEST_SP", "PUSH"]
       }
     - {
         name: "invite",
@@ -368,7 +375,7 @@ manage:
     - {
         name: "sysadmin",
         password: "{{ manage_sysadmin_secret }}",
-        scopes: ["READ", "WRITE", "PUSH", "SYSTEM"]
+        scopes: ["READ", "WRITE_SP", "WRITE_IDP", "PUSH", "SYSTEM"]
       }
     - {
         name: "stats",

diff --git a/environments/vm/secrets/vm.yml b/environments/vm/secrets/vm.yml
@@ -37,12 +37,15 @@ engine_api_metadata_push_password: secret
 oidcng_api_metadata_push_password: secret
 oidcng_api_tokens_profile_password: secret
 oidcng_api_tokens_eduid_password: secret
-myconext_api_attribute_manipulation_password: secret
+myconext_api_attribute_manipulation_password: "{noop}secret"
 myconext_oidcng_rs_client_secret: secret
-myconext_api_attribute_aggregation_password: secret
+myconext_api_attribute_aggregation_password: "{noop}secret"
+myconext_api_studielink_password: "{noop}secret"
 myconext_client_secret: secret
 myconext_rs_client_secret: secret
 myconext_geo2lite_license_key: secret
+myconext_verify_client_id: secret
+myconext_verify_secret: secret
 engine_api_profile_password: secret
 engine_api_deprovision_password: secret
 
@@ -66,6 +69,7 @@ pdp_sab_password: secret
 aa_eb_password: secret
 aa_authz_client_secret: secretsecret
 aa_sab_password: secret
+aa_sab_rest_password: secret
 aa_idin_client_secret: secret
 aa_orcid_password: secret
 aa_surfmarket_password: secret
@@ -285,11 +289,12 @@ myconext_private_key: |
 
 invite_oidc_secret: secretsecret
 invite_rs_secret: secretsecret
-invite_voot_secret: secret
-invite_teams_secret: secret
-invite_attribute_aggregation_secret: secret
+invite_voot_secret: "{noop}secret"
+invite_teams_secret: "{noop}secret"
+invite_attribute_aggregation_secret: "{noop}secret"
 invite_manage_secret: secret
-invite_lifecycle_secret: secret
+invite_lifecycle_secret: "{noop}secret"
+invite_profile_secret: "{noop}secret"
 invite_private_key_pkcs8: |
   -----BEGIN PRIVATE KEY-----
   MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQCfpYYMgKYDICkp

diff --git a/library/haproxy_commands.py b/library/haproxy_commands.py
diff --git a/provision.yml b/provision.yml
@@ -152,8 +152,6 @@
   gather_facts: true
   become: true
   roles:
-    - role: stats
-      tags: ['stats' ]
     - role: influxdb
       tags: ['influxdb' ]
   handlers:
@@ -174,8 +172,20 @@
 - hosts: docker
   become: true
   roles:
-    - { role: docker,                            tags: ['docker' ] }
-    - { role: invite,                            tags: ['invite' ] }
+    - { role: docker,     tags: ['docker' ] }
+    - { role: invite,     tags: ['invite' ] }
+    - { role: dashboard,  tags: ["dashboard"] }
+    - { role: teams,      tags: ["teams"] }
+    - { role: pdp,        tags: ["pdp"] }
+    - { role: voot,       tags: ["voot"] }
+    - { role: attribute-aggregation, tags: ["aa", "attribute-aggregation"] }
+    - { role: mujina-idp, tags: ["mujina-idp"] }  
+    - { role: oidc-playground, tags: ["oidc-playground"] }  
+    - { role: myconext,    tags: ["myconext"] }  
+    - { role: stats,      tags: ["stats"] }  
+    - { role: diyidp,      tags: ["diyidp"] }  
+    - { role: profile,      tags: ["profile"] }  
+    - { role: lifecycle,      tags: ["lifecycle"] }  
 
 - import_playbook: "{{ environment_dir }}/playbook.yml"
 
diff --git a/roles/attribute-aggregation-gui/defaults/main.yml b/roles/attribute-aggregation-gui/defaults/main.yml
diff --git a/roles/attribute-aggregation-gui/meta/main.yml b/roles/attribute-aggregation-gui/meta/main.yml
diff --git a/roles/attribute-aggregation-gui/tasks/main.yml b/roles/attribute-aggregation-gui/tasks/main.yml