New user / secret for push policies from Manage to PdP

OpenConext · Jan 16, 2024 · 2506f1b · 2506f1b
1 parent 739510c
commit 2506f1b
Show file tree

Hide file tree

Showing 3 changed files with 8 additions and 2 deletions.
diff --git a/environments/template/secrets/skeleton.yml b/environments/template/secrets/skeleton.yml
@@ -95,6 +95,7 @@ manage_backdoor_api_password: secret
 manage_dashboard_secret: secret
 manage_myconext_secret: secret
 manage_pdp_secret: secret
+pdp_push_endpoint_secret: secret
 manage_sp_dashboard_secret: secret
 manage_sysadmin_secret: secret
 manage_invite_secret: secret

diff --git a/environments/vm/secrets/vm.yml b/environments/vm/secrets/vm.yml
@@ -86,6 +86,7 @@ manage_backdoor_api_password: secret
 manage_dashboard_secret: secret
 manage_myconext_secret: secret
 manage_pdp_secret: secret
+pdp_push_endpoint_secret: secret
 manage_sp_dashboard_secret: secret
 manage_sysadmin_secret: secret
 manage_stats_api_password: secret

diff --git a/roles/pdp-server/templates/application.properties.j2 b/roles/pdp-server/templates/application.properties.j2
@@ -56,6 +56,10 @@ manage.password={{ manage_pdp_secret }}
 period.manage.refresh.minutes=10
 manage.manageBaseUrl=https://manage.{{ base_domain }}
 
+# Basic authentication for push-policies endpoint
+push_endpoint.username=manage
+push_endpoint.password={{ pdp_push_endpoint_secret }}
+
 # Number of days how long the policy violations are retained
 policy.violation.retention.period.days=30
 
@@ -74,15 +78,15 @@ sab.userName={{ pdp.sab_username }}
 sab.password={{ pdp.sab_password }}
 sab.endpoint={{ pdp.sab_endpoint }}
 
-# Do not expose any of the Spring BOOT endpoints except the health and info for loadbalacer health check
+# Do not expose any of the Spring BOOT endpoints except the health and info for loadbalancer health check
 endpoints.enabled=false
 endpoints.health.enabled=true
 endpoints.info.enabled=true
 
 # This is the internal logging of PDP. Leave this to DEBUG for now as it is not much overhead
 logging.level.pdp=DEBUG
 
-# In a multi master database setup toggle which machine is reponsible for cron jobs
+# In a multi master database setup toggle which machine is responsible for cron jobs
 pdpCronJobResponsible={{ pdp_cronjobmaster }}
 
 loa.levels={{ stepup_loa_values_supported | join(",") }}