Skip to content

Commit 567c1cc

Browse files
oharstaTyskaiLiemineRicardo van der Heijdenricardovdheijden
authored
Merge Develop (#593)
Merge Develop --------- Co-authored-by: Ines <Tyskai@users.noreply.github.com> Co-authored-by: Leroy <3416288+Liemine@users.noreply.github.com> Co-authored-by: Ricardo van der Heijden <ricardo.vanderheijden@surf.nl> Co-authored-by: Ricardo van der Heijden <20791917+ricardovdheijden@users.noreply.github.com> Co-authored-by: Bas Zoetekouw <bas.zoetekouw@surf.nl>
1 parent 50715c3 commit 567c1cc

6 files changed

Lines changed: 65 additions & 5 deletions

File tree

‎group_vars/all.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,7 @@ httpd_csp:
3434
lenient: "default-src 'self'; object-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; form-action 'self'; frame-ancestors 'none'; base-uri 'none'"
3535
lenient_with_static_img: "default-src 'self'; object-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' https://{{ static_vhost }} http://localhost:* data:; form-action 'self'; frame-ancestors 'none'; base-uri 'none'"
3636
lenient_with_static_img_with_oidcng: "default-src 'self'; object-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; connect-src 'self' https://{{ oidcng_vhost }}; img-src 'self' https://{{ static_vhost }} http://localhost:* data:; form-action 'self'; frame-ancestors 'none'; base-uri 'none'"
37+
lenient_with_static_img_with_surfconext: "default-src 'self'; object-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; connect-src 'self' https://{{ oidcng_vhost }}; img-src 'self' https://{{ static_vhost }} https://*.surfconext.nl http://localhost:* data:; form-action 'self'; frame-ancestors 'none'; base-uri 'none'"
3738
strict: "default-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; font-src 'self'; connect-src 'self'; img-src 'self' data:; form-action 'self'; frame-ancestors 'none'; base-uri 'none'; manifest-src 'self'"
3839
strict_with_static_img: "default-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; font-src 'self'; connect-src 'self'; img-src 'self' https://{{ static_vhost }} http://localhost:* data:; form-action 'self'; frame-ancestors 'none'; base-uri 'none'; manifest-src 'self'"
3940
lenient_with_static_img_for_idp: "default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; font-src 'self'; connect-src 'self' https://{{ oidcng_vhost }}; img-src 'self' https://{{ static_vhost }} http://localhost:* data:; form-action 'self' https://*.{{ base_domain }}; frame-ancestors 'none'; base-uri 'none'"

‎roles/manage/files/policies/allowed_attributes.json‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,38 +1,56 @@
11
[
22
{
33
"value": "urn:mace:terena.org:attribute-def:schacHomeOrganization",
4+
"validationRegex": "^[a-z]+(\\.[a-z]+)+$",
5+
"allowedInDenyRule": true,
46
"label": "Schac home organization"
57
},
68
{
79
"value": "urn:mace:terena.org:attribute-def:schacHomeOrganizationType",
10+
"validationRegex": "^[a-z]+$",
11+
"allowedInDenyRule": true,
812
"label": "Schac home organization type"
913
},
1014
{
1115
"value": "urn:mace:dir:attribute-def:eduPersonAffiliation",
16+
"validationRegex": "^(student|staff|faculty|employee|member)$",
17+
"allowedInDenyRule": true,
1218
"label": "Edu person affiliation"
1319
},
1420
{
1521
"value": "urn:mace:dir:attribute-def:eduPersonScopedAffiliation",
22+
"validationRegex": "^(student|staff|faculty|employee|member)@[a-z]+(\\.[a-z]+)+$",
23+
"allowedInDenyRule": true,
1624
"label": "Edu person scoped affiliation"
1725
},
1826
{
1927
"value": "urn:mace:dir:attribute-def:eduPersonEntitlement",
28+
"validationRegex": "^[a-z]+$",
29+
"allowedInDenyRule": true,
2030
"label": "Edu person entitlement"
2131
},
2232
{
2333
"value": "urn:mace:dir:attribute-def:isMemberOf",
34+
"validationRegex": "^.*$",
35+
"allowedInDenyRule": true,
2436
"label": "Is-member-of"
2537
},
2638
{
2739
"value": "urn:collab:group:surfteams.nl",
40+
"validationRegex": "^(urn:mace:surf\\.nl:invite:|urn:collab:group:)[a-z0-9_]+$",
41+
"allowedInDenyRule": false,
2842
"label": "SURFconext Invite (voot) role urn"
2943
},
3044
{
3145
"value": "urn:collab:sab:surfnet.nl",
46+
"validationRegex": "^(Superuser|Instellingsbevoegde|OperationeelBeheerder|SURFconextbeheerder|DNS-Beheerder)$",
47+
"allowedInDenyRule": false,
3248
"label": "SAB role"
3349
},
3450
{
3551
"value": "urn:mace:dir:attribute-def:mail",
52+
"validationRegex": "^[^@]+@[^@]+\\.[^@]+$",
53+
"allowedInDenyRule": true,
3654
"label": "Mail address"
3755
}
3856
]

‎roles/manage/tasks/main.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -158,7 +158,7 @@
158158
start_period: 10s
159159
hostname: managegui
160160
env:
161-
HTTPD_CSP: "{{ httpd_csp.lenient_with_static_img }}"
161+
HTTPD_CSP: "{{ httpd_csp.lenient_with_static_img_with_surfconext }}"
162162
HTTPD_SERVERNAME: "manage.{{ base_domain }}"
163163
OPENCONEXT_INSTANCENAME: "{{ instance_name }}"
164164
OPENCONEXT_ENGINE_LOGOUT_URL: "https://engine.{{ base_domain }}/logout"

‎roles/manage/templates/application.yml.j2‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -64,6 +64,7 @@ product:
6464
metadata_configuration_path: file://{{ manage_dir }}/metadata_configuration
6565
metadata_templates_path: file://{{ manage_dir }}/metadata_templates
6666
metadata_export_path: classpath:/metadata_export
67+
disabled_metadata_schemas:
6768

6869
security:
6970
backdoor_user_name: {{ manage.backdoor_api_user }}

‎roles/myconext/templates/application.yml.j2‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -37,11 +37,13 @@ springdoc:
3737
enabled: true
3838

3939
email:
40-
from_deprovisioning: "{{ myconext.email.from_deprovisioning }}"
41-
from_code: "{{ myconext.email.from_code }}"
42-
from_app_nudge: "{{ myconext.email.from_deprovisioning }}"
43-
from_new_device: "{{ myconext.email.from_deprovisioning }}"
40+
from_deprovisioning: <noreply+deprovisioning@{{ myconext_base_domain }}>
41+
from: eduID <noreply@{{ myconext_base_domain }}>
42+
from_code: eduID <noreply@{{ myconext_base_domain }}>
43+
from_app_nudge: <noreply+appnudge@{{ myconext_base_domain }}>
44+
from_new_device: <noreply+newdevice@{{ myconext_base_domain }}>
4445
error: {{ error_mail_to }}
46+
error_mail: {{ error_mail_to }}
4547
magic-link-url: https://login.{{ myconext_base_domain }}/saml/guest-idp/magic
4648
my-surfconext-url: https://mijn.{{ myconext_base_domain }}
4749
idp-surfconext-url: https://login.{{ myconext_base_domain }}

‎roles/openaccess/templates/serverapplication.yml.j2‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -94,6 +94,31 @@ config:
9494
invite: "https://invite.{{ base_domain }}"
9595
sram: "https://{{ env }}.sram.surf.nl/"
9696
serviceDesk: "https://servicedesk.surf.nl/jira/plugins/servlet/desk/user/requests?reporter=all"
97+
# For other environments, move to group_vars
98+
identity_providers:
99+
- name: "SXS IdP"
100+
entityid: "http://mock-idp"
101+
descriptionEN: "Een test-IdP waarmee je zelf attributen-sets kunt simuleren. De metadata vind je <a href='https://mujina-idp.test.surfconext.nl/metadata' target='_blank'>hier</a>"
102+
descriptionNL: "Een test-IdP waarmee je zelf attributen-sets kunt simuleren. De metadata vind je <a href='https://mujina-idp.test.surfconext.nl/metadata' target='_blank'>hier</a>"
103+
- name: "SXS Dummy"
104+
entityid: "https://idp.diy.surfconext.nl"
105+
descriptionEN: "Een test-IdP met <a href='https://idp.diy.surfconext.nl/showusers.php' target='_blank'>fictieve gebruikersaccounts</a>. De metadata vind je <a href='https://idp.diy.surfconext.nl/saml2/idp/metadata.php' target='_blank'>hier</a>"
106+
descriptionNL: "Een test-IdP met <a href='https://idp.diy.surfconext.nl/showusers.php' target='_blank'>fictieve gebruikersaccounts</a>. De metadata vind je <a href='https://idp.diy.surfconext.nl/saml2/idp/metadata.php' target='_blank'>hier</a>"
107+
idp_proxy_meta_data: https://metadata.test2.surfconext.nl/idp-metadata.xml
108+
minimal_stepup_acr_level: "http://{{ base_domain }}/assurance/loa2"
109+
features:
110+
- name: idp
111+
enabled: true
112+
- name: invite
113+
enabled: true
114+
- name: sram
115+
enabled: true
116+
- name: mfa
117+
enabled: true
118+
acr_values:
119+
{% for loa in [stepup_intrinsic_loa] + stepup_loa_values_supported %}
120+
- "{{ loa }}"
121+
{% endfor %}
97122

98123
eduid-idp-entity-id: "https://login.{{ myconext_base_domain }}"
99124

@@ -134,6 +159,19 @@ manage:
134159
staticManageDirectory: classpath:/manage
135160
# staticManageDirectory: file:///usr/local/etc/manage
136161

162+
invite:
163+
enabled: True
164+
url: "https://invite.{{ base_domain }}"
165+
user: {{ invite.access_user }}
166+
password: "{{ invite.access_secret }}"
167+
168+
# Todo relace with openconextaccess user
169+
statistics:
170+
enabled: True
171+
url: {{ dashboard.stats_url }}
172+
user: {{ dashboard.stats_user }}
173+
password: {{ stats_dashboard_api_password }}
174+
137175
s3storage:
138176
url: {{ openconextaccess.s3_storage.url }}
139177
key: {{ openconextaccess.s3_storage.key }}

0 commit comments

Comments
 (0)