Skip to content

Commit e47b124

Browse files
baszoetekouwbaszoetekouw
authored
Merge pull request #667 from OpenConext/release/646
Release/646: Manage update including stepup-in-manage config
2 parents 5c616c4 + 1dae51d commit e47b124

16 files changed

Lines changed: 487 additions & 123 deletions

‎roles/invite/templates/logback.xml.j2‎

Lines changed: 31 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -2,41 +2,41 @@
22
<?xml version="1.0" encoding="UTF-8"?>
33
<configuration scan="true">
44

5-
<appender name="STDOUT" class="ch.qos.logback.core.ConsoleAppender">
6-
<encoder>
7-
<pattern>%d{ISO8601} %5p [%t] %logger{40}:%L - %m%n</pattern>
8-
</encoder>
9-
</appender>
5+
<appender name="STDOUT" class="ch.qos.logback.core.ConsoleAppender">
6+
<encoder>
7+
<pattern>%d{ISO8601} %5p [%t] %logger{40}:%L - %m%n</pattern>
8+
</encoder>
9+
</appender>
1010

11-
<appender name="JSON_SYSLOG" class="net.logstash.logback.appender.LogstashTcpSocketAppender">
12-
<destination>host.docker.internal:514</destination>
11+
<appender name="JSON_SYSLOG" class="net.logstash.logback.appender.LogstashTcpSocketAppender">
12+
<destination>host.docker.internal:514</destination>
1313
<encoder class="net.logstash.logback.encoder.LogstashEncoder">
14-
<customFields>{"app":"invite"}</customFields>
15-
<includeCallerData>true</includeCallerData>
16-
<fieldNames>
17-
<thread>[ignore]</thread>
18-
<version>[ignore]</version>
19-
<levelValue>[ignore]</levelValue>
20-
</fieldNames>
21-
<prefix class="ch.qos.logback.core.encoder.LayoutWrappingEncoder">
22-
<layout class="ch.qos.logback.classic.PatternLayout">
23-
<pattern>invitejson: </pattern>
24-
</layout>
25-
</prefix>
26-
</encoder>
14+
<customFields>{"app":"invite"}</customFields>
15+
<includeCallerData>true</includeCallerData>
16+
<fieldNames>
17+
<thread>[ignore]</thread>
18+
<version>[ignore]</version>
19+
<levelValue>[ignore]</levelValue>
20+
</fieldNames>
21+
<prefix class="ch.qos.logback.core.encoder.LayoutWrappingEncoder">
22+
<layout class="ch.qos.logback.classic.PatternLayout">
23+
<pattern>invitejson:</pattern>
24+
</layout>
25+
</prefix>
26+
</encoder>
2727
</appender>
2828

29-
<logger name="invite" level="DEBUG" />
30-
<logger name="org.springframework.security" level="WARN" />
31-
<logger name="org.springframework" level="WARN" />
32-
<logger name="org.springframework.security" level="WARN" />
33-
<logger name="com.zaxxer.hikari" level="ERROR" />
29+
<logger name="invite" level="DEBUG"/>
30+
<logger name="org.springframework.security" level="WARN"/>
31+
<logger name="org.springframework" level="WARN"/>
32+
<logger name="org.springframework.security" level="WARN"/>
33+
<logger name="com.zaxxer.hikari" level="ERROR"/>
3434

35-
<root level="WARN">
36-
<appender-ref ref="STDOUT" />
37-
{% if invite_logback_json | bool %}
38-
<appender-ref ref="JSON_SYSLOG" />
39-
{%endif%}
40-
</root>
35+
<root level="WARN">
36+
<appender-ref ref="STDOUT"/>
37+
{% if invite_logback_json | bool %}
38+
<appender-ref ref="JSON_SYSLOG"/>
39+
{% endif %}
40+
</root>
4141

4242
</configuration>

‎roles/manage/defaults/main.yml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,13 @@ manage_tabs_enabled:
3232
- provisioning
3333
- sram
3434
- organisation
35+
- sfo
36+
- institution
3537
manage_docker_networks:
3638
- name: loadbalancer
3739
manage_server_restart_policy: always
3840
manage_server_restart_retries: 0
41+
manage_logback_json: false
42+
43+
manage_stepup_raas:
44+
- "urn:collab:person:example.com:admin"

‎roles/manage/files/metadata_templates/institution.template.json‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
{
2+
"entityid": "",
3+
"metaDataFields": {},
4+
"identifier": "",
5+
"use_ra_locations": true,
6+
"show_raa_contact_information": true,
7+
"verify_email": true,
8+
"allowed_second_factors": [
9+
"tiqr"
10+
],
11+
"number_of_tokens_per_identity": 3,
12+
"use_ra": [],
13+
"use_raa": [],
14+
"select_raa": [],
15+
"self_vet": true,
16+
"allow_self_asserted_tokens": false,
17+
"sso_on_2fa": false,
18+
"stepup-client": "full"
19+
}

‎roles/manage/files/metadata_templates/sfo.template.json‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
{
2+
"name": "",
3+
"entityid": "",
4+
"metaDataFields": {},
5+
"public_key": "",
6+
"acs": [],
7+
"loa": "{{ stepup_loa_values_supported[0] }}",
8+
"assertion_encryption_enabled": false,
9+
"second_factor_only": true,
10+
"second_factor_only_nameid_patterns": [],
11+
"blacklisted_encryption_algorithms": [],
12+
"allow_sso_on_2fa": true,
13+
"set_sso_cookie_on_2fa": true
14+
}

‎roles/manage/files/policies/allowed_attributes.json‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,8 @@
1515
"value": "urn:mace:dir:attribute-def:eduPersonAffiliation",
1616
"validationRegex": "^(student|staff|faculty|employee|member)$",
1717
"allowedInDenyRule": true,
18-
"label": "Edu person affiliation"
18+
"label": "Edu person affiliation",
19+
"enum": true
1920
},
2021
{
2122
"value": "urn:mace:dir:attribute-def:eduPersonScopedAffiliation",
@@ -45,7 +46,8 @@
4546
"value": "urn:collab:sab:surfnet.nl",
4647
"validationRegex": "^(Superuser|Instellingsbevoegde|OperationeelBeheerder|SURFconextbeheerder|DNS-Beheerder)$",
4748
"allowedInDenyRule": false,
48-
"label": "SAB role"
49+
"label": "SAB role",
50+
"enum": true
4951
},
5052
{
5153
"value": "urn:mace:dir:attribute-def:mail",

‎roles/manage/tasks/main.yml‎

Lines changed: 40 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,15 @@
1111
- "/opt/openconext/manage/metadata_templates"
1212
- "/opt/openconext/manage/policies"
1313

14+
- name: Copy Stepup stepup_config.json from inventory
15+
ansible.builtin.template:
16+
src: "stepup_config.json.j2"
17+
dest: "/opt/openconext/manage/stepup_config.json"
18+
owner: "root"
19+
group: "root"
20+
mode: "0644"
21+
notify: restart manageserver
22+
1423
- name: Import the mongo CA file
1524
ansible.builtin.copy:
1625
src: "{{ inventory_dir }}/secrets/mongo/mongoca.pem"
@@ -31,14 +40,14 @@
3140
- name: Place the serverapplication configfiles
3241
ansible.builtin.template:
3342
src: "{{ item }}.j2"
34-
dest: /opt/openconext/manage/{{ item }}
35-
owner: root
36-
group: root
43+
dest: "/opt/openconext/manage/{{ item }}"
44+
owner: "root"
45+
group: "root"
3746
mode: "0644"
3847
with_items:
39-
- application.yml
40-
- logback.xml
41-
- manage-api-users.yml
48+
- "application.yml"
49+
- "logback.xml"
50+
- "manage-api-users.yml"
4251
notify: restart manageserver
4352

4453
- name: Place old __cacert_entrypoint.sh script
@@ -53,8 +62,8 @@
5362
ansible.builtin.template:
5463
src: "metadata_configuration/{{ item }}.schema.json.j2"
5564
dest: "/opt/openconext/manage/metadata_configuration/{{ item }}.schema.json"
56-
owner: root
57-
group: root
65+
owner: "root"
66+
group: "root"
5867
mode: "0640"
5968
with_items:
6069
- "{{ manage_tabs_enabled }}"
@@ -81,17 +90,17 @@
8190
group: root
8291
mode: "0640"
8392
with_items:
84-
- allowed_attributes.json
85-
- extra_saml_attributes.json
93+
- "allowed_attributes.json"
94+
- "extra_saml_attributes.json"
8695
notify:
8796
- "restart manageserver"
8897

8998
- name: Add the mongodb and mariadb docker network to the list of networks when MongoDB runs in Docker
9099
ansible.builtin.set_fact:
91100
manage_docker_networks:
92-
- name: loadbalancer
93-
- name: openconext_mongodb
94-
- name: openconext_mariadb
101+
- name: "loadbalancer"
102+
- name: "openconext_mongodb"
103+
- name: "openconext_mariadb"
95104
when: mongodb_in_docker | default(false) | bool
96105

97106
- name: Create and start the server container
@@ -105,15 +114,22 @@
105114
state: started
106115
networks: "{{ manage_docker_networks }}"
107116
mounts:
108-
- source: /opt/openconext/manage/
109-
target: /config/
110-
type: bind
111-
- source: /opt/openconext/manage/mongoca.pem
112-
target: /certificates/mongoca.crt
113-
type: bind
114-
- source: /opt/openconext/manage/__cacert_entrypoint.sh
115-
target: /__cacert_entrypoint.sh
116-
type: bind
117+
- source: "/opt/openconext/manage/"
118+
target: "/config/"
119+
type: "bind"
120+
read_only: true
121+
- source: "/opt/openconext/manage/mongoca.pem"
122+
target: "/certificates/mongoca.crt"
123+
type: "bind"
124+
read_only: true
125+
- source: "/opt/openconext/manage/__cacert_entrypoint.sh"
126+
target: "/__cacert_entrypoint.sh"
127+
type: "bind"
128+
read_only: true
129+
- source: "/opt/openconext/manage/stepup_config.json"
130+
target: "/stepup_config.json"
131+
type: "bind"
132+
read_only: true
117133
command: "java -jar /app.jar -Xmx512m --spring.config.location=./config/"
118134
etc_hosts:
119135
host.docker.internal: host-gateway
@@ -170,6 +186,8 @@
170186
- source: /etc/localtime
171187
target: /etc/localtime
172188
type: bind
189+
read_only: true
173190
- source: /opt/openconext/common/favicon.ico
174191
target: /var/www/favicon.ico
175192
type: bind
193+
read_only: true

‎roles/manage/templates/application.yml.j2‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -53,11 +53,20 @@ push:
5353
user: {{ pdp.username }}
5454
password: "{{ pdp.password }}"
5555
enabled: {{ manage.pdp_push_enabled }}
56+
stepup:
57+
url: https://middleware.{{ base_domain }}
58+
user: {{ manage.middleware_user }}
59+
configuration_file: "file:///stepup_config.json"
60+
password: {{ manage_middleware_password }}
61+
enabled: {{ manage.stepup_push_enabled }}
62+
5663

5764
product:
5865
name: Manage
5966
organization: {{ instance_name }}
6067
service_provider_feed_url: {{ manage_service_provider_feed_url }}
68+
jira_base_url: https://servicedesk.surf.nl/jira/browse/
69+
jira_ticket_prefixes: CXT,SD
6170
supported_languages: {{ supported_language_codes }}
6271
show_oidc_rp: {{ manage_show_oidc_rp_tab }}
6372

‎roles/manage/templates/logback.xml.j2‎

Lines changed: 39 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -1,32 +1,49 @@
1-
#jinja2:lstrip_blocks: True
21
<?xml version="1.0" encoding="UTF-8"?>
32
<configuration scan="true">
43

5-
<appender name="STDOUT" class="ch.qos.logback.core.ConsoleAppender">
6-
<encoder>
7-
<pattern>%d{ISO8601} %5p [%t] %logger{40}:%L - %m%n</pattern>
8-
</encoder>
9-
</appender>
4+
<appender name="STDOUT" class="ch.qos.logback.core.ConsoleAppender">
5+
<encoder>
6+
<pattern>%d{ISO8601} %5p [%t] %logger{40}:%L - %m%n</pattern>
7+
</encoder>
8+
</appender>
109

11-
<appender name="EMAIL" class="ch.qos.logback.classic.net.SMTPAppender">
12-
<smtpHost>{{ smtp_server }}</smtpHost>
13-
<from>{{ noreply_email }}</from>
14-
<to>{{ error_mail_to }}</to>
15-
<subject>{{ error_subject_prefix }}Unexpected error manage</subject>
16-
<layout class="ch.qos.logback.classic.html.HTMLLayout"/>
10+
<appender name="EMAIL" class="ch.qos.logback.classic.net.SMTPAppender">
11+
<smtpHost>{{ smtp_server }}</smtpHost>
12+
<from>{{ noreply_email }}</from>
13+
<to>{{ error_mail_to }}</to>
14+
<subject>{{ error_subject_prefix }}Unexpected error manage</subject>
15+
<layout class="ch.qos.logback.classic.html.HTMLLayout"/>
1716

1817
<filter class="filter.CustomThresholdFilter">
19-
<clazz>org.everit.json.schema.ValidationException</clazz>
20-
<level>ERROR</level>
21-
</filter>
22-
</appender>
18+
<clazz>org.everit.json.schema.ValidationException</clazz>
19+
<level>ERROR</level>
20+
</filter>
21+
</appender>
2322

24-
<logger name="manage" level="DEBUG" />
25-
<logger name="com.github.cloudyrock" level="INFO" />
23+
{% if manage_logback_json | bool -%}
24+
<appender name="JSON_SYSLOG" class="net.logstash.logback.appender.LogstashTcpSocketAppender">
25+
<destination>host.docker.internal:514</destination>
26+
<encoder class="net.logstash.logback.encoder.LogstashEncoder">
27+
<customFields>{"app":"manage"}</customFields>
28+
<includeCallerData>true</includeCallerData>
29+
<fieldNames>
30+
<thread>[ignore]</thread>
31+
<version>[ignore]</version>
32+
<levelValue>[ignore]</levelValue>
33+
</fieldNames>
34+
</encoder>
35+
</appender>
36+
{%- endif %}
2637

27-
<root level="WARN">
28-
<appender-ref ref="EMAIL" />
29-
<appender-ref ref="STDOUT" />
30-
</root>
38+
<logger name="manage" level="DEBUG"/>
39+
<logger name="com.github.cloudyrock" level="INFO"/>
40+
41+
<root level="WARN">
42+
<appender-ref ref="STDOUT"/>
43+
<appender-ref ref="EMAIL"/>
44+
{% if manage_logback_json | bool -%}
45+
<appender-ref ref="JSON_SYSLOG"/>
46+
{%- endif %}
47+
</root>
3148

3249
</configuration>

0 commit comments

Comments
 (0)