fix(zitadel): vendor ovhcloud saml sp metadata instead of fetching at plan time (#1799)

zackpollard · web-flow · commit 3fefe557c719 · 2026-07-10T11:45:46.000+01:00
diff --git a/tf/deployment/modules/shared/zitadel/cloud/assets/ovhcloud-sp-metadata.xml b/tf/deployment/modules/shared/zitadel/cloud/assets/ovhcloud-sp-metadata.xml
@@ -0,0 +1,14 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata" entityID="https://www.ovhcloud.com/eu/auth/">
+  <SPSSODescriptor AuthnRequestsSigned="false" WantAssertionsSigned="true" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
+    <KeyDescriptor>
+      <KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#">
+        <X509Data>
+          <X509Certificate>MIIFVzCCAz+gAwIBAgIUQSUwSIh9zUNgNtP/FhkGdy7bEPYwDQYJKoZIhvcNAQELBQAwOzEdMBsGA1UEAwwUYXV0aC5ldS5vdmhjbG91ZC5jb20xCzAJBgNVBAsMAlNQMQ0wCwYDVQQKDARTQU1MMB4XDTI0MDExMjE0MTYzM1oXDTM0MDEwOTE0MTYzM1owOzEdMBsGA1UEAwwUYXV0aC5ldS5vdmhjbG91ZC5jb20xCzAJBgNVBAsMAlNQMQ0wCwYDVQQKDARTQU1MMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA0RWhT7fEM8NLiLeEe9Burk15IJUVHvHXJFySOr4lGhbpUWXgnRQZKP8klr3Jd9jZwv9ss+NhsbT/64lqB6WINozk11fGefdyrO6TbIioQnTOcwtF7NCTy9ypuBZiseqMxA67g6VDRqtRuZCtHVFOBJxMzux0h6sGS5t/a3aaHR+0xw9dhhHE0+sNiZUehl0BuNafoelar1nK6Q1ZfXWmoC5zJjxxJAE2DH+kNZaWOdkbPCWpD5G1maZlNL+tEFHzAAmCjj5re4C9enMs4/XPnxqS4wLzsuAEU2/7917+wdgPTpF7RHsqYgFD+gff00IkpY1+H8oqsEtf/iebIvoy0EYD0KozPnSolKNHhOEqSFcxehtCDOPdVq92Ie5FzMPLEeZoO1UvPIlKm2043BjGbNtYNBcFOTP6jdMInGau7KLXz/Bh5g/8mBI+UyCTbZaSoB1GkfzJJpP5j+VPYXcum/s/Y0AJUwNBXujQnu7EkNwQeE8QkjfrHXSC0wI6QYzpcc4DyMk1TNWg+4dn2EdU0TJS+zO/ohaAO1L1O9Pw6+JfHrXcNy5E7iPeRyMhkRMEhWyHxh6PlO7c2Hydo1WVAuV1BqQJmjMYP3D4dzcdmaZiy6JElV4fvkGBh/J3+jRGqeQtb0vplz0d3Dj5Zeto07xi79XtaItk4e9a6KPVds8CAwEAAaNTMFEwHQYDVR0OBBYEFJ/VldqCVgz9XObIdmTtzX+7qo9JMB8GA1UdIwQYMBaAFJ/VldqCVgz9XObIdmTtzX+7qo9JMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggIBACVM09u+blp3PDDjJsSJM0WyAq40bamTxncfyqZG1P+pN+K/Y38XU+F874FpiglFn1U1ZNekPA8HHj9SpRK1iZKqohB2r6ivwMqcwOJJM3LPNuPxs/RnNXAuup7KfnkEocnIYfad4KUr5QZoWfAyzMGiiRUF9mY4mLvRii1627XsTeQiDN2NJKvl/8FzXSWy2X61nA6kjw7erx5n6QoOprrXbG4Lmq2dRGdO3fqKtSByXrr5pLvHQgduoCtwbJn2mJHEnNSM8h7EDcszMRsgagQuUxT/XdGA8jqzs/qL38XHPxSmdaVzLO1pIxGXH5mZ+emDPGFN/Yd3WA/63qQ+Ig+ctu5gKJGDHaVLXmHE/cQXWs9tYoEen2iSL4nTf9hdH9hz7osQ1q9tNyJkHPwxYYvV9po6ui6jivd/OrasO54SzkoIEIlz0GpaZ4+sVfxWxoaHguQjmbesrppMXwdj8rc8fzKq70nMUm/T3hlehFXsBeH1lZygfKpb1EtpSbmStrQ/pY6xPB0oa4syj9kAnLfVWWsogg4RnIJ3QBZmk5qqwkf1Nq07fnXxIHRxmt5c1PS4hqvSxvIcH/Ghq0VVDZb3yMELZYJWIN20Q52A9I78yEwbjWmtGJ9oG1hRceGlWsxVhqX6Br1fHaHvkgz8HIoTM6kwPAHT+IVxnBIkKOuC</X509Certificate>
+        </X509Data>
+      </KeyInfo>
+    </KeyDescriptor>
+    <NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</NameIDFormat>
+    <AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://www.ovhcloud.com/eu/auth/saml/acs" index="1"></AssertionConsumerService>
+  </SPSSODescriptor>
+</EntityDescriptor>
diff --git a/tf/deployment/modules/shared/zitadel/cloud/config.tf b/tf/deployment/modules/shared/zitadel/cloud/config.tf
@@ -13,10 +13,6 @@ terraform {
       source  = "1Password/onepassword"
       version = "~> 2.1"
     }
-    http = {
-      source  = "hashicorp/http"
-      version = "~> 3.5"
-    }
     cloudflare = {
       source  = "cloudflare/cloudflare"
       version = "5.19.1"
diff --git a/tf/deployment/modules/shared/zitadel/cloud/project.tf b/tf/deployment/modules/shared/zitadel/cloud/project.tf
@@ -6,7 +6,7 @@ locals {
     postLogoutRedirectUris = []
     grantTypes             = ["AUTHORIZATION_CODE"]
     protocol               = "oidc"
-    metadataUrl            = ""
+    metadataFile           = ""
     # When true, a user is granted every role they match (not just the
     # highest-priority one) — e.g. Outline admins land in Leadership and Team.
     multi_role = false
@@ -86,10 +86,15 @@ locals {
       roles = [{ key = "Granted", grants_to = ["yucca"] }]
     },
     {
-      name        = "OVHCloud"
-      protocol    = "saml"
-      roles       = [{ key = "ADMIN", grants_to = ["immich_admin", "yucca"] }, { key = "DEFAULT", grants_to = ["team"] }]
-      metadataUrl = "https://auth.eu.ovhcloud.com/sso/saml/sp/metadata.xml"
+      name     = "OVHCloud"
+      protocol = "saml"
+      roles    = [{ key = "ADMIN", grants_to = ["immich_admin", "yucca"] }, { key = "DEFAULT", grants_to = ["team"] }]
+      # SP metadata is vendored rather than fetched at plan time: OVH gates
+      # https://auth.eu.ovhcloud.com/sso/saml/sp/metadata.xml behind a CDN
+      # Set-Cookie 307-redirect-to-self that the http provider (no cookie jar)
+      # can't satisfy, so `data.http` loops to 10 redirects and fails the apply.
+      # Re-fetch with `curl -sL -c jar -b jar <url>` if OVH rotates their SP cert.
+      metadataFile = "ovhcloud-sp-metadata.xml"
     }
   ]
 
@@ -152,15 +157,10 @@ resource "onepassword_item" "application_client_secret" {
   password = each.value.client_secret
 }
 
-data "http" "saml_sp_metadata" {
-  for_each = { for project in local.saml_projects : project.name => project }
-  url      = each.value.metadataUrl
-}
-
 resource "zitadel_application_saml" "applications" {
   for_each     = { for project in local.saml_projects : project.name => project }
   name         = upper(replace(each.value.name, "/[^a-zA-Z0-9]/", "_"))
   org_id       = zitadel_org.immich.id
   project_id   = zitadel_project.projects[each.key].id
-  metadata_xml = data.http.saml_sp_metadata[each.key].response_body
+  metadata_xml = file("${path.module}/assets/${each.value.metadataFile}")
 }
diff --git a/tf/deployment/modules/shared/zitadel/self-hosted/assets/ovhcloud-sp-metadata.xml b/tf/deployment/modules/shared/zitadel/self-hosted/assets/ovhcloud-sp-metadata.xml
@@ -0,0 +1,14 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata" entityID="https://www.ovhcloud.com/eu/auth/">
+  <SPSSODescriptor AuthnRequestsSigned="false" WantAssertionsSigned="true" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
+    <KeyDescriptor>
+      <KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#">
+        <X509Data>
+          <X509Certificate>MIIFVzCCAz+gAwIBAgIUQSUwSIh9zUNgNtP/FhkGdy7bEPYwDQYJKoZIhvcNAQELBQAwOzEdMBsGA1UEAwwUYXV0aC5ldS5vdmhjbG91ZC5jb20xCzAJBgNVBAsMAlNQMQ0wCwYDVQQKDARTQU1MMB4XDTI0MDExMjE0MTYzM1oXDTM0MDEwOTE0MTYzM1owOzEdMBsGA1UEAwwUYXV0aC5ldS5vdmhjbG91ZC5jb20xCzAJBgNVBAsMAlNQMQ0wCwYDVQQKDARTQU1MMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA0RWhT7fEM8NLiLeEe9Burk15IJUVHvHXJFySOr4lGhbpUWXgnRQZKP8klr3Jd9jZwv9ss+NhsbT/64lqB6WINozk11fGefdyrO6TbIioQnTOcwtF7NCTy9ypuBZiseqMxA67g6VDRqtRuZCtHVFOBJxMzux0h6sGS5t/a3aaHR+0xw9dhhHE0+sNiZUehl0BuNafoelar1nK6Q1ZfXWmoC5zJjxxJAE2DH+kNZaWOdkbPCWpD5G1maZlNL+tEFHzAAmCjj5re4C9enMs4/XPnxqS4wLzsuAEU2/7917+wdgPTpF7RHsqYgFD+gff00IkpY1+H8oqsEtf/iebIvoy0EYD0KozPnSolKNHhOEqSFcxehtCDOPdVq92Ie5FzMPLEeZoO1UvPIlKm2043BjGbNtYNBcFOTP6jdMInGau7KLXz/Bh5g/8mBI+UyCTbZaSoB1GkfzJJpP5j+VPYXcum/s/Y0AJUwNBXujQnu7EkNwQeE8QkjfrHXSC0wI6QYzpcc4DyMk1TNWg+4dn2EdU0TJS+zO/ohaAO1L1O9Pw6+JfHrXcNy5E7iPeRyMhkRMEhWyHxh6PlO7c2Hydo1WVAuV1BqQJmjMYP3D4dzcdmaZiy6JElV4fvkGBh/J3+jRGqeQtb0vplz0d3Dj5Zeto07xi79XtaItk4e9a6KPVds8CAwEAAaNTMFEwHQYDVR0OBBYEFJ/VldqCVgz9XObIdmTtzX+7qo9JMB8GA1UdIwQYMBaAFJ/VldqCVgz9XObIdmTtzX+7qo9JMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggIBACVM09u+blp3PDDjJsSJM0WyAq40bamTxncfyqZG1P+pN+K/Y38XU+F874FpiglFn1U1ZNekPA8HHj9SpRK1iZKqohB2r6ivwMqcwOJJM3LPNuPxs/RnNXAuup7KfnkEocnIYfad4KUr5QZoWfAyzMGiiRUF9mY4mLvRii1627XsTeQiDN2NJKvl/8FzXSWy2X61nA6kjw7erx5n6QoOprrXbG4Lmq2dRGdO3fqKtSByXrr5pLvHQgduoCtwbJn2mJHEnNSM8h7EDcszMRsgagQuUxT/XdGA8jqzs/qL38XHPxSmdaVzLO1pIxGXH5mZ+emDPGFN/Yd3WA/63qQ+Ig+ctu5gKJGDHaVLXmHE/cQXWs9tYoEen2iSL4nTf9hdH9hz7osQ1q9tNyJkHPwxYYvV9po6ui6jivd/OrasO54SzkoIEIlz0GpaZ4+sVfxWxoaHguQjmbesrppMXwdj8rc8fzKq70nMUm/T3hlehFXsBeH1lZygfKpb1EtpSbmStrQ/pY6xPB0oa4syj9kAnLfVWWsogg4RnIJ3QBZmk5qqwkf1Nq07fnXxIHRxmt5c1PS4hqvSxvIcH/Ghq0VVDZb3yMELZYJWIN20Q52A9I78yEwbjWmtGJ9oG1hRceGlWsxVhqX6Br1fHaHvkgz8HIoTM6kwPAHT+IVxnBIkKOuC</X509Certificate>
+        </X509Data>
+      </KeyInfo>
+    </KeyDescriptor>
+    <NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</NameIDFormat>
+    <AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://www.ovhcloud.com/eu/auth/saml/acs" index="1"></AssertionConsumerService>
+  </SPSSODescriptor>
+</EntityDescriptor>
diff --git a/tf/deployment/modules/shared/zitadel/self-hosted/config.tf b/tf/deployment/modules/shared/zitadel/self-hosted/config.tf
@@ -13,9 +13,5 @@ terraform {
       source  = "1Password/onepassword"
       version = "~> 2.1"
     }
-    http = {
-      source  = "hashicorp/http"
-      version = "~> 3.5"
-    }
   }
 }
diff --git a/tf/deployment/modules/shared/zitadel/self-hosted/project.tf b/tf/deployment/modules/shared/zitadel/self-hosted/project.tf
@@ -5,7 +5,7 @@ locals {
     redirectUris = []
     grantTypes   = ["AUTHORIZATION_CODE"]
     protocol     = "oidc"
-    metadataUrl  = ""
+    metadataFile = ""
   }
   projects_data = [
     {
@@ -54,10 +54,15 @@ locals {
       redirectUris = ["https://loopdedupe.internal.immich.cloud/oauth2/callback"]
     },
     {
-      name        = "OVHCloud"
-      protocol    = "saml"
-      roles       = [{ key = "ADMIN", grants_to = ["immich_admin", "yucca"] }, { key = "DEFAULT", grants_to = ["team"] }]
-      metadataUrl = "https://auth.eu.ovhcloud.com/sso/saml/sp/metadata.xml"
+      name     = "OVHCloud"
+      protocol = "saml"
+      roles    = [{ key = "ADMIN", grants_to = ["immich_admin", "yucca"] }, { key = "DEFAULT", grants_to = ["team"] }]
+      # SP metadata is vendored rather than fetched at plan time: OVH gates
+      # https://auth.eu.ovhcloud.com/sso/saml/sp/metadata.xml behind a CDN
+      # Set-Cookie 307-redirect-to-self that the http provider (no cookie jar)
+      # can't satisfy, so `data.http` loops to 10 redirects and fails the apply.
+      # Re-fetch with `curl -sL -c jar -b jar <url>` if OVH rotates their SP cert.
+      metadataFile = "ovhcloud-sp-metadata.xml"
     }
   ]
 
@@ -119,15 +124,10 @@ resource "onepassword_item" "application_client_secret" {
   password = each.value.client_secret
 }
 
-data "http" "saml_sp_metadata" {
-  for_each = { for project in local.saml_projects : project.name => project }
-  url      = each.value.metadataUrl
-}
-
 resource "zitadel_application_saml" "applications" {
   for_each     = { for project in local.saml_projects : project.name => project }
   name         = upper(replace(each.value.name, "/[^a-zA-Z0-9]/", "_"))
   org_id       = zitadel_org.immich.id
   project_id   = zitadel_project.projects[each.key].id
-  metadata_xml = data.http.saml_sp_metadata[each.key].response_body
+  metadata_xml = file("${path.module}/assets/${each.value.metadataFile}")
 }
diff --git a/tf/deployment/modules/shared/zitadel/self-hosted/terragrunt.hcl b/tf/deployment/modules/shared/zitadel/self-hosted/terragrunt.hcl
@@ -5,7 +5,7 @@ terraform {
     commands = get_terraform_commands_that_need_vars()
   }
 
-  include_in_copy = ["repo-files/*"]
+  include_in_copy = ["repo-files/*", "assets/*"]
 }
 
 include "root" {

Original file line number	Diff line number	Diff line change
`@@ -13,9 +13,5 @@ terraform {`
`13`	`13`	`source = "1Password/onepassword"`
`14`	`14`	`version = "~> 2.1"`
`15`	`15`	`}`
`16`		`- http = {`
`17`		`- source = "hashicorp/http"`
`18`		`- version = "~> 3.5"`
`19`		`- }`
`20`	`16`	`}`
`21`	`17`	`}`
Original file line number	Diff line number	Diff line change
`@@ -5,7 +5,7 @@ terraform {`
`5`	`5`	`commands = get_terraform_commands_that_need_vars()`
`6`	`6`	`}`
`7`	`7`
`8`		`- include_in_copy = ["repo-files/*"]`
	`8`	`+ include_in_copy = ["repo-files/", "assets/"]`
`9`	`9`	`}`
`10`	`10`
`11`	`11`	`include "root" {`