Skip to content

Commit 0be47c9

Browse files
rimi-itkrimi-itk
authored
Merge pull request #591 from itk-dev/feature/server-test-setup
Cleaned up local OIDC setup
2 parents 9b646ff + 6321fc4 commit 0be47c9

7 files changed

Lines changed: 94 additions & 33 deletions

File tree

‎CHANGELOG.md‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,9 @@ Versioning](https://semver.org/spec/v2.0.0.html).
66

77
## [Unreleased]
88

9+
* [PR-591](https://github.com/itk-dev/deltag.aarhus.dk/pull/591)
10+
* Cleaned up local OIDC setup
11+
* Added test server OIDC setup
912
* [PR-587](https://github.com/itk-dev/deltag.aarhus.dk/pull/587)
1013
Cleaned up translations
1114
* [PR-586](https://github.com/itk-dev/hoeringsportal/pull/586)

‎README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@
1717
4. [Pretix setup](documentation/pretix.md)
1818
5. [Custom Høringsportalen theme](web/themes/custom/hoeringsportal/README.md)
1919
6. [Testing](documentation/Testing.md)
20+
7. [Server](documentation/Server.md)
2021

2122
## Database dumps
2223

‎docker-compose.oidc.yml‎

Lines changed: 1 addition & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -2,24 +2,17 @@ services:
22
# https://github.com/geigerzaehler/oidc-provider-mock
33
idp-citizen:
44
image: ghcr.io/geigerzaehler/oidc-provider-mock:latest
5-
profiles:
6-
- oidc
7-
- test
85
# Let this container be accessible both internally and externally on the same domain.
96
container_name: idp-citizen.${COMPOSE_DOMAIN}
107
networks:
118
- app
129
- frontend
13-
ports:
14-
- "80"
1510
labels:
1611
- "traefik.enable=true"
1712
- "traefik.docker.network=frontend"
1813
- "traefik.http.routers.${COMPOSE_PROJECT_NAME}-idp.rule=Host(`idp-citizen.${COMPOSE_DOMAIN}`)"
1914
command:
2015
[
21-
"--port",
22-
"80",
2316
"--user-claims",
2417
'{"sub": "citizen1", "dk_ssn": "1111111111", "name": "Anders And", "zip": "1111"}',
2518
"--user-claims",
@@ -34,27 +27,19 @@ services:
3427
'{"sub": "aarhusianer", "dk_ssn": "2611740000", "name": "Betina Henningsentest"}',
3528
]
3629

37-
# https://github.com/Soluto/oidc-server-mock
3830
idp-employee:
3931
image: ghcr.io/geigerzaehler/oidc-provider-mock:latest
40-
profiles:
41-
- oidc
42-
- test
4332
# Let this container be accessible both internally and externally on the same domain.
4433
container_name: idp-employee.${COMPOSE_DOMAIN}
4534
networks:
4635
- app
4736
- frontend
48-
ports:
49-
- "80"
5037
labels:
5138
- "traefik.enable=true"
5239
- "traefik.docker.network=frontend"
5340
- "traefik.http.routers.${COMPOSE_PROJECT_NAME}_idp-employee.rule=Host(`idp-employee.${COMPOSE_DOMAIN}`)"
5441
command:
5542
[
56-
"--port",
57-
"80",
5843
"--user-claims",
5944
'{"sub": "user", "email": "user@example.com", "groups": ["authenticated"]}',
6045
"--user-claims",
@@ -78,7 +63,7 @@ services:
7863
idp_mock_api:
7964
image: dotronglong/faker:stable
8065
profiles:
81-
- oidc
66+
- oidc-api
8267
networks:
8368
- app
8469
- frontend

‎docker-compose.server.oidc.yml‎

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
# Use this file to enable test OIDC login on a test server, e.g.
2+
#
3+
# ``` sh
4+
# # .env.docker.local
5+
# COMPOSE_FILES=…,docker-compose.server.oidc.yml
6+
# ```
7+
8+
services:
9+
idp-citizen:
10+
image: ghcr.io/geigerzaehler/oidc-provider-mock:latest
11+
restart: unless-stopped
12+
networks:
13+
- app
14+
- frontend
15+
labels:
16+
- "traefik.enable=true"
17+
- "traefik.docker.network=frontend"
18+
- "traefik.http.routers.idp-citizen_${COMPOSE_PROJECT_NAME}-http.rule=Host(`idp-citizen.${COMPOSE_SERVER_DOMAIN}`)"
19+
- "traefik.http.routers.idp-citizen_${COMPOSE_PROJECT_NAME}-http.entrypoints=web"
20+
- "traefik.http.routers.idp-citizen_${COMPOSE_PROJECT_NAME}-http.middlewares=redirect-to-https"
21+
- "traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https"
22+
- "traefik.http.routers.idp-citizen_${COMPOSE_PROJECT_NAME}.rule=Host(`idp-citizen.${COMPOSE_SERVER_DOMAIN}`)"
23+
- "traefik.http.routers.idp-citizen_${COMPOSE_PROJECT_NAME}.entrypoints=websecure"
24+
- "traefik.http.services.idp-citizen_${COMPOSE_PROJECT_NAME}.loadbalancer.server.port=9400"
25+
command:
26+
[
27+
"--user-claims",
28+
'{"sub": "citizen1", "dk_ssn": "1111111111", "name": "Anders And", "zip": "1111"}',
29+
"--user-claims",
30+
'{"sub": "citizen2", "dk_ssn": "2222222222", "name": "Bent Betjentsen", "zip": "2222"}',
31+
"--user-claims",
32+
'{"sub": "citizen3", "dk_ssn": "3333333333", "name": "Carsten Carlsen", "zip": "3333"}',
33+
"--user-claims",
34+
'{"sub": "citizen4", "dk_ssn": "4444444444", "name": "Dorte Dyhr", "zip": "4444"}',
35+
"--user-claims",
36+
'{"sub": "ikke-aarhusianer", "dk_ssn": "1705880000", "name": "Troels Bondetest"}',
37+
"--user-claims",
38+
'{"sub": "aarhusianer", "dk_ssn": "2611740000", "name": "Betina Henningsentest"}',
39+
]
40+
41+
idp-employee:
42+
image: ghcr.io/geigerzaehler/oidc-provider-mock:latest
43+
networks:
44+
- app
45+
- frontend
46+
labels:
47+
- "traefik.enable=true"
48+
- "traefik.docker.network=frontend"
49+
- "traefik.http.routers.idp-employee_${COMPOSE_PROJECT_NAME}-http.rule=Host(`idp-employee.${COMPOSE_SERVER_DOMAIN}`)"
50+
- "traefik.http.routers.idp-employee_${COMPOSE_PROJECT_NAME}-http.entrypoints=web"
51+
- "traefik.http.routers.idp-employee_${COMPOSE_PROJECT_NAME}-http.middlewares=redirect-to-https"
52+
- "traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https"
53+
- "traefik.http.routers.idp-employee_${COMPOSE_PROJECT_NAME}.rule=Host(`idp-employee.${COMPOSE_SERVER_DOMAIN}`)"
54+
- "traefik.http.routers.idp-employee_${COMPOSE_PROJECT_NAME}.entrypoints=websecure"
55+
- "traefik.http.services.idp-employee_${COMPOSE_PROJECT_NAME}.loadbalancer.server.port=9400"
56+
command:
57+
[
58+
"--user-claims",
59+
'{"sub": "user", "email": "user@example.com", "groups": ["authenticated"]}',
60+
"--user-claims",
61+
'{"sub": "page_editor", "email": "page_editor@example.com", "groups": ["page_editor"]}',
62+
"--user-claims",
63+
'{"sub": "public_meeting_editor", "email": "public_meeting_editor@example.com", "groups": ["public_meeting_editor"]}',
64+
"--user-claims",
65+
'{"sub": "dialogue_editor", "email": "dialogue_editor@example.com", "groups": ["dialogue_editor"]}',
66+
"--user-claims",
67+
'{"sub": "decision_editor", "email": "decision_editor@example.com", "groups": ["decision_editor"]}',
68+
"--user-claims",
69+
'{"sub": "project_editor", "email": "project_editor@example.com", "groups": ["project_editor"]}',
70+
"--user-claims",
71+
'{"sub": "hearing_editor", "email": "hearing_editor@example.com", "groups": ["hearing_editor"]}',
72+
"--user-claims",
73+
'{"sub": "citizen_proposal_editor", "email": "citizen_proposal_editor@example.com", "groups": ["citizen_proposal_editor"]}',
74+
"--user-claims",
75+
'{"sub": "administrator", "email": "administrator@example.com", "groups": ["administrator"]}',
76+
]

‎documentation/Server.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
# Server
2+
3+
To easy user login (as both employee and citizen) on *test servers*, we have a test server OIDC setup in
4+
[`docker-compose.server.oidc.yml`](../docker-compose.server.oidc.yml), which see.

‎documentation/localDevelopment.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -111,8 +111,8 @@ Start docker
111111
```sh
112112
docker compose pull
113113
docker compose up --detach
114-
# Note: If you want to start pretix and the mock OIDC IdP you have to enable the "pretix" and "oidc" profiles (cf. https://docs.docker.com/compose/profiles/):
115-
# docker compose --profile pretix --profile oidc up --detach
114+
# Note: If you want to start pretix you have to enable the "pretix" profile (cf. https://docs.docker.com/compose/profiles/):
115+
# docker compose --profile pretix up --detach
116116
docker compose exec phpfpm composer install
117117
docker compose exec phpfpm vendor/bin/drush --yes site:install --existing-config
118118

‎documentation/openIdConnect.md‎

Lines changed: 7 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -34,9 +34,9 @@ docker compose exec phpfpm vendor/bin/drush config:get --include-overridden open
3434
See the [Høringsportalen OpenID Connect module](../web/modules/custom/hoeringsportal_openid_connect/README.md) for
3535
details on configuring OpenID Connect authentification for citizens.
3636

37-
For local testing we use [OpenId Connect Server Mock](https://github.com/Soluto/oidc-server-mock) for (almost) real
37+
For local testing we use [OpenID Provider Mock](https://github.com/geigerzaehler/oidc-provider-mock) for (almost) real
3838
OpenID Connect. Users and their claims are defined in
39-
[`docker-compose.override.yml`](../../../../docker-compose.override.yml).
39+
[`docker-compose.oidc.yml`](../../../../docker-compose.oidc.yml).
4040

4141
## Employee authentification
4242

@@ -56,24 +56,16 @@ docker compose exec phpfpm vendor/bin/drush php:eval "\Drupal\taxonomy\Entity\Te
5656
## Debugging OpenID Connect authentification
5757

5858
```sh
59-
docker compose --profile oidc up --detach
59+
docker compose up --detach
6060
```
6161

6262
### Local OIDC test
6363

64-
During (local) development we use [OpenId Connect Server Mock](https://github.com/Soluto/oidc-server-mock) (cf.
64+
During (local) development we use [OpenID Provider Mock](https://github.com/geigerzaehler/oidc-provider-mock) (cf.
6565
[`docker-compose.oidc.yml`](docker-compose.oidc.yml) which is
6666
[included](https://docs.docker.com/compose/how-tos/multiple-compose-files/include/) in
6767
[`docker-compose.override.yml`](docker-compose.override.yml)).
6868

69-
#### Employees
70-
71-
| Username | Password | Groups |
72-
|---------------------|----------------------|---------------|
73-
| department1-admin | department1-admin | administrator |
74-
| department2-editor | department2-editor | editor |
75-
| department3-editor | department3-editor | editor |
76-
7769
## Debug OIDC
7870

7971
During development it can be useful to see the user info we actually get during OpenID Connect authentification, and to
@@ -106,13 +98,13 @@ The json files with mock returns are located in the `mocks` folder in the root o
10698
To test if this works, patiently wait for:
10799

108100
```sh
109-
docker compose --profile oidc up --detach
101+
docker compose up --detach
110102
```
111103

112104
To test if it works, run (should return something starting with `HTTP/1.1 200 OK`)
113105

114106
```sh
115-
curl -d '{}' "http://$(docker compose --profile oidc port idp_mock_api 3030)/users"
107+
curl -d '{}' "http://$(docker compose port idp_mock_api 3030)/users"
116108
```
117109

118110
or
@@ -188,6 +180,6 @@ above config file (here, `userprincipalname`).
188180
### Test delta sync
189181

190182
```sh
191-
docker compose --profile oidc up --detach
183+
docker compose --profile oidc-api up --detach
192184
./test-delta-sync
193185
```

0 commit comments

Comments
 (0)