🚀(env) make FER URLs configurable per environment

Of course in production we will want the production federation.

docker-compose.yml

@@ -28,6 +28,8 @@ services:
             "token_endpoint_auth_method": "client_secret_post"
           }
         }
+      SAML2_DISCOVERY_URL: https://discovery.renater.fr/test/
+      SAML2_METADATA_URL: https://pub.federation.renater.fr/metadata/test/preview/preview-idps-test-metadata.xml
     env_file:
       - env.d/development/common
       - env.d/development/satosa

src/helm/env.d/dev/values.oidc2fer.yaml.gotmpl

@@ -25,6 +25,8 @@ satosa:
       }
     SAML2_BACKEND_CERT: {{ .Values.SAML2_BACKEND_CERT | toYaml | indent 8 }}
     SAML2_BACKEND_KEY: {{ .Values.SAML2_BACKEND_KEY | toYaml | indent 8 }}
+    SAML2_DISCOVERY_URL: https://discovery.renater.fr/test/
+    SAML2_METADATA_URL: https://pub.federation.renater.fr/metadata/test/preview/preview-idps-test-metadata.xml
     OIDC_FRONTEND_KEY: {{ .Values.OIDC_FRONTEND_KEY | toYaml | indent 8 }}
     OIDC_DB_URI: "redis://:pass@redis-master:6379"
     STATE_ENCRYPTION_KEY: "{{ .Values.STATE_ENCRYPTION_KEY }}"

src/helm/env.d/staging/values.oidc2fer.yaml.gotmpl

@@ -10,6 +10,8 @@ satosa:
     GUNICORN_CMD_ARGS: --workers=3
     SAML2_BACKEND_CERT: {{ .Values.SAML2_BACKEND_CERT | toYaml | indent 8 }}
     SAML2_BACKEND_KEY: {{ .Values.SAML2_BACKEND_KEY | toYaml | indent 8 }}
+    SAML2_DISCOVERY_URL: https://discovery.renater.fr/test/
+    SAML2_METADATA_URL: https://pub.federation.renater.fr/metadata/test/preview/preview-idps-test-metadata.xml
     OIDC_FRONTEND_KEY: {{ .Values.OIDC_FRONTEND_KEY | toYaml | indent 8 }}
     OIDC_DB_URI:
       secretKeyRef:

src/satosa/plugins/backends/saml2_backend.yaml

@@ -1,7 +1,7 @@
 module: satosa.backends.saml2.SAMLBackend
 name: Saml2
 config:
-  disco_srv: https://discovery.renater.fr/test/
+  disco_srv: !ENV SAML2_DISCOVERY_URL
   entityid_endpoint: true
   mirror_force_authn: 'no'
   memorize_idp: 'no'
@@ -22,7 +22,7 @@ config:
       # mdq:
       #   - url: https://mdq.federation.renater.fr
       remote:
-        - url: https://pub.federation.renater.fr/metadata/test/preview/preview-idps-test-metadata.xml
+        - url: !ENV SAML2_METADATA_URL
     entityid: <base_url>/<name>/proxy_saml2_backend.xml
     accepted_time_diff: 60
     allow_unknown_attributes: true
@@ -45,7 +45,7 @@ config:
         endpoints:
           assertion_consumer_service:
             - - <base_url>/<name>/acs/post
-              - urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST
+              - 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST'
           discovery_response:
             - - <base_url>/<name>/disco
               - 'urn:oasis:names:tc:SAML:profiles:SSO:idp-discovery-protocol'