From 4478152156d0e43dafed3993e7c085626c8e1a54 Mon Sep 17 00:00:00 2001
From: Jonathan Perret <j-github@jonathanperret.net>
Date: Mon, 29 Apr 2024 23:09:02 +0200
Subject: [PATCH] =?UTF-8?q?=F0=9F=9A=80(env)=20make=20FER=20URLs=20configu?=
 =?UTF-8?q?rable=20per=20environment?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Of course in production we will want the production federation.
---
 docker-compose.yml                                 | 2 ++
 src/helm/env.d/dev/values.oidc2fer.yaml.gotmpl     | 2 ++
 src/helm/env.d/staging/values.oidc2fer.yaml.gotmpl | 2 ++
 src/satosa/plugins/backends/saml2_backend.yaml     | 6 +++---
 4 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/docker-compose.yml b/docker-compose.yml
index 147a0a6..f7ef2ca 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -28,6 +28,8 @@ services:
             "token_endpoint_auth_method": "client_secret_post"
           }
         }
+      SAML2_DISCOVERY_URL: https://discovery.renater.fr/test/
+      SAML2_METADATA_URL: https://pub.federation.renater.fr/metadata/test/preview/preview-idps-test-metadata.xml
     env_file:
       - env.d/development/common
       - env.d/development/satosa
diff --git a/src/helm/env.d/dev/values.oidc2fer.yaml.gotmpl b/src/helm/env.d/dev/values.oidc2fer.yaml.gotmpl
index 193ce66..6456cbd 100644
--- a/src/helm/env.d/dev/values.oidc2fer.yaml.gotmpl
+++ b/src/helm/env.d/dev/values.oidc2fer.yaml.gotmpl
@@ -25,6 +25,8 @@ satosa:
       }
     SAML2_BACKEND_CERT: {{ .Values.SAML2_BACKEND_CERT | toYaml | indent 8 }}
     SAML2_BACKEND_KEY: {{ .Values.SAML2_BACKEND_KEY | toYaml | indent 8 }}
+    SAML2_DISCOVERY_URL: https://discovery.renater.fr/test/
+    SAML2_METADATA_URL: https://pub.federation.renater.fr/metadata/test/preview/preview-idps-test-metadata.xml
     OIDC_FRONTEND_KEY: {{ .Values.OIDC_FRONTEND_KEY | toYaml | indent 8 }}
     OIDC_DB_URI: "redis://:pass@redis-master:6379"
     STATE_ENCRYPTION_KEY: "{{ .Values.STATE_ENCRYPTION_KEY }}"
diff --git a/src/helm/env.d/staging/values.oidc2fer.yaml.gotmpl b/src/helm/env.d/staging/values.oidc2fer.yaml.gotmpl
index 8607425..e5cbf15 100644
--- a/src/helm/env.d/staging/values.oidc2fer.yaml.gotmpl
+++ b/src/helm/env.d/staging/values.oidc2fer.yaml.gotmpl
@@ -10,6 +10,8 @@ satosa:
     GUNICORN_CMD_ARGS: --workers=3
     SAML2_BACKEND_CERT: {{ .Values.SAML2_BACKEND_CERT | toYaml | indent 8 }}
     SAML2_BACKEND_KEY: {{ .Values.SAML2_BACKEND_KEY | toYaml | indent 8 }}
+    SAML2_DISCOVERY_URL: https://discovery.renater.fr/test/
+    SAML2_METADATA_URL: https://pub.federation.renater.fr/metadata/test/preview/preview-idps-test-metadata.xml
     OIDC_FRONTEND_KEY: {{ .Values.OIDC_FRONTEND_KEY | toYaml | indent 8 }}
     OIDC_DB_URI:
       secretKeyRef:
diff --git a/src/satosa/plugins/backends/saml2_backend.yaml b/src/satosa/plugins/backends/saml2_backend.yaml
index 1d5964c..8f56106 100644
--- a/src/satosa/plugins/backends/saml2_backend.yaml
+++ b/src/satosa/plugins/backends/saml2_backend.yaml
@@ -1,7 +1,7 @@
 module: satosa.backends.saml2.SAMLBackend
 name: Saml2
 config:
-  disco_srv: https://discovery.renater.fr/test/
+  disco_srv: !ENV SAML2_DISCOVERY_URL
   entityid_endpoint: true
   mirror_force_authn: 'no'
   memorize_idp: 'no'
@@ -22,7 +22,7 @@ config:
       # mdq:
       #   - url: https://mdq.federation.renater.fr
       remote:
-        - url: https://pub.federation.renater.fr/metadata/test/preview/preview-idps-test-metadata.xml
+        - url: !ENV SAML2_METADATA_URL
     entityid: <base_url>/<name>/proxy_saml2_backend.xml
     accepted_time_diff: 60
     allow_unknown_attributes: true
@@ -45,7 +45,7 @@ config:
         endpoints:
           assertion_consumer_service:
             - - <base_url>/<name>/acs/post
-              - urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST
+              - 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST'
           discovery_response:
             - - <base_url>/<name>/disco
               - 'urn:oasis:names:tc:SAML:profiles:SSO:idp-discovery-protocol'