diff --git a/CHANGELOG.md b/CHANGELOG.md index 251d0b3..14d145e 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,6 +6,9 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). +## [Unreleased] +- switch to stateless OIDC and remove Redis + ## [1.0.12] - 2026-03-02 - upgrade dependencies: Python 3.14.3, gunicorn 25.1.0… diff --git a/docker-compose.yml b/docker-compose.yml index 46075ce..58fc605 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -14,7 +14,7 @@ services: GUNICORN_CMD_ARGS: --workers=2 TEST_E2E: 1 #TEST_E2E_PC: 1 - OIDC_DB_URI: redis://redis/0 + OIDC_DB_URI: stateless://:STATE-ENCRYPTION-KEY@localhost CLIENT_DB_JSON: | { "oidc-test-client": { @@ -38,8 +38,6 @@ services: volumes: - ./src/satosa:/app - ./docker/files/usr/local/etc/gunicorn/satosa.py:/usr/local/etc/gunicorn/satosa.py - depends_on: - - redis healthcheck: test: ["CMD", "curl", "--fail", "http://localhost:8000/ping"] interval: 60s @@ -77,9 +75,6 @@ services: extra_hosts: - "oidc2fer.127.0.0.1.nip.io:host-gateway" - redis: - image: redis:7.2.4 - nginx: image: nginx:1.25 ports: diff --git a/docker/files/usr/local/bin/entrypoint b/docker/files/usr/local/bin/entrypoint index 8d09ebe..2906ce3 100755 --- a/docker/files/usr/local/bin/entrypoint +++ b/docker/files/usr/local/bin/entrypoint @@ -39,11 +39,5 @@ printenv SAML2_BACKEND_KEY > /tmp/backend.key printenv OIDC_FRONTEND_KEY > /tmp/frontend.key printenv CLIENT_DB_JSON > /tmp/client_db.json -# Redis database number must be specified -if [[ ! $OIDC_DB_URI =~ /[0-9]+$ ]]; then - echo "🐳(entrypoint) adding db id to OIDC_DB_URI" - export OIDC_DB_URI=$OIDC_DB_URI/0 -fi - echo "🐳(entrypoint) running your command: ${*}" exec "$@" diff --git a/src/helm/env.d/dev/values.oidc2fer.yaml.gotmpl b/src/helm/env.d/dev/values.oidc2fer.yaml.gotmpl index e064866..99a28fd 100644 --- a/src/helm/env.d/dev/values.oidc2fer.yaml.gotmpl +++ b/src/helm/env.d/dev/values.oidc2fer.yaml.gotmpl @@ -5,42 +5,57 @@ image: satosa: replicas: 1 - envVars: - BASE_URL: https://oidc2fer.127.0.0.1.nip.io - GUNICORN_CMD_ARGS: --workers=3 + env: + - name: BASE_URL + value: https://oidc2fer.127.0.0.1.nip.io + + - name: GUNICORN_CMD_ARGS + value: --workers=3 - LOG_LEVEL: debug + - name: LOG_LEVEL + value: debug - SAML2_DISCOVERY_URL: https://discovery.renater.fr/test/ - SAML2_METADATA_URL: https://pub.federation.renater.fr/metadata/test/idps.xml - SAML2_ENTITY_ID: https://oidc2fer.127.0.0.1.nip.io/Saml2/proxy_saml2_backend.xml + - name: SAML2_DISCOVERY_URL + value: https://discovery.renater.fr/test/ + - name: SAML2_METADATA_URL + value: https://pub.federation.renater.fr/metadata/test/idps.xml + - name: SAML2_ENTITY_ID + value: https://oidc2fer.127.0.0.1.nip.io/Saml2/proxy_saml2_backend.xml - STATE_ENCRYPTION_KEY: { secretKeyRef: { name: oidc2fer, key: STATE_ENCRYPTION_KEY } } - SAML2_BACKEND_CERT: { secretKeyRef: { name: oidc2fer, key: SAML2_BACKEND_CERT } } - SAML2_BACKEND_KEY: { secretKeyRef: { name: oidc2fer, key: SAML2_BACKEND_KEY } } - OIDC_FRONTEND_KEY: { secretKeyRef: { name: oidc2fer, key: OIDC_FRONTEND_KEY } } + - name: STATE_ENCRYPTION_KEY + valueFrom: { secretKeyRef: { name: oidc2fer, key: STATE_ENCRYPTION_KEY } } + - name: SAML2_BACKEND_CERT + valueFrom: { secretKeyRef: { name: oidc2fer, key: SAML2_BACKEND_CERT } } + - name: SAML2_BACKEND_KEY + valueFrom: { secretKeyRef: { name: oidc2fer, key: SAML2_BACKEND_KEY } } + - name: OIDC_FRONTEND_KEY + valueFrom: { secretKeyRef: { name: oidc2fer, key: OIDC_FRONTEND_KEY } } - OIDC_DB_URI: "redis://:pass@redis-master:6379" - CLIENT_DB_JSON: |- - { - "oidc-test-client": { - "response_types": [ - "id_token", - "code" - ], - "redirect_uris": [ - "https://oidc-test-client.traefik.me/redirect_uri", - "https://oidc-test-client.traefik.me:8443/redirect_uri", - "https://oidc-test-client.127.0.0.1.nip.io/redirect_uri" - ], - "client_secret": "oidc-test-secret", - "token_endpoint_auth_method": "client_secret_post" + - name: OIDC_DB_URI + value: "stateless://:$(STATE_ENCRYPTION_KEY)@localhost" + + - name: CLIENT_DB_JSON + value: |- + { + "oidc-test-client": { + "response_types": [ + "id_token", + "code" + ], + "redirect_uris": [ + "https://oidc-test-client.traefik.me/redirect_uri", + "https://oidc-test-client.traefik.me:8443/redirect_uri", + "https://oidc-test-client.127.0.0.1.nip.io/redirect_uri" + ], + "client_secret": "oidc-test-secret", + "token_endpoint_auth_method": "client_secret_post" + } + } + - name: SIRET_MAP + value: |- + { + "https://test-idp.federation.renater.fr/idp/shibboleth": "12345678200010" } - } - SIRET_MAP: |- - { - "https://test-idp.federation.renater.fr/idp/shibboleth": "12345678200010" - } ingress: enabled: true diff --git a/src/helm/env.d/outscale-production/values.oidc2fer.yaml.gotmpl b/src/helm/env.d/outscale-production/values.oidc2fer.yaml.gotmpl index d171398..a852563 100644 --- a/src/helm/env.d/outscale-production/values.oidc2fer.yaml.gotmpl +++ b/src/helm/env.d/outscale-production/values.oidc2fer.yaml.gotmpl @@ -5,154 +5,168 @@ image: satosa: replicas: 2 - envVars: - BASE_URL: https://renater.agentconnect.gouv.fr - GUNICORN_CMD_ARGS: --workers=3 + env: + - name: BASE_URL + value: https://renater.agentconnect.gouv.fr + - name: GUNICORN_CMD_ARGS + value: --workers=3 - LOG_LEVEL: INFO - LOG_LEVELS: '{ "satosa.backends.saml2": "DEBUG" }' + - name: LOG_LEVEL + value: INFO + - name: LOG_LEVELS + value: '{ "satosa.backends.saml2": "DEBUG" }' - SAML2_DISCOVERY_URL: https://discovery.renater.fr/agentconnect/ - SAML2_METADATA_URL: https://pub.federation.renater.fr/metadata/fer/idps.xml - SAML2_ENTITY_ID: https://renater.agentconnect.gouv.fr/Saml2/proxy_saml2_backend.xml + - name: SAML2_DISCOVERY_URL + value: https://discovery.renater.fr/agentconnect/ + - name: SAML2_METADATA_URL + value: https://pub.federation.renater.fr/metadata/fer/idps.xml + - name: SAML2_ENTITY_ID + value: https://renater.agentconnect.gouv.fr/Saml2/proxy_saml2_backend.xml - STATE_ENCRYPTION_KEY: { secretKeyRef: { name: oidc2fer, key: STATE_ENCRYPTION_KEY } } - SAML2_BACKEND_CERT: { secretKeyRef: { name: oidc2fer, key: SAML2_BACKEND_CERT } } - SAML2_BACKEND_KEY: { secretKeyRef: { name: oidc2fer, key: SAML2_BACKEND_KEY } } - OIDC_FRONTEND_KEY: { secretKeyRef: { name: oidc2fer, key: OIDC_FRONTEND_KEY } } - CLIENT_DB_JSON: { secretKeyRef: { name: oidc2fer, key: CLIENT_DB_JSON } } + - name: STATE_ENCRYPTION_KEY + valueFrom: { secretKeyRef: { name: oidc2fer, key: STATE_ENCRYPTION_KEY } } + - name: SAML2_BACKEND_CERT + valueFrom: { secretKeyRef: { name: oidc2fer, key: SAML2_BACKEND_CERT } } + - name: SAML2_BACKEND_KEY + valueFrom: { secretKeyRef: { name: oidc2fer, key: SAML2_BACKEND_KEY } } + - name: OIDC_FRONTEND_KEY + valueFrom: { secretKeyRef: { name: oidc2fer, key: OIDC_FRONTEND_KEY } } + - name: CLIENT_DB_JSON + valueFrom: { secretKeyRef: { name: oidc2fer, key: CLIENT_DB_JSON } } - OIDC_DB_URI: { secretKeyRef: { name: redis.redis.libre.sh, key: url } } + - name: OIDC_DB_URI + value: "stateless://:$(STATE_ENCRYPTION_KEY)@localhost" # As provided by RENATER - SIRET_MAP: |- - { - "http://idp.univ-poitiers.fr": "19860856400375", - "https://apps.univ-lr.fr/idp/shibboleth": "19170032700015", - "https://auth.sso.vet-alfort.fr/saml/metadata": "19940608300014", - "https://auth.uttop.fr/saml/metadata": "19650048200019", - "https://authentification.inrae.fr/saml/metadata/idp": "18007003901803", - "https://federation.ens.psl.eu/idp/shibboleth": "19753459700012", - "https://federation.umontpellier.fr/idp/shibboleth": "13002979600013", - "https://federation.unimes.fr/idp/shibboleth": "93249157400012", - "https://federation.upf.pf/idp/shibboleth": "19987001500013", - "https://federation.utbm.fr/idp/shibboleth": "19900356700013", - "https://federation3.univ-brest.fr/idp/shibboleth": "94129831700012", - "https://idauthproxy.insa-lyon.fr/Saml2IDP/metadata": "19690192000013", - "https://ident-shib.ensc-rennes.fr/idp/shibboleth": "19350077400016", - "https://identification.univ-toulouse.fr": "13002132200016", - "https://identites.ec-lyon.fr/idp/shibboleth": "19690187000010", - "https://identites.ensea.fr/idp/shibboleth": "19951376300011", - "https://identities.univ-jfc.fr/idp/prod": "19811201300018", - "https://idp-genci.renater.fr/idp/shibboleth": "49468697500041", - "https://idp-ng.univ-st-etienne.fr/idp/shibboleth": "93850168100010", - "https://idp-septa.onisep.fr/idp/shibboleth": "18004302800653", - "https://idp-v4.univ-montp3.fr/idp/shibboleth": "93249089900014", - "https://idp.bnu.fr/idp/shibboleth": "18004406700015", - "https://idp.cirad.fr/idp/shibboleth": "33159627000016", - "https://idp.crous-reims.fr/idp/shibboleth": "18510200100327", - "https://idp.ec-nantes.fr/idp/shibboleth": "19440100600011", - "https://idp.ehesp.fr/idp/shibboleth": "13000362700010", - "https://idp.ens-lyon.fr/idp/shibboleth": "13000812100019", - "https://idp.ensam.eu/idp/shibboleth": "19753472000010", - "https://idp.ensfea.fr/idp/shibboleth": "19310143300012", - "https://idp.ensma.fr/idp/shibboleth": "19860073600021", - "https://idp.ent.dauphine.fr/idp/shibboleth": "19754692200018", - "https://idp.imt-atlantique.fr/idp/shibboleth": "18009202500121", - "https://idp.inha.fr/idp/shibboleth": "19754688000018", - "https://idp.inp-toulouse.fr/idp/shibboleth": "19311381800127", - "https://idp.insa-rennes.fr/idp/shibboleth": "19350097200016", - "https://idp.institut-agro.fr/idp": "13002622200013", - "https://idp.isae.fr/idp/shibboleth": "13000427800011", - "https://idp.lyon.archi.fr/idp/shibboleth": "19690184700018", - "https://idp.renater.fr/idp/shibboleth": "18008947600055", - "https://idp.rennes.archi.fr/idp/shibboleth": "19350089900029", - "https://idp.sciencespo-lyon.fr/idp/shibboleth": "19690173000024", - "https://idp.sciencespobordeaux.fr/idp/shibboleth": "19330192600039", - "https://idp.uca.fr/idp/shibboleth": "13002806100013", - "https://idp.uha.fr/idp/shibboleth": "19681166500013", - "https://idp.unistra.fr/idp/shibboleth": "13000545700010", - "https://idp.univ-avignon.fr/idp/shibboleth": "19840685200204", - "https://idp.univ-cotedazur.fr/idp/shibboleth": "13002566100013", - "https://idp.univ-eiffel.fr/idp/shibboleth": "13002612300013", - "https://idp.univ-lemans.fr/idp/shibboleth": "19720916600010", - "https://idp.univ-lille.fr/idp/shibboleth": "13002975400012", - "https://idp.univ-lyon2.fr/idp/shibboleth": "19691775100014", - "https://idp.univ-lyon3.fr/idp/shibboleth": "19692437700282", - "https://idp.univ-orleans.fr/idp/shibboleth": "19450855200016", - "https://idp.univ-perp.fr/idp/shibboleth": "19660437500010", - "https://idp.univ-tln.fr/idp/shibboleth": "19830766200017", - "https://idp.univ-tlse3.fr/idp/shibboleth": "93827139200012", - "https://idp.univ-tours.fr/idp/shibboleth": "19370800500478", - "https://idp.universite-paris-saclay.fr/idp": "13002602400054", - "https://idp1.agroparistech.fr/idp/shibboleth": "13000285000134", - "https://idp1.ens-paris-saclay.fr/idp/shibboleth": "19940607500036", - "https://idp1.univ-fcomte.fr/idp/shibboleth": "93810656400017", - "https://idp2.amue.fr/idp/shibboleth": "18004312700091", - "https://idp2.brgm.fr/idp/shibboleth": "58205614900120", - "https://idp2.emse.fr/idp/shibboleth": "18009202500105", - "https://idp2.univ-paris8.fr/idp/shibboleth": "19931827000014", - "https://idp3.univ-lorraine.fr/idp/shibboleth": "13001550600012", - "https://idp3.ut-capitole.fr/idp/shibboleth": "13003061200019", - "https://idp4.unicaen.fr/idp/shibboleth": "19141408500016", - "https://idpv3.univ-amu.fr/idp/shibboleth": "13001533200013", - "https://janus.cnrs.fr/idp": "18008901303720", - "https://multipass.imt-nord-europe.fr/idp/shibboleth": "18009202500139", - "https://papangue.vetagro-sup.fr/idp/shibboleth": "13000858400018", - "https://prod-idp.inria.fr": "18008904700013", - "https://ruhnu.univ-tlse2.fr/idp/shibboleth": "19311383400017", - "https://shib.mines-albi.fr/idp/shibboleth": "18009202500097", - "https://shib.univ-lehavre.fr/idp/shibboleth": "19762762300097", - "https://identite.univ-reims.fr/idp/shibboleth": "19511296600799", - "https://shib2.unc.nc/idp/shibboleth": "13000322100012", - "https://shibboleth.ens2m.fr/idp/shibboleth": "19250082500026", - "https://shibboleth.grenoble-inp.fr/idp/shibboleth": "19381912500017", - "https://shibboleth.insa-rouen.fr/idp/shibboleth": "19760165100023", - "https://shibboleth.ube.fr/idp/shibboleth": "93823061200013", - "https://shibboleth.univ-corse.fr/idp/shibboleth": "19202664900264", - "https://shibboleth.univ-evry.fr/idp/shibboleth": "19911975100014", - "https://shibboleth.univ-grenoble-alpes.fr/idp/shibboleth": "13002608100013", - "https://shibboleth.univ-savoie.fr/idp/shibboleth": "19730858800015", - "https://shibboleth03.chartes.psl.eu/idp/shibboleth": "19753478700043", - "https://shibboleth3.utt.fr/idp/shibboleth": "19101060200032", - "https://srv-fii.insa-toulouse.fr/idp/shibboleth": "19310152400018", - "https://sso-ciation-saclay.centralesupelec.fr/idp/shibboleth": "13002076100016", - "https://sso.bordeaux-inp.fr/idp/shibboleth": "13000635600013", - "https://sso.ird.fr/idp/shibboleth": "18000602500159", - "https://upnidp2.parisnanterre.fr/idp/shibboleth": "19921204400010", - "https://vip.espci.fr/saml2/idp/metadata.php": "20000068500012", - "urn:mace:cru.fr:federation:uhb.fr": "19350937900015", - "urn:mace:cru.fr:federation:unilim.fr": "19870669900321", - "urn:mace:cru.fr:federation:univ-nantes.fr": "13002974700016", - "urn:mace:cru.fr:federation:univ-paris1.fr": "19751717000019", - "urn:mace:cru.fr:federation:univ-rennes1.fr": "13003051300019", - "urn:mace:cru.fr:federation:univ-rouen.fr": "19761904200017", - "urn:mace:cru.fr:federation:univ-ubs.fr": "19561718800600", - "https://idp.marseille.archi.fr/idp/shibboleth": "19130236300020", - "https://idp.inalco.fr/idp/shibboleth": "19753488600092", - "https://idp.sigma-clermont.fr/idp/shibboleth": "13002191800011", - "https://idp.univ-artois.fr/idp/shibboleth": "19624401600016", - "https://idp2.ensai.fr/idp/shibboleth": "13001422800055", - "urn:mace:cru.fr:federation:univ-lyon1.fr": "19691774400019", - "https://idp.enitab.fr/idp/shibboleth": "19330203100011", - "https://idp.oca.eu/idp/shibboleth": "19061563300012", - "https://idp.univ-paris13.fr/idp/shibboleth": "19931238000017", - "https://idp.ens-rennes.fr/idp/shibboleth": "13001848400019", - "https://idp.uphf.fr/idp/shibboleth": "13002574500014", - "https://idp.college-de-france.fr/idp/shibboleth": "19753480300014", - "https://shibboleth.csi.uvsq.fr/idp/shibboleth": "19781944400013", - "https://idp.esaip.org/idp/shibboleth": "37920438100014", - "https://idp.eskn.fr/idp/shibboleth": "13002617200010", - "https://auth.centrale-marseille.fr/idp/shibboleth": "19133340000015", - "https://idp-insa-cvl.renater.fr/idp/shibboleth": "13001833600011", - "https://shibboleth3.obspm.fr/idp/shibboleth": "19753496900013", - "https://idp-ecole-air.renater.fr/idp/shibboleth": "13002454000010", - "https://idp.enpc.fr/saml/metadata": "19753501600020", - "https://idp.paris-malaquais.archi.fr/idp/shibboleth": "18009221500011", - "https://idp.univ-pau.fr/idp/shibboleth": "19640251500270", - "https://idp4.cereq.fr/idp/shibboleth": "18004303600037", - "urn:mace:cru.fr:federation:univ-angers.fr": "19490970100303" - } + - name: SIRET_MAP + value: |- + { + "http://idp.univ-poitiers.fr": "19860856400375", + "https://apps.univ-lr.fr/idp/shibboleth": "19170032700015", + "https://auth.sso.vet-alfort.fr/saml/metadata": "19940608300014", + "https://auth.uttop.fr/saml/metadata": "19650048200019", + "https://authentification.inrae.fr/saml/metadata/idp": "18007003901803", + "https://federation.ens.psl.eu/idp/shibboleth": "19753459700012", + "https://federation.umontpellier.fr/idp/shibboleth": "13002979600013", + "https://federation.unimes.fr/idp/shibboleth": "93249157400012", + "https://federation.upf.pf/idp/shibboleth": "19987001500013", + "https://federation.utbm.fr/idp/shibboleth": "19900356700013", + "https://federation3.univ-brest.fr/idp/shibboleth": "94129831700012", + "https://idauthproxy.insa-lyon.fr/Saml2IDP/metadata": "19690192000013", + "https://ident-shib.ensc-rennes.fr/idp/shibboleth": "19350077400016", + "https://identification.univ-toulouse.fr": "13002132200016", + "https://identites.ec-lyon.fr/idp/shibboleth": "19690187000010", + "https://identites.ensea.fr/idp/shibboleth": "19951376300011", + "https://identities.univ-jfc.fr/idp/prod": "19811201300018", + "https://idp-genci.renater.fr/idp/shibboleth": "49468697500041", + "https://idp-ng.univ-st-etienne.fr/idp/shibboleth": "93850168100010", + "https://idp-septa.onisep.fr/idp/shibboleth": "18004302800653", + "https://idp-v4.univ-montp3.fr/idp/shibboleth": "93249089900014", + "https://idp.bnu.fr/idp/shibboleth": "18004406700015", + "https://idp.cirad.fr/idp/shibboleth": "33159627000016", + "https://idp.crous-reims.fr/idp/shibboleth": "18510200100327", + "https://idp.ec-nantes.fr/idp/shibboleth": "19440100600011", + "https://idp.ehesp.fr/idp/shibboleth": "13000362700010", + "https://idp.ens-lyon.fr/idp/shibboleth": "13000812100019", + "https://idp.ensam.eu/idp/shibboleth": "19753472000010", + "https://idp.ensfea.fr/idp/shibboleth": "19310143300012", + "https://idp.ensma.fr/idp/shibboleth": "19860073600021", + "https://idp.ent.dauphine.fr/idp/shibboleth": "19754692200018", + "https://idp.imt-atlantique.fr/idp/shibboleth": "18009202500121", + "https://idp.inha.fr/idp/shibboleth": "19754688000018", + "https://idp.inp-toulouse.fr/idp/shibboleth": "19311381800127", + "https://idp.insa-rennes.fr/idp/shibboleth": "19350097200016", + "https://idp.institut-agro.fr/idp": "13002622200013", + "https://idp.isae.fr/idp/shibboleth": "13000427800011", + "https://idp.lyon.archi.fr/idp/shibboleth": "19690184700018", + "https://idp.renater.fr/idp/shibboleth": "18008947600055", + "https://idp.rennes.archi.fr/idp/shibboleth": "19350089900029", + "https://idp.sciencespo-lyon.fr/idp/shibboleth": "19690173000024", + "https://idp.sciencespobordeaux.fr/idp/shibboleth": "19330192600039", + "https://idp.uca.fr/idp/shibboleth": "13002806100013", + "https://idp.uha.fr/idp/shibboleth": "19681166500013", + "https://idp.unistra.fr/idp/shibboleth": "13000545700010", + "https://idp.univ-avignon.fr/idp/shibboleth": "19840685200204", + "https://idp.univ-cotedazur.fr/idp/shibboleth": "13002566100013", + "https://idp.univ-eiffel.fr/idp/shibboleth": "13002612300013", + "https://idp.univ-lemans.fr/idp/shibboleth": "19720916600010", + "https://idp.univ-lille.fr/idp/shibboleth": "13002975400012", + "https://idp.univ-lyon2.fr/idp/shibboleth": "19691775100014", + "https://idp.univ-lyon3.fr/idp/shibboleth": "19692437700282", + "https://idp.univ-orleans.fr/idp/shibboleth": "19450855200016", + "https://idp.univ-perp.fr/idp/shibboleth": "19660437500010", + "https://idp.univ-tln.fr/idp/shibboleth": "19830766200017", + "https://idp.univ-tlse3.fr/idp/shibboleth": "93827139200012", + "https://idp.univ-tours.fr/idp/shibboleth": "19370800500478", + "https://idp.universite-paris-saclay.fr/idp": "13002602400054", + "https://idp1.agroparistech.fr/idp/shibboleth": "13000285000134", + "https://idp1.ens-paris-saclay.fr/idp/shibboleth": "19940607500036", + "https://idp1.univ-fcomte.fr/idp/shibboleth": "93810656400017", + "https://idp2.amue.fr/idp/shibboleth": "18004312700091", + "https://idp2.brgm.fr/idp/shibboleth": "58205614900120", + "https://idp2.emse.fr/idp/shibboleth": "18009202500105", + "https://idp2.univ-paris8.fr/idp/shibboleth": "19931827000014", + "https://idp3.univ-lorraine.fr/idp/shibboleth": "13001550600012", + "https://idp3.ut-capitole.fr/idp/shibboleth": "13003061200019", + "https://idp4.unicaen.fr/idp/shibboleth": "19141408500016", + "https://idpv3.univ-amu.fr/idp/shibboleth": "13001533200013", + "https://janus.cnrs.fr/idp": "18008901303720", + "https://multipass.imt-nord-europe.fr/idp/shibboleth": "18009202500139", + "https://papangue.vetagro-sup.fr/idp/shibboleth": "13000858400018", + "https://prod-idp.inria.fr": "18008904700013", + "https://ruhnu.univ-tlse2.fr/idp/shibboleth": "19311383400017", + "https://shib.mines-albi.fr/idp/shibboleth": "18009202500097", + "https://shib.univ-lehavre.fr/idp/shibboleth": "19762762300097", + "https://identite.univ-reims.fr/idp/shibboleth": "19511296600799", + "https://shib2.unc.nc/idp/shibboleth": "13000322100012", + "https://shibboleth.ens2m.fr/idp/shibboleth": "19250082500026", + "https://shibboleth.grenoble-inp.fr/idp/shibboleth": "19381912500017", + "https://shibboleth.insa-rouen.fr/idp/shibboleth": "19760165100023", + "https://shibboleth.ube.fr/idp/shibboleth": "93823061200013", + "https://shibboleth.univ-corse.fr/idp/shibboleth": "19202664900264", + "https://shibboleth.univ-evry.fr/idp/shibboleth": "19911975100014", + "https://shibboleth.univ-grenoble-alpes.fr/idp/shibboleth": "13002608100013", + "https://shibboleth.univ-savoie.fr/idp/shibboleth": "19730858800015", + "https://shibboleth03.chartes.psl.eu/idp/shibboleth": "19753478700043", + "https://shibboleth3.utt.fr/idp/shibboleth": "19101060200032", + "https://srv-fii.insa-toulouse.fr/idp/shibboleth": "19310152400018", + "https://sso-ciation-saclay.centralesupelec.fr/idp/shibboleth": "13002076100016", + "https://sso.bordeaux-inp.fr/idp/shibboleth": "13000635600013", + "https://sso.ird.fr/idp/shibboleth": "18000602500159", + "https://upnidp2.parisnanterre.fr/idp/shibboleth": "19921204400010", + "https://vip.espci.fr/saml2/idp/metadata.php": "20000068500012", + "urn:mace:cru.fr:federation:uhb.fr": "19350937900015", + "urn:mace:cru.fr:federation:unilim.fr": "19870669900321", + "urn:mace:cru.fr:federation:univ-nantes.fr": "13002974700016", + "urn:mace:cru.fr:federation:univ-paris1.fr": "19751717000019", + "urn:mace:cru.fr:federation:univ-rennes1.fr": "13003051300019", + "urn:mace:cru.fr:federation:univ-rouen.fr": "19761904200017", + "urn:mace:cru.fr:federation:univ-ubs.fr": "19561718800600", + "https://idp.marseille.archi.fr/idp/shibboleth": "19130236300020", + "https://idp.inalco.fr/idp/shibboleth": "19753488600092", + "https://idp.sigma-clermont.fr/idp/shibboleth": "13002191800011", + "https://idp.univ-artois.fr/idp/shibboleth": "19624401600016", + "https://idp2.ensai.fr/idp/shibboleth": "13001422800055", + "urn:mace:cru.fr:federation:univ-lyon1.fr": "19691774400019", + "https://idp.enitab.fr/idp/shibboleth": "19330203100011", + "https://idp.oca.eu/idp/shibboleth": "19061563300012", + "https://idp.univ-paris13.fr/idp/shibboleth": "19931238000017", + "https://idp.ens-rennes.fr/idp/shibboleth": "13001848400019", + "https://idp.uphf.fr/idp/shibboleth": "13002574500014", + "https://idp.college-de-france.fr/idp/shibboleth": "19753480300014", + "https://shibboleth.csi.uvsq.fr/idp/shibboleth": "19781944400013", + "https://idp.esaip.org/idp/shibboleth": "37920438100014", + "https://idp.eskn.fr/idp/shibboleth": "13002617200010", + "https://auth.centrale-marseille.fr/idp/shibboleth": "19133340000015", + "https://idp-insa-cvl.renater.fr/idp/shibboleth": "13001833600011", + "https://shibboleth3.obspm.fr/idp/shibboleth": "19753496900013", + "https://idp-ecole-air.renater.fr/idp/shibboleth": "13002454000010", + "https://idp.enpc.fr/saml/metadata": "19753501600020", + "https://idp.paris-malaquais.archi.fr/idp/shibboleth": "18009221500011", + "https://idp.univ-pau.fr/idp/shibboleth": "19640251500270", + "https://idp4.cereq.fr/idp/shibboleth": "18004303600037", + "urn:mace:cru.fr:federation:univ-angers.fr": "19490970100303" + } ingress: enabled: true diff --git a/src/helm/env.d/staging/values.oidc2fer.yaml.gotmpl b/src/helm/env.d/staging/values.oidc2fer.yaml.gotmpl index bc133e8..ba6737f 100644 --- a/src/helm/env.d/staging/values.oidc2fer.yaml.gotmpl +++ b/src/helm/env.d/staging/values.oidc2fer.yaml.gotmpl @@ -5,29 +5,43 @@ image: satosa: replicas: 2 - envVars: - BASE_URL: https://oidc2fer-staging.beta.numerique.gouv.fr - GUNICORN_CMD_ARGS: --workers=3 + env: + - name: BASE_URL + value: https://oidc2fer-staging.beta.numerique.gouv.fr + - name: GUNICORN_CMD_ARGS + value: --workers=3 - LOG_LEVEL: DEBUG - LOG_LEVELS: '{ "satosa.backends.saml2": "DEBUG" }' + - name: LOG_LEVEL + value: DEBUG + - name: LOG_LEVELS + value: '{ "satosa.backends.saml2": "DEBUG" }' - SAML2_DISCOVERY_URL: https://discovery.renater.fr/test/ - SAML2_METADATA_URL: https://pub.federation.renater.fr/metadata/test/idps.xml - SAML2_ENTITY_ID: https://oidc2fer-staging.beta.numerique.gouv.fr/Saml2/proxy_saml2_backend.xml-test + - name: SAML2_DISCOVERY_URL + value: https://discovery.renater.fr/test/ + - name: SAML2_METADATA_URL + value: https://pub.federation.renater.fr/metadata/test/idps.xml + - name: SAML2_ENTITY_ID + value: https://oidc2fer-staging.beta.numerique.gouv.fr/Saml2/proxy_saml2_backend.xml-test - STATE_ENCRYPTION_KEY: { secretKeyRef: { name: oidc2fer, key: STATE_ENCRYPTION_KEY } } - SAML2_BACKEND_CERT: { secretKeyRef: { name: oidc2fer, key: SAML2_BACKEND_CERT } } - SAML2_BACKEND_KEY: { secretKeyRef: { name: oidc2fer, key: SAML2_BACKEND_KEY } } - OIDC_FRONTEND_KEY: { secretKeyRef: { name: oidc2fer, key: OIDC_FRONTEND_KEY } } - CLIENT_DB_JSON: { secretKeyRef: { name: oidc2fer, key: CLIENT_DB_JSON } } + - name: STATE_ENCRYPTION_KEY + valueFrom: { secretKeyRef: { name: oidc2fer, key: STATE_ENCRYPTION_KEY } } + - name: SAML2_BACKEND_CERT + valueFrom: { secretKeyRef: { name: oidc2fer, key: SAML2_BACKEND_CERT } } + - name: SAML2_BACKEND_KEY + valueFrom: { secretKeyRef: { name: oidc2fer, key: SAML2_BACKEND_KEY } } + - name: OIDC_FRONTEND_KEY + valueFrom: { secretKeyRef: { name: oidc2fer, key: OIDC_FRONTEND_KEY } } + - name: CLIENT_DB_JSON + valueFrom: { secretKeyRef: { name: oidc2fer, key: CLIENT_DB_JSON } } - OIDC_DB_URI: { secretKeyRef: { name: redis.redis.libre.sh, key: url } } + - name: OIDC_DB_URI + value: "stateless://:$(STATE_ENCRYPTION_KEY)@localhost" - SIRET_MAP: |- - { - "https://test-idp.federation.renater.fr/idp/shibboleth": "12345678200010" - } + - name: SIRET_MAP + value: |- + { + "https://test-idp.federation.renater.fr/idp/shibboleth": "12345678200010" + } ingress: enabled: true diff --git a/src/helm/extra/Chart.yaml b/src/helm/extra/Chart.yaml deleted file mode 100644 index 438e511..0000000 --- a/src/helm/extra/Chart.yaml +++ /dev/null @@ -1,5 +0,0 @@ -apiVersion: v2 -name: extra -description: A Helm chart to add some manifests to oidc2fer -type: application -version: 0.1.0 diff --git a/src/helm/extra/templates/redis.yaml b/src/helm/extra/templates/redis.yaml deleted file mode 100644 index 00898ae..0000000 --- a/src/helm/extra/templates/redis.yaml +++ /dev/null @@ -1,7 +0,0 @@ -apiVersion: core.libre.sh/v1alpha1 -kind: Redis -metadata: - name: redis - namespace: {{ .Release.Namespace | quote }} -spec: - disableAuth: false diff --git a/src/helm/helmfile.yaml.gotmpl b/src/helm/helmfile.yaml.gotmpl index d58bc3f..402293e 100644 --- a/src/helm/helmfile.yaml.gotmpl +++ b/src/helm/helmfile.yaml.gotmpl @@ -21,25 +21,6 @@ repositories: oci: true releases: - - name: redis - installed: {{ eq .Environment.Name "dev" | toYaml }} - namespace: {{ .Namespace }} - chart: bitnami/redis - version: 18.19.2 - values: - - auth: - password: pass - architecture: standalone - image: - repository: bitnamilegacy/redis - - - name: extra - installed: {{ ne .Environment.Name "dev" | toYaml }} - namespace: {{ .Namespace }} - chart: ./extra - secrets: - - env.d/{{ .Environment.Name }}/secrets.enc.yaml - - name: oidc2fer version: {{ .Values.version }} namespace: {{ .Namespace }} diff --git a/src/helm/oidc2fer/templates/_helpers.tpl b/src/helm/oidc2fer/templates/_helpers.tpl index 4228dd7..c4f91b2 100644 --- a/src/helm/oidc2fer/templates/_helpers.tpl +++ b/src/helm/oidc2fer/templates/_helpers.tpl @@ -50,46 +50,6 @@ app.kubernetes.io/name: {{ include "oidc2fer.name" . }} app.kubernetes.io/instance: {{ .Release.Name }} {{- end }} -{{/* -transform dictionnary of environment variables -Usage : {{ include "oidc2fer.env.transformDict" .Values.envVars }} - -Example: -envVars: - # Using simple strings as env vars - ENV_VAR_NAME: "envVar value" - # Using a value from a configMap - ENV_VAR_FROM_CM: - configMapKeyRef: - name: cm-name - key: "key_in_cm" - # Using a value from a secret - ENV_VAR_FROM_SECRET: - secretKeyRef: - name: secret-name - key: "key_in_secret" -*/}} -{{- define "oidc2fer.env.transformDict" -}} -{{- range $key, $value := . }} -- name: {{ $key | quote }} -{{- if $value | kindIs "map" }} - valueFrom: {{ $value | toYaml | nindent 4 }} -{{- else }} - value: {{ $value | quote }} -{{- end }} -{{- end }} -{{- end }} - - -{{/* -oidc2fer env vars -*/}} -{{- define "oidc2fer.common.env" -}} -{{- $topLevelScope := index . 0 -}} -{{- $workerScope := index . 1 -}} -{{- include "oidc2fer.env.transformDict" $workerScope.envVars -}} -{{- end }} - {{/* Common labels diff --git a/src/helm/oidc2fer/templates/satosa_deployment.yaml b/src/helm/oidc2fer/templates/satosa_deployment.yaml index cd99eec..0f4b20e 100644 --- a/src/helm/oidc2fer/templates/satosa_deployment.yaml +++ b/src/helm/oidc2fer/templates/satosa_deployment.yaml @@ -1,4 +1,3 @@ -{{- $envVars := include "oidc2fer.common.env" (list . .Values.satosa) -}} {{- $fullName := include "oidc2fer.satosa.fullname" . -}} {{- $component := "satosa" -}} apiVersion: apps/v1 @@ -42,10 +41,9 @@ spec: args: {{- toYaml . | nindent 12 }} {{- end }} - env: - {{- if $envVars}} - {{- $envVars | indent 12 }} - {{- end }} + {{- with .Values.satosa.env }} + env: {{ toJson . }} + {{- end }} {{- with .Values.satosa.securityContext }} securityContext: {{- toYaml . | nindent 12 }} diff --git a/src/helm/oidc2fer/templates/satosa_svc.yaml b/src/helm/oidc2fer/templates/satosa_svc.yaml index 900aa8a..72739c2 100644 --- a/src/helm/oidc2fer/templates/satosa_svc.yaml +++ b/src/helm/oidc2fer/templates/satosa_svc.yaml @@ -1,4 +1,3 @@ -{{- $envVars := include "oidc2fer.common.env" (list . .Values.satosa) -}} {{- $fullName := include "oidc2fer.satosa.fullname" . -}} {{- $component := "satosa" -}} apiVersion: v1 diff --git a/src/helm/oidc2fer/values.yaml b/src/helm/oidc2fer/values.yaml index 27e1fa9..0c9e8ad 100644 --- a/src/helm/oidc2fer/values.yaml +++ b/src/helm/oidc2fer/values.yaml @@ -21,10 +21,6 @@ image: nameOverride: "" fullnameOverride: "" -## @skip commonEnvVars -commonEnvVars: &commonEnvVars - <<: [] - ## @param ingress.enabled whether to enable the Ingress or not ## @param ingress.className IngressClass to use for the Ingress ## @param ingress.host Host for the Ingress @@ -79,15 +75,8 @@ satosa: ## @param satosa.securityContext Configure satosa Pod security context securityContext: null - ## @param satosa.envVars Configure satosa container environment variables - ## @extra satosa.envVars.BY_VALUE Example environment variable by setting value directly - ## @extra satosa.envVars.FROM_CONFIGMAP.configMapKeyRef.name Name of a ConfigMap when configuring env vars from a ConfigMap - ## @extra satosa.envVars.FROM_CONFIGMAP.configMapKeyRef.key Key within a ConfigMap when configuring env vars from a ConfigMap - ## @extra satosa.envVars.FROM_SECRET.secretKeyRef.name Name of a Secret when configuring env vars from a Secret - ## @extra satosa.envVars.FROM_SECRET.secretKeyRef.key Key within a Secret when configuring env vars from a Secret - ## @skip satosa.envVars - envVars: - <<: *commonEnvVars + ## @param satosa.env Configure satosa container environment variables + env: [] ## @param satosa.podAnnotations Annotations to add to the satosa Pod podAnnotations: {} diff --git a/src/satosa/pyproject.toml b/src/satosa/pyproject.toml index df37567..4353859 100644 --- a/src/satosa/pyproject.toml +++ b/src/satosa/pyproject.toml @@ -26,7 +26,6 @@ requires-python = ">=3.14" dependencies = [ "SATOSA==8.5.1", "gunicorn==25.1.0", - "redis==7.2.1", "JSON-log-formatter==1.1.1", "WhiteNoise==6.12.0", ]