8f9a9ed1f0
temporary enable debug logs in production
2025-03-05 17:32:56 +01:00
a6e01c071e
Merge pull request #21 from numerique-gouv/add-pdbs
...
🔧 (helm) add pdbs to deployements
2025-02-10 17:24:10 +01:00
5a0f2da202
🔧 (helm) add pdbs to deployements
...
In order to avoid a service interruption during a Kubernetes
(k8s)upgrade, we add a Pod Disruption Budget (PDB) to deployments.
2025-02-10 17:19:08 +01:00
3b2d50d657
Merge pull request #20 from numerique-gouv/fix-issuer
...
fix letsencrypt issuer for new preprod
2025-02-07 11:53:59 +01:00
52d7de305c
🔧 (helm) change letsencrypt issuer
...
The name of the cluster issuer on the new preprod is 'letsencrypt,' so I
adjusted it.
2025-02-07 10:49:36 +01:00
64a0d4dd3d
Merge pull request #19 from numerique-gouv/improve-helm
2024-10-02 10:46:04 +02:00
ffbd161e29
✨ (ci) add helmfile linter
...
Add a github job to run helmfile linter on PR
2024-09-24 17:11:13 +02:00
ba1c14291d
Merge pull request #17 from numerique-gouv/add-architecture-doc
...
📝 (architecture) add first architecture doc
2024-09-21 12:21:01 +02:00
4c4ccc88ba
📝 (architecture) add first architecture doc
...
This gives an overview and the detail of the workings of OIDC2FER.
2024-09-18 19:31:33 +02:00
c1b33453c3
Deploy release v1.0.4 to production.
2024-09-11 12:43:17 +02:00
6cede0a7f2
v1.0.4 release
2024-09-11 11:00:09 +02:00
3b518b9b3a
Merge pull request #15 from numerique-gouv/serve-static-assets
...
✨ (static) add static frontend to serve assets
2024-09-11 10:49:04 +02:00
039d9a12cc
✨ (static) add static file serving
...
We needed a way to serve a handful of static assets, starting with
the ProConnect logo to be embedded in IdP pages.
2024-09-11 10:44:11 +02:00
6424679b85
Set discovery URL to dedicated WAYF
2024-09-05 19:11:57 +02:00
30c91e2345
Add missing slash to discovery URL
...
This saves one redirect when accessing the discovery service.
2024-09-04 20:05:06 +02:00
ad726a92ce
Add missing info about "production" tag to deployment instructions
2024-09-02 17:42:42 +02:00
7cc8fc18a2
Deploy release v1.0.3 to production.
2024-09-02 17:18:00 +02:00
17289b1040
v1.0.3 release
2024-09-02 17:09:56 +02:00
0580ec6d7e
Merge pull request #14 from numerique-gouv/fix-saml-signature
...
Upgrade SAML signature algorithm for interoperability with RENATER Access Check
2024-09-02 16:26:07 +02:00
4b5bd5757c
🔒 ️(saml) set SAML signing algorithm to use SHA256
...
It turns out the RENATER AccessCheck IdP rejects AuthnRequests signed
with the default SHA1-based SignatureMethod.
2024-08-29 20:34:36 +02:00
61680de401
Deploy 1.0.2 to outscale-production
2024-07-22 20:55:08 +02:00
0fc4450766
v1.0.2 release
2024-07-22 20:52:50 +02:00
db99364ae6
Merge pull request #13 from numerique-gouv/check-eppn-scope
...
🔒 ️(saml) check the scope of the eduPersonPrincipalName attribute
2024-07-22 20:49:25 +02:00
25c401c653
🔒 ️(saml) check the scope of the eduPersonPrincipalName attribute
...
The metadata obtained from the federation server contains a list of
allowed scopes for each of the registered identity providers.
By checking the value of the eduPersonPrincipalName attribute
returned by an IdP against the allowed scopes for that IdP,
we protect the downstream services against identity theft by
a compromised IdP.
2024-07-22 20:35:06 +02:00
311d490566
Merge pull request #10 from numerique-gouv/check-affiliation
...
Only allow employees to authenticate
2024-07-22 19:45:25 +02:00
ba69d2d4bd
📝 (changelog) update CHANGELOG
...
Document new affiliation check.
2024-07-22 19:00:45 +02:00
82fc42d093
🔒 ️(saml) only allow employees to authenticate
...
We check the eduPersonAffiliation attribute for a "employee" value to
reject students.
2024-07-22 17:32:20 +02:00
10fc48b9ad
✅ (e2e) make renater test idp interaction deterministic
...
By default the consent form is only shown if the requested claims have
changed since the last login for that user, and this appears to be
stored server-side, which caused the test to break when I added
eduPersonAffiliation to the requested claims.
We now always request the consent form on login so that the interaction
is deterministic.
2024-07-22 16:02:10 +02:00
b8fe38853f
🚀 (staging) complete switch to test federation
...
Switches the staging instance to the test federation.
2024-06-19 14:37:08 +02:00
e03dddde67
🚀 (staging) use test entity ID
...
Switches the staging instance to the test federation.
2024-06-19 14:33:34 +02:00
15064a0b45
🚀 (config) get SAML entity ID from environment
...
This lets us decouple the entity ID from the deployment URL.
2024-06-19 14:29:50 +02:00
a2d275366c
💚 (ci) remove secret from repository ( #12 )
...
- Remove *.enc.*
- Add symlinks
- Adapt CI
2024-06-07 17:20:03 +02:00
5c18904e39
🚀 (staging) use qualification federation
...
The RENATER Qualification federation is more similar to the production
federation than the test federation.
2024-06-04 17:05:50 +02:00
4aae1dbec2
v1.0.1 release
2024-06-04 16:36:22 +02:00
4d19d6ec1b
🚀 (logging) enable JSON logs and LOG_LEVEL env var ( #11 )
...
All logs (Gunicorn + SATOSA) are now logged as JSON and the level can be
controlled with the LOG_LEVEL environment variable.
2024-06-04 16:28:15 +02:00
7ecc4c404a
🚀 (prod) fix letsencrypt issuer for production
...
Certificate generation fails if we use the wrong issuer.
2024-05-30 16:09:17 +02:00
a940151661
🚀 (prod) set production URL to renater.agentconnect.gouv.fr
...
This is the domain we agreed upon with the AgentConnect team.
2024-05-30 12:01:02 +02:00
aa9af2a401
🚀 (prod) set production URL to renater.agentconnect.gouv.fr
...
This is the domain we agreed upon with the AgentConnect team.
2024-05-29 17:13:20 +02:00
132e7a442d
Merge pull request #9 from numerique-gouv/production-setup
...
🚀 (prod) add production config to chart
2024-05-16 18:21:38 +02:00
08d5a5ef4d
🚀 (prod) add production config to chart
...
This will be picked up by ArgoCD to deploy on the Outscale production
cluster.
2024-05-16 17:43:59 +02:00
80b5de3afe
Revert " 🚀 (staging) use PR docker image in staging"
...
This reverts commit 788c55cf4a
2024-05-16 12:00:27 +02:00
65f1c750b5
Merge pull request #8 from numerique-gouv/agent-connect
...
Fix AgentConnect integration
2024-05-16 11:56:29 +02:00
96e244fd6c
🔒 ️(saml) use eduPersonPrincipalName rather than NameID for sub
...
The NameID returned by the SAML server is actually transient so we can't
use it as a sub. We'll use eduPersonPrincipalName both in sub and uid.
2024-05-15 22:30:56 +02:00
7239b366e8
🚀 (helm) move secrets to k8s secrets
...
This avoids secrets being visible in manifests.
2024-05-02 19:42:55 +02:00
8fdf8e5f89
🚀 (helm) add resource requests/limit and liveness probe
...
All defined in the default values file, can be overriden per environment
if needed.
2024-05-02 19:24:58 +02:00
aa68ce574e
🧑💻 (tilt) watch helm chart for changes in dev
...
This makes Tilt rebuild when the chart is edited.
2024-05-02 19:24:58 +02:00
4478152156
🚀 (env) make FER URLs configurable per environment
...
Of course in production we will want the production federation.
2024-04-29 23:09:02 +02:00
78a1b549fc
🚀 (redis) add Redis instance to dev and staging
...
Necessary to support more that one SATOSA worker.
2024-04-29 22:28:18 +02:00
b50126675a
🔒 ️(oidc) return JWT from userinfo endpoint
...
AgentConnect apparently requires the userinfo endpoint to return a
signed JWT.
2024-04-29 16:35:33 +02:00
94cdbc9497
👔 (oidc) generate required claims in user_info
...
Because SATOSA defaults to list-valued attributes, I had to add
a custom attribute processor to return strings in the userinfo
response.
2024-04-25 15:00:36 +02:00
Jonathan Perret