docs: add DEPLOYMENT.md for saillant.cc instance

- SAML entity in Renater test federation - Metadata URL, OIDC clients (moodle-lms, frappe-lms) - SATOSA 8.5.1 container config Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
🔐(secrets) update secrets to current main
2026-03-27 13:37:55 +01:00 · 2026-03-26 15:26:17 +01:00 · 2026-03-26 15:10:43 +01:00 · 2026-03-26 14:54:48 +01:00 · 2026-03-26 14:53:06 +01:00 · 2026-03-26 14:34:58 +01:00
31 changed files with 409 additions and 2038 deletions
@@ -123,6 +123,14 @@ jobs:
        with:
          submodules: recursive
          token: ${{ steps.app-token.outputs.token }}
+      -
+        name: Install mkcert
+        run: |
+          apt-get update -y -q && apt-get install -y -q libnss3-tools
+          curl -Ss -L -o mkcert https://github.com/FiloSottile/mkcert/releases/download/v1.4.4/mkcert-v1.4.4-linux-amd64
+          chmod +x mkcert
+          mv mkcert /usr/local/bin/
+          TRUST_STORES=none mkcert -install
      -
        name: Helmfile lint
        env:
@@ -6,6 +6,9 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0),
 and this project adheres to
 [Semantic Versioning](https://semver.org/spec/v2.0.0.html).

+## [1.0.13] - 2026-03-26 
+- switch to stateless OIDC and remove Redis
+
 ## [1.0.12] - 2026-03-02
 - upgrade dependencies: Python 3.14.3, gunicorn 25.1.0…

@@ -0,0 +1,32 @@
+# oidc2fer -- Deploiement saillant.cc
+
+Fork de [proconnect-gouv/oidc2fer](https://github.com/proconnect-gouv/oidc2fer) maintenu sur [electron-rare/oidc2fer](https://github.com/electron-rare/oidc2fer).
+
+## Federation SAML Renater
+
+- Entite SAML enregistree dans la **federation de test Renater**
+- Metadata URL : https://pub.federation.renater.fr/metadata/test/idps.xml
+
+## Clients OIDC configures
+
+| Client | Usage |
+|--------|-------|
+| moodle-lms | Plateforme LMS Moodle |
+| frappe-lms | Plateforme LMS Frappe |
+
+## Container
+
+- **Nom** : oidc2fer
+- **Image** : oidc2fer-app (build local depuis le Dockerfile)
+
+## Stack technique
+
+- **SATOSA 8.5.1** -- proxy SAML-to-OIDC
+- Bridge entre les IdP SAML de la federation Renater et les clients OIDC locaux
+
+## Demarrage
+
+```bash
+cd /home/clems/oidc2fer
+docker compose -f docker-compose.prod.yml up -d
+```
@@ -13,6 +13,11 @@ docker_build(
    ]
 )

+docker_build(
+    'localhost:5001/oidc-test-client:latest',
+    context='docker/oidc-test-client'
+)
+
 watch_file('src/helm')

 k8s_yaml(local('cd src/helm && helmfile -n oidc2fer -e dev template .'))
@@ -1,125 +0,0 @@
-https://idp1.agroparistech.fr/idp/shibboleth
-https://idpv3.univ-amu.fr/idp/shibboleth
-https://idp2.amue.fr/idp/shibboleth
-https://idp.univ-avignon.fr/idp/shibboleth
-https://idp.bnu.fr/idp/shibboleth
-https://sso.bordeaux-inp.fr/idp/shibboleth
-https://idp.enitab.fr/idp/shibboleth
-https://idp2.brgm.fr/idp/shibboleth
-https://auth.centrale-marseille.fr/idp/shibboleth
-https://idp.ec-nantes.fr/idp/shibboleth
-https://sso-ciation-saclay.centralesupelec.fr/idp/shibboleth
-https://idp4.cereq.fr/idp/shibboleth
-https://idp.cirad.fr/idp/shibboleth
-https://janus.cnrs.fr/idp
-https://identification.univ-toulouse.fr
-https://idp.crous-reims.fr/idp/shibboleth
-https://identites.ec-lyon.fr/idp/shibboleth
-https://idp-ecole-air.renater.fr/idp/shibboleth
-https://shibboleth03.chartes.psl.eu/idp/shibboleth
-https://idp.enpc.fr/saml/metadata
-https://idp.marseille.archi.fr/idp/shibboleth
-https://idp.paris-malaquais.archi.fr/idp/shibboleth
-https://idp.ensam.eu/idp/shibboleth
-https://ident-shib.ensc-rennes.fr/idp/shibboleth
-https://auth.sso.vet-alfort.fr/saml/metadata
-https://federation.ens.psl.eu/idp/shibboleth
-https://idp1.ens-paris-saclay.fr/idp/shibboleth
-https://idp.ehesp.fr/idp/shibboleth
-https://idp.ens-lyon.fr/idp/shibboleth
-https://idp.ens-rennes.fr/idp/shibboleth
-https://idp.rennes.archi.fr/idp/shibboleth
-https://idp2.ensai.fr/idp/shibboleth
-https://idp.lyon.archi.fr/idp/shibboleth
-https://identites.ensea.fr/idp/shibboleth
-https://idp.ensfea.fr/idp/shibboleth
-https://idp.ensma.fr/idp/shibboleth
-https://idp.esaip.org/idp/shibboleth
-https://vip.espci.fr/saml2/idp/metadata.php
-https://idp-genci.renater.fr/idp/shibboleth
-https://idp.renater.fr/idp/shibboleth
-https://shibboleth.grenoble-inp.fr/idp/shibboleth
-https://idp.college-de-france.fr/idp/shibboleth
-https://idp.imt-atlantique.fr/idp/shibboleth
-https://shib.mines-albi.fr/idp/shibboleth
-https://multipass.imt-nord-europe.fr/idp/shibboleth
-https://idp.inalco.fr/idp/shibboleth
-https://idp.inha.fr/idp/shibboleth
-https://authentification.inrae.fr/saml/metadata/idp
-https://prod-idp.inria.fr
-https://idp-insa-cvl.renater.fr/idp/shibboleth
-https://idauthproxy.insa-lyon.fr/Saml2IDP/metadata
-https://idp.insa-rennes.fr/idp/shibboleth
-https://shibboleth.insa-rouen.fr/idp/shibboleth
-https://srv-fii.insa-toulouse.fr/idp/shibboleth
-https://identities.univ-jfc.fr/idp/prod
-https://sso.ird.fr/idp/shibboleth
-https://idp.isae.fr/idp/shibboleth
-https://idp.institut-agro.fr/idp
-https://apps.univ-lr.fr/idp/shibboleth
-https://idp.univ-lemans.fr/idp/shibboleth
-https://idp2.emse.fr/idp/shibboleth
-urn:mace:cru.fr:federation:univ-nantes.fr
-https://federation.unimes.fr/idp/shibboleth
-https://idp-septa.onisep.fr/idp/shibboleth
-https://idp.oca.eu/idp/shibboleth
-https://shibboleth3.obspm.fr/idp/shibboleth
-https://access-check.renater.fr/simplesaml/saml2/idp/metadata.php
-https://idp.sciencespobordeaux.fr/idp/shibboleth
-https://idp.sciencespo-lyon.fr/idp/shibboleth
-https://idp.sigma-clermont.fr/idp/shibboleth
-https://shibboleth.ens2m.fr/idp/shibboleth
-https://idp.inp-toulouse.fr/idp/shibboleth
-https://shibboleth.ube.fr/idp/shibboleth
-urn:mace:cru.fr:federation:univ-ubs.fr
-urn:mace:cru.fr:federation:univ-lyon1.fr
-https://idp.uca.fr/idp/shibboleth
-https://idp.univ-cotedazur.fr/idp/shibboleth
-urn:mace:cru.fr:federation:univ-angers.fr
-https://idp.univ-artois.fr/idp/shibboleth
-https://shibboleth.univ-evry.fr/idp/shibboleth
-https://idp.univ-orleans.fr/idp/shibboleth
-https://federation3.univ-brest.fr/idp/shibboleth
-https://idp4.unicaen.fr/idp/shibboleth
-https://shibboleth.univ-corse.fr/idp/shibboleth
-https://idp.uha.fr/idp/shibboleth
-https://shib2.unc.nc/idp/shibboleth
-https://idp.univ-lille.fr/idp/shibboleth
-urn:mace:cru.fr:federation:unilim.fr
-https://idp3.univ-lorraine.fr/idp/shibboleth
-https://idp.univ-lyon2.fr/idp/shibboleth
-https://idp.univ-lyon3.fr/idp/shibboleth
-https://federation.umontpellier.fr/idp/shibboleth
-https://idp.univ-pau.fr/idp/shibboleth
-https://idp.univ-perp.fr/idp/shibboleth
-http://idp.univ-poitiers.fr
-https://federation.upf.pf/idp/shibboleth
-https://identite.univ-reims.fr/idp/shibboleth
-urn:mace:cru.fr:federation:univ-rennes1.fr
-urn:mace:cru.fr:federation:univ-rouen.fr
-https://idp-ng.univ-st-etienne.fr/idp/shibboleth
-https://idp.unistra.fr/idp/shibboleth
-https://federation.utbm.fr/idp/shibboleth
-https://shibboleth3.utt.fr/idp/shibboleth
-https://idp.univ-tln.fr/idp/shibboleth
-https://idp.univ-tlse3.fr/idp/shibboleth
-https://idp.univ-tours.fr/idp/shibboleth
-https://shibboleth.csi.uvsq.fr/idp/shibboleth
-https://shibboleth.univ-grenoble-alpes.fr/idp/shibboleth
-https://idp.univ-eiffel.fr/idp/shibboleth
-https://shib.univ-lehavre.fr/idp/shibboleth
-https://idp1.univ-fcomte.fr/idp/shibboleth
-urn:mace:cru.fr:federation:univ-paris1.fr
-https://idp2.univ-paris8.fr/idp/shibboleth
-https://idp.ent.dauphine.fr/idp/shibboleth
-https://upnidp2.parisnanterre.fr/idp/shibboleth
-https://idp.universite-paris-saclay.fr/idp
-https://idp-v4.univ-montp3.fr/idp/shibboleth
-https://idp.uphf.fr/idp/shibboleth
-urn:mace:cru.fr:federation:uhb.fr
-https://shibboleth.univ-savoie.fr/idp/shibboleth
-https://idp.univ-paris13.fr/idp/shibboleth
-https://idp3.ut-capitole.fr/idp/shibboleth
-https://ruhnu.univ-tlse2.fr/idp/shibboleth
-https://auth.uttop.fr/saml/metadata
-https://papangue.vetagro-sup.fr/idp/shibboleth
@@ -1,367 +0,0 @@
-3sr-grenoble.fr
-admin.in2p3.fr
-agro-bordeaux.fr
-agroparistech.fr
-agrotoulouse.fr
-alsace.cnrs.fr
-amue.fr
-apc.in2p3.fr
-artsetmetiers.fr
-artsetmetiers.ma
-atilf.fr
-biocampus.cnrs.fr
-bis-sorbonne.fr
-bnu.fr
-bordeaux-inp.fr
-brgm.fr
-caes.cnrs.fr
-caesug.cnrs.fr
-cbs.cnrs.fr
-cc.in2p3.fr
-ccsd.cnrs.fr
-cebc.cnrs.fr
-cefas.cnrs.fr
-cefe.cnrs.fr
-cefrepa.cnrs.fr
-ceipi.edu
-cemes.fr
-cemipai.cnrs.fr
-cenbg.in2p3.fr
-centrale-med.fr
-centralesupelec.fr
-centre-cired.fr
-cepam.cnrs.fr
-cercec.cnrs.fr
-cerege.fr
-cereq.fr
-cermav.cnrs.fr
-cfee.cnrs.fr
-chartes.psl.eu
-cirad.fr
-cirfc.fr
-cirm-math.fr
-clermont-auvergne-inp.fr
-clermont.in2p3.fr
-cnrs-bellevue.fr
-cnrs-dir.fr
-cnrs-imn.fr
-cnrs-mrs.fr
-cnrs-orleans.fr
-cnrs.cnrs.fr
-cnrs.fr
-college-de-france.fr
-cppm.in2p3.fr
-crbm.cnrs.fr
-crhea.cnrs.fr
-crous-reims.fr
-crpp.cnrs.fr
-csnsm.in2p3.fr
-cso.cnrs.fr
-dauphine.eu
-dauphine.fr
-dauphine.psl.eu
-doctorant.upf.pf
-dr1.cnrs.fr
-dr11.cnrs.fr
-dr12.cnrs.fr
-dr13.cnrs.fr
-dr14.cnrs.fr
-dr15.cnrs.fr
-dr17.cnrs.fr
-dr18.cnrs.fr
-dr2.cnrs.fr
-dr4.cnrs.fr
-dr5.cnrs.fr
-dr6.cnrs.fr
-dr7.cnrs.fr
-dr8.cnrs.fr
-dsi.cnrs.fr
-dt.insu.cnrs.fr
-ec-lyon.fr
-ec-nantes.fr
-eccorev.fr
-ecole-air.fr
-ecotron.cnrs.fr
-edu.ehesp.fr
-edu.univ-paris13.fr
-edu.univ-spn.fr
-ehesp.fr
-em-strasbourg.fr
-emse.fr
-enit.fr
-enitab.fr
-enpc.fr
-ens-lyon.fr
-ens-paris-saclay.fr
-ens-rennes.fr
-ens.psl.eu
-ens.univ-artois.fr
-ensai.fr
-ensam.eu
-ensc-rennes.fr
-ensea.fr
-enseeiht.fr
-ensfea.fr
-ensiacet.fr
-ensma.fr
-epicur.education
-esaip.org
-eskemm-numerique.fr
-espci.fr
-espci.psl.eu
-etu.emse.fr
-etu.umontpellier.fr
-etu.umpv.fr
-etu.unicaen.fr
-etu.univ-lorraine.fr
-etu.univ-montp3.fr
-etu.univ-orleans.fr
-etu.univ-rouen.fr
-etu.univ-st-etienne.fr
-etud.univ-angers.fr
-etud.univ-jfc.fr
-etud.univ-pau.fr
-etud.univ-tln.fr
-etud.univ-ubs.fr
-etudiant.univ-lr.fr
-etudiant.univ-perp.fr
-etudiant.univ-reims.fr
-ext.esaip.org
-ext.isae-supaero.fr
-ext.univ-jfc.fr
-fmnt.fr
-fondation-lehn.fr
-fpp.cnrs.fr
-france-bioinformatique.fr
-fsab.cnrs.fr
-ganil.fr
-gate.cnrs.fr
-genci.fr
-genopole.cnrs.fr
-genopolys.fr
-geoazur.unice.fr
-gredeg.cnrs.fr
-grenoble-inp.fr
-grenoble-inp.org
-grenoble.cnrs.fr
-gsrl.cnrs.fr
-huma-num.fr
-iap.fr
-ibcp.fr
-ibgc.cnrs.fr
-ibl.cnrs.fr
-ibs.fr
-icfrc.fr
-icgm.fr
-icmcb-bordeaux.cnrs.fr
-icmcb.cnrs.fr
-icmpe.cnrs.fr
-icsn.cnrs-gif.fr
-idemec.cnrs.fr
-idris.fr
-iemn.fr
-ifpindia.org
-ifporient.org
-igf.cnrs.fr
-igh.cnrs.fr
-igmm.cnrs.fr
-igs.cnrs-mrs.fr
-ijclab.in2p3.fr
-ijm.fr
-iker.cnrs.fr
-imbe.fr
-imev-mer.fr
-imft.fr
-imm.cnrs.fr
-imnc.in2p3.fr
-imt-atlantique.fr
-imt-nord-europe.fr
-in2p3.fr
-inalco.fr
-inha.fr
-inist.fr
-inp-toulouse.fr
-inphyni.cnrs.fr
-inrae.fr
-inria.fr
-insa-cvl.fr
-insa-lyon.fr
-insa-rennes.fr
-insa-rouen.fr
-insa-toulouse.fr
-inv.univ-rouen.fr
-ip2i.in2p3.fr
-ipbs.fr
-iphc.cnrs.fr
-ipht.fr
-ipmc.cnrs.fr
-ipnl.in2p3.fr
-ipno.in2p3.fr
-ipsl.fr
-ipst-cnam.fr
-ipst.fr
-ird.fr
-irht.cnrs.fr
-irim.cnrs.fr
-irisa.fr
-isa-lyon.fr
-isae-supaero.fr
-isae.fr
-isc.cnrs.fr
-ish-lyon.cnrs.fr
-isv.cnrs-gif.fr
-iutbayonne.univ-pau.fr
-l2it.in2p3.fr
-laas.fr
-laet.ish-lyon.cnrs.fr
-laet.msh-lse.fr
-lal.in2p3.fr
-lam.fr
-lapp.in2p3.fr
-lapth.cnrs.fr
-latmos.ipsl.fr
-lcc-toulouse.fr
-lcts.cnrs.fr
-legi.cnrs.fr
-legs.cnrs.fr
-let.ish-lyon.cnrs.fr
-lgp.cnrs.fr
-lip6.fr
-liris.cnrs.fr
-lis-lab.fr
-lisa.ipsl.fr
-listes.imev-mer.fr
-llr.in2p3.fr
-lma.cnrs-mrs.fr
-lma.in2p3.fr
-lmd.ipsl.fr
-lmf.cnrs.fr
-lncmi.cnrs.fr
-locean.ipsl.fr
-loria.fr
-lp2ib.in2p3.fr
-lpccaen.in2p3.fr
-lpmmc.cnrs.fr
-lpnhe.in2p3.fr
-lpsc.in2p3.fr
-lsce.ipsl.fr
-lspm.cnrs.fr
-lupm.in2p3.fr
-lyon.archi.fr
-map.cnrs.fr
-marseille.archi.fr
-math.cnrs.fr
-mgx.cnrs.fr
-mines-albi.fr
-mines-stetienne.fr
-mio.osupytheas.fr
-misha.cnrs.fr
-misha.fr
-mom.fr
-mri.cnrs.fr
-msh-lse.fr
-neel.cnrs.fr
-obs-besancon.fr
-obspm.fr
-oca.eu
-omega.in2p3.fr
-onisep.fr
-osupytheas.fr
-pantheonsorbonne.fr
-parisgeo.cnrs.fr
-parisnanterre.fr
-placamat.cnrs.fr
-prestataire.renater.fr
-primato.cnrs.fr
-prism.cnrs.fr
-promes.cnrs.fr
-renater.fr
-rennes.archi.fr
-risc.cnrs.fr
-sb-roscoff.fr
-sciencespo-aix.fr
-sciencespo-lyon.fr
-sciencespobordeaux.fr
-scpobx.fr
-seatech.fr
-sete.cnrs.fr
-sigma-clermont.fr
-student.isae-supaero.fr
-subatech.in2p3.fr
-supagro.fr
-supmicrotech.fr
-sys2diag.cnrs.fr
-toulouse-inp.fr
-tyl.in2p3.fr
-u-bourgogne.fr
-u-strasbg.fr
-ube.fr
-uca.fr
-uha.fr
-umontpellier.fr
-umpv.fr
-unc.nc
-unicaen.fr
-unice.fr
-unilim.fr
-unimes.fr
-unistra.fr
-univ-amu.fr
-univ-angers.fr
-univ-artois.fr
-univ-avignon.fr
-univ-brest.fr
-univ-corse.fr
-univ-cotedazur.fr
-univ-eiffel.fr
-univ-evry.fr
-univ-fcomte.fr
-univ-grenoble-alpes.fr
-univ-jfc.fr
-univ-lehavre.fr
-univ-lemans.fr
-univ-lille.fr
-univ-lorraine.fr
-univ-lr.fr
-univ-lyon1.fr
-univ-lyon2.fr
-univ-lyon3.fr
-univ-montp3.fr
-univ-nantes.fr
-univ-nc.nc
-univ-orleans.fr
-univ-paris1.fr
-univ-paris13.fr
-univ-paris8.fr
-univ-pau.fr
-univ-perp.fr
-univ-poitiers.fr
-univ-reims.fr
-univ-rennes.fr
-univ-rennes2.fr
-univ-rouen.fr
-univ-savoie.fr
-univ-smb.fr
-univ-spn.fr
-univ-st-etienne.fr
-univ-tln.fr
-univ-tlse2.fr
-univ-tlse3.fr
-univ-toulouse.fr
-univ-tours.fr
-univ-ubs.fr
-universite-paris-saclay.fr
-upf.pf
-uphf.fr
-usias.fr
-ut-capitole.fr
-utbm.fr
-utinam.cnrs.fr
-utt.fr
-uttop.fr
-uvsq.fr
-vacataire.upf.pf
-vet-alfort.fr
-vetagro-sup.fr
-vjf.cnrs.fr
-xlim.fr
@@ -14,7 +14,7 @@ services:
      GUNICORN_CMD_ARGS: --workers=2
      TEST_E2E: 1
      #TEST_E2E_PC: 1
-      OIDC_DB_URI: redis://redis/0
+      OIDC_DB_URI: stateless://:STATE-ENCRYPTION-KEY@localhost
      CLIENT_DB_JSON: |
        {
          "oidc-test-client": {
@@ -38,8 +38,6 @@ services:
    volumes:
      - ./src/satosa:/app
      - ./docker/files/usr/local/etc/gunicorn/satosa.py:/usr/local/etc/gunicorn/satosa.py
-    depends_on:
-      - redis
    healthcheck:
      test: ["CMD", "curl", "--fail", "http://localhost:8000/ping"]
      interval: 60s
@@ -77,9 +75,6 @@ services:
    extra_hosts:
      - "oidc2fer.127.0.0.1.nip.io:host-gateway"

-  redis:
-    image: redis:7.2.4
-
  nginx:
    image: nginx:1.25
    ports:
@@ -39,11 +39,5 @@ printenv SAML2_BACKEND_KEY > /tmp/backend.key
 printenv OIDC_FRONTEND_KEY > /tmp/frontend.key
 printenv CLIENT_DB_JSON > /tmp/client_db.json

-# Redis database number must be specified
-if [[ ! $OIDC_DB_URI =~ /[0-9]+$ ]]; then
-    echo "🐳(entrypoint) adding db id to OIDC_DB_URI"
-    export OIDC_DB_URI=$OIDC_DB_URI/0
-fi
-
 echo "🐳(entrypoint) running your command: ${*}"
 exec "$@"
@@ -1,4 +1,4 @@
-FROM python:3.14
+FROM python:3.14.3-slim-trixie

 COPY . /app

@@ -1,37 +0,0 @@
-agro-bordeaux.fr
-centrale-med.fr
-clermont-auvergne-inp.fr
-college-de-france.fr
-ecole-air.fr
-edu.univ-paris13.fr
-edu.univ-spn.fr
-enitab.fr
-enpc.fr
-ens-rennes.fr
-ens.univ-artois.fr
-ensai.fr
-esaip.org
-eskemm-numerique.fr
-ext.esaip.org
-geoazur.unice.fr
-inalco.fr
-insa-cvl.fr
-marseille.archi.fr
-univ-artois.fr
-obspm.fr
-oca.eu
-sigma-clermont.fr
-unice.fr
-univ-lyon1.fr
-univ-paris13.fr
-univ-spn.fr
-uphf.fr
-uvsq.fr
-paris-malaquais.archi.fr
-etud.univ-pau.fr
-iutbayonne.univ-pau.fr
-univ-pau.fr
-cereq.fr
-etud.univ-angers.fr
-univ-angers.fr
-
@@ -1 +0,0 @@
-paris-malaquais.archi.fr etud.univ-pau.fr iutbayonne.univ-pau.fr univ-pau.fr cereq.fr etud.univ-angers.fr univ-angers.fr
@@ -1,162 +0,0 @@
-agroparistech.fr
-agrotoulouse.fr
-amue.fr
-artsetmetiers.fr
-artsetmetiers.ma
-bis-sorbonne.fr
-bnu.fr
-bordeaux-inp.fr
-brgm.fr
-ceipi.edu
-centralesupelec.fr
-chartes.psl.eu
-cirad.fr
-cirfc.fr
-cnrs-dir.fr
-cnrs.fr
-crous-reims.fr
-dauphine.eu
-dauphine.fr
-dauphine.psl.eu
-doctorant.upf.pf
-ec-lyon.fr
-ec-nantes.fr
-edu.ehesp.fr
-ehesp.fr
-em-strasbourg.fr
-emse.fr
-enit.fr
-ens-lyon.fr
-ens-paris-saclay.fr
-ens.psl.eu
-ensam.eu
-ensc-rennes.fr
-ensea.fr
-enseeiht.fr
-ensfea.fr
-ensiacet.fr
-ensma.fr
-epicur.education
-espci.fr
-espci.psl.eu
-etu.emse.fr
-etu.umontpellier.fr
-etu.umpv.fr
-etu.unicaen.fr
-etu.univ-lorraine.fr
-etu.univ-montp3.fr
-etu.univ-orleans.fr
-etu.univ-rouen.fr
-etu.univ-st-etienne.fr
-etud.univ-jfc.fr
-etud.univ-tln.fr
-etud.univ-ubs.fr
-etudiant.univ-lr.fr
-etudiant.univ-perp.fr
-etudiant.univ-reims.fr
-ext.isae-supaero.fr
-ext.univ-jfc.fr
-fondation-lehn.fr
-genci.fr
-grenoble-inp.fr
-grenoble-inp.org
-icfrc.fr
-imft.fr
-imt-atlantique.fr
-imt-nord-europe.fr
-inha.fr
-inp-toulouse.fr
-inrae.fr
-inria.fr
-insa-lyon.fr
-insa-rennes.fr
-insa-rouen.fr
-insa-toulouse.fr
-inv.univ-rouen.fr
-ipst-cnam.fr
-ipst.fr
-ird.fr
-irisa.fr
-isae-supaero.fr
-isae.fr
-loria.fr
-lyon.archi.fr
-mines-albi.fr
-mines-stetienne.fr
-misha.fr
-onisep.fr
-pantheonsorbonne.fr
-parisnanterre.fr
-prestataire.renater.fr
-renater.fr
-rennes.archi.fr
-sciencespo-aix.fr
-sciencespo-lyon.fr
-sciencespobordeaux.fr
-scpobx.fr
-seatech.fr
-student.isae-supaero.fr
-supagro.fr
-supmicrotech.fr
-toulouse-inp.fr
-u-bourgogne.fr
-u-strasbg.fr
-ube.fr
-uca.fr
-uha.fr
-umontpellier.fr
-umpv.fr
-unc.nc
-unicaen.fr
-unice.fr
-unilim.fr
-unimes.fr
-unistra.fr
-univ-amu.fr
-univ-avignon.fr
-univ-brest.fr
-univ-corse.fr
-univ-cotedazur.fr
-univ-eiffel.fr
-univ-evry.fr
-univ-fcomte.fr
-univ-grenoble-alpes.fr
-univ-jfc.fr
-univ-lehavre.fr
-univ-lemans.fr
-univ-lille.fr
-univ-lorraine.fr
-univ-lr.fr
-univ-lyon2.fr
-univ-lyon3.fr
-univ-montp3.fr
-univ-nantes.fr
-univ-nc.nc
-univ-orleans.fr
-univ-paris1.fr
-univ-paris8.fr
-univ-perp.fr
-univ-poitiers.fr
-univ-reims.fr
-univ-rennes.fr
-univ-rennes2.fr
-univ-rouen.fr
-univ-savoie.fr
-univ-smb.fr
-univ-st-etienne.fr
-univ-tln.fr
-univ-tlse2.fr
-univ-tlse3.fr
-univ-toulouse.fr
-univ-tours.fr
-univ-ubs.fr
-universite-paris-saclay.fr
-upf.pf
-usias.fr
-ut-capitole.fr
-utbm.fr
-utt.fr
-uttop.fr
-vacataire.upf.pf
-vet-alfort.fr
-vetagro-sup.fr
@@ -2,7 +2,6 @@ SAML2_BACKEND_CERT: ENC[AES256_GCM,data:uVs1uGoFfESz0eAkxvPUkSXQw6cCvzi+YfH7pbXL
 SAML2_BACKEND_KEY: ENC[AES256_GCM,data:svNEf0i2AB0fQlJlwJ4tkST7R0GGArPGw7iVGA4pRYedphZrRkeTVUoI3e/Ku5fTv2IXBK4NU5NB9OvFL8VaX1hN3xxWcW6htcOzSGPklee/U4j9fSnUvZzCHtCz1sYgCoQCPcQObfLA2S2H+CMekJpy53djxfjbZdo6+A+T1Lcqk/aJkl8IO0+LgfK2vlp7X5hR4BLS+fdVOrogqzlIrr7iumvSBTS8RY0dp87iLGcWmKCYLrvSieyneiC1VgYughl6LxcPLBTPSJFZBt0NLR3oUMcumBaRpvrlLxPihJbqyC4Jn+We0IKBMYmLCEBBLjx+J4EFLHaG6p3+SyUmLYNJMeOvvexR/qTaiuwUp/3gsD8PrwxFVn7Z3jeL5gX0ohCQyETNuLpAw47yNAlHZaZ11FcFpRUINZrPBG/myJk4i40UQ+AmWBPgS/SxmQj91hoUPw23VDTGWLKv/B5Xd48A3hEOKeA7PmGOfCfd7d9eOJP42dcqWyUypogELAJgF+Leci4q6T99fnIGlBahJK8yDltc4NU4kEAsACdIBZBK+Ezyu+n1hOtg9BEDOUeilSy1TAgfi/B9CQrFLU9cSo1qFPHxIkaRPV3IVuGfEaxNpVrv68RaicYCfeUWIcQ3h13ftPIQlZ6rNukC1pDugV4GrPTtapokV/Z8/8QU0BcRAmfDIniBlk+uP2ga8YDJ4c1FDl6KYQt2zyzFQACOoVPOm/VvffGzOl042iO0ibHAklZerFgbjsiUCpBcRi4dOFqMt6OkvdTldFYGOm+FADtVdJaRoUk8uXe13GCUASjJUCrMOmimEb6gKNYbm2u27kWBIlPMNmLlelVkEpmPCmAl2yLXiJhdxBu0YgHyqwqizKOumckoYditFDXkK52ZtANqwLaHNtGV+aB5dvxRlN5NhsUYr9zLmgv4bUkYL2lI5p5IFN0Lha0fDG105FbIoqmuKXxWJ7IL7MisQLW5DGzN29gWH/uh3A00b3jiEn/0HvEh+P/38t20/IP/l65Z7OZAf2VA1jpCv04lKPXYmvMbcXIROhWcA1yqJvdgiNIh8eWWt/1mFzjRHQ1vfiW5XEn1Yoln6Q++Q5RgnlraizuZWDGeKvP/b5+B15lgdx7keG5rmSpn8ogJD7Cey6epsVY84Qbqpvcp5i5EcL/cMs9NkN2Yf6EGKhczILOAwH2YypWnttIz8OrftjqPzbAP/XOXLFxNbFBlyzLlYwTcjNUIZtg9OwK3k0zDKeHT+q6xSMFdyf3Xpdoh+NJD1QYzoSzosWj/Yzxg9bZVVpKOb89fkGRpNtCuHEkprr0LJUCaPSArANE+MH7E6uisBVvIQwF9MzTf6apHoyUIi0Oq0dRpryvD/OBf0V0Zn75uitpoSqEZf+i8+L3s7dsFp1lEwywUZuZPxmk8kOIyPGNG6KmuFOr0j/6jPO4/05dIvYb/f/sSCjQo3E99whPx5Of9tmlU4eCM4Fwzpgu/w4uKy4f27W4LYosfpENHGRbaWI2XFmmNL1J6Lm6h1yZ+3ck0391zBZA0pp0tNIR5AEc5UBn8GQHrmk9NW2QLMqQLPmhgAD6unHeJY9iYMoCAMqc14c6gjF7gjBCrZd58qBTcNHw3p0GJXACgCm/OGqhRYFuWF0kJUugnTK9n1wfy3/HNE/adBnOqJWEkoP4n/VVL+eucECBtOX0jPFHmPsMYMSdwupCB32G7I36dQPYQsjbD+Sg9StAQxbXUIALRQ1cMaeHpUNSc48sE8ElrjZStNf46oWs+rDjhleWdOlpfsOJ+qwJrLLXFqBMeFtgXpzL4NnRoEGjFFK5l7EtfGDK0/ytPPmOwarjEDftaLmDTfBniZrt/WuuChe7MHbKRcGFkBYA2nbbBfMcpnsGBXpEMQl8LYZR9Sg8hMT0rFYtXj+h0ceCIfsa1HdV43NR/oos7Nf32rjLAu/jVUMNwWOKew5+Du61gmhBVpVNtvTe8+31dYMoQGQrIbxnHQmT1fu8LB0Am45+Zghk8sc0d+81xEzYxvYXMR/QMbwJnWGGI4e7XSUMA5k9xKXXNDeYNCP/e9BGhl9sS0XYX0HSrjX6rsVI5K1QRjT+CBiIqlS7q6bofZ8tsiYhRSh7pgYgvodsPKezrZCTTY4/Xyg9iLMtqtpqMnfqmbaYvwJ6r5LbWeR89tkjmlHcWcue/85Y2D/1COiGFRODIityykTTjacGj/MlYXPE3O20Lr1P1YP2lm22i9kM5jKuCiGbyMn8ZuFVQ30Hnwv2qH4k=,iv:itJR8JpZRrwhbQY/kTEURY28vyu1qex7GsRme9icZYw=,tag:JgkJOE+bdK19KjvdH/k1Ug==,type:str]
 OIDC_FRONTEND_KEY: ENC[AES256_GCM,data:8I/blGdvSDc+Hy96s4OsULJTo9+qyF+8Z4mxA/S11kLQjhue9sRTp/2Q0Db/gw0fMibb8gwrRi4oH4BsHfXaNxtyPCxrgwmeCpaq0rvgrOn+czEDQGErf7QxHnzvsOMBqMygRWKk3aKLjZTNvfMeaQL9KSrtEgePrfUvykSIPwN4HwtNH9Tymq6xopAhgk9jWq5kzomCu6u4OCxz9Fp1GgTdj/gLplMWYeTyWZQFRPimZoBfoxhbih9qofw4uqmN8+iT/Fj9EOAUMsdYeI9i2GKoT/YRso8yipi8760teUwqoDntTVv2ExR4zDvhI5Z9jISyX3qAXls/bwmwAWSb+JIxPAwgbsMDwmPTHItG3Xr2NPkiBVWujMhg7duq+labguwUZelpqQnvnKbxWHm1+NGRS+VYpPQRvzRREh02ybDt7/yjQMSAhWOkDXzZf6WNQfEf5jguz3B6CA6PGAwz9gZX7JivP1O5ontaeULbF373VsOQPmn57qZirk39Ntg7S9tkt2voxilSBMkhDsSXC3Qa9veGnd+t+Jg/YCEamoJEJ85EBfPzgvr2s6Av9D8B2h/gruXCQVCm/Zr9BX8Lus8JmSohTeZUFVteabmxr4W0gwPJgb5Ki0HciKxGsE7ITA5SFFN4LdxsBHlvJ0aJ1pipYfkkpI3YdC45CI22b2gDNIqVamK8hpYn8bTP3jLWsO36M/wnDB6oKsFiTTb4HxNuWVzIshQG8Ua0xwuhizuvZRDuRPUe+gfaiy0Dqzo/RLX1C92TJ7tYzlpM5/u0n7YkY5+/IB2ljnmAC5Kj5z+kNxhTflX/8Z62WTPBZlzE+kJb9hgMQQ8t7jDk6RnpmrUhOKx7rzrFzI/qmXC9+8yHEhiCBI5Wn3R89uCwV0O6WAhIuG9zQiaSiCwDaS3DHCy4PgcUBdbh5tddJ6aazmM9xBZFcevy06gWKmdjbkg3sacjCpTTdnIT4hwxdISTRWtuyYj+pp1d/rs5426yadftPI21OQ1F062nSTKtyViP8PFxzppbCzpSUK5oDdL7wCX2+y8071GJqNipLw+hUS/1z9x7GvEs0Fy5ZOefoHShO/vS6CfXUYoPNpq9ZiAoXvLCRSfY8HEqfOF45hFJLJsVhaKXOe1t4mfHJxrl88NKZXRC3nvSdoqwP9MTdNuvTf86Gn4n+zd3qT07ARqjq4hlV3L69xBxAK/QFrxHagSWOE4Z/tHvYYEiohbn/F6J4k30uv5KnR5P2OpXGRiS5eNXzXdfW+DptBHttmJKtzxD4JJbWRP6kFaUZiCLQLyhZTWoPHmFSTphkxZ2MkqCx13eFTHA927/zehAYCU/miJ1JLATMYaD3mHWifEKRipfG406cF1Y11w27Of3fmhAhqO/7LeZX1a39NXKHW6sIk1Rz0mEaFT8tpBUUxdR1FVaj//MUc7QsvzaxT1O8JletttC8wlWx1mePS1IU49O0DyYcZn4BW8vVJFDz24N7ARb+WcajmsopZScgNwO6XqvDaH/j8mH/0eWCFzIMfW0+pUoCrrmAtoHQ/Z2Dx1j1Yhddxkae1dwoyWGFDqLJyjJ9Hq7Xpx9jQOGGP0mQ2TOw1zwNCzfnWV3MTXmLLwSMc4/ZpOxSqsmI9RlMPE8LeU+ee/jhINYntD/q0zykcoSLj07SfwnYBZPfZcnxNyc94fyrX6GYGfXIAmPR2/pryRtPyXLR3WK9SbL/8rGN50mO42QlvXK0azWRe6gMT4yHZP6V6d5Vqrte1tfhUf/DYuUC0on6qHW5TDrWw7QBdiUQeip4YhW42vgU2WjjNiPZF332uExy0pypO6cZTnsR/jCUZxFMd/IVKWyhAeJt/Wx1Jli1c1SNTigH7LCrSLyrsA2tmufRAcGXRzG2C0mjwofWb7zR1IGCZ0yoVPSt7HNpOY5WoBLpsbhXBodyYTmrSprxXu4cg/n/G8jbAo/xW0AriJolA5k6F9/DWD/tDnIawhwW4AqqeWDk1MmNoGOf/OMplDdwrpkmclVidIcNnaCML8iuKiPx4g+8mdOdkc/mqIP8zaSInRV1/IrIGGSGRwSfQ4wyRFGqC8fYckympShVAGbetOLXn5dd7S3MGlh6n/rgUecqYySs9ckN2Ti0F1g/2CMI5g1Tn4fF2dwOk/iKFLvsSt5Y/vLMTfjK7W+FSg8ImtLs/Jfbn0rrlMVjoBXB2e/yajmu7r+xneP0OeRja+oA1gGExodDmUa4zV6QEU8IFSMLdnqMtShDdRs/XT1YAHbrlS4swg=,iv:EJEMIEsraig+i+5PlieAwHS6XV5bP+wlxv6Wni/9Dws=,tag:DM1XLnEtTp0vFEjAD4u4ag==,type:str]
 STATE_ENCRYPTION_KEY: ENC[AES256_GCM,data:U0BoVcDN6/sNDST8epqmOzs5oWok6lRZ+hLo7O6/Mkz0cqB4rcHe/OOC9HTe39K5WUCD25Rfrb4lSeK0Finl9A==,iv:NM9Wjlx/llNc7Ws8DaNYy9dVq/oFEdlK5a/Alr5ZxVA=,tag:VT8GhiFxeI8AjdcKdRkEcQ==,type:str]
-REDIS_PASSWORD: ENC[AES256_GCM,data:lf2Dadck+FkabNsliZCt+s3+fJsgwDyq4isod3mq1WM=,iv:R8Hed2qUe2hUbfILsh7yUf0vgLLLpQETeapr0h54D9w=,tag:+VTC3lf4fa+UFb9XDBgOSw==,type:str]
 sops:
    kms: []
    gcp_kms: []
@@ -45,8 +44,8 @@ sops:
            VVlBdFVNZUx1c2p2cERZVFVLWldORzQKaS/7SUU+ueI+MVU/gZIPmr9QwpdVkbGi
            SFpfPMtN4CzcSBC4QsFXm7AeUZdpBiJMCLWApHGaas5ai6djiv47rg==
            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-03-18T15:20:42Z"
-    mac: ENC[AES256_GCM,data:dxjNp3+ttM6ky02H5lYB9Fp5pG6CeijTnLzaxzHbKTJooIJudv52e3BDG6ui2GeMZINTaGt+IOfpCp2DE+pVZdvShbgrXZ7K1tvwzBslhH4uk48qo4rds9IXDaqPQhbAtlNPhdPPsdrkUA2Wrp3OLDPhi2DsVy5B9mhe6nukrBM=,iv:dWBRiQkp+zCjcGFKyn7uFqVJivwBFP7tpbdyQOA4rT4=,tag:0n9fxsl5BkQglDzobozzRA==,type:str]
+    lastmodified: "2024-04-18T13:56:51Z"
+    mac: ENC[AES256_GCM,data:C/p3iSmwr7Tv4oqr1G0FxQ7z0kspFmFR7OsKkRsSLINQ+pvcpFAIjzloUoT32PO+QrBRRSmtGmE0CkmUHh7tEnUVB9q6GcPT/9OwQEqvqtmqx1vjQKNxdTt5zpe7GxLXoJywW1nhgehFweysIlT1r1jgraWidfQ17ZbSQU8ybg4=,iv:LFxTa39rTxfpE+9e5HCFkl6ggJTt1zJMvc745glky08=,tag:U5Z8/HdYE0ZikPEP7oVjzw==,type:str]
    pgp: []
    unencrypted_suffix: _unencrypted
    version: 3.8.1
@@ -0,0 +1,22 @@
+image:
+  repository: localhost:5001/oidc-test-client
+  pullPolicy: Always
+  tag: "latest"
+
+ingress:
+  enabled: true
+  host: oidc-test-client.127.0.0.1.nip.io
+
+env:
+  - name: OIDC_ROOT_URL
+    value: https://oidc-test-client.127.0.0.1.nip.io
+  - name: OIDC_PROVIDER
+    value: https://oidc2fer.127.0.0.1.nip.io
+  - name: OIDC_CLIENT_ID
+    value: oidc-test-client
+  - name: OIDC_CLIENT_SECRET
+    value: oidc-test-secret
+  - name: OIDC_SCOPES
+    value: openid,uid,given_name,usual_name,email,siret
+  - name: EXTRA_ROOT_CA
+    value: {{ exec "mkcert" (list "-CAROOT") | trim | printf "%s/rootCA.pem" | readFile | quote }}
@@ -4,17 +4,7 @@ image:
  tag: "latest"

 satosa:
-  replicas: 2
-  affinity:
-    podAffinity:
-      requiredDuringSchedulingIgnoredDuringExecution:
-      - labelSelector:
-          matchExpressions:
-          - key: app.kubernetes.io/instance
-            operator: In
-            values:
-            - redis-oidc
-        topologyKey: kubernetes.io/hostname
+  replicas: 1
  env:
    - name: BASE_URL
      value: https://oidc2fer.127.0.0.1.nip.io
@@ -41,11 +31,8 @@ satosa:
    - name: OIDC_FRONTEND_KEY
      valueFrom: { secretKeyRef: { name: oidc2fer, key: OIDC_FRONTEND_KEY    } }

-    - name: REDIS_PASSWORD
-      valueFrom: { secretKeyRef: { name: oidc2fer, key: REDIS_PASSWORD } }
-
    - name: OIDC_DB_URI
-      value: "redis://:$(REDIS_PASSWORD)@redis-oidc-master:6379/0"
+      value: "stateless://:$(STATE_ENCRYPTION_KEY)@localhost"

    - name: CLIENT_DB_JSON
      value: |-
@@ -57,7 +44,8 @@ satosa:
            ],
            "redirect_uris": [
              "https://oidc-test-client.traefik.me/redirect_uri",
-              "https://oidc-test-client.traefik.me:8443/redirect_uri"
+              "https://oidc-test-client.traefik.me:8443/redirect_uri",
+              "https://oidc-test-client.127.0.0.1.nip.io/redirect_uri"
            ],
            "client_secret": "oidc-test-secret",
            "token_endpoint_auth_method": "client_secret_post"
@@ -69,7 +57,6 @@ satosa:
            "https://test-idp.federation.renater.fr/idp/shibboleth": "12345678200010"
        }

-
 ingress:
  enabled: true
  host: oidc2fer.127.0.0.1.nip.io
@@ -1,20 +1,10 @@
 image:
  repository: ghcr.io/proconnect-gouv/oidc2fer
  pullPolicy: Always
-  tag: "v1.0.12"
+  tag: "v1.0.13"

 satosa:
-  replicas: 4
-  affinity:
-    podAffinity:
-      requiredDuringSchedulingIgnoredDuringExecution:
-      - labelSelector:
-          matchExpressions:
-          - key: app.kubernetes.io/instance
-            operator: In
-            values:
-            - redis-oidc
-        topologyKey: kubernetes.io/hostname
+  replicas: 2
  env:
    - name: BASE_URL
      value: https://renater.agentconnect.gouv.fr
@@ -44,11 +34,8 @@ satosa:
    - name: CLIENT_DB_JSON
      valueFrom: { secretKeyRef: { name: oidc2fer, key: CLIENT_DB_JSON       } }

-    - name: REDIS_PASSWORD
-      valueFrom: { secretKeyRef: { name: oidc2fer, key: REDIS_PASSWORD } }
-
    - name: OIDC_DB_URI
-      value: 'redis://:$(REDIS_PASSWORD)@redis-oidc-master:6379/0'
+      value: "stateless://:$(STATE_ENCRYPTION_KEY)@localhost"

    # As provided by RENATER
    - name: SIRET_MAP
@@ -180,12 +167,6 @@ satosa:
          "https://idp4.cereq.fr/idp/shibboleth": "18004303600037",
          "urn:mace:cru.fr:federation:univ-angers.fr": "19490970100303"
        }
-  resources:
-    requests:
-      memory: "256Mi"
-      cpu: "500m"
-    limits:
-      memory: "512Mi"

 ingress:
  enabled: true
@@ -5,16 +5,6 @@ image:

 satosa:
  replicas: 2
-  affinity:
-    podAffinity:
-      requiredDuringSchedulingIgnoredDuringExecution:
-      - labelSelector:
-          matchExpressions:
-          - key: app.kubernetes.io/instance
-            operator: In
-            values:
-            - redis-oidc
-        topologyKey: kubernetes.io/hostname
  env:
    - name: BASE_URL
      value: https://oidc2fer-staging.beta.numerique.gouv.fr
@@ -44,11 +34,8 @@ satosa:
    - name: CLIENT_DB_JSON
      valueFrom: { secretKeyRef: { name: oidc2fer, key: CLIENT_DB_JSON       } }

-    - name: REDIS_PASSWORD
-      valueFrom: { secretKeyRef: { name: oidc2fer, key: REDIS_PASSWORD } }
-
    - name: OIDC_DB_URI
-      value: "redis://:$(REDIS_PASSWORD)@redis-oidc-master:6379/0"
+      value: "stateless://:$(STATE_ENCRYPTION_KEY)@localhost"

    - name: SIRET_MAP
      value: |-
@@ -21,20 +21,6 @@ repositories:
  oci: true

 releases:
-  - name: redis-oidc
-    namespace: {{ .Namespace }}
-    chart: bitnami/redis
-    version: 25.3.5
-    needs:
-      - oidc2fer
-    values:
-      - auth:
-          existingSecret: oidc2fer
-          existingSecretPasswordKey: REDIS_PASSWORD
-        architecture: standalone
-        image:
-          repository: bitnamilegacy/redis
-
  - name: oidc2fer
    version: {{ .Values.version }}
    namespace: {{ .Namespace }}
@@ -43,3 +29,11 @@ releases:
      - env.d/{{ .Environment.Name }}/values.oidc2fer.yaml.gotmpl
    secrets:
      - env.d/{{ .Environment.Name }}/secrets.enc.yaml
+
+  - name: oidc-test-client
+    installed: {{ eq .Environment.Name "dev" }}
+    version: {{ .Values.version }}
+    namespace: {{ .Namespace }}
+    chart: ./oidc-test-client
+    values:
+      - env.d/{{ .Environment.Name }}/values.oidc-test-client.yaml.gotmpl
@@ -0,0 +1,24 @@
+apiVersion: v2
+name: oidc-test-client
+description: Test OIDC client
+
+# A chart can be either an 'application' or a 'library' chart.
+#
+# Application charts are a collection of templates that can be packaged into versioned archives
+# to be deployed.
+#
+# Library charts provide useful utilities or functions for the chart developer. They're included as
+# a dependency of application charts to inject those utilities and functions into the rendering
+# pipeline. Library charts do not define any templates and therefore cannot be deployed.
+type: application
+
+# This is the chart version. This version number should be incremented each time you make changes
+# to the chart and its templates, including the app version.
+# Versions are expected to follow Semantic Versioning (https://semver.org/)
+version: 0.1.0
+
+# This is the version number of the application being deployed. This version number should be
+# incremented each time you make changes to the application. Versions are not expected to
+# follow Semantic Versioning. They should reflect the version the application is using.
+# It is recommended to use it with quotes.
+appVersion: "1.0.0"
@@ -0,0 +1,51 @@
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "oidc-test-client.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "oidc-test-client.fullname" -}}
+{{- if .Values.fullnameOverride }}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- $name := default .Chart.Name .Values.nameOverride }}
+{{- if contains $name .Release.Name }}
+{{- .Release.Name | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "oidc-test-client.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Common labels
+*/}}
+{{- define "oidc-test-client.labels" -}}
+helm.sh/chart: {{ include "oidc-test-client.chart" . }}
+{{ include "oidc-test-client.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "oidc-test-client.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "oidc-test-client.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
@@ -0,0 +1,71 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "oidc-test-client.fullname" . }}
+  namespace: {{ .Release.Namespace | quote }}
+  labels:
+    {{- include "oidc-test-client.labels" . | nindent 4 }}
+spec:
+  replicas: {{ .Values.replicaCount }}
+  selector:
+    matchLabels:
+      {{- include "oidc-test-client.selectorLabels" . | nindent 6 }}
+  template:
+    metadata:
+      {{- with .Values.podAnnotations }}
+      annotations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      labels:
+        {{- include "oidc-test-client.labels" . | nindent 8 }}
+        {{- with .Values.podLabels }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
+    spec:
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      securityContext:
+        {{- toYaml .Values.podSecurityContext | nindent 8 }}
+      containers:
+        - name: {{ .Chart.Name }}
+          securityContext:
+            {{- toYaml .Values.securityContext | nindent 12 }}
+          image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          ports:
+            - name: http
+              containerPort: {{ .Values.service.port }}
+              protocol: TCP
+          {{ with .Values.livenessProbe }}
+          livenessProbe: {{ toJson . }}
+          {{- end }}
+          {{ with .Values.readinessProbe }}
+          readinessProbe: {{ toJson . }}
+          {{- end }}
+          resources:
+            {{- toYaml .Values.resources | nindent 12 }}
+          {{- with .Values.env }}
+          env:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          command:
+            - sh
+            - -ec
+            - |-
+              printenv EXTRA_ROOT_CA >> $(python -m certifi)
+              exec python app.py
+
+      {{- with .Values.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
@@ -0,0 +1,38 @@
+{{- if .Values.ingress.enabled -}}
+{{- $fullName := include "oidc-test-client.fullname" . -}}
+{{- $svcPort := .Values.service.port -}}
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: {{ $fullName }}
+  namespace: {{ .Release.Namespace | quote }}
+  labels:
+    {{- include "oidc-test-client.labels" . | nindent 4 }}
+  {{- with .Values.ingress.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  ingressClassName: {{ .Values.ingress.className }}
+  {{- if .Values.ingress.tls.enabled }}
+  tls:
+    {{- if .Values.ingress.host }}
+    - secretName: {{ $fullName }}-tls
+      hosts:
+        - {{ .Values.ingress.host | quote }}
+    {{- end }}
+  {{- end }}
+  rules:
+    {{- if .Values.ingress.host }}
+    - host: {{ .Values.ingress.host | quote }}
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: {{ $fullName }}
+                port:
+                  number: {{ $svcPort }}
+    {{- end }}
+{{- end }}
@@ -0,0 +1,16 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "oidc-test-client.fullname" . }}
+  namespace: {{ .Release.Namespace | quote }}
+  labels:
+    {{- include "oidc-test-client.labels" . | nindent 4 }}
+spec:
+  type: {{ .Values.service.type }}
+  ports:
+    - port: {{ .Values.service.port }}
+      targetPort: http
+      protocol: TCP
+      name: http
+  selector:
+    {{- include "oidc-test-client.selectorLabels" . | nindent 4 }}
@@ -0,0 +1,71 @@
+# Default values for oidc-test-client.
+# This is a YAML-formatted file.
+# Declare variables to be passed into your templates.
+
+replicaCount: 1
+
+image:
+  repository: oidc-test-client
+  pullPolicy: Always
+  # Overrides the image tag whose default is the chart appVersion.
+  tag: ""
+
+imagePullSecrets: []
+nameOverride: ""
+fullnameOverride: ""
+
+podAnnotations: {}
+podLabels: {}
+
+podSecurityContext: {}
+  # fsGroup: 2000
+
+securityContext: {}
+  # capabilities:
+  #   drop:
+  #   - ALL
+  # readOnlyRootFilesystem: true
+  # runAsNonRoot: true
+  # runAsUser: 1000
+
+service:
+  type: ClusterIP
+  port: 5000
+
+ingress:
+  enabled: true
+  className: ""
+  annotations: {}
+    # kubernetes.io/ingress.class: nginx
+    # kubernetes.io/tls-acme: "true"
+  hosts: []
+  tls:
+    enabled: true
+    
+resources: {}
+  # We usually recommend not to specify default resources and to leave this as a conscious
+  # choice for the user. This also increases chances charts run on environments with little
+  # resources, such as Minikube. If you do want to specify resources, uncomment the following
+  # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
+  # limits:
+  #   cpu: 100m
+  #   memory: 128Mi
+  # requests:
+  #   cpu: 100m
+  #   memory: 128Mi
+
+livenessProbe:
+  httpGet:
+    path: /healthz
+    port: http
+  periodSeconds: 30
+
+readinessProbe: null
+
+nodeSelector: {}
+
+tolerations: []
+
+affinity: {}
+
+env: []
@@ -9,4 +9,3 @@ stringData:
  SAML2_BACKEND_KEY: {{ .Values.SAML2_BACKEND_KEY | toYaml | indent 8 }}
  OIDC_FRONTEND_KEY: {{ .Values.OIDC_FRONTEND_KEY | toYaml | indent 8 }}
  CLIENT_DB_JSON: {{ .Values.CLIENT_DB_JSON | toYaml | indent 8 }}
-  REDIS_PASSWORD: {{ .Values.REDIS_PASSWORD | quote }}
@@ -105,7 +105,7 @@ satosa:
  ## @param satosa.probes.readiness.initialDelaySeconds [nullable] Configure timeout for satosa readiness probe
  probes:
    liveness:
-      targetPort: 8000
+      targetPost: 8000
      path: /ping
      initialDelaySeconds: 10
    #readiness:
@@ -26,7 +26,6 @@ requires-python = ">=3.14"
 dependencies = [
    "SATOSA==8.5.1",
    "gunicorn==25.1.0",
-    "redis==7.2.1",
    "JSON-log-formatter==1.1.1",
    "WhiteNoise==6.12.0",
 ]
@@ -1,5 +1,9 @@
+import concurrent.futures
 import json
+import logging
 import os
+import time
+import urllib.request

 import pytest
 from playwright.sync_api import Browser, Page, expect
@@ -32,7 +36,7 @@ def oidc_to_renater(
    expected_given_name="Georges",
    expected_usual_name="Grospieds",
 ):
-    page.goto("https://oidc-test-client.traefik.me")
+    page.goto("https://oidc-test-client.127.0.0.1.nip.io")
    renater_wayf(page)
    renater_test_idp(page, login=login)

@@ -41,6 +45,7 @@ def oidc_to_renater(
    result = json.loads(text)

    id_token = result["access_token_response"]["id_token"]
+    access_token = result["access_token_response"]["access_token"]
    assert {"acr": "eidas1"}.items() <= id_token.items()
    userinfo = result["userinfo"]
    assert {
@@ -51,7 +56,7 @@ def oidc_to_renater(
        "usual_name": expected_usual_name,
        "siret": "12345678200010",
    }.items() <= userinfo.items()
-    return id_token
+    return id_token, access_token


@pytest.mark.skipif(
@@ -59,18 +64,53 @@ def oidc_to_renater(
 )
 def test_oidc_to_renater_keeps_sub(browser: Browser):
    with browser.new_context().new_page() as page:
-        id_token1 = oidc_to_renater(page)
+        id_token1, _ = oidc_to_renater(page)
    with browser.new_context().new_page() as page:
-        id_token2 = oidc_to_renater(page)
+        id_token2, _ = oidc_to_renater(page)

    assert id_token1["sub"] == id_token2["sub"]


+@pytest.mark.skipif(
+    "BENCH_E2E" not in os.environ, reason="Benchmark runs only if requested"
+)
+def test_benchmark_userinfo(browser: Browser):
+    with browser.new_context().new_page() as page:
+        _, access_token = oidc_to_renater(page)
+
+    request_count = int(os.environ.get("BENCH_E2E_N", "100"))
+    client_count = int(os.environ.get("BENCH_E2E_P", "2"))
+    start = time.time()
+
+    def make_request():
+        return urllib.request.urlopen(
+            urllib.request.Request(
+                "https://oidc2fer.127.0.0.1.nip.io/OIDC/userinfo",
+                headers={"Authorization": f"Bearer {access_token}"},
+            )
+        )
+
+    with concurrent.futures.ThreadPoolExecutor(max_workers=client_count) as executor:
+        futures = []
+        for _ in range(request_count):
+            futures.append(executor.submit(make_request))
+        for future in concurrent.futures.as_completed(futures):
+            with future.result() as resp:
+                assert resp.status == 200
+    end = time.time()
+    logging.info(
+        "Average userinfo request time with %d parallel requests: \
+            %.2f seconds",
+        client_count,
+        (end - start) / request_count,
+    )
+
+
@pytest.mark.skipif(
    "TEST_E2E" not in os.environ, reason="Depends on app running locally"
 )
 def test_oidc_to_renater_student_not_allowed(page: Page):
-    page.goto("https://oidc-test-client.traefik.me")
+    page.goto("https://oidc-test-client.127.0.0.1.nip.io")
    renater_wayf(page)
    renater_test_idp(page, login="etudiant1")

@@ -135,5 +175,5 @@ def test_pro_connect_to_renater_student_not_allowed(page: Page):
    "TEST_E2E" not in os.environ, reason="Depends on app running locally"
 )
 def test_serve_static_assets(page: Page):
-    page.goto("https://satosa.traefik.me/images/logo.svg")
+    page.goto("https://oidc2fer.127.0.0.1.nip.io/images/logo.svg")
    expect(page.locator("svg")).to_be_visible()
@@ -1,23 +0,0 @@
-https://idp.enitab.fr/idp/shibboleth
-https://auth.centrale-marseille.fr/idp/shibboleth
-https://idp4.cereq.fr/idp/shibboleth
-https://idp-ecole-air.renater.fr/idp/shibboleth
-https://idp.enpc.fr/saml/metadata
-https://idp.marseille.archi.fr/idp/shibboleth
-https://idp.paris-malaquais.archi.fr/idp/shibboleth
-https://idp.ens-rennes.fr/idp/shibboleth
-https://idp2.ensai.fr/idp/shibboleth
-https://idp.esaip.org/idp/shibboleth
-https://idp.college-de-france.fr/idp/shibboleth
-https://idp.inalco.fr/idp/shibboleth
-https://idp-insa-cvl.renater.fr/idp/shibboleth
-https://idp.oca.eu/idp/shibboleth
-https://shibboleth3.obspm.fr/idp/shibboleth
-https://idp.sigma-clermont.fr/idp/shibboleth
-urn:mace:cru.fr:federation:univ-lyon1.fr
-urn:mace:cru.fr:federation:univ-angers.fr
-https://idp.univ-artois.fr/idp/shibboleth
-https://idp.univ-pau.fr/idp/shibboleth
-https://shibboleth.csi.uvsq.fr/idp/shibboleth
-https://idp.uphf.fr/idp/shibboleth
-https://idp.univ-paris13.fr/idp/shibboleth
Author	SHA1	Message	Date
electron	2616d040d0	docs: add DEPLOYMENT.md for saillant.cc instance - SAML entity in Renater test federation - Metadata URL, OIDC clients (moodle-lms, frappe-lms) - SATOSA 8.5.1 container config Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-27 13:37:55 +01:00
Jonathan Perret	5932135ec5	🔐(secrets) update secrets to current main	2026-03-26 15:26:17 +01:00
Jonathan Perret	0a43908ac3	Deploy release v1.0.13 to production	2026-03-26 15:10:43 +01:00
Jonathan Perret	435e2e20a9	v1.0.13 release	2026-03-26 14:54:48 +01:00
Jonathan Perret	5dcfcf213d	Merge pull request #40 from proconnect-gouv/stateless-oidc Utiliser le mode stateless de SATOSA pour ne plus avoir besoin de Redis	2026-03-26 14:53:06 +01:00
Jonathan Perret	00b048d94d	🗃️(redis) remove Redis support We switched to stateless OIDC.	2026-03-26 14:34:58 +01:00
Jonathan Perret	bda7a44bc8	🔧(helm) use stateless OIDC in production Getting rid of Redis should help with performance.	2026-03-26 13:41:53 +01:00
Jonathan Perret	9db60451aa	🔧(helm) use stateless OIDC in dev and staging Getting rid of Redis should help with performance.	2026-03-25 10:37:00 +01:00
Jonathan Perret	018b9e8726	🔧(helm) use lists for env vars Moving back to the Kubernetes-native syntax of lists makes it possible to use dependent environment variables.	2026-03-25 10:04:28 +01:00
Jonathan Perret	ea4199de91	Merge pull request #39 from proconnect-gouv/tilt-oidc-test-client 🔨 Configuration Tilt pour le client test OIDC	2026-03-20 15:44:31 +01:00
Jonathan Perret	4d1a9c56d2	🔨(e2e) add benchmark e2e test This can help diagnose performance issues.	2026-03-20 15:32:09 +01:00
Jonathan Perret	14f9d42889	⬆️ (oidc-test-client) create Helm chart for test client This helps running tests with the app running in a Kubernetes cluster.	2026-03-20 15:32:08 +01:00
				`@@ -1 +0,0 @@`
				`paris-malaquais.archi.fr etud.univ-pau.fr iutbayonne.univ-pau.fr univ-pau.fr cereq.fr etud.univ-angers.fr univ-angers.fr`