temporary enable debug logs in production

.github/workflows/docker-hub.yml

@@ -65,9 +65,29 @@ jobs:
     needs:
       - build-and-push
     steps:
-      - uses: numerique-gouv/action-argocd-webhook-notification@main
-        id: notify
+      -
+        uses: actions/create-github-app-token@v1
+        id: app-token
         with:
-          deployment_repo_path: "${{ github.repository }}"
-          argocd_webhook_secret: "${{ secrets.ARGOCD_PREPROD_WEBHOOK_SECRET }}"
-          argocd_url: "${{ vars.ARGOCD_PREPROD_WEBHOOK_URL }}"
+          app-id: ${{ secrets.APP_ID }}
+          private-key: ${{ secrets.PRIVATE_KEY }}
+          owner: ${{ github.repository_owner }}
+          repositories: "oidc2fer,secrets"
+      -
+        name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          submodules: recursive
+          token: ${{ steps.app-token.outputs.token }}
+      -
+        name: Load sops secrets
+        uses: rouja/actions-sops@main
+        with:
+          secret-file: secrets/numerique-gouv/oidc2fer/secrets.enc.env
+          age-key: ${{ secrets.SOPS_PRIVATE }}
+      -
+        name: Call argocd github webhook
+        run: |
+          data='{"ref": "'$GITHUB_REF'","repository": {"html_url":"'$GITHUB_SERVER_URL'/'$GITHUB_REPOSITORY'"}}'
+          sig=$(echo -n ${data} | openssl dgst -sha1 -hmac ''${ARGOCD_WEBHOOK_SECRET}'' | awk '{print "X-Hub-Signature: sha1="$2}')
+          curl -X POST -H 'X-GitHub-Event:push' -H "Content-Type: application/json" -H "${sig}" --data "${data}" $ARGOCD_WEBHOOK_URL

.github/workflows/helmfile-linter.yml

@@ -10,7 +10,7 @@ jobs:
   helmfile-lint:
     runs-on: ubuntu-latest
     container:
-      image: ghcr.io/helmfile/helmfile:v0.171.0
+      image: ghcr.io/helmfile/helmfile:latest
     steps:
       -
         uses: numerique-gouv/action-helmfile-lint@main

CHANGELOG.md

@@ -6,18 +6,6 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0),
 and this project adheres to
 [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## [1.0.7] - 2025-05-07
-- remove unused APT dependencies
-- upgrade to gunicorn 23.0.0
-
-## [1.0.6] - 2025-03-11
-- upgrade to SATOSA 8.5.1
-- allow faculty, staff, employee, researcher, teacher affiliations
-
-## [1.0.5] - 2025-03-06
-- add allowlist for URL paths to nginx ingress
-- allow customizing log levels per logger
-
 ## [1.0.4] - 2024-09-11
 - serve static files
 

Dockerfile

@@ -1,11 +1,17 @@
 # ---- base image to inherit from ----
-FROM python:3.11.12-slim-bookworm AS common
+FROM python:3.11-slim-bookworm as common
 
 # Install xmlsec1 dependencies required for xmlsec (for SAML)
 # Needs to be kept before the `pip install`
 RUN apt-get update && \
     apt-get -y upgrade && \
-    apt-get install -qy --no-install-recommends xmlsec1 && \
+    apt-get install -y \
+        pkg-config \
+        gcc \
+        xmlsec1 \
+        libxml2-dev \
+        libxmlsec1-dev \
+        libxmlsec1-openssl && \
     rm -rf /var/lib/apt/lists/*
 
 # We want the most up-to-date stable pip release
@@ -13,7 +19,7 @@ RUN pip install --upgrade pip
 
 ENV PYTHONUNBUFFERED=1
 
-# Give the "root" group the same permissions AS the "root" user on /etc/passwd
+# Give the "root" group the same permissions as the "root" user on /etc/passwd
 # to allow a user belonging to the root group to add new users; typically the
 # docker user (see entrypoint).
 RUN chmod g=u /etc/passwd
@@ -35,7 +41,7 @@ COPY docker/files/usr/local/etc/gunicorn/satosa.py /usr/local/etc/gunicorn/satos
 CMD ["gunicorn", "-c", "/usr/local/etc/gunicorn/satosa.py"]
 
 # ---- Development image ----
-FROM common AS development
+FROM common as development
 
 # Playwright browsers
 ENV PLAYWRIGHT_BROWSERS_PATH=/pw-browsers
@@ -61,7 +67,7 @@ COPY ./src/satosa /app/
 USER ${DOCKER_USER}
 
 # ---- Production image (keep last so it is the default target) ----
-FROM common AS production
+FROM common as production
 
 # Copy oidc2fer application (see .dockerignore)
 COPY ./src/satosa /app/

README.md

@@ -63,13 +63,6 @@ number and date.
 3. Commit and push to `main`.
 4. Update the `production` tag and push it.
 
-## Environment variables
-
-| variable | usage |
-| --- | --- |
-| `LOG_LEVEL` | Sets the log level for the root logger, i.e. the default. Defaults to `INFO`. |
-| `LOG_LEVELS` | A JSON object that can be used to set log levels for specific loggers, e.g. `{"satosa.backends.saml2": "DEBUG"}`. Defaults to `{}`. |
-
 ## Contributing
 
 This project is intended to be community-driven, so please, do not hesitate to

docker-compose.yml

@@ -13,7 +13,7 @@ services:
       BASE_URL: https://satosa.traefik.me
       GUNICORN_CMD_ARGS: --workers=2
       TEST_E2E: 1
-      #TEST_E2E_PC: 1
+      #TEST_E2E_AC: 1
       OIDC_DB_URI: redis://redis/0
       CLIENT_DB_JSON: |
         {
@@ -30,7 +30,7 @@ services:
           }
         }
       SAML2_DISCOVERY_URL: https://discovery.renater.fr/test/
-      SAML2_MDQ_URL: https://mdq.federation.renater.fr/test
+      SAML2_METADATA_URL: https://pub.federation.renater.fr/metadata/test/preview/preview-idps-test-metadata.xml
       SAML2_ENTITY_ID: https://satosa.traefik.me/Saml2/proxy_saml2_backend.xml
     env_file:
       - env.d/development/common

docker/files/usr/local/etc/gunicorn/satosa.py

@@ -1,5 +1,4 @@
 import datetime
-import json
 import logging
 import os
 import sys
@@ -30,8 +29,6 @@ class RequestJSONFormatter(json_log_formatter.JSONFormatter):
             url += f"?{record.args['q']}"
 
         return {
-            "logger": record.name,
-            "level": record.levelname,
             "remote_ip": record.args["h"],
             "method": record.args["m"],
             "path": url,
@@ -40,7 +37,7 @@ class RequestJSONFormatter(json_log_formatter.JSONFormatter):
             "user_agent": record.args["a"],
             "referer": record.args["f"],
             "duration_in_ms": record.args["M"],
-            "pid": record.process,
+            "poppid": record.process,
         }
 
 
@@ -58,23 +55,11 @@ class DefaultJSONFormatter(json_log_formatter.JSONFormatter):
         payload: dict[str, str | int | float] = super().json_record(
             message, extra, record
         )
-        payload["logger"] = record.name
         payload["level"] = record.levelname
         payload["pid"] = record.process
         return payload
 
 
-class NoPingFilter(logging.Filter):
-    """
-    Filters out /ping requests from the access log.
-    """
-
-    def filter(self, record: logging.LogRecord) -> bool:
-        return not( record.args.get("m", "") == "GET"
-                   and record.args.get("U", "") == "/ping"
-                   and str(record.args.get("s", "")) == "200" )
-
-
 bind = ["0.0.0.0:8000"]
 name = "satosa"
 python_path = "/app"
@@ -91,9 +76,6 @@ accesslog = "-"
 errorlog = "-"
 loglevel = os.environ.get("LOG_LEVEL", "INFO")
 
-loglevels_json = os.environ.get("LOG_LEVELS", "{}")
-loglevels = json.loads(loglevels_json)
-
 logconfig_dict = {
     "version": 1,
     "disable_existing_loggers": True,
@@ -113,24 +95,7 @@ logconfig_dict = {
             "handlers": ["json_request"],
             "propagate": False,
             "qualname": "gunicorn.access",
-            "filters": [NoPingFilter()],
         },
-        "satosa.base": {
-            "level": "INFO",
-        },
-        "satosa.state": {
-            "level": "INFO",
-        },
-        "satosa.proxy_server": {
-            "level": "INFO",
-        },
-        "satosa.routing": {
-            "level": "INFO",
-        },
-        "satosa.frontends.ping": {
-            "level": "INFO",
-        },
-        **{k: {"level": v.upper()} for k, v in loglevels.items()},
     },
     "formatters": {
         "json_request": {

src/helm/env.d/dev/values.oidc2fer.yaml.gotmpl

@@ -12,7 +12,7 @@ satosa:
     LOG_LEVEL: debug
 
     SAML2_DISCOVERY_URL: https://discovery.renater.fr/test/
-    SAML2_MDQ_URL: https://mdq.federation.renater.fr/test
+    SAML2_METADATA_URL: https://pub.federation.renater.fr/metadata/test/preview/preview-idps-test-metadata.xml
     SAML2_ENTITY_ID:  https://oidc2fer.127.0.0.1.nip.io/Saml2/proxy_saml2_backend.xml
 
     STATE_ENCRYPTION_KEY: { secretKeyRef: { name: oidc2fer, key: STATE_ENCRYPTION_KEY } }

src/helm/env.d/outscale-production/values.oidc2fer.yaml.gotmpl

@@ -1,7 +1,7 @@
 image:
   repository: lasuite/oidc2fer
   pullPolicy: Always
-  tag: "v1.0.7"
+  tag: "v1.0.4"
 
 satosa:
   replicas: 2
@@ -9,11 +9,10 @@ satosa:
     BASE_URL: https://renater.agentconnect.gouv.fr
     GUNICORN_CMD_ARGS: --workers=3
 
-    LOG_LEVEL: INFO
-    LOG_LEVELS: '{ "satosa.backends.saml2": "DEBUG" }'
+    LOG_LEVEL: debug
 
     SAML2_DISCOVERY_URL: https://discovery.renater.fr/agentconnect/
-    SAML2_MDQ_URL: https://mdq.federation.renater.fr/fer
+    SAML2_METADATA_URL: https://pub.federation.renater.fr/metadata/renater/main/main-idps-renater-metadata.xml
     SAML2_ENTITY_ID:  https://renater.agentconnect.gouv.fr/Saml2/proxy_saml2_backend.xml
 
     STATE_ENCRYPTION_KEY: { secretKeyRef: { name: oidc2fer, key: STATE_ENCRYPTION_KEY } }

src/helm/env.d/staging/values.oidc2fer.yaml.gotmpl

@@ -9,11 +9,10 @@ satosa:
     BASE_URL: https://oidc2fer-staging.beta.numerique.gouv.fr
     GUNICORN_CMD_ARGS: --workers=3
 
-    LOG_LEVEL: DEBUG
-    LOG_LEVELS: '{ "satosa.backends.saml2": "DEBUG" }'
+    LOG_LEVEL: debug
 
     SAML2_DISCOVERY_URL: https://discovery.renater.fr/test/
-    SAML2_MDQ_URL: https://mdq.federation.renater.fr/test
+    SAML2_METADATA_URL: https://pub.federation.renater.fr/metadata/test/preview/preview-idps-test-metadata.xml
     SAML2_ENTITY_ID:  https://oidc2fer-staging.beta.numerique.gouv.fr/Saml2/proxy_saml2_backend.xml-test
 
     STATE_ENCRYPTION_KEY: { secretKeyRef: { name: oidc2fer, key: STATE_ENCRYPTION_KEY } }

src/helm/oidc2fer/templates/ingress.yaml

@@ -1,6 +1,5 @@
 {{- if .Values.ingress.enabled -}}
 {{- $fullName := include "oidc2fer.fullname" . -}}
-{{- $port := .Values.satosa.service.port -}}
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
@@ -34,15 +33,13 @@ spec:
     - host: {{ .Values.ingress.host | quote }}
       http:
         paths:
-          {{- range .Values.ingress.paths }}
-          - path: {{ .path | quote }}
-            pathType: {{ .pathType }}
+          - path: /
+            pathType: Prefix
             backend:
               service:
-                name: {{ $fullName }}-satosa
+                name: {{ include "oidc2fer.satosa.fullname" . }}
                 port:
-                  number: {{ $port }}
-          {{- end }}
+                  number: {{ .Values.satosa.service.port }}
           {{- with .Values.ingress.customBackends }}
             {{- toYaml . | nindent 10 }}
           {{- end }}

src/helm/oidc2fer/values.yaml

@@ -33,9 +33,7 @@ ingress:
   enabled: false
   className: null
   host: oidc2fer.example.com
-  paths:
-  - path: '/$|^/\.well-known/openid-configuration$|^/images/|^/Saml2/|^/OIDC/|^/ping$'
-    pathType: ImplementationSpecific # enables regex matching
+  path: /
   ## @param ingress.hosts Additional host to configure for the Ingress
   hosts: []
   #  - chart-example.local
@@ -50,9 +48,6 @@ ingress:
   ## @param ingress.customBackends Add custom backends to ingress
   customBackends: []
 
-  annotations:
-    nginx.ingress.kubernetes.io/use-regex: "true"
-
 ## @section satosa
 
 satosa:

src/satosa/plugins/backends/saml2_backend.yaml

@@ -3,11 +3,11 @@ name: Saml2
 config:
   disco_srv: !ENV SAML2_DISCOVERY_URL
   entityid_endpoint: true
-  mirror_force_authn: false
-  memorize_idp: false
-  use_memorized_idp_when_force_authn: false
-  send_requester_id: false
-  enable_metadata_reload: false
+  mirror_force_authn: 'no'
+  memorize_idp: 'no'
+  use_memorized_idp_when_force_authn: 'no'
+  send_requester_id: 'no'
+  enable_metadata_reload: 'no'
   acs_selection_strategy: prefer_matching_host
   sp_config:
     name: Passerelle OIDC vers FER
@@ -19,9 +19,10 @@ config:
       display_name: DINUM
       url: https://beta.gouv.fr/incubateurs/dinum_produits_interministeriels.html
     metadata:
-      mdq:
-        - url: !ENV SAML2_MDQ_URL
-          freshness_period: "P0Y0M0DT1H0M10S"
+      # mdq:
+      #   - url: https://mdq.federation.renater.fr
+      remote:
+        - url: !ENV SAML2_METADATA_URL
     entityid: !ENV SAML2_ENTITY_ID
     accepted_time_diff: 60
     allow_unknown_attributes: true

src/satosa/plugins/microservices/attribute_authorization.yaml

@@ -13,8 +13,4 @@ config:
           # later in the PrimaryIdentifier processor.
           - ".+"
         eduPersonAffiliation:
-          - "^faculty$"
-          - "^staff$"
           - "^employee$"
-          - "^researcher$"
-          - "^teacher$"

src/satosa/pyproject.toml

@@ -23,8 +23,8 @@ license = { file = "LICENSE" }
 readme = "README.md"
 requires-python = ">=3.11"
 dependencies = [
-    "SATOSA==8.5.1",
-    "gunicorn==23.0.0",
+    "SATOSA==8.4.0",
+    "gunicorn==22.0.0",
     "redis==5.0.4",
     "JSON-log-formatter==1.0",
     "WhiteNoise==6.7.0",

src/satosa/tests/test_e2e.py

@@ -75,26 +75,26 @@ def test_oidc_to_renater_student_not_allowed(page: Page):
     expect(page.locator("pre")).to_contain_text('"error":"access_denied"')
 
 
-def pro_connect_login(page: Page, email):
+def agent_connect_login(page: Page, email):
     page.goto("https://fsa1v2.integ01.dev-agentconnect.fr/")
-    page.get_by_role("button", name="S’identifier avec ProConnect").click()
+    page.get_by_label("Connexion à AgentConnect").click()
     page.get_by_label("Email professionnel").fill(email)
     page.get_by_test_id("interaction-connection-button").click()
 
 
-def pro_connect_to_renater(
+def agent_connect_to_renater(
     page: Page,
     login="enseignant1",
     expected_email="georges.grospieds@formation.renater.fr",
     expected_given_name="Georges",
     expected_usual_name="Grospieds",
 ):
-    pro_connect_login(page, email=expected_email)
+    agent_connect_login(page, email=expected_email)
     renater_wayf(page)
     renater_test_idp(page, login=login)
 
     expect(page.locator("body")).to_contain_text(expected_email)
-    text = page.inner_text("#userinfo")
+    text = page.inner_text("#json")
     result = json.loads(text)
     assert {
         "uid": f"{login}@test-renater.fr",
@@ -106,22 +106,22 @@ def pro_connect_to_renater(
 
 
 @pytest.mark.skipif(
-    "TEST_E2E_PC" not in os.environ, reason="Depends on staging deployment"
+    "TEST_E2E_AC" not in os.environ, reason="Depends on staging deployment"
 )
-def test_pro_connect_to_renater_keeps_sub(browser: Browser):
+def test_agent_connect_to_renater_keeps_sub(browser: Browser):
     with browser.new_context().new_page() as page:
-        result1 = pro_connect_to_renater(page)
+        result1 = agent_connect_to_renater(page)
     with browser.new_context().new_page() as page:
-        result2 = pro_connect_to_renater(page)
+        result2 = agent_connect_to_renater(page)
 
     assert result1["sub"] == result2["sub"]
 
 
 @pytest.mark.skipif(
-    "TEST_E2E_PC" not in os.environ, reason="Depends on staging deployment"
+    "TEST_E2E_AC" not in os.environ, reason="Depends on staging deployment"
 )
-def test_pro_connect_to_renater_student_not_allowed(page: Page):
-    pro_connect_login(page, email="jean.dupont@formation.renater.fr")
+def test_agent_connect_to_renater_student_not_allowed(page: Page):
+    agent_connect_login(page, email="jean.dupont@formation.renater.fr")
     renater_wayf(page)
     renater_test_idp(page, login="etudiant1")