🐛(ci) fix helmfile linter

Latest helmfile version breaks lots of thing.

.github/ISSUE_TEMPLATE/Support_question.md

@@ -9,9 +9,9 @@ We primarily use GitHub as an issue tracker. If however you're encountering an i
 
 ---
 
-Please make sure you have read our [main Readme](https://github.com/proconnect-gouv/oidc2fer).
+Please make sure you have read our [main Readme](https://github.com/numerique-gouv/oidc2fer).
 
-Also make sure it was not already answered in [an open or close issue](https://github.com/proconnect-gouv/oidc2fer/issues).
+Also make sure it was not already answered in [an open or close issue](https://github.com/numerique-gouv/oidc2fer/issues).
 
 If your question was not covered, and you feel like it should be, fire away! We'd love to improve our docs! 👌
 

.github/workflows/build-docker.yml

@@ -1,67 +0,0 @@
-name: 🐳 Build docker images
-
-on:
-  push:
-    branches:
-      - 'main'
-    tags:
-      - 'v*'
-  pull_request:
-    branches:
-      - 'main'
-
-jobs:
-  build-and-push:
-    runs-on: ubuntu-latest
-    permissions:
-      packages: write
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
-
-      - name: Docker meta
-        id: meta
-        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5
-        with:
-          images: ghcr.io/${{ github.repository }}
-          tags: |
-            type=ref,event=branch
-            type=ref,event=tag
-            type=ref,event=pr
-            type=sha,prefix=sha-
-            # set latest tag for default branch
-            type=raw,value=latest,enable={{is_default_branch}}
-
-      - name: Login to Github Container Registry
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
-        with:
-          registry: ghcr.io
-          username: ${{ github.repository_owner }}
-          password: ${{ github.token }}
-
-      - name: Build and push
-        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
-        with:
-          context: .
-          target: production
-          platforms: linux/amd64,linux/arm64
-          push: true
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
-
-  notify-argocd:
-    runs-on: ubuntu-latest
-    if: |
-      github.event_name != 'pull_request'
-    needs:
-      - build-and-push
-    steps:
-      - uses: numerique-gouv/action-argocd-webhook-notification@cac2ee67896eb13e84e804f60c4271370424eaa8 # main
-        id: notify
-        with:
-          deployment_repo_path: "${{ github.repository }}"
-          argocd_webhook_secret: "${{ secrets.ARGOCD_PREPROD_WEBHOOK_SECRET }}"
-          argocd_url: "${{ vars.ARGOCD_PREPROD_WEBHOOK_URL }}"

.github/workflows/docker-hub.yml

@@ -0,0 +1,73 @@
+name: Docker Hub Workflow
+
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - 'main'
+    tags:
+      - 'v*'
+  pull_request:
+    branches:
+      - 'main'
+
+jobs:
+  build-and-push:
+    runs-on: ubuntu-latest
+    steps:
+      -
+        uses: actions/create-github-app-token@v1
+        id: app-token
+        with:
+          app-id: ${{ secrets.APP_ID }}
+          private-key: ${{ secrets.PRIVATE_KEY }}
+          owner: ${{ github.repository_owner }}
+          repositories: "oidc2fer,secrets"
+      -
+        name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          submodules: recursive
+          token: ${{ steps.app-token.outputs.token }}
+      -
+        name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+      -
+        name: Docker meta
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: lasuite/oidc2fer
+      -
+        name: Load sops secrets
+        uses: rouja/actions-sops@main
+        with:
+          secret-file: secrets/numerique-gouv/oidc2fer/secrets.enc.env
+          age-key: ${{ secrets.SOPS_PRIVATE }}
+      -
+        name: Login to DockerHub
+        run: echo "$DOCKER_HUB_PASSWORD" | docker login -u "$DOCKER_HUB_USER" --password-stdin
+      -
+        name: Build and push
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          target: production
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+
+  notify-argocd:
+    runs-on: ubuntu-latest
+    if: |
+      github.event_name != 'pull_request'
+    needs:
+      - build-and-push
+    steps:
+      - uses: numerique-gouv/action-argocd-webhook-notification@main
+        id: notify
+        with:
+          deployment_repo_path: "${{ github.repository }}"
+          argocd_webhook_secret: "${{ secrets.ARGOCD_PREPROD_WEBHOOK_SECRET }}"
+          argocd_url: "${{ vars.ARGOCD_PREPROD_WEBHOOK_URL }}"

.github/workflows/helmfile-linter.yml

@@ -0,0 +1,22 @@
+name: Helmfile lint
+run-name: Helmfile lint
+
+on:
+  pull_request:
+    branches:
+      - 'main'
+
+jobs:
+  helmfile-lint:
+    runs-on: ubuntu-latest
+    container:
+      image: ghcr.io/helmfile/helmfile:v0.171.0
+    steps:
+      -
+        uses: numerique-gouv/action-helmfile-lint@main
+        with:
+          app-id: ${{ secrets.APP_ID }}
+          age-key: ${{ secrets.SOPS_PRIVATE }}
+          private-key: ${{ secrets.PRIVATE_KEY }}
+          helmfile-src: "src/helm"
+          repositories: "oidc2fer,secrets"

.github/workflows/oidc2fer.yml

@@ -1,4 +1,4 @@
-name: 💚 CI Tests
+name: OIDC2FER Workflow
 
 on:
   push:
@@ -16,14 +16,14 @@ jobs:
     if: github.event_name == 'pull_request' # Makes sense only for pull requests
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@v4
         with:
             fetch-depth: 0
       - name: show
         run: git log
       - name: Enforce absence of print statements in code
         run: |
-          ! git diff origin/${{ github.event.pull_request.base.ref }}..HEAD -- . ':(exclude).github/**' | grep "print("
+          ! git diff origin/${{ github.event.pull_request.base.ref }}..HEAD -- . ':(exclude)**/oidc2fer.yml' | grep "print("
       - name: Check absence of fixup commits
         run: |
           ! git log | grep 'fixup!'
@@ -39,17 +39,17 @@ jobs:
       github.event_name == 'pull_request'
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@v4
         with:
             fetch-depth: 0
       - name: Check that the CHANGELOG has been modified in the current branch
-        run: git log --name-only --pretty="" origin/${{ github.event.pull_request.base.ref }}..HEAD | grep CHANGELOG
+        run: git whatchanged --name-only --pretty="" origin/${{ github.event.pull_request.base.ref }}..HEAD | grep CHANGELOG
 
   lint-changelog:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@v4
       - name: Check CHANGELOG max line length
         run: |
           max_line_length=$(cat CHANGELOG.md | grep -Ev "^\[.*\]: https://github.com" | wc -L)
@@ -65,11 +65,11 @@ jobs:
         working-directory: src/satosa
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@v4
       - name: Install Python
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
+        uses: actions/setup-python@v3
         with:
-          python-version: '3.14'
+          python-version: '3.11'
       - name: Install development dependencies
         run: |
           # Python's xmlsec requirement
@@ -89,11 +89,11 @@ jobs:
         working-directory: src/satosa
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@v4
       - name: Install Python
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
+        uses: actions/setup-python@v3
         with:
-          python-version: '3.14'
+          python-version: '3.11'
       - name: Install development dependencies
         run: |
           # Python's xmlsec requirement
@@ -101,37 +101,3 @@ jobs:
           pip install --user .[dev]
       - name: Run tests
         run: ~/.local/bin/pytest
-
-  helmfile-lint:
-    runs-on: ubuntu-latest
-    # skip this job on forks since they won't have access to the required secrets
-    if: github.event.pull_request.head.repo.full_name == github.repository || github.event_name != 'pull_request'
-    container:
-      image: ghcr.io/helmfile/helmfile:v1.2.0
-    steps:
-      -
-        uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2
-        id: app-token
-        with:
-          app-id: ${{ secrets.APP_ID }}
-          private-key: ${{ secrets.PRIVATE_KEY }}
-          owner: numerique-gouv
-          repositories: secrets
-      -
-        name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-        with:
-          submodules: recursive
-          token: ${{ steps.app-token.outputs.token }}
-      -
-        name: Helmfile lint
-        env:
-          SOPS_AGE_KEY: ${{ secrets.SOPS_PRIVATE }}
-        run: |
-          HELMFILE=src/helm/helmfile.yaml.gotmpl
-          environments=$(< $HELMFILE awk -F'[ :]+' '/^  [^ ]/ {print $2} /^---/ { exit }')
-          for env in $environments; do
-            echo "################### $env lint ###################"
-            helmfile -e $env -f "$HELMFILE" lint || exit 1
-            echo -e "\n"
-          done

.gitmodules

@@ -1,3 +1,3 @@
 [submodule "secrets"]
 	path = secrets
-	url = ../../numerique-gouv/secrets
+	url = ../secrets

CHANGELOG.md

@@ -6,28 +6,6 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0),
 and this project adheres to
 [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## [1.0.12] - 2026-03-02
-- upgrade dependencies: Python 3.14.3, gunicorn 25.1.0…
-
-## [1.0.11] - 2025-11-24
-- remove setuptools, wheel and pip from production Docker image
-
-## [1.0.10] - 2025-11-21
-- rename helmfile.yaml for compatibility with helmfile 1.x
-
-## [1.0.9] - 2025-10-03
-- map SAML entity IDs to SIRET (#34)
-- include ACR claim in ID token only if requested (#32)
-
-## [1.0.8] - 2025-09-10
-- fix secrets submodule path following move to `proconnect-gouv` organization
-- update other references to `numerique-gouv` organization
-- publish Docker images at ghcr.io/proconnect-gouv/oidc2fer
-
-## [1.0.7] - 2025-05-07
-- remove unused APT dependencies
-- upgrade to gunicorn 23.0.0
-
 ## [1.0.6] - 2025-03-11
 - upgrade to SATOSA 8.5.1
 - allow faculty, staff, employee, researcher, teacher affiliations

Dockerfile

@@ -1,23 +1,25 @@
 # ---- base image to inherit from ----
-FROM python:3.14.3-slim-trixie AS common
+FROM python:3.11-slim-bookworm as common
 
 # Install xmlsec1 dependencies required for xmlsec (for SAML)
 # Needs to be kept before the `pip install`
-RUN export DEBIAN_FRONTEND=noninteractive && \
-    apt-get update && \
+RUN apt-get update && \
     apt-get -y upgrade && \
-    apt-get install -qy --no-install-recommends xmlsec1 && \
+    apt-get install -y \
+        pkg-config \
+        gcc \
+        xmlsec1 \
+        libxml2-dev \
+        libxmlsec1-dev \
+        libxmlsec1-openssl && \
     rm -rf /var/lib/apt/lists/*
 
-# Silence pip warnings about running as root in a container
-ENV PIP_ROOT_USER_ACTION=ignore
-
 # We want the most up-to-date stable pip release
 RUN pip install --upgrade pip
 
 ENV PYTHONUNBUFFERED=1
 
-# Give the "root" group the same permissions AS the "root" user on /etc/passwd
+# Give the "root" group the same permissions as the "root" user on /etc/passwd
 # to allow a user belonging to the root group to add new users; typically the
 # docker user (see entrypoint).
 RUN chmod g=u /etc/passwd
@@ -39,11 +41,7 @@ COPY docker/files/usr/local/etc/gunicorn/satosa.py /usr/local/etc/gunicorn/satos
 CMD ["gunicorn", "-c", "/usr/local/etc/gunicorn/satosa.py"]
 
 # ---- Development image ----
-FROM common AS development
-
-# Install curl (for healthchecks)
-RUN export DEBIAN_FRONTEND=noninteractive && \
-    apt-get update && apt-get install -qy curl
+FROM common as development
 
 # Playwright browsers
 ENV PLAYWRIGHT_BROWSERS_PATH=/pw-browsers
@@ -69,15 +67,14 @@ COPY ./src/satosa /app/
 USER ${DOCKER_USER}
 
 # ---- Production image (keep last so it is the default target) ----
-FROM common AS production
+FROM common as production
 
 # Copy oidc2fer application (see .dockerignore)
 COPY ./src/satosa /app/
 
 WORKDIR /app
 
-# Uninstall pip, setuptools and wheel after installation to reduce attack surface
-RUN pip install . && pip uninstall -y setuptools wheel pip
+RUN pip install .
 
 # Switch to unprivileged user
 USER ${DOCKER_USER}

README.md

@@ -57,7 +57,7 @@ number and date.
 ## Deploying a release to production (DINUM instance)
 
 1. Make sure the release you want to deploy has been built and appears on
-   https://github.com/proconnect-gouv/oidc2fer/pkgs/container/oidc2fer
+   https://hub.docker.com/r/lasuite/oidc2fer/tags .
 2. Edit `image/tag` at the top of
    `src/helm/env.d/outscale-production/values.oidc2fer.yaml.gotmpl`.
 3. Commit and push to `main`.

docker-compose.yml

@@ -30,7 +30,7 @@ services:
           }
         }
       SAML2_DISCOVERY_URL: https://discovery.renater.fr/test/
-      SAML2_METADATA_URL: https://pub.federation.renater.fr/metadata/test/idps.xml
+      SAML2_METADATA_URL: https://pub.federation.renater.fr/metadata/test/preview/preview-idps-test-metadata.xml
       SAML2_ENTITY_ID: https://satosa.traefik.me/Saml2/proxy_saml2_backend.xml
     env_file:
       - env.d/development/common
@@ -40,13 +40,6 @@ services:
       - ./docker/files/usr/local/etc/gunicorn/satosa.py:/usr/local/etc/gunicorn/satosa.py
     depends_on:
       - redis
-    healthcheck:
-      test: ["CMD", "curl", "--fail", "http://localhost:8000/ping"]
-      interval: 60s
-      timeout: 5s
-      retries: 3
-      start_period: 30s
-      start_interval: 1s
 
   oidc-test-client:
     build: docker/oidc-test-client
@@ -73,7 +66,7 @@ services:
       #OIDC_PROVIDER: https://oidc2fer-staging.beta.numerique.gouv.fr
       OIDC_CLIENT_ID: oidc-test-client
       OIDC_CLIENT_SECRET: oidc-test-secret
-      OIDC_SCOPES: openid,uid,given_name,usual_name,email,siret
+      OIDC_SCOPES: openid,uid,given_name,usual_name,email
     extra_hosts:
       - "oidc2fer.127.0.0.1.nip.io:host-gateway"
 

docker/oidc-test-client/Dockerfile

@@ -1,4 +1,4 @@
-FROM python:3.14
+FROM python:3.11
 
 COPY . /app
 

docker/oidc-test-client/app.py

@@ -2,10 +2,13 @@ from flask import Flask, jsonify, request, session
 from oic.oic import Client
 from oic.utils.authn.client import CLIENT_AUTHN_METHOD
 from oic import rndstr
-from oic.oic.message import Claims, ClaimsRequest, RegistrationResponse
+from oic.oic.message import RegistrationResponse
 from oic.utils.http_util import Redirect
 from oic.oic.message import AuthorizationResponse
 import secrets
+import webbrowser
+import threading
+import time
 import logging
 import os
 
@@ -49,7 +52,6 @@ def index():
             "nonce": session["nonce"],
             "redirect_uri": client.registration_response["redirect_uris"][0],
             "state": session["state"],
-            "claims": ClaimsRequest(id_token=Claims(acr=None, amr=None)),
         }
     )
     login_url = auth_req.request(client.authorization_endpoint)

docker/oidc-test-client/requirements.txt

@@ -1,2 +1,2 @@
 Flask==3.0.3
-oic==1.7.0
+oic==1.6.1

src/helm/env.d/dev/values.oidc2fer.yaml.gotmpl

@@ -12,7 +12,7 @@ satosa:
     LOG_LEVEL: debug
 
     SAML2_DISCOVERY_URL: https://discovery.renater.fr/test/
-    SAML2_METADATA_URL: https://pub.federation.renater.fr/metadata/test/idps.xml
+    SAML2_METADATA_URL: https://pub.federation.renater.fr/metadata/test/preview/preview-idps-test-metadata.xml
     SAML2_ENTITY_ID:  https://oidc2fer.127.0.0.1.nip.io/Saml2/proxy_saml2_backend.xml
 
     STATE_ENCRYPTION_KEY: { secretKeyRef: { name: oidc2fer, key: STATE_ENCRYPTION_KEY } }
@@ -36,10 +36,6 @@ satosa:
           "token_endpoint_auth_method": "client_secret_post"
         }
       }
-    SIRET_MAP: |-
-      {
-          "https://test-idp.federation.renater.fr/idp/shibboleth": "12345678200010"
-      }
 
 ingress:
   enabled: true

src/helm/env.d/outscale-production/values.oidc2fer.yaml.gotmpl

@@ -1,7 +1,7 @@
 image:
-  repository: ghcr.io/proconnect-gouv/oidc2fer
+  repository: lasuite/oidc2fer
   pullPolicy: Always
-  tag: "v1.0.11"
+  tag: "v1.0.6"
 
 satosa:
   replicas: 2
@@ -13,7 +13,7 @@ satosa:
     LOG_LEVELS: '{ "satosa.backends.saml2": "DEBUG" }'
 
     SAML2_DISCOVERY_URL: https://discovery.renater.fr/agentconnect/
-    SAML2_METADATA_URL: https://pub.federation.renater.fr/metadata/fer/idps.xml
+    SAML2_METADATA_URL: https://pub.federation.renater.fr/metadata/renater/main/main-idps-renater-metadata.xml
     SAML2_ENTITY_ID:  https://renater.agentconnect.gouv.fr/Saml2/proxy_saml2_backend.xml
 
     STATE_ENCRYPTION_KEY: { secretKeyRef: { name: oidc2fer, key: STATE_ENCRYPTION_KEY } }
@@ -24,112 +24,6 @@ satosa:
 
     OIDC_DB_URI: { secretKeyRef: { name: redis.redis.libre.sh, key: url } }
 
-    # As provided by RENATER
-    SIRET_MAP: |-
-      {
-        "http://idp.univ-poitiers.fr": "19860856400375",
-        "https://apps.univ-lr.fr/idp/shibboleth": "19170032700015",
-        "https://auth.sso.vet-alfort.fr/saml/metadata": "19940608300014",
-        "https://auth.uttop.fr/saml/metadata": "19650048200019",
-        "https://authentification.inrae.fr/saml/metadata/idp": "18007003901803",
-        "https://federation.ens.psl.eu/idp/shibboleth": "19753459700012",
-        "https://federation.umontpellier.fr/idp/shibboleth": "13002979600013",
-        "https://federation.unimes.fr/idp/shibboleth": "93249157400012",
-        "https://federation.upf.pf/idp/shibboleth": "19987001500013",
-        "https://federation.utbm.fr/idp/shibboleth": "19900356700013",
-        "https://federation3.univ-brest.fr/idp/shibboleth": "94129831700012",
-        "https://idauthproxy.insa-lyon.fr/Saml2IDP/metadata": "19690192000013",
-        "https://ident-shib.ensc-rennes.fr/idp/shibboleth": "19350077400016",
-        "https://identification.univ-toulouse.fr": "13002132200016",
-        "https://identites.ec-lyon.fr/idp/shibboleth": "19690187000010",
-        "https://identites.ensea.fr/idp/shibboleth": "19951376300011",
-        "https://identities.univ-jfc.fr/idp/prod": "19811201300018",
-        "https://idp-genci.renater.fr/idp/shibboleth": "49468697500041",
-        "https://idp-ng.univ-st-etienne.fr/idp/shibboleth": "93850168100010",
-        "https://idp-septa.onisep.fr/idp/shibboleth": "18004302800653",
-        "https://idp-v4.univ-montp3.fr/idp/shibboleth": "93249089900014",
-        "https://idp.bnu.fr/idp/shibboleth": "18004406700015",
-        "https://idp.cirad.fr/idp/shibboleth": "33159627000016",
-        "https://idp.crous-reims.fr/idp/shibboleth": "18510200100327",
-        "https://idp.ec-nantes.fr/idp/shibboleth": "19440100600011",
-        "https://idp.ehesp.fr/idp/shibboleth": "13000362700010",
-        "https://idp.ens-lyon.fr/idp/shibboleth": "13000812100019",
-        "https://idp.ensam.eu/idp/shibboleth": "19753472000010",
-        "https://idp.ensfea.fr/idp/shibboleth": "19310143300012",
-        "https://idp.ensma.fr/idp/shibboleth": "19860073600021",
-        "https://idp.ent.dauphine.fr/idp/shibboleth": "19754692200018",
-        "https://idp.imt-atlantique.fr/idp/shibboleth": "18009202500121",
-        "https://idp.inha.fr/idp/shibboleth": "19754688000018",
-        "https://idp.inp-toulouse.fr/idp/shibboleth": "19311381800127",
-        "https://idp.insa-rennes.fr/idp/shibboleth": "19350097200016",
-        "https://idp.institut-agro.fr/idp": "13002622200013",
-        "https://idp.isae.fr/idp/shibboleth": "13000427800011",
-        "https://idp.lyon.archi.fr/idp/shibboleth": "19690184700018",
-        "https://idp.renater.fr/idp/shibboleth": "18008947600055",
-        "https://idp.rennes.archi.fr/idp/shibboleth": "19350089900029",
-        "https://idp.sciencespo-lyon.fr/idp/shibboleth": "19690173000024",
-        "https://idp.sciencespobordeaux.fr/idp/shibboleth": "19330192600039",
-        "https://idp.uca.fr/idp/shibboleth": "13002806100013",
-        "https://idp.uha.fr/idp/shibboleth": "19681166500013",
-        "https://idp.unistra.fr/idp/shibboleth": "13000545700010",
-        "https://idp.univ-avignon.fr/idp/shibboleth": "19840685200204",
-        "https://idp.univ-cotedazur.fr/idp/shibboleth": "13002566100013",
-        "https://idp.univ-eiffel.fr/idp/shibboleth": "13002612300013",
-        "https://idp.univ-lemans.fr/idp/shibboleth": "19720916600010",
-        "https://idp.univ-lille.fr/idp/shibboleth": "13002975400012",
-        "https://idp.univ-lyon2.fr/idp/shibboleth": "19691775100014",
-        "https://idp.univ-lyon3.fr/idp/shibboleth": "19692437700282",
-        "https://idp.univ-orleans.fr/idp/shibboleth": "19450855200016",
-        "https://idp.univ-perp.fr/idp/shibboleth": "19660437500010",
-        "https://idp.univ-tln.fr/idp/shibboleth": "19830766200017",
-        "https://idp.univ-tlse3.fr/idp/shibboleth": "93827139200012",
-        "https://idp.univ-tours.fr/idp/shibboleth": "19370800500478",
-        "https://idp.universite-paris-saclay.fr/idp": "13002602400054",
-        "https://idp1.agroparistech.fr/idp/shibboleth": "13000285000134",
-        "https://idp1.ens-paris-saclay.fr/idp/shibboleth": "19940607500036",
-        "https://idp1.univ-fcomte.fr/idp/shibboleth": "93810656400017",
-        "https://idp2.amue.fr/idp/shibboleth": "18004312700091",
-        "https://idp2.brgm.fr/idp/shibboleth": "58205614900120",
-        "https://idp2.emse.fr/idp/shibboleth": "18009202500105",
-        "https://idp2.univ-paris8.fr/idp/shibboleth": "19931827000014",
-        "https://idp3.univ-lorraine.fr/idp/shibboleth": "13001550600012",
-        "https://idp3.ut-capitole.fr/idp/shibboleth": "13003061200019",
-        "https://idp4.unicaen.fr/idp/shibboleth": "19141408500016",
-        "https://idpv3.univ-amu.fr/idp/shibboleth": "13001533200013",
-        "https://janus.cnrs.fr/idp": "18008901303720",
-        "https://multipass.imt-nord-europe.fr/idp/shibboleth": "18009202500139",
-        "https://papangue.vetagro-sup.fr/idp/shibboleth": "13000858400018",
-        "https://prod-idp.inria.fr": "18008904700013",
-        "https://ruhnu.univ-tlse2.fr/idp/shibboleth": "19311383400017",
-        "https://shib.mines-albi.fr/idp/shibboleth": "18009202500097",
-        "https://shib.univ-lehavre.fr/idp/shibboleth": "19762762300097",
-        "https://identite.univ-reims.fr/idp/shibboleth": "19511296600799",
-        "https://shib2.unc.nc/idp/shibboleth": "13000322100012",
-        "https://shibboleth.ens2m.fr/idp/shibboleth": "19250082500026",
-        "https://shibboleth.grenoble-inp.fr/idp/shibboleth": "19381912500017",
-        "https://shibboleth.insa-rouen.fr/idp/shibboleth": "19760165100023",
-        "https://shibboleth.ube.fr/idp/shibboleth": "93823061200013",
-        "https://shibboleth.univ-corse.fr/idp/shibboleth": "19202664900264",
-        "https://shibboleth.univ-evry.fr/idp/shibboleth": "19911975100014",
-        "https://shibboleth.univ-grenoble-alpes.fr/idp/shibboleth": "13002608100013",
-        "https://shibboleth.univ-savoie.fr/idp/shibboleth": "19730858800015",
-        "https://shibboleth03.chartes.psl.eu/idp/shibboleth": "19753478700043",
-        "https://shibboleth3.utt.fr/idp/shibboleth": "19101060200032",
-        "https://srv-fii.insa-toulouse.fr/idp/shibboleth": "19310152400018",
-        "https://sso-ciation-saclay.centralesupelec.fr/idp/shibboleth": "13002076100016",
-        "https://sso.bordeaux-inp.fr/idp/shibboleth": "13000635600013",
-        "https://sso.ird.fr/idp/shibboleth": "18000602500159",
-        "https://upnidp2.parisnanterre.fr/idp/shibboleth": "19921204400010",
-        "https://vip.espci.fr/saml2/idp/metadata.php": "20000068500012",
-        "urn:mace:cru.fr:federation:uhb.fr": "19350937900015",
-        "urn:mace:cru.fr:federation:unilim.fr": "19870669900321",
-        "urn:mace:cru.fr:federation:univ-nantes.fr": "13002974700016",
-        "urn:mace:cru.fr:federation:univ-paris1.fr": "19751717000019",
-        "urn:mace:cru.fr:federation:univ-rennes1.fr": "13003051300019",
-        "urn:mace:cru.fr:federation:univ-rouen.fr": "19761904200017",
-        "urn:mace:cru.fr:federation:univ-ubs.fr": "19561718800600"
-      }
-
 ingress:
   enabled: true
   host: renater.agentconnect.gouv.fr

src/helm/env.d/staging/values.oidc2fer.yaml.gotmpl

@@ -1,7 +1,7 @@
 image:
-  repository: ghcr.io/proconnect-gouv/oidc2fer
+  repository: lasuite/oidc2fer
   pullPolicy: Always
-  tag: "latest"
+  tag: "main"
 
 satosa:
   replicas: 2
@@ -13,7 +13,7 @@ satosa:
     LOG_LEVELS: '{ "satosa.backends.saml2": "DEBUG" }'
 
     SAML2_DISCOVERY_URL: https://discovery.renater.fr/test/
-    SAML2_METADATA_URL: https://pub.federation.renater.fr/metadata/test/idps.xml
+    SAML2_METADATA_URL: https://pub.federation.renater.fr/metadata/test/preview/preview-idps-test-metadata.xml
     SAML2_ENTITY_ID:  https://oidc2fer-staging.beta.numerique.gouv.fr/Saml2/proxy_saml2_backend.xml-test
 
     STATE_ENCRYPTION_KEY: { secretKeyRef: { name: oidc2fer, key: STATE_ENCRYPTION_KEY } }
@@ -24,11 +24,6 @@ satosa:
 
     OIDC_DB_URI: { secretKeyRef: { name: redis.redis.libre.sh, key: url } }
 
-    SIRET_MAP: |-
-      {
-          "https://test-idp.federation.renater.fr/idp/shibboleth": "12345678200010"
-      }
-
 ingress:
   enabled: true
   host: oidc2fer-staging.beta.numerique.gouv.fr

src/helm/helmfile.yaml

@@ -1,20 +1,3 @@
-environments:
-  dev:
-    values:
-      - version: 0.0.1
-    secrets:
-      - env.d/{{ .Environment.Name }}/secrets.enc.yaml
-  staging:
-    values:
-      - version: 0.0.1
-    secrets:
-      - env.d/{{ .Environment.Name }}/secrets.enc.yaml
-  outscale-production:
-    values:
-      - version: 0.0.1
-    secrets:
-      - env.d/{{ .Environment.Name }}/secrets.enc.yaml
----
 repositories:
 - name: bitnami
   url: registry-1.docker.io/bitnamicharts
@@ -30,8 +13,6 @@ releases:
       - auth:
           password: pass
         architecture: standalone
-        image:
-          repository: bitnamilegacy/redis
 
   - name: extra
     installed: {{ ne .Environment.Name "dev" | toYaml }}
@@ -48,3 +29,21 @@ releases:
       - env.d/{{ .Environment.Name }}/values.oidc2fer.yaml.gotmpl
     secrets:
       - env.d/{{ .Environment.Name }}/secrets.enc.yaml
+
+environments:
+  dev:
+    values:
+      - version: 0.0.1
+    secrets:
+      - env.d/{{ .Environment.Name }}/secrets.enc.yaml
+  staging:
+    values:
+      - version: 0.0.1
+    secrets:
+      - env.d/{{ .Environment.Name }}/secrets.enc.yaml
+  outscale-production:
+    values:
+      - version: 0.0.1
+    secrets:
+      - env.d/{{ .Environment.Name }}/secrets.enc.yaml
+

src/satosa/internal_attributes.yaml

@@ -31,6 +31,3 @@ attributes:
   uid:
     openid:
       - uid
-  siret:
-    openid:
-      - siret

src/satosa/oidc2fer/attribute_generators/__init__.py

@@ -1 +0,0 @@
-from .entity_id_to_siret_mapper import EntityIdToSiretMapper

src/satosa/oidc2fer/attribute_generators/entity_id_to_siret_mapper.py

@@ -1,23 +0,0 @@
-import json
-import logging
-
-from satosa.micro_services.base import ResponseMicroService
-
-logger = logging.getLogger(__name__)
-
-
-class EntityIdToSiretMapper(ResponseMicroService):
-    def __init__(self, config, *args, **kwargs):
-        super().__init__(*args, **kwargs)
-        self.attribute = config.get("attribute", "siret")
-        self.mapping = json.loads(config.get("mapping_json", "{}"))
-
-    def process(self, context, data):
-        entity_id = data.auth_info.issuer
-        if entity_id in self.mapping:
-            siret = self.mapping[entity_id]
-            logger.info("Mapping entity ID %s to SIRET %s", entity_id, siret)
-            data.attributes[self.attribute] = siret
-        else:
-            logger.warning("No SIRET mapping found for entity ID %s", entity_id)
-        return super().process(context, data)

src/satosa/plugins/frontends/openid_connect_frontend.yaml

@@ -43,7 +43,6 @@ config:
       - uid
       - given_name
       - usual_name
-      - siret
 
     # Set code/token lifetimes as short as possible
     authorization_code_lifetime: 60
@@ -57,5 +56,8 @@ config:
       - given_name
       usual_name:
       - usual_name
-      siret:
-      - siret
+    extra_id_token_claims:
+      oidc-test-client:
+        - acr
+      agent-connect:
+        - acr

src/satosa/plugins/microservices/siret_mapping.yaml

@@ -1,5 +0,0 @@
-module: oidc2fer.attribute_generators.EntityIdToSiretMapper
-name: EntityIdToSiretMapper
-config:
-  attribute: siret
-  mapping_json: !ENV SIRET_MAP

src/satosa/proxy_conf.yaml

@@ -17,7 +17,6 @@ MICRO_SERVICES:
   - plugins/microservices/primary_identifier.yaml
   - plugins/microservices/static_attributes.yaml
   - plugins/microservices/attribute_processor.yaml
-  - plugins/microservices/siret_mapping.yaml
 LOGGING:
   # All the logging configuration is done in the Gunicorn config, this is just
   # here to avoid overwriting it with the default SATOSA config

src/satosa/pyproject.toml

@@ -11,45 +11,47 @@ version = "0.1.0"
 authors = [{ "name" = "DINUM", "email" = "dev@mail.numerique.gouv.fr" }]
 classifiers = [
     "Development Status :: 5 - Production/Stable",
-    "Intended Audience :: End Users/Desktop",
-    "Intended Audience :: System Administrators",
+    "Intended Audience :: Developers",
     "License :: OSI Approved :: MIT License",
     "Natural Language :: English",
     "Programming Language :: Python :: 3",
-    "Programming Language :: Python :: 3.14",
+    "Programming Language :: Python :: 3.11",
 ]
-description = "A gateway from RENATER's FER to ProConnect's OIDC provider, built on top of SATOSA."
+description = "An application to handle contacts and teams."
 keywords = ["OIDC", "SAML", "Shibboleth", "FER", "RENATER"]
 license = { file = "LICENSE" }
 readme = "README.md"
-requires-python = ">=3.14"
+requires-python = ">=3.11"
 dependencies = [
     "SATOSA==8.5.1",
-    "gunicorn==25.1.0",
-    "redis==7.2.1",
-    "JSON-log-formatter==1.1.1",
-    "WhiteNoise==6.12.0",
+    "gunicorn==22.0.0",
+    "redis==5.0.4",
+    "JSON-log-formatter==1.0",
+    "WhiteNoise==6.7.0",
 ]
 
 [project.urls]
-"Bug Tracker" = "https://github.com/proconnect-gouv/oidc2fer/issues/new"
-"Changelog" = "https://github.com/proconnect-gouv/oidc2fer/blob/main/CHANGELOG.md"
-"Homepage" = "https://github.com/proconnect-gouv/oidc2fer"
-"Repository" = "https://github.com/proconnect-gouv/oidc2fer"
+"Bug Tracker" = "https://github.com/numerique-gouv/oidc2fer/issues/new"
+"Changelog" = "https://github.com/numerique-gouv/oidc2fer/blob/main/CHANGELOG.md"
+"Homepage" = "https://github.com/numerique-gouv/oidc2fer"
+"Repository" = "https://github.com/numerique-gouv/oidc2fer"
 
 [project.optional-dependencies]
 dev = [
     "pylint==3.1.0",
     "pytest-cov==4.1.0",
-    "pytest==9.0.2",
-    "ruff==0.15.4",
-    "pytest-playwright==0.7.2",
+    "pytest==8.0.2",
+    "ruff==0.2.2",
+    "pytest-playwright==0.4.4",
 ]
 
 [tool.setuptools]
 packages = { find = { where = ["."], exclude = ["tests"] } }
 zip-safe = true
 
+[tool.distutils.bdist_wheel]
+universal = true
+
 [tool.ruff]
 exclude = [
     ".git",

src/satosa/setup.py

@@ -0,0 +1,7 @@
+#!/usr/bin/env python
+"""Setup file for the oidc2fer module. All configuration stands in the setup.cfg file."""
+# coding: utf-8
+
+from setuptools import setup
+
+setup()

src/satosa/tests/oidc2fer/attribute_generators/test_entity_id_to_siret_mapper.py

@@ -1,42 +0,0 @@
-import json
-
-from satosa.context import Context
-from satosa.internal import AuthenticationInformation, InternalData
-
-from oidc2fer.attribute_generators import EntityIdToSiretMapper
-
-
-class TestEntityIdToSiretMapper:
-    def create_mapper(self):
-        mapper = EntityIdToSiretMapper(
-            config={
-                "attribute": "siret",
-                "mapping_json": json.dumps(
-                    {
-                        "https://idp.example.fr": "12345678200010",
-                    }
-                ),
-            },
-            name="siret_mapper",
-            base_url="https://satosa.example.com",
-        )
-        mapper.next = lambda ctx, data: data
-        return mapper
-
-    def test_sets_siret_for_known_entityid(self):
-        mapper = self.create_mapper()
-        resp = InternalData(
-            auth_info=AuthenticationInformation(issuer="https://idp.example.fr")
-        )
-        ctx = Context()
-        mapper.process(ctx, resp)
-        assert resp.attributes["siret"] == "12345678200010"
-
-    def test_does_not_set_siret_for_unknown_entityid(self):
-        mapper = self.create_mapper()
-        resp = InternalData(
-            auth_info=AuthenticationInformation(issuer="https://unknown.example.fr")
-        )
-        ctx = Context()
-        mapper.process(ctx, resp)
-        assert "siret" not in resp.attributes

src/satosa/tests/test_e2e.py

@@ -20,7 +20,6 @@ def renater_test_idp(page, login):
 
 def renater_wayf(page):
     page.get_by_text("Veuillez sélectionner").click()
-    page.get_by_role("searchbox").fill("GIP RENATER - IdP de test")
     page.get_by_role("option", name="GIP RENATER - IdP de test", exact=True).click()
     page.get_by_role("button", name="Sélection").click()
 
@@ -49,7 +48,6 @@ def oidc_to_renater(
         "email": expected_email,
         "given_name": expected_given_name,
         "usual_name": expected_usual_name,
-        "siret": "12345678200010",
     }.items() <= userinfo.items()
     return id_token
 
@@ -103,7 +101,6 @@ def pro_connect_to_renater(
         "email": expected_email,
         "given_name": expected_given_name,
         "usual_name": expected_usual_name,
-        "siret": "12345678200010",
     }.items() <= result.items()
     return result
 
@@ -128,7 +125,7 @@ def test_pro_connect_to_renater_student_not_allowed(page: Page):
     renater_wayf(page)
     renater_test_idp(page, login="etudiant1")
 
-    expect(page.locator("body")).to_contain_text("access_denied")
+    expect(page.locator("body")).to_contain_text("Une erreur technique est survenue.")
 
 
 @pytest.mark.skipif(

start-kind.sh

@@ -26,8 +26,7 @@ fi
 # https://github.com/kubernetes-sigs/kind/issues/2875
 # https://github.com/containerd/containerd/blob/main/docs/cri/config.md#registry-configuration
 # See: https://github.com/containerd/containerd/blob/main/docs/hosts.md
-kind --name=oidc2fer delete cluster || true
-cat <<EOF | kind --name=oidc2fer create cluster --config=-
+cat <<EOF | kind create cluster --config=-
 kind: Cluster
 apiVersion: kind.x-k8s.io/v1alpha4
 containerdConfigPatches:
@@ -36,6 +35,7 @@ containerdConfigPatches:
     config_path = "/etc/containerd/certs.d"
 nodes:
 - role: control-plane
+  image: kindest/node:v1.27.3
   kubeadmConfigPatches:
   - |
     kind: InitConfiguration
@@ -50,7 +50,9 @@ nodes:
     hostPort: 443
     protocol: TCP
 - role: worker
+  image: kindest/node:v1.27.3
 - role: worker
+  image: kindest/node:v1.27.3
 EOF
 
 # 3. Add the registry config to the nodes
@@ -62,7 +64,7 @@ EOF
 # We want a consistent name that works from both ends, so we tell containerd to
 # alias localhost:${reg_port} to the registry container when pulling images
 REGISTRY_DIR="/etc/containerd/certs.d/localhost:${reg_port}"
-for node in $(kind --name=oidc2fer get nodes); do
+for node in $(kind get nodes); do
 	docker exec "${node}" mkdir -p "${REGISTRY_DIR}"
 	cat <<EOF | docker exec -i "${node}" cp /dev/stdin "${REGISTRY_DIR}/hosts.toml"
 [host."http://${reg_name}:5000"]
@@ -89,17 +91,6 @@ data:
     help: "https://kind.sigs.k8s.io/docs/user/local-registry/"
 EOF
 
-# Patch the CoreDNS configmap to rewrite requests for *.127.0.0.1.nip.io to the Ingress Controller service
-kubectl -n kube-system get configmap coredns -o yaml |
-  yq '.data.Corefile |= (
-        trim
-        | split("\n")
-        | .[-1] = "    rewrite name regex .*\\.127\\.0\\.0\\.1\\.nip\\.io ingress-nginx-controller.ingress-nginx.svc.cluster.local answer auto\n"
-          + .[-1]
-        | join("\n")
-      )' |
-  kubectl replace -f -
-
 kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/main/deploy/static/provider/kind/deploy.yaml
 kubectl -n ingress-nginx create secret tls mkcert --key /tmp/127.0.0.1.nip.io+1-key.pem --cert /tmp/127.0.0.1.nip.io+1.pem
 kubectl -n ingress-nginx patch deployments.apps ingress-nginx-controller --type 'json' -p '[{"op": "add", "path": "/spec/template/spec/containers/0/args/-", "value":"--default-ssl-certificate=ingress-nginx/mkcert"}]'