WIP of using an Alpine Python base image

We have to remain with debian as a base for the development image
since we install Playwright in the image.

CHANGELOG.md

@@ -6,6 +6,10 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0),
 and this project adheres to
 [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.0.6] - 2025-03-11
+- upgrade to SATOSA 8.5.1
+- allow faculty, staff, employee, researcher, teacher affiliations
+
 ## [1.0.5] - 2025-03-06
 - add allowlist for URL paths to nginx ingress
 - allow customizing log levels per logger

Dockerfile

@@ -1,17 +1,11 @@
-# ---- base image to inherit from ----
-FROM python:3.11-slim-bookworm as common
+# ---- Development image ----
+FROM python:3.11-slim-bookworm AS development
 
 # Install xmlsec1 dependencies required for xmlsec (for SAML)
 # Needs to be kept before the `pip install`
 RUN apt-get update && \
     apt-get -y upgrade && \
-    apt-get install -y \
-        pkg-config \
-        gcc \
-        xmlsec1 \
-        libxml2-dev \
-        libxmlsec1-dev \
-        libxmlsec1-openssl && \
+    apt-get install --no-install-recommends -y xmlsec1 && \
     rm -rf /var/lib/apt/lists/*
 
 # We want the most up-to-date stable pip release
@@ -40,9 +34,6 @@ COPY docker/files/usr/local/etc/gunicorn/satosa.py /usr/local/etc/gunicorn/satos
 # The default command runs gunicorn WSGI server in satosa's main module
 CMD ["gunicorn", "-c", "/usr/local/etc/gunicorn/satosa.py"]
 
-# ---- Development image ----
-FROM common as development
-
 # Playwright browsers
 ENV PLAYWRIGHT_BROWSERS_PATH=/pw-browsers
 RUN pip install playwright
@@ -67,7 +58,37 @@ COPY ./src/satosa /app/
 USER ${DOCKER_USER}
 
 # ---- Production image (keep last so it is the default target) ----
-FROM common as production
+FROM python:3.11-alpine AS production
+
+# Install xmlsec (for SAML)
+# Needs to be kept before the `pip install`
+RUN apk add xmlsec bash
+
+# We want the most up-to-date stable pip release
+RUN pip install --upgrade pip
+
+ENV PYTHONUNBUFFERED=1
+
+# Give the "root" group the same permissions as the "root" user on /etc/passwd
+# to allow a user belonging to the root group to add new users; typically the
+# docker user (see entrypoint).
+RUN chmod g=u /etc/passwd
+
+# We wrap commands run in this container by the following entrypoint that
+# creates a user on-the-fly with the container user ID (see USER) and root group
+# ID.
+COPY ./docker/files/usr/local/bin/entrypoint /usr/local/bin/entrypoint
+ENTRYPOINT [ "/usr/local/bin/entrypoint" ]
+
+# Un-privileged user running the application
+ARG DOCKER_USER
+
+# Gunicorn
+RUN mkdir -p /usr/local/etc/gunicorn
+COPY docker/files/usr/local/etc/gunicorn/satosa.py /usr/local/etc/gunicorn/satosa.py
+
+# The default command runs gunicorn WSGI server in satosa's main module
+CMD ["gunicorn", "-c", "/usr/local/etc/gunicorn/satosa.py"]
 
 # Copy oidc2fer application (see .dockerignore)
 COPY ./src/satosa /app/

src/helm/env.d/outscale-production/values.oidc2fer.yaml.gotmpl

@@ -1,7 +1,7 @@
 image:
   repository: lasuite/oidc2fer
   pullPolicy: Always
-  tag: "v1.0.4"
+  tag: "v1.0.6"
 
 satosa:
   replicas: 2

src/satosa/plugins/backends/saml2_backend.yaml

@@ -3,11 +3,11 @@ name: Saml2
 config:
   disco_srv: !ENV SAML2_DISCOVERY_URL
   entityid_endpoint: true
-  mirror_force_authn: 'no'
-  memorize_idp: 'no'
-  use_memorized_idp_when_force_authn: 'no'
-  send_requester_id: 'no'
-  enable_metadata_reload: 'no'
+  mirror_force_authn: false
+  memorize_idp: false
+  use_memorized_idp_when_force_authn: false
+  send_requester_id: false
+  enable_metadata_reload: false
   acs_selection_strategy: prefer_matching_host
   sp_config:
     name: Passerelle OIDC vers FER

src/satosa/plugins/microservices/attribute_authorization.yaml

@@ -13,4 +13,8 @@ config:
           # later in the PrimaryIdentifier processor.
           - ".+"
         eduPersonAffiliation:
+          - "^faculty$"
+          - "^staff$"
           - "^employee$"
+          - "^researcher$"
+          - "^teacher$"

src/satosa/pyproject.toml

@@ -23,7 +23,7 @@ license = { file = "LICENSE" }
 readme = "README.md"
 requires-python = ">=3.11"
 dependencies = [
-    "SATOSA==8.4.0",
+    "SATOSA==8.5.1",
     "gunicorn==22.0.0",
     "redis==5.0.4",
     "JSON-log-formatter==1.0",