From 793582e621791586ff255d37d040eb1d21ab8e1c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Laurent=20Gourv=C3=A9nec?= Date: Thu, 9 Nov 2023 09:10:15 +0100 Subject: [PATCH 1/4] Adding a task to update hydra-remote-user only --- tasks/update-hydra-remote-user.yml | 33 ++++++++++++++++++++++++++++++ 1 file changed, 33 insertions(+) create mode 100644 tasks/update-hydra-remote-user.yml diff --git a/tasks/update-hydra-remote-user.yml b/tasks/update-hydra-remote-user.yml new file mode 100644 index 0000000..6959dd4 --- /dev/null +++ b/tasks/update-hydra-remote-user.yml @@ -0,0 +1,33 @@ +--- +# Simple task to update the package/container cadoles-pod-hydra-remote-user only. +- name: Install hydra-remote-user package + ansible.builtin.apt: + name: + - cadoles-pod-hydra-remote-user-v1={{ cadoles_pod_hydra_remote_user_v1_package_version }} + update_cache: yes + state: present + become: true + +- name: Configure cadoles-pod-hydra-remote-user-v1 + template: + src: "{{ item.src }}" + dest: "{{ item.dest }}" + mode: "{{ item.mode }}" + with_items: + - src: cadoles-pod-hydra-remote-user-v1.conf.j2 + dest: /etc/cadoles-pod-hydra-remote-user-v1.conf + mode: u=rw,g=r + - src: hydra-remote-user.yml.j2 + dest: /etc/hydra-remote-user/conf.d/remote-user.yml + mode: u=rw,g=r,o=r + notify: + - Restart cadoles-pod-hydra-remote-user-v1 + become: true + +- name: Configure cadoles-pod-hydra-remote-user-v1 (2) + ansible.builtin.copy: + src: hydra-remote-user-v1-apache.conf + dest: /etc/hydra-remote-user/apache.conf + notify: + - Restart cadoles-pod-hydra-remote-user-v1 + become: true From daa8612bae886f3be4234e69fd1315909b97c02b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Laurent=20Gourv=C3=A9nec?= Date: Mon, 13 Nov 2023 11:09:48 +0100 Subject: [PATCH 2/4] cosmetic: move hydra_ttl_refresh_token option --- defaults/main.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/defaults/main.yml b/defaults/main.yml index 9d7bce2..2c7f123 100644 --- a/defaults/main.yml +++ b/defaults/main.yml @@ -53,6 +53,9 @@ hydra_public_cors_allowed_origins: [] hydra_log_level: warn hydra_log_leak_sensitive_values: no +# Durée de vie des "refresh_token" +hydra_ttl_refresh_token: "24h" + # This value should not be changed after first deployment ! hydra_secrets_seed: "{{ inventory_hostname }}" @@ -166,9 +169,6 @@ hydra_saml_debug: no # Niveau de verbosité du service shibboleth-sp hydra_saml_sp_log_level: WARN -# Durée de vie des "refresh_token" -hydra_ttl_refresh_token: "24h" - # Inclure les règles de cartographie des attributs SAML fournis par défaut par le projet hydra-shibboleth-sp-v3 hydra_saml_include_sp_default_attributes_mapping: "yes" From 9fb1118961aeb57281600192db45541cd0dd0aff Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Laurent=20Gourv=C3=A9nec?= Date: Mon, 13 Nov 2023 11:12:03 +0100 Subject: [PATCH 3/4] feat(hydra): add variable HYDRA_BCRYPT_COST --- defaults/main.yml | 2 ++ sso.schema.yml | 4 ++++ templates/cadoles-pod-hydra-v1.conf.j2 | 1 + 3 files changed, 7 insertions(+) diff --git a/defaults/main.yml b/defaults/main.yml index 2c7f123..ed69327 100644 --- a/defaults/main.yml +++ b/defaults/main.yml @@ -56,6 +56,8 @@ hydra_log_leak_sensitive_values: no # Durée de vie des "refresh_token" hydra_ttl_refresh_token: "24h" +hydra_bcrypt_cost: 8 + # This value should not be changed after first deployment ! hydra_secrets_seed: "{{ inventory_hostname }}" diff --git a/sso.schema.yml b/sso.schema.yml index 27af98e..6699a0a 100644 --- a/sso.schema.yml +++ b/sso.schema.yml @@ -89,6 +89,10 @@ properties: hydra_ttl_refresh_token: type: string + hydra_brypt_cost: + type: number + description: Coût CPU pour calculer des hachages de secret (4-31) + # This value should not be changed after first deployment ! hydra_secrets_seed: type: string diff --git a/templates/cadoles-pod-hydra-v1.conf.j2 b/templates/cadoles-pod-hydra-v1.conf.j2 index f98951a..129c495 100644 --- a/templates/cadoles-pod-hydra-v1.conf.j2 +++ b/templates/cadoles-pod-hydra-v1.conf.j2 @@ -25,5 +25,6 @@ PODMAN_ARGS="\ {% endif %} -e 'HYDRA_SECRETS_SYSTEM={{ lookup('ansible.builtin.password', '/dev/null length=32 seed=hydra_secrets_seed') }}' \ -e 'HYDRA_OIDC_SUBJECT_IDENTIFIERS_PAIRWISE_SALT={{ lookup('ansible.builtin.password', '/dev/null length=32 seed=hydra_secrets_seed') }}' \ + -e 'HYDRA_BCRYPT_COST={{ hydra_bcrypt_cost }}' \ -v /etc/hydra/clients.d:/etc/hydra/clients.d \ " From d365d2ec507cc5b3f66f3d9c734504ca32e8e370 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Laurent=20Gourv=C3=A9nec?= Date: Tue, 14 Nov 2023 12:30:22 +0100 Subject: [PATCH 4/4] fix: update all shibboleth config files when updating shibboleth-sp --- tasks/update-hydra-sp.yml | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/tasks/update-hydra-sp.yml b/tasks/update-hydra-sp.yml index 52c488f..0086e36 100644 --- a/tasks/update-hydra-sp.yml +++ b/tasks/update-hydra-sp.yml @@ -14,9 +14,15 @@ dest: "{{ item.dest }}" mode: "{{ item.mode }}" with_items: - - src: cadoles-pod-shibboleth-sp-v3.conf.j2 + - src: cadoles-pod-shibboleth-sp-v3.conf.j2 dest: /etc/cadoles-pod-shibboleth-sp-v3.conf mode: u=rw,g=r + - src: shibboleth-attribute-map.inc.xml.j2 + dest: /etc/shibboleth/attribute-map.inc.xml + mode: u=rw,g=r,o=r + - src: shibboleth-attribute-policy.inc.xml.j2 + dest: /etc/shibboleth/attribute-policy.inc.xml + mode: u=rw,g=r,o=r notify: - Restart cadoles-pod-shibboleth-sp-v3 become: true