f/fix_update_sp (#17)

Reviewed-on: #17
Reviewed-by: vfebvre <vfebvre@cadoles.com>
This commit is contained in:
vfebvre 2023-11-28 13:43:13 +01:00
commit 554d79b3b7
5 changed files with 50 additions and 4 deletions

View File

@ -53,6 +53,11 @@ hydra_public_cors_allowed_origins: []
hydra_log_level: warn
hydra_log_leak_sensitive_values: no
# Durée de vie des "refresh_token"
hydra_ttl_refresh_token: "24h"
hydra_bcrypt_cost: 8
# This value should not be changed after first deployment !
hydra_secrets_seed: "{{ inventory_hostname }}"
@ -166,9 +171,6 @@ hydra_saml_debug: no
# Niveau de verbosité du service shibboleth-sp
hydra_saml_sp_log_level: WARN
# Durée de vie des "refresh_token"
hydra_ttl_refresh_token: "24h"
# Inclure les règles de cartographie des attributs SAML fournis par défaut par le projet hydra-shibboleth-sp-v3
hydra_saml_include_sp_default_attributes_mapping: "yes"

View File

@ -89,6 +89,10 @@ properties:
hydra_ttl_refresh_token:
type: string
hydra_brypt_cost:
type: number
description: Coût CPU pour calculer des hachages de secret (4-31)
# This value should not be changed after first deployment !
hydra_secrets_seed:
type: string

View File

@ -0,0 +1,33 @@
---
# Simple task to update the package/container cadoles-pod-hydra-remote-user only.
- name: Install hydra-remote-user package
ansible.builtin.apt:
name:
- cadoles-pod-hydra-remote-user-v1={{ cadoles_pod_hydra_remote_user_v1_package_version }}
update_cache: yes
state: present
become: true
- name: Configure cadoles-pod-hydra-remote-user-v1
template:
src: "{{ item.src }}"
dest: "{{ item.dest }}"
mode: "{{ item.mode }}"
with_items:
- src: cadoles-pod-hydra-remote-user-v1.conf.j2
dest: /etc/cadoles-pod-hydra-remote-user-v1.conf
mode: u=rw,g=r
- src: hydra-remote-user.yml.j2
dest: /etc/hydra-remote-user/conf.d/remote-user.yml
mode: u=rw,g=r,o=r
notify:
- Restart cadoles-pod-hydra-remote-user-v1
become: true
- name: Configure cadoles-pod-hydra-remote-user-v1 (2)
ansible.builtin.copy:
src: hydra-remote-user-v1-apache.conf
dest: /etc/hydra-remote-user/apache.conf
notify:
- Restart cadoles-pod-hydra-remote-user-v1
become: true

View File

@ -17,6 +17,12 @@
- src: cadoles-pod-shibboleth-sp-v3.conf.j2
dest: /etc/cadoles-pod-shibboleth-sp-v3.conf
mode: u=rw,g=r
- src: shibboleth-attribute-map.inc.xml.j2
dest: /etc/shibboleth/attribute-map.inc.xml
mode: u=rw,g=r,o=r
- src: shibboleth-attribute-policy.inc.xml.j2
dest: /etc/shibboleth/attribute-policy.inc.xml
mode: u=rw,g=r,o=r
notify:
- Restart cadoles-pod-shibboleth-sp-v3
become: true

View File

@ -25,5 +25,6 @@ PODMAN_ARGS="\
{% endif %}
-e 'HYDRA_SECRETS_SYSTEM={{ lookup('ansible.builtin.password', '/dev/null length=32 seed=hydra_secrets_seed') }}' \
-e 'HYDRA_OIDC_SUBJECT_IDENTIFIERS_PAIRWISE_SALT={{ lookup('ansible.builtin.password', '/dev/null length=32 seed=hydra_secrets_seed') }}' \
-e 'HYDRA_BCRYPT_COST={{ hydra_bcrypt_cost }}' \
-v /etc/hydra/clients.d:/etc/hydra/clients.d \
"