feat: initial commit
This commit is contained in:
commit
f93f90f594
|
|
@ -0,0 +1,47 @@
|
|||
---
|
||||
# cadoles-pod repository configuration
|
||||
cadoles_pod_debian_repository_url: https://vulcain.cadoles.com
|
||||
cadoles_pod_debian_repository: bullseye-dev
|
||||
cadoles_pod_debian_repository_key_url: https://vulcain.cadoles.com/cadoles.gpg
|
||||
|
||||
# Hydra database configuration
|
||||
hydra_database_name: hydra
|
||||
hydra_database_user: hydra
|
||||
hydra_database_password: hydra
|
||||
hydra_database_host: 10.0.2.2
|
||||
hydra_database_port: 3306
|
||||
|
||||
# Hydra OIDC configuration
|
||||
|
||||
public_scheme: http
|
||||
public_host: "{{ ansible_default_ipv4.address | default(ansible_all_ipv4_addresses[0]) }}"
|
||||
|
||||
# Hydra Passwordless configuration
|
||||
|
||||
enable_hydra_passwordless: yes
|
||||
hydra_passwordless_app_title: Adresse courriel
|
||||
hydra_passwordless_app_description: Authentification via adresse courriel
|
||||
hydra_passwordless_app_icon_url: https://upload.wikimedia.org/wikipedia/commons/4/48/You%27ve_got_mail.png
|
||||
hydra_passwordless_smtp_host: smtp-server
|
||||
hydra_passwordless_smtp_port: 25
|
||||
hydra_passwordless_smtp_user: smtp-user
|
||||
hydra_passwordless_smtp_password: smtp-password
|
||||
hydra_passwordless_smtp_insecure_skip_verify: no
|
||||
hydra_passwordless_smtp_use_start_tls: no
|
||||
hydra_passwordless_sender_address: noreply@localhost
|
||||
hydra_passwordless_sender_name: "[hydra-passwordless]"
|
||||
|
||||
# Hydra SAML configuration
|
||||
|
||||
enable_hydra_saml: yes
|
||||
hydra_saml_app_title: SAML
|
||||
hydra_saml_app_description: Authentification via SAML
|
||||
hydra_saml_app_icon_url:
|
||||
hydra_saml_idp_entity_id: https://samltest.id/saml/idp
|
||||
hydra_saml_idp_metadata_url: https://samltest.id/saml/idp
|
||||
|
||||
# OIDC Test configuration
|
||||
|
||||
enable_oidc_test_app: yes
|
||||
oidc_test_app_client_id: oidc-test
|
||||
oidc_test_app_client_secret: '$oidc-test&123456$'
|
||||
|
|
@ -0,0 +1,110 @@
|
|||
@startuml
|
||||
|
||||
!theme vibrant
|
||||
skinparam linetype ortho
|
||||
left to right direction
|
||||
|
||||
package "External Ports (0.0.0.0)" as ExternalPorts {
|
||||
interface "tcp/80 (HTTP)" as PortServerHTTP
|
||||
}
|
||||
|
||||
node "SSO Server" as SSOServer {
|
||||
package "Internal Ports (127.0.0.1)" as InternalPorts {
|
||||
interface "tcp/4444 (Hydra Public)" as PortHydraPublic
|
||||
interface "tcp/4445 (Hydra Admin)" as PortHydraAdmin
|
||||
interface "tcp/3000 (Hydra Dispatcher)" as PortHydraDispatcher
|
||||
interface "tcp/3001 (Hydra Passwordless)" as PortHydraPasswordless
|
||||
interface "tcp/3002 (Shibboleth SP)" as PortShibbolethSP
|
||||
interface "tcp/3003 (Hydra Remote User)" as PortHydraRemoteUser
|
||||
}
|
||||
|
||||
package "Containers" as Containers {
|
||||
[cadoles-pod-hydra-v1] as ContainerHydra
|
||||
[cadoles-pod-hydra-dispatcher-v1] as ContainerHydraDispatcher
|
||||
[cadoles-pod-hydra-passwordless-v1] as ContainerHydraPasswordless
|
||||
[cadoles-pod-hydra-remote-user-v1] as ContainerHydraRemoteUser
|
||||
[cadoles-pod-shibboleth-sp-v3] as ContainerShibbolethSP
|
||||
}
|
||||
|
||||
package "Files" as Filesystem {
|
||||
frame "/etc/haproxy/haproxy.cfg" as HAProxyConfFile
|
||||
frame "/etc/cadoles-pod-hydra-v1.conf" as HydraConfFile
|
||||
frame "/etc/cadoles-pod-hydra-dispatcher-v1.conf" as HydraDispatcherConfFile
|
||||
frame "/etc/hydra-dispatcher/conf.d/*.yml" as HydraDispatcherAppsConfFile
|
||||
frame "/etc/hydra/clients.d/*.json" as HydraClientConfFile
|
||||
frame "/etc/cadoles-pod-hydra-remote-user-v1.conf" as HydraRemoteUserConfFile
|
||||
frame "/etc/hydra-remote-user/conf.d/*.yml" as HydraRemoteUserMappingsConfFile
|
||||
frame "/etc/cadoles-pod-hydra-passwordless-v1.conf" as HydraPasswordlessConfFile
|
||||
frame "/etc/cadoles-pod-shibboleth-sp-v3.conf" as ShibbolethSPConfFile
|
||||
frame "/etc/shibboleth/credentials/*" as ShibbolethSPCredentialsFile
|
||||
}
|
||||
|
||||
package "Packages" as Packages {
|
||||
[cadoles-pod-hydra-v1] as PackageHydra
|
||||
[cadoles-pod-hydra-dispatcher-v1] as PackageHydraDispatcher
|
||||
[cadoles-pod-hydra-remote-user-v1] as PackageHydraRemoteUser
|
||||
[cadoles-pod-hydra-shibboleth-sp-v3] as PackageShibbolethSP
|
||||
[cadoles-pod-hydra-passwordless-v1] as PackageHydraPasswordless
|
||||
[haproxy] as PackageHAProxy
|
||||
}
|
||||
|
||||
package "Services" as Services {
|
||||
[cadoles-pod-hydra-v1] as ServiceHydra
|
||||
[cadoles-pod-hydra-dispatcher-v1] as ServiceHydraDispatcher
|
||||
[cadoles-pod-shibboleth-sp-v3] as ServiceShibbolethSP
|
||||
[cadoles-pod-hydra-remote-user-v1] as ServiceHydraRemoteUser
|
||||
[cadoles-pod-hydra-passwordless-v1] as ServiceHydraPasswordless
|
||||
[haproxy] as ServiceHAProxy
|
||||
}
|
||||
|
||||
PackageHAProxy ..up.> PortServerHTTP: binds
|
||||
|
||||
ServiceHAProxy ...> PortHydraPublic : exposes (/)
|
||||
ServiceHAProxy ...> PortHydraDispatcher : exposes (/auth/dispatcher)
|
||||
ServiceHAProxy ...> PortHydraPasswordless : exposes (/auth/passwordless)
|
||||
ServiceHAProxy ...> PortShibbolethSP : exposes (/auth/saml)
|
||||
|
||||
ContainerHydra ...> PortHydraPublic : binds
|
||||
ContainerHydra ...> PortHydraAdmin : binds
|
||||
ContainerHydraDispatcher ...> PortHydraDispatcher : binds
|
||||
ContainerShibbolethSP ...> PortShibbolethSP : binds
|
||||
ContainerHydraPasswordless ...> PortHydraPasswordless : binds
|
||||
ContainerHydraRemoteUser ...> PortHydraRemoteUser : binds
|
||||
ContainerShibbolethSP ..> PortHydraRemoteUser : proxies
|
||||
|
||||
ServiceHydra ...> ContainerHydra: manages
|
||||
ServiceHydraDispatcher ...> ContainerHydraDispatcher: manages
|
||||
ServiceShibbolethSP ...> ContainerShibbolethSP: manages
|
||||
ServiceHydraPasswordless ...> ContainerHydraPasswordless: manages
|
||||
ServiceHydraRemoteUser ...> ContainerHydraRemoteUser: manages
|
||||
|
||||
ContainerHydra ...> HydraConfFile : uses
|
||||
ContainerHydra ...> HydraClientConfFile : uses
|
||||
ContainerHydraDispatcher ...> HydraDispatcherConfFile : uses
|
||||
ContainerHydraDispatcher ...> HydraDispatcherAppsConfFile : uses
|
||||
ContainerHydraPasswordless ...> HydraPasswordlessConfFile : uses
|
||||
ContainerHydraRemoteUser ...> HydraRemoteUserConfFile : uses
|
||||
ContainerHydraRemoteUser ...> HydraRemoteUserMappingsConfFile : uses
|
||||
ContainerShibbolethSP ...> ShibbolethSPConfFile : uses
|
||||
ContainerShibbolethSP ...> ShibbolethSPCredentialsFile : creates
|
||||
|
||||
PackageHAProxy ...> HAProxyConfFile : deploys
|
||||
PackageHydra ...> HydraConfFile : deploys
|
||||
PackageHydraDispatcher ...> HydraDispatcherConfFile : deploys
|
||||
PackageHydraRemoteUser ...> HydraRemoteUserConfFile : deploys
|
||||
PackageShibbolethSP ...> ShibbolethSPConfFile : deploys
|
||||
|
||||
PackageHAProxy ...> ServiceHAProxy : deploys
|
||||
PackageHydra ...> ServiceHydra : deploys
|
||||
PackageHydraDispatcher ...> ServiceHydraDispatcher : deploys
|
||||
PackageHydraRemoteUser ...> ServiceHydraRemoteUser : deploys
|
||||
PackageHydraPasswordless ...> ServiceHydraPasswordless : deploys
|
||||
|
||||
PackageHydra ...> ContainerHydra : deploys
|
||||
PackageHydraDispatcher ...> ContainerHydraDispatcher : deploys
|
||||
PackageHydraRemoteUser ...> ContainerHydraRemoteUser : deploys
|
||||
PackageShibbolethSP ...> ContainerShibbolethSP : deploys
|
||||
PackageHydraPasswordless ...> ContainerHydraPasswordless : deploys
|
||||
}
|
||||
|
||||
@enduml
|
||||
|
|
@ -0,0 +1,32 @@
|
|||
<VirtualHost *:80>
|
||||
DocumentRoot /var/www/public
|
||||
|
||||
SetEnv APP_DEBUG ${APP_DEBUG}
|
||||
SetEnv APP_ENV ${APP_ENV}
|
||||
SetEnv HYDRA_ADMIN_BASE_URL ${HYDRA_ADMIN_BASE_URL}
|
||||
SetEnv TRUSTED_PROXIES ${TRUSTED_PROXIES}
|
||||
SetEnv LOGOUT_REDIRECT_URL_PATTERN ${LOGOUT_REDIRECT_URL_PATTERN}
|
||||
|
||||
# Création d'un alias pour réécrire gérer le préfixe /auth/saml
|
||||
Alias "/auth/saml" "/var/www/public"
|
||||
|
||||
<Directory /var/www/public>
|
||||
AllowOverride None
|
||||
Order Allow,Deny
|
||||
Allow from All
|
||||
|
||||
<IfModule mod_rewrite.c>
|
||||
RewriteEngine On
|
||||
|
||||
# Remapping de l'ensemble des chemins en /auth/saml
|
||||
RewriteBase /auth/saml
|
||||
|
||||
RewriteCond %{REQUEST_FILENAME} !-f
|
||||
RewriteRule ^(.*)$ index.php [QSA,L]
|
||||
</IfModule>
|
||||
</Directory>
|
||||
|
||||
|
||||
CustomLog /dev/stdout combined
|
||||
ErrorLog /dev/stderr
|
||||
</VirtualHost>
|
||||
|
|
@ -0,0 +1,257 @@
|
|||
<SPConfig xmlns="urn:mace:shibboleth:3.0:native:sp:config"
|
||||
xmlns:conf="urn:mace:shibboleth:3.0:native:sp:config"
|
||||
xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
|
||||
clockSkew="180">
|
||||
|
||||
<!-- The OutOfProcess section contains properties affecting the shibd daemon. -->
|
||||
<OutOfProcess
|
||||
logger="shibd.logger" tranLogFormat="[TRANSACTION] %u|%s|%IDP|%i|%ac|%t|%attr|%n|%b|%E|%S|%SS|%L|%UA|%a">
|
||||
<!-- <Extensions>
|
||||
<Library path="odbc-store.so" fatal="true"/>
|
||||
</Extensions> -->
|
||||
</OutOfProcess>
|
||||
|
||||
<!-- <InProcess logger="native.logger" checkSpoofing="false"/> -->
|
||||
|
||||
<!-- Only one listener can be defined, to connect in-process modules to shibd. -->
|
||||
<UnixListener address="shibd.sock"/>
|
||||
<!-- <TCPListener address="127.0.0.1" port="1600" acl="127.0.0.1"/> -->
|
||||
|
||||
<!-- This set of components stores sessions and other persistent data in daemon memory. -->
|
||||
<StorageService type="Memory" id="mem" cleanupInterval="900"/>
|
||||
<SessionCache type="StorageService" StorageService="mem" cacheAssertions="false"
|
||||
cacheAllowance="900" inprocTimeout="900" cleanupInterval="900"/>
|
||||
<ReplayCache StorageService="mem"/>
|
||||
<ArtifactMap artifactTTL="180"/>
|
||||
|
||||
<!-- This set of components stores sessions and other persistent data in an ODBC database. -->
|
||||
<!--
|
||||
<StorageService type="ODBC" id="db" cleanupInterval="900">
|
||||
<ConnectionString>
|
||||
DRIVER=drivername;SERVER=dbserver;UID=shibboleth;PWD=password;DATABASE=shibboleth;APP=Shibboleth
|
||||
</ConnectionString>
|
||||
</StorageService>
|
||||
<SessionCache type="StorageService" StorageService="db" cacheAssertions="false"
|
||||
cacheTimeout="3600" inprocTimeout="900" cleanupInterval="900"/>
|
||||
<ReplayCache StorageService="db"/>
|
||||
<ArtifactMap StorageService="db" artifactTTL="180"/>
|
||||
-->
|
||||
|
||||
<!--
|
||||
The ApplicationDefaults element is where most of Shibboleth's SAML bits are defined.
|
||||
Resource requests are mapped by the RequestMapper to an applicationId that
|
||||
points into to this section (or to the defaults here).
|
||||
-->
|
||||
<ApplicationDefaults entityID="{{ getenv "SP_ENTITY_ID" "http://sp-entity-id" }}"
|
||||
REMOTE_USER="{{ getenv "SP_REMOTE_USER" "eppn subject-id pairwise-id persistent-id" }}"
|
||||
cipherSuites="DEFAULT:!EXP:!LOW:!aNULL:!eNULL:!DES:!IDEA:!SEED:!RC4:!3DES:!kRSA:!SSLv2:!SSLv3:!TLSv1:!TLSv1.1">
|
||||
|
||||
<!--
|
||||
Controls session lifetimes, address checks, cookie handling, and the protocol handlers.
|
||||
Each Application has an effectively unique handlerURL, which defaults to "/Shibboleth.sso"
|
||||
and should be a relative path, with the SP computing the full value based on the virtual
|
||||
host. Using handlerSSL="true" will force the protocol to be https. You should also set
|
||||
cookieProps to "https" for SSL-only sites. Note that while we default checkAddress to
|
||||
"false", this makes an assertion stolen in transit easier for attackers to misuse.
|
||||
-->
|
||||
<Sessions lifetime="28800" timeout="3600"
|
||||
handlerURL="{{ getenv "SP_HANDLER_BASE_PATH" "" }}/Shibboleth.sso" handlerSSL="false" cookieProps="http" relayState="ss:mem"
|
||||
redirectLimit="{{ getenv "SP_SESSIONS_REDIRECT_LIMIT" "host" }}"
|
||||
checkAddress="false"
|
||||
consistentAddress="false"
|
||||
exportLocation="http://localhost/Shibboleth.sso/GetAssertion" exportACL="127.0.0.1"
|
||||
idpHistory="false" idpHistoryDays="7">
|
||||
|
||||
<!--
|
||||
The "stripped down" files use the shorthand syntax for configuring handlers.
|
||||
This uses the old "every handler specified directly" syntax. You can supplement
|
||||
the new syntax following these examples but it is NOT advisable to use this
|
||||
approach wholesale.
|
||||
-->
|
||||
|
||||
<!--
|
||||
SessionInitiators handle session requests and relay them to a Discovery page,
|
||||
or to an IdP if possible. Automatic/active session rules will use the default
|
||||
or first element (or requireSessionWith can specify a specific id to use).
|
||||
-->
|
||||
|
||||
<!-- Default directs to a specific IdP. -->
|
||||
<SessionInitiator type="Chaining" Location="/Login" isDefault="true" id="Login"
|
||||
entityID="{{ getenv "IDP_ENTITY_ID" "http://idp-entity-id" }}">
|
||||
|
||||
<SessionInitiator type="SAML2" template="bindingTemplate.html"/>
|
||||
<SessionInitiator type="Shib1"/>
|
||||
|
||||
<!--
|
||||
To allow for >1 IdP, remove entityID property from Chaining element and add
|
||||
*either* of the SAMLDS or WAYF handlers below:
|
||||
|
||||
<SessionInitiator type="SAMLDS" URL="https://ds.example.org/DS/WAYF"/>
|
||||
<SessionInitiator type="WAYF" URL="https://wayf.example.org/WAYF"/>
|
||||
-->
|
||||
</SessionInitiator>
|
||||
|
||||
<!--
|
||||
md:AssertionConsumerService locations handle specific SSO protocol bindings,
|
||||
such as SAML 2.0 POST or SAML 1.1 Artifact. The isDefault and index attributes
|
||||
are used when sessions are initiated to determine how to tell the IdP where and
|
||||
how to return the response.
|
||||
-->
|
||||
<md:AssertionConsumerService Location="/SAML2/POST" index="1"
|
||||
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"/>
|
||||
<md:AssertionConsumerService Location="/SAML2/POST-SimpleSign" index="2"
|
||||
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign"/>
|
||||
<md:AssertionConsumerService Location="/SAML2/Artifact" index="3"
|
||||
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact"/>
|
||||
<md:AssertionConsumerService Location="/SAML2/ECP" index="4"
|
||||
Binding="urn:oasis:names:tc:SAML:2.0:bindings:PAOS"/>
|
||||
<md:AssertionConsumerService Location="/SAML/POST" index="5"
|
||||
Binding="urn:oasis:names:tc:SAML:1.0:profiles:browser-post"/>
|
||||
<md:AssertionConsumerService Location="/SAML/Artifact" index="6"
|
||||
Binding="urn:oasis:names:tc:SAML:1.0:profiles:artifact-01"/>
|
||||
|
||||
<!-- LogoutInitiators enable SP-initiated local or global/single logout of sessions. -->
|
||||
<LogoutInitiator type="Chaining" Location="/Logout">
|
||||
<LogoutInitiator type="SAML2" template="bindingTemplate.html"/>
|
||||
<LogoutInitiator type="Local"/>
|
||||
</LogoutInitiator>
|
||||
|
||||
<!-- Administrative logout, separate from user-driven logout above. -->
|
||||
<LogoutInitiator type="Admin" Location="/Logout/Admin" acl="127.0.0.1 ::1" />
|
||||
|
||||
<!-- md:SingleLogoutService locations handle single logout (SLO) protocol messages. -->
|
||||
<md:SingleLogoutService Location="/SLO/SOAP"
|
||||
Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP"/>
|
||||
<md:SingleLogoutService Location="/SLO/Redirect" conf:template="bindingTemplate.html"
|
||||
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"/>
|
||||
<md:SingleLogoutService Location="/SLO/POST" conf:template="bindingTemplate.html"
|
||||
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"/>
|
||||
<md:SingleLogoutService Location="/SLO/Artifact" conf:template="bindingTemplate.html"
|
||||
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact"/>
|
||||
|
||||
<!-- md:ManageNameIDService locations handle NameID management (NIM) protocol messages. -->
|
||||
<md:ManageNameIDService Location="/NIM/SOAP"
|
||||
Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP"/>
|
||||
<md:ManageNameIDService Location="/NIM/Redirect" conf:template="bindingTemplate.html"
|
||||
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"/>
|
||||
<md:ManageNameIDService Location="/NIM/POST" conf:template="bindingTemplate.html"
|
||||
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"/>
|
||||
<md:ManageNameIDService Location="/NIM/Artifact" conf:template="bindingTemplate.html"
|
||||
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact"/>
|
||||
|
||||
<!--
|
||||
md:ArtifactResolutionService locations resolve artifacts issued when using the
|
||||
SAML 2.0 HTTP-Artifact binding on outgoing messages, generally uses SOAP.
|
||||
-->
|
||||
<md:ArtifactResolutionService Location="/Artifact/SOAP" index="1"
|
||||
Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP"/>
|
||||
|
||||
<!-- Extension service that generates "approximate" metadata based on SP configuration. -->
|
||||
<Handler type="MetadataGenerator" Location="/Metadata" signing="false"/>
|
||||
|
||||
<!-- Status reporting service. -->
|
||||
<Handler type="Status" Location="/Status" acl="127.0.0.1 ::1"/>
|
||||
|
||||
<!-- Session diagnostic service. -->
|
||||
<Handler type="Session" Location="/Session" showAttributeValues="true"/>
|
||||
|
||||
<!-- JSON feed of discovery information. -->
|
||||
<Handler type="DiscoveryFeed" Location="/DiscoFeed"/>
|
||||
</Sessions>
|
||||
|
||||
<!--
|
||||
Allows overriding of error template information/filenames. You can
|
||||
also add your own attributes with values that can be plugged into the
|
||||
templates, e.g., helpLocation below.
|
||||
-->
|
||||
<Errors supportContact="{{ getenv "CONTACT_EMAIL" "admin@localhost" }}"
|
||||
helpLocation="/about.html"
|
||||
styleSheet="/shibboleth-sp/main.css"/>
|
||||
|
||||
<!--
|
||||
Uncomment and modify to tweak settings for specific IdPs or groups. Settings here
|
||||
generally match those allowed by the <ApplicationDefaults> element.
|
||||
-->
|
||||
<!--
|
||||
<RelyingParty Name="SpecialFederation" keyName="SpecialKey"/>
|
||||
-->
|
||||
|
||||
<!-- Example of locally maintained metadata. -->
|
||||
<!--
|
||||
<MetadataProvider type="XML" validate="true" path="partner-metadata.xml"/>
|
||||
-->
|
||||
|
||||
<!-- Example of remotely supplied batch of signed metadata. -->
|
||||
<!--
|
||||
<MetadataProvider type="XML" validate="true"
|
||||
url="http://federation.org/federation-metadata.xml"
|
||||
backingFilePath="federation-metadata.xml" maxRefreshDelay="7200">
|
||||
<MetadataFilter type="RequireValidUntil" maxValidityInterval="2419200"/>
|
||||
<MetadataFilter type="Signature" certificate="fedsigner.pem" verifyBackup="false"/>
|
||||
<DiscoveryFilter type="Exclude" matcher="EntityAttributes" trimTags="true"
|
||||
attributeName="http://macedir.org/entity-category"
|
||||
attributeNameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"
|
||||
attributeValue="http://refeds.org/category/hide-from-discovery" />
|
||||
</MetadataProvider>
|
||||
-->
|
||||
|
||||
<!-- Example of remotely supplied "on-demand" signed metadata. -->
|
||||
<!--
|
||||
<MetadataProvider type="MDQ" validate="true" cacheDirectory="mdq"
|
||||
baseUrl="http://mdq.federation.org" ignoreTransport="true">
|
||||
<MetadataFilter type="RequireValidUntil" maxValidityInterval="2419200"/>
|
||||
<MetadataFilter type="Signature" certificate="mdqsigner.pem" />
|
||||
</MetadataProvider>
|
||||
-->
|
||||
|
||||
<MetadataProvider type="Dynamic"
|
||||
verifyHost="false"
|
||||
ignoreTransport="true"
|
||||
uri="{{ getenv "IDP_METADATA_URL" "http://idp/idp/shibboleth" }}">
|
||||
</MetadataProvider>
|
||||
|
||||
<!-- TrustEngines run in order to evaluate peer keys and certificates. -->
|
||||
<TrustEngine type="ExplicitKey"/>
|
||||
<!-- <TrustEngine type="PKIX"/> -->
|
||||
|
||||
<!-- Map to extract attributes from SAML assertions. -->
|
||||
<AttributeExtractor type="XML" validate="true" reloadChanges="false" path="attribute-map.xml"/>
|
||||
|
||||
<!-- Extracts support information for IdP from its metadata. -->
|
||||
<AttributeExtractor type="Metadata" errorURL="errorURL" DisplayName="displayName"/>
|
||||
|
||||
<!-- Use a SAML query if no attributes are supplied during SSO. -->
|
||||
<AttributeResolver type="Query" subjectMatch="true"/>
|
||||
|
||||
<!-- Default filtering policy for recognized attributes, lets other data pass. -->
|
||||
<AttributeFilter type="XML" validate="true" path="attribute-policy.xml"/>
|
||||
|
||||
<!-- Simple file-based resolvers for separate signing/encryption keys. -->
|
||||
<CredentialResolver type="File" use="signing"
|
||||
key="/etc/shibboleth/credentials/sp-signing.key" certificate="/etc/shibboleth/credentials/sp-signing.crt"/>
|
||||
<CredentialResolver type="File" use="encryption"
|
||||
key="/etc/shibboleth/credentials/sp-encrypt.key" certificate="/etc/shibboleth/credentials/sp-encrypt.crt"/>
|
||||
|
||||
<!--
|
||||
The default settings can be overridden by creating ApplicationOverride elements.
|
||||
Resource requests are mapped by web server commands, or the RequestMapper, to an
|
||||
applicationId setting.
|
||||
|
||||
This "canonical" use case of overriding the SP's entityID alone is now obsolete;
|
||||
you can apply selfEntityID as a content setting based on host or path to control
|
||||
the SP's own identity.
|
||||
|
||||
Avoid overrides: ask on the list or refer to the wiki for examples of how to do
|
||||
whatever you want to do without them.
|
||||
-->
|
||||
<!--
|
||||
<ApplicationOverride id="admin" entityID="https://admin.example.org/shibboleth"/>
|
||||
-->
|
||||
</ApplicationDefaults>
|
||||
|
||||
<!-- Policies that determine how to process and authenticate runtime messages. -->
|
||||
<SecurityPolicyProvider type="XML" validate="true" path="security-policy.xml"/>
|
||||
|
||||
<!-- Low-level configuration about protocols and bindings available for use. -->
|
||||
<ProtocolProvider type="XML" validate="true" reloadChanges="false" path="protocols.xml"/>
|
||||
</SPConfig>
|
||||
|
|
@ -0,0 +1,35 @@
|
|||
---
|
||||
- name: Restart HAProxy
|
||||
service:
|
||||
name: haproxy
|
||||
state: restarted
|
||||
|
||||
- name: Restart cadoles-pod-hydra-v1
|
||||
service:
|
||||
name: cadoles-pod-hydra-v1
|
||||
state: restarted
|
||||
|
||||
- name: Restart cadoles-pod-hydra-dispatcher-v1
|
||||
service:
|
||||
name: cadoles-pod-hydra-dispatcher-v1
|
||||
state: restarted
|
||||
|
||||
- name: Restart cadoles-pod-hydra-passwordless-v1
|
||||
service:
|
||||
name: cadoles-pod-hydra-passwordless-v1
|
||||
state: restarted
|
||||
|
||||
- name: Restart cadoles-pod-hydra-remote-user-v1
|
||||
service:
|
||||
name: cadoles-pod-hydra-remote-user-v1
|
||||
state: restarted
|
||||
|
||||
- name: Restart cadoles-pod-shibboleth-sp-v3
|
||||
service:
|
||||
name: cadoles-pod-shibboleth-sp-v3
|
||||
state: restarted
|
||||
|
||||
- name: Restart MySQL
|
||||
service:
|
||||
name: mysql
|
||||
state: restarted
|
||||
|
|
@ -0,0 +1 @@
|
|||
---
|
||||
|
|
@ -0,0 +1,18 @@
|
|||
---
|
||||
|
||||
- name: Install cadoles-pod-hydra-passwordless-v1 package
|
||||
ansible.builtin.apt:
|
||||
name:
|
||||
- cadoles-pod-hydra-passwordless-v1
|
||||
update_cache: yes
|
||||
state: latest
|
||||
|
||||
- name: Configure cadoles-pod-hydra-passwordless-v1
|
||||
template:
|
||||
src: "{{ item.src }}"
|
||||
dest: "{{ item.dest }}"
|
||||
with_items:
|
||||
- src: cadoles-pod-hydra-passwordless-v1.conf.j2
|
||||
dest: /etc/cadoles-pod-hydra-passwordless-v1.conf
|
||||
notify:
|
||||
- Restart cadoles-pod-hydra-passwordless-v1
|
||||
|
|
@ -0,0 +1,55 @@
|
|||
---
|
||||
|
||||
- name: Install cadoles-pod-hydra-remote-user-v1 package
|
||||
ansible.builtin.apt:
|
||||
name:
|
||||
- cadoles-pod-shibboleth-sp-v3
|
||||
- cadoles-pod-hydra-remote-user-v1
|
||||
update_cache: yes
|
||||
state: latest
|
||||
|
||||
- name: Configure cadoles-pod-hydra-remote-user-v1
|
||||
template:
|
||||
src: "{{ item.src }}"
|
||||
dest: "{{ item.dest }}"
|
||||
with_items:
|
||||
- src: cadoles-pod-hydra-remote-user-v1.conf.j2
|
||||
dest: /etc/cadoles-pod-hydra-remote-user-v1.conf
|
||||
- src: hydra-remote-user.yml.j2
|
||||
dest: /etc/hydra-remote-user/conf.d/remote-user.yml
|
||||
notify:
|
||||
- Restart cadoles-pod-hydra-remote-user-v1
|
||||
|
||||
- name: Configure cadoles-pod-hydra-remote-user-v1 (2)
|
||||
ansible.builtin.copy:
|
||||
src: hydra-remote-user-v1-apache.conf
|
||||
dest: /etc/hydra-remote-user/apache.conf
|
||||
notify:
|
||||
- Restart cadoles-pod-hydra-remote-user-v1
|
||||
|
||||
- name: Create cadoles-pod-shibboleth-sp-v3 expected directories
|
||||
file:
|
||||
name: "{{ item }}"
|
||||
state: directory
|
||||
with_items:
|
||||
- /etc/shibboleth
|
||||
- /etc/shibboleth/credentials
|
||||
|
||||
- name: Configure cadoles-pod-shibboleth-sp-v3
|
||||
ansible.builtin.template:
|
||||
src: "{{ item.src }}"
|
||||
dest: "{{ item.dest }}"
|
||||
with_items:
|
||||
- src: cadoles-pod-shibboleth-sp-v3.conf.j2
|
||||
dest: /etc/cadoles-pod-shibboleth-sp-v3.conf
|
||||
- src: shibboleth-attribute-map.inc.xml.j2
|
||||
dest: /etc/shibboleth/attribute-map.inc.xml
|
||||
notify:
|
||||
- Restart cadoles-pod-shibboleth-sp-v3
|
||||
|
||||
- name: Configure cadoles-pod-shibboleth-sp-v3 (2)
|
||||
ansible.builtin.copy:
|
||||
src: shibboleth2.xml.gotmpl
|
||||
dest: /etc/shibboleth/shibboleth2.xml.gotmpl
|
||||
notify:
|
||||
- Restart cadoles-pod-shibboleth-sp-v3
|
||||
|
|
@ -0,0 +1,98 @@
|
|||
---
|
||||
|
||||
- name: Add required utilities
|
||||
ansible.builtin.apt:
|
||||
name:
|
||||
- gpg
|
||||
- wget
|
||||
- openssl
|
||||
update_cache: yes
|
||||
state: present
|
||||
|
||||
- name: Add LetsEncrypt missing intermediate certificates
|
||||
command: "bash -c 'wget -O- --no-check-certificate https://forge.cadoles.com/Cadoles/Jenkins/raw/branch/master/resources/com/cadoles/common/add-letsencrypt-ca.sh | bash'"
|
||||
args:
|
||||
creates: /etc/ssl/certs/lets-encrypt-e1.pem.pem
|
||||
|
||||
- name: Add cadoles-pod debian repository key
|
||||
ansible.builtin.apt_key:
|
||||
url: "{{ cadoles_pod_debian_repository_key_url }}"
|
||||
state: present
|
||||
|
||||
- name: Configure cadoles-pod debian repository
|
||||
ansible.builtin.apt_repository:
|
||||
repo: "deb {{ cadoles_pod_debian_repository_url }} {{ cadoles_pod_debian_repository }} main"
|
||||
state: present
|
||||
|
||||
- name: Install core packages
|
||||
ansible.builtin.apt:
|
||||
name:
|
||||
- haproxy
|
||||
- mariadb-server
|
||||
- python3-pip
|
||||
- cadoles-pod-hydra-v1
|
||||
- cadoles-pod-hydra-dispatcher-v1
|
||||
update_cache: yes
|
||||
state: latest
|
||||
|
||||
- name: Install PyMySQL python package
|
||||
ansible.builtin.pip:
|
||||
name: PyMySQL
|
||||
|
||||
- name: Create Hydra database
|
||||
community.mysql.mysql_db:
|
||||
name: "{{ hydra_database_name }}"
|
||||
login_unix_socket: /var/run/mysqld/mysqld.sock
|
||||
state: present
|
||||
|
||||
- name: Create Hydra database user
|
||||
community.mysql.mysql_user:
|
||||
name: "{{ hydra_database_user }}"
|
||||
password: "{{ hydra_database_password }}"
|
||||
login_unix_socket: /var/run/mysqld/mysqld.sock
|
||||
priv: '{{ hydra_database_name }}.*:ALL,GRANT'
|
||||
state: present
|
||||
|
||||
- name: Configure HAProxy
|
||||
template:
|
||||
src: haproxy.cfg.j2
|
||||
dest: /etc/haproxy/haproxy.cfg
|
||||
validate: "haproxy -c -f %s"
|
||||
notify:
|
||||
- Restart HAProxy
|
||||
|
||||
- name: Configure cadoles-pod-hydra-v1
|
||||
template:
|
||||
src: "{{ item.src }}"
|
||||
dest: "{{ item.dest }}"
|
||||
with_items:
|
||||
- src: cadoles-pod-hydra-v1.conf.j2
|
||||
dest: /etc/cadoles-pod-hydra-v1.conf
|
||||
- src: oidc-test-client.json.j2
|
||||
dest: /etc/hydra/clients.d/oidc-test.json
|
||||
notify:
|
||||
- Restart cadoles-pod-hydra-v1
|
||||
|
||||
- name: Configure cadoles-pod-hydra-dispatcher-v1
|
||||
template:
|
||||
src: "{{ item.src }}"
|
||||
dest: "{{ item.dest }}"
|
||||
with_items:
|
||||
- src: cadoles-pod-hydra-dispatcher-v1.conf.j2
|
||||
dest: /etc/cadoles-pod-hydra-dispatcher-v1.conf
|
||||
- src: hydra-dispatcher-apps.yml.j2
|
||||
dest: /etc/hydra-dispatcher/conf.d/apps.yml
|
||||
notify:
|
||||
- Restart cadoles-pod-hydra-dispatcher-v1
|
||||
|
||||
- name: Configure passwordless authentification if enabled
|
||||
ansible.builtin.include_tasks: hydra-passwordless.yml
|
||||
when: enable_hydra_passwordless
|
||||
|
||||
- name: Configure SAML authentification if enabled
|
||||
ansible.builtin.include_tasks: hydra-saml.yml
|
||||
when: enable_hydra_saml
|
||||
|
||||
- name: Sart OIDC Test app if enabled
|
||||
ansible.builtin.include_tasks: oidc-test.yml
|
||||
when: enable_oidc_test_app
|
||||
|
|
@ -0,0 +1,17 @@
|
|||
---
|
||||
|
||||
- name: Start oidc-test app
|
||||
containers.podman.podman_container:
|
||||
name: oidc-test
|
||||
image: docker.io/bornholm/oidc-test:v0.0.0-2-gd0583cc
|
||||
state: started
|
||||
network: host
|
||||
recreate: yes
|
||||
env:
|
||||
OIDC_CLIENT_ID: "{{ oidc_test_app_client_id }}"
|
||||
OIDC_CLIENT_SECRET: "{{ oidc_test_app_client_secret }}"
|
||||
LOG_LEVEL: 0
|
||||
OIDC_ISSUER_URL: "http://{{ public_host }}/"
|
||||
OIDC_REDIRECT_URL: "http://{{ public_host }}:8080"
|
||||
OIDC_POST_LOGOUT_REDIRECT_URL: "http://{{ public_host }}:8080"
|
||||
HTTP_ADDRESS: 0.0.0.0:8080
|
||||
|
|
@ -0,0 +1,16 @@
|
|||
PODMAN_ARGS="\
|
||||
--name 'cadoles-pod-hydra-dispatcher-v1' \
|
||||
--replace \
|
||||
--network=slirp4netns:allow_host_loopback=true \
|
||||
-p 127.0.0.1:3000:80 \
|
||||
-v /etc/hydra-dispatcher/conf.d:/var/www/config/hydra \
|
||||
-e APP_ENV=prod \
|
||||
-e APP_DEBUG=yes \
|
||||
-e HYDRA_ADMIN_BASE_URL=http://10.0.2.2:4445 \
|
||||
-e HYDRA_BASE_URL=http://10.0.2.2:4444 \
|
||||
-e HYDRA_REWRITE_ISSUER=no \
|
||||
-e HYDRA_ORIGINAL_ISSUER={{ public_scheme }}://{{ public_host }} \
|
||||
-e HYDRA_NEW_ISSUER={{ public_scheme }}://{{ public_host }} \
|
||||
-e 'ASSETS_BASE_URL={{ public_scheme }}://{{ public_host }}/auth/dispatcher' \
|
||||
-e 'COOKIE_PATH=/auth/dispatcher' \
|
||||
"
|
||||
|
|
@ -0,0 +1,15 @@
|
|||
PODMAN_ARGS="\
|
||||
-p 127.0.0.1:3001:3000 \
|
||||
--network=slirp4netns:allow_host_loopback=true \
|
||||
--replace --name 'cadoles-pod-hydra-passwordless-v1' \
|
||||
-e HTTP_BASE_URL={{ public_scheme }}://{{ public_host }}/auth/passwordless \
|
||||
-e 'SMTP_HOST={{ hydra_passwordless_smtp_host }}' \
|
||||
-e 'SMTP_PORT={{ hydra_passwordless_smtp_port }}' \
|
||||
-e 'SMTP_USER={{ hydra_passwordless_smtp_user }}' \
|
||||
-e 'SMTP_PASSWORD={{ hydra_passwordless_smtp_password }}' \
|
||||
-e 'SMTP_INSECURE_SKIP_VERIFY={{ hydra_passwordless_smtp_insecure_skip_verify }}' \
|
||||
-e 'SMTP_SENDER_ADDRESS={{ hydra_passwordless_sender_address }}' \
|
||||
-e 'SMTP_USE_START_TLS={{ hydra_passwordless_smtp_use_start_tls }}' \
|
||||
-e 'SMTP_SENDER_NAME={{ hydra_passwordless_sender_name }}' \
|
||||
-e HYDRA_BASE_URL=http://10.0.2.2:3000 \
|
||||
"
|
||||
|
|
@ -0,0 +1,14 @@
|
|||
PODMAN_ARGS="\
|
||||
-p 127.0.0.1:3003:80 \
|
||||
--network=slirp4netns:allow_host_loopback=true \
|
||||
--replace --name 'cadoles-pod-hydra-remote-user-v1' \
|
||||
-v /etc/hydra-remote-user/conf.d:/var/www/config/remote_user \
|
||||
-v /etc/hydra-remote-user/apache.conf:/etc/apache2/sites-available/000-default.conf \
|
||||
-e APP_ENV=prod \
|
||||
-e APP_DEBUG=no \
|
||||
-e HTTP_BASE_URL={{ public_scheme }}://{{ public_host }}/auth/saml \
|
||||
-e COOKIE_PATH=/auth/saml \
|
||||
-e HYDRA_ADMIN_BASE_URL=http://10.0.2.2:3000 \
|
||||
-e 'TRUSTED_PROXIES=127.0.0.1,10.0.2.0/24' \
|
||||
-e LOGOUT_REDIRECT_URL_PATTERN={{ public_scheme }}://{{ public_host }}/auth/saml/Shibboleth.sso/Logout?return=%s \
|
||||
"
|
||||
|
|
@ -0,0 +1,18 @@
|
|||
PODMAN_ARGS="\
|
||||
--name 'cadoles-pod-hydra-v1' \
|
||||
--replace \
|
||||
--network=slirp4netns:allow_host_loopback=true \
|
||||
-p 127.0.0.1:4444:4444 \
|
||||
-p 127.0.0.1:4445:4445 \
|
||||
--tmpfs /tmp \
|
||||
-e 'HYDRA_DSN=mysql://{{ hydra_database_user }}:{{ hydra_database_password }}@tcp({{ hydra_database_host }}:{{ hydra_database_port }})/{{ hydra_database_name }}?parseTime=true' \
|
||||
-e LOG_LEVEL=debug \
|
||||
-e LOG_LEAK_SENSITIVE_VALUES=true \
|
||||
-e HYDRA_URLS_SELF_ISSUER={{ public_scheme }}://{{ public_host }} \
|
||||
-e HYDRA_URLS_CONSENT={{ public_scheme }}://{{ public_host }}/auth/dispatcher/consent \
|
||||
-e HYDRA_URLS_LOGIN={{ public_scheme }}://{{ public_host }}/auth/dispatcher/login \
|
||||
-e HYDRA_URLS_LOGOUT={{ public_scheme }}://{{ public_host }}/auth/dispatcher/logout \
|
||||
-e HYDRA_ALLOW_INSECURE=yes \
|
||||
-e HYDRA_LEVEL=debug \
|
||||
-v /etc/hydra/clients.d:/etc/hydra/clients.d \
|
||||
"
|
||||
|
|
@ -0,0 +1,13 @@
|
|||
PODMAN_ARGS="\
|
||||
-p 127.0.0.1:3002:80 \
|
||||
--network=slirp4netns:allow_host_loopback=true \
|
||||
--replace --name 'cadoles-pod-shibboleth-sp-v3' \
|
||||
-e 'SP_ENTITY_ID={{ public_scheme }}://{{ public_host }}/auth/saml' \
|
||||
-e 'IDP_ENTITY_ID={{ hydra_saml_idp_entity_id }}' \
|
||||
-e 'IDP_METADATA_URL={{ hydra_saml_idp_metadata_url }}' \
|
||||
-e 'APACHE_BACKEND_URL=http://10.0.2.2:3003' \
|
||||
-e 'SP_HANDLER_BASE_PATH=/auth/saml' \
|
||||
-v '/etc/shibboleth/attribute-map.inc.xml:/etc/shibboleth/attribute-map.inc.xml' \
|
||||
-v '/etc/shibboleth/shibboleth2.xml.gotmpl:/etc/shibboleth/shibboleth2.xml.gotmpl' \
|
||||
-v '/etc/shibboleth/credentials:/etc/shibboleth/credentials' \
|
||||
"
|
||||
|
|
@ -0,0 +1,115 @@
|
|||
global
|
||||
log /dev/log local0
|
||||
log /dev/log local1 notice
|
||||
chroot /var/lib/haproxy
|
||||
stats socket /run/haproxy/admin.sock mode 660 level admin expose-fd listeners
|
||||
stats timeout 30s
|
||||
user haproxy
|
||||
group haproxy
|
||||
daemon
|
||||
|
||||
# Default SSL material locations
|
||||
ca-base /etc/ssl/certs
|
||||
crt-base /etc/ssl/private
|
||||
|
||||
# See: https://ssl-config.mozilla.org/#server=haproxy&server-version=2.0.3&config=intermediate
|
||||
ssl-default-bind-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
|
||||
ssl-default-bind-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
|
||||
ssl-default-bind-options ssl-min-ver TLSv1.2 no-tls-tickets
|
||||
|
||||
defaults
|
||||
log global
|
||||
mode http
|
||||
option httplog
|
||||
option dontlognull
|
||||
timeout connect 5000
|
||||
timeout client 50000
|
||||
timeout server 50000
|
||||
errorfile 400 /etc/haproxy/errors/400.http
|
||||
errorfile 403 /etc/haproxy/errors/403.http
|
||||
errorfile 408 /etc/haproxy/errors/408.http
|
||||
errorfile 500 /etc/haproxy/errors/500.http
|
||||
errorfile 502 /etc/haproxy/errors/502.http
|
||||
errorfile 503 /etc/haproxy/errors/503.http
|
||||
errorfile 504 /etc/haproxy/errors/504.http
|
||||
|
||||
frontend http-in
|
||||
bind 0.0.0.0:80
|
||||
mode http
|
||||
|
||||
maxconn 2000
|
||||
|
||||
acl login_dispatcher path_beg -i /auth/dispatcher
|
||||
{% if enable_hydra_passwordless %}
|
||||
acl login_passwordless path_beg -i /auth/passwordless
|
||||
{% endif %}
|
||||
{% if enable_hydra_saml %}
|
||||
acl login_saml path_beg -i /auth/saml
|
||||
{% endif %}
|
||||
|
||||
use_backend hydra_dispatcher if login_dispatcher
|
||||
{% if enable_hydra_passwordless %}
|
||||
use_backend hydra_passwordless if login_passwordless
|
||||
{% endif %}
|
||||
{% if enable_hydra_saml %}
|
||||
use_backend hydra_saml if login_saml
|
||||
{% endif %}
|
||||
use_backend hydra
|
||||
|
||||
# Backend Hydra
|
||||
backend hydra
|
||||
balance roundrobin
|
||||
|
||||
# Headers HTTP des requêtes
|
||||
option forwardfor
|
||||
http-request set-header X-Forwarded-Port %[dst_port]
|
||||
http-request add-header X-Forwarded-Proto http
|
||||
http-request set-header X-Forwarded-Host %[req.hdr(Host)]
|
||||
|
||||
server hydra 127.0.0.1:4444 check
|
||||
|
||||
# Backend Hydra Dispatcher
|
||||
backend hydra_dispatcher
|
||||
balance roundrobin
|
||||
|
||||
# Headers HTTP des requêtes
|
||||
option forwardfor
|
||||
http-request set-header X-Forwarded-Port %[dst_port]
|
||||
http-request add-header X-Forwarded-Proto http
|
||||
http-request set-header X-Forwarded-Host %[req.hdr(Host)]
|
||||
|
||||
# Suppression du préfixe /auth/dispatcher dans l'URL
|
||||
http-request set-path %[path,regsub(^/auth/dispatcher/,/)]
|
||||
|
||||
server hydra-login-dispatcher 127.0.0.1:3000 check
|
||||
|
||||
{% if enable_hydra_passwordless %}
|
||||
# Backend Hydra Passwordless
|
||||
backend hydra_passwordless
|
||||
balance roundrobin
|
||||
|
||||
# Headers HTTP des requêtes
|
||||
option forwardfor
|
||||
http-request set-header X-Forwarded-Port %[dst_port]
|
||||
http-request add-header X-Forwarded-Proto http
|
||||
http-request set-header X-Forwarded-Host %[req.hdr(Host)]
|
||||
|
||||
# Suppression du préfixe /auth/passwordless dans l'URL
|
||||
http-request set-path %[path,regsub(^/auth/passwordless,)]
|
||||
|
||||
server hydra-login-passwordless 127.0.0.1:3001 check
|
||||
{%- endif %}
|
||||
|
||||
{% if enable_hydra_saml %}
|
||||
# Backend Hydra SAML
|
||||
backend hydra_saml
|
||||
balance roundrobin
|
||||
|
||||
# Headers HTTP des requêtes
|
||||
option forwardfor
|
||||
http-request set-header X-Forwarded-Port %[dst_port]
|
||||
http-request add-header X-Forwarded-Proto http
|
||||
http-request set-header X-Forwarded-Host %[req.hdr(Host)]
|
||||
|
||||
server hydra-login-saml 127.0.0.1:3002 check
|
||||
{%- endif %}
|
||||
|
|
@ -0,0 +1,26 @@
|
|||
hydra:
|
||||
apps:
|
||||
{% if enable_hydra_passwordless %}
|
||||
- id: passwordless
|
||||
title: "{{ hydra_passwordless_app_title }}"
|
||||
description: "{{ hydra_passwordless_app_description }}"
|
||||
login_url: {{ public_scheme }}://{{ public_host }}/auth/passwordless/login
|
||||
consent_url: {{ public_scheme }}://{{ public_host }}/auth/passwordless/consent
|
||||
logout_url: {{ public_scheme }}://{{ public_host }}/auth/passwordless/logout
|
||||
attributes_rewrite_rules:
|
||||
email:
|
||||
- consent.session.id_token.email
|
||||
icon_url: "{{ hydra_passwordless_app_icon_url }}"
|
||||
{% endif %}
|
||||
{% if enable_hydra_saml %}
|
||||
- id: saml
|
||||
title: "{{ hydra_saml_app_title }}"
|
||||
description: "{{ hydra_saml_app_description }}"
|
||||
login_url: {{ public_scheme }}://{{ public_host }}/auth/saml/login
|
||||
consent_url: {{ public_scheme }}://{{ public_host }}/auth/saml/consent
|
||||
logout_url: {{ public_scheme }}://{{ public_host }}/auth/saml/logout
|
||||
attributes_rewrite_rules:
|
||||
email:
|
||||
- consent.session.id_token.email
|
||||
icon_url: "{{ hydra_saml_app_icon_url }}"
|
||||
{% endif %}
|
||||
|
|
@ -0,0 +1,6 @@
|
|||
remote_user:
|
||||
subject_header: subject-id
|
||||
headers_attributes_mapping:
|
||||
- header: mail
|
||||
attribute: email
|
||||
required: true
|
||||
|
|
@ -0,0 +1,19 @@
|
|||
{
|
||||
"client_id": "{{ oidc_test_app_client_id }}",
|
||||
"client_name": "OIDC Test",
|
||||
"client_secret": "{{ oidc_test_app_client_secret }}",
|
||||
"grant_types": [
|
||||
"authorization_code",
|
||||
"refresh_token"
|
||||
],
|
||||
"jwks": {},
|
||||
"metadata": {},
|
||||
"post_logout_redirect_uris": ["{{ public_scheme }}://{{ public_host }}:8080"],
|
||||
"redirect_uris": ["{{ public_scheme }}://{{ public_host }}:8080/oauth2/callback"],
|
||||
"response_types": [
|
||||
"code"
|
||||
],
|
||||
"logo_uri": "https://www.cadoles.com/images/logo.svg",
|
||||
"scope": "openid profile email",
|
||||
"token_endpoint_auth_method": "client_secret_post"
|
||||
}
|
||||
|
|
@ -0,0 +1,2 @@
|
|||
<Attribute name="urn:oid:0.9.2342.19200300.100.1.1" nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" id="uid" />
|
||||
<Attribute name="urn:oid:0.9.2342.19200300.100.1.3" nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" id="mail" />
|
||||
Loading…
Reference in New Issue