kevinveenbirkenbach/computer-playbook
1
0 Fork 0
mirror of https://github.com/kevinveenbirkenbach/computer-playbook.git synced 2026-11-06 10:59:59 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
fix/dev-python/python-upper-bound
computer-playbook/roles/web-app-friendica/TODO.md
T
kevinveenbirkenbachandClaude Opus 4.7 24d4ab8e4a refactor(sso)\!: collapse oauth2 + oidc into unified services.sso block (req 21) 
Implements docs/requirements/021-sso-flavor-migration.md atomically:

* Schema: every role's meta/services.yml replaces the parallel
  `oauth2:` / `oidc:` top-level blocks with a single `sso:` block
  carrying `enabled`, `shared`, and a `flavor` discriminator
  (`oidc` | `oauth2` | `saml`; default `oidc`). Flavor-specific
  sub-keys live under `sso.<flavor>.*` (`sso.oauth2.{origin,acl,
  allowed_groups}`, `sso.oidc.plugin`).
* Provider role: roles/web-app-oauth2-proxy/ is deleted in its
  entirety; its 5 sidecar templates move under
  roles/web-app-keycloak/templates/sso_proxy/, and the per-consumer
  rendering task lives at roles/web-app-keycloak/tasks/sso_proxy.yml.
  web-app-keycloak now declares `provides: sso`.
* Runtime: new resolver utils/roles/applications/services/sso.py
  centralises the SSO predicates (`is_enabled`, `is_proxy_gated`,
  `is_oidc_native`) and the oauth2 sub-values
  (`oauth2_origin_{host,port}`, `oauth2_acl`, `oauth2_allowed_groups`).
  Three lookup plugins consume the resolver: `sso` (single-app
  predicate access), `sso_proxy_consumers` (enumerates oauth2-flavored
  consumers), `sso_oidc_plugin` (renamed from `oidc_flavor`, Nextcloud
  plugin selector). sys-stk-backend, sys-svc-compose, sys-svc-proxy
  and plugins/filter/compose_volumes.py all gate on
  `lookup('sso', ..., 'is_proxy_gated')` instead of manually combining
  `enabled` and `flavor`.
* Identifier renames repo-wide: `services.<entity>.ports.local.oauth2`
  → `ports.local.sso`; `PORT_BANDS.local.oauth2` → `PORT_BANDS.local.sso`;
  `OAUTH2_PROXY_*` env/Jinja vars → `SSO_PROXY_*`;
  `oauth2_proxy_cookie_secret` → `sso_proxy_cookie_secret`;
  `OAUTH2_SERVICE_ENABLED` + `OIDC_SERVICE_ENABLED` collapse into
  `SSO_SERVICE_ENABLED`; Playwright gating helpers
  (isServiceEnabled/skipUnlessServiceEnabled/requireService/safeIsEnabled/
  safeSkipUnlessEnabled) move from `oidc`/`oauth2` to `sso`.
* Dual-block resolution: per req's Background-Table, web-app-bookwyrm
  is `flavor: oauth2`; web-app-gitea and web-app-friendica keep
  `flavor: oauth2` with their existing `oauth2.acl.blacklist`
  (/user/login) and `oauth2.acl.whitelist` (federation + discovery
  endpoints) — preserving the operative oauth2-proxy gating.
* Tests: the two mutual-exclusion guards
  (tests/integration/iam/oauth2_oidc/test_mutual_exclusive.py and
  test_acl_mutual_exclusive.py) are deleted per Decision #10;
  test_oauth2_contract.py is renamed and rewritten to
  test_sso_contract.py, asserting that `flavor: oauth2` roles carry
  `oauth2.origin.{host,port}` plus `ports.local.sso`; test_sso.py
  (web-app integration) now requires the unified `sso:` block with an
  explicit flavor or a `# nocheck: sso` opt-out; new
  tests/lint/repository/no_legacy_sso_paths/ guards the source tree
  against re-introducing the legacy strings.
* Docs: req 21 itself has every AC checked off, and reqs 006, 008,
  009, 013, 015, 016, 019, 020 plus 10+ role READMEs and
  docs/contributing/actions/testing/suppression.md are updated to the
  unified SSO naming.

Empirically validated end-to-end against the validation app set
(web-app-keycloak, web-app-nextcloud, web-app-bookwyrm, web-app-gitea,
web-app-friendica, web-app-dashboard) in matrix variants 0 and 1; v2
also passes the 4 target roles' Playwright after a documented
pre-existing KC_HOSTNAME-drift workaround (separate concern, not
caused by this refactor).

BREAKING CHANGE: every consumer of `services.oauth2.*`,
`services.oidc.*`, `OAUTH2_PROXY_*`, `OAUTH2_SERVICE_ENABLED`,
`OIDC_SERVICE_ENABLED`, `oauth2_proxy_cookie_secret`,
`oauth2_proxy_application_id`, `ports.local.oauth2`, the
`web-app-oauth2-proxy` role, or the legacy gating helper service names
(`oidc`/`oauth2`) must migrate to the unified `sso` shape documented
in docs/requirements/021-sso-flavor-migration.md.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-05-23 12:59:59 +02:00

2.6 KiB
Raw Permalink Blame History

TODOs

Migrate auth to the saml addon (replaces oauth2-proxy + ldapauth + double-login)

Why: Friendica currently authenticates in two steps: oauth2-proxy gates the vhost (Keycloak-Authorization-Code-Flow, 2FA-enforceable), then the user must fill Friendica's own /login form because stock Friendica has no header-trusted auto-login — Owa.php / OAuth/Token.php only read HTTP_AUTHORIZATION for API endpoints, never for the web session. The ldapauth addon stays enabled solely as a first-login bootstrap that materialises the friendica.user row from openldap.

The double-login is UX-hostile (creds typed twice) and the second hop silently bypasses any 2FA Keycloak enforced on the first hop — anyone with the LDAP password can reach the app even when WebAuthn/OTP is required at the IdP. Friendica's stock saml addon (already on disk under /var/www/html/addon/saml/) supports a SAML2 AuthnRequest → IdP-initiated SSO with auto-account-creation, which collapses the chain to a single 2FA-gated round-trip.

Migration outline (~4-6h):

  1. Enable addons.saml: {} in meta/services.yml (and drop addons.ldapauth: {} plus services.oauth2 once SAML autocreate is verified).
  2. Template saml.config.php.j2 analogous to ldapauth.config.php.j2: IdP-metadata-URL, SP-Entity-ID, SP-ACS-URL, NameID format, attribute map (email/firstName/lastName/groups), signing/encryption cert paths.
  3. Mount the rendered saml.config.php in compose.yml.j2 (analogous to ldapauth).
  4. Provision a SAML client in Keycloak (extend roles/web-app-keycloak's client-provisioning logic which currently only handles OIDC clients). Attribute mappers, SP-metadata import, signing certificate alignment.
  5. Drop services.sso.enabled for friendica — SAML handles SSO end-to- end, oauth2-proxy in front would double-gate.
  6. Rewrite files/playwright/playwright.spec.js to use the generic admin/biber persona flows (remove PERSONA_*_BLOCKED=true from templates/playwright.env.j2, drop the bespoke loginViaOauth2ProxyAndFriendica helper, drop the FRIENDICA_BASE_URL env var).

Risks / unknowns:

  • Friendica's saml addon is community-maintained — last-commit recency AND config-format compatibility need verification before committing to it as the canonical SSO path.
  • SAML cert lifecycle (rotation, alignment between Friendica SP and Keycloak IdP) is a new maintenance burden — clarify ownership before shipping.
  • First-login autocreate via SAML's auto_register option must be tested with both the administrator and biber openldap-sourced identities before ldapauth is removed.
Reference in new issue View Git Blame Copy Permalink