mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-08 03:38:23 +00:00
kevinveenbirkenbachandClaude Opus 4.7
24d4ab8e4a
Implements docs/requirements/021-sso-flavor-migration.md atomically:
* Schema: every role's meta/services.yml replaces the parallel
`oauth2:` / `oidc:` top-level blocks with a single `sso:` block
carrying `enabled`, `shared`, and a `flavor` discriminator
(`oidc` | `oauth2` | `saml`; default `oidc`). Flavor-specific
sub-keys live under `sso.<flavor>.*` (`sso.oauth2.{origin,acl,
allowed_groups}`, `sso.oidc.plugin`).
* Provider role: roles/web-app-oauth2-proxy/ is deleted in its
entirety; its 5 sidecar templates move under
roles/web-app-keycloak/templates/sso_proxy/, and the per-consumer
rendering task lives at roles/web-app-keycloak/tasks/sso_proxy.yml.
web-app-keycloak now declares `provides: sso`.
* Runtime: new resolver utils/roles/applications/services/sso.py
centralises the SSO predicates (`is_enabled`, `is_proxy_gated`,
`is_oidc_native`) and the oauth2 sub-values
(`oauth2_origin_{host,port}`, `oauth2_acl`, `oauth2_allowed_groups`).
Three lookup plugins consume the resolver: `sso` (single-app
predicate access), `sso_proxy_consumers` (enumerates oauth2-flavored
consumers), `sso_oidc_plugin` (renamed from `oidc_flavor`, Nextcloud
plugin selector). sys-stk-backend, sys-svc-compose, sys-svc-proxy
and plugins/filter/compose_volumes.py all gate on
`lookup('sso', ..., 'is_proxy_gated')` instead of manually combining
`enabled` and `flavor`.
* Identifier renames repo-wide: `services.<entity>.ports.local.oauth2`
→ `ports.local.sso`; `PORT_BANDS.local.oauth2` → `PORT_BANDS.local.sso`;
`OAUTH2_PROXY_*` env/Jinja vars → `SSO_PROXY_*`;
`oauth2_proxy_cookie_secret` → `sso_proxy_cookie_secret`;
`OAUTH2_SERVICE_ENABLED` + `OIDC_SERVICE_ENABLED` collapse into
`SSO_SERVICE_ENABLED`; Playwright gating helpers
(isServiceEnabled/skipUnlessServiceEnabled/requireService/safeIsEnabled/
safeSkipUnlessEnabled) move from `oidc`/`oauth2` to `sso`.
* Dual-block resolution: per req's Background-Table, web-app-bookwyrm
is `flavor: oauth2`; web-app-gitea and web-app-friendica keep
`flavor: oauth2` with their existing `oauth2.acl.blacklist`
(/user/login) and `oauth2.acl.whitelist` (federation + discovery
endpoints) — preserving the operative oauth2-proxy gating.
* Tests: the two mutual-exclusion guards
(tests/integration/iam/oauth2_oidc/test_mutual_exclusive.py and
test_acl_mutual_exclusive.py) are deleted per Decision #10;
test_oauth2_contract.py is renamed and rewritten to
test_sso_contract.py, asserting that `flavor: oauth2` roles carry
`oauth2.origin.{host,port}` plus `ports.local.sso`; test_sso.py
(web-app integration) now requires the unified `sso:` block with an
explicit flavor or a `# nocheck: sso` opt-out; new
tests/lint/repository/no_legacy_sso_paths/ guards the source tree
against re-introducing the legacy strings.
* Docs: req 21 itself has every AC checked off, and reqs 006, 008,
009, 013, 015, 016, 019, 020 plus 10+ role READMEs and
docs/contributing/actions/testing/suppression.md are updated to the
unified SSO naming.
Empirically validated end-to-end against the validation app set
(web-app-keycloak, web-app-nextcloud, web-app-bookwyrm, web-app-gitea,
web-app-friendica, web-app-dashboard) in matrix variants 0 and 1; v2
also passes the 4 target roles' Playwright after a documented
pre-existing KC_HOSTNAME-drift workaround (separate concern, not
caused by this refactor).
BREAKING CHANGE: every consumer of `services.oauth2.*`,
`services.oidc.*`, `OAUTH2_PROXY_*`, `OAUTH2_SERVICE_ENABLED`,
`OIDC_SERVICE_ENABLED`, `oauth2_proxy_cookie_secret`,
`oauth2_proxy_application_id`, `ports.local.oauth2`, the
`web-app-oauth2-proxy` role, or the legacy gating helper service names
(`oidc`/`oauth2`) must migrate to the unified `sso` shape documented
in docs/requirements/021-sso-flavor-migration.md.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
51 lines
2.6 KiB
Markdown
51 lines
2.6 KiB
Markdown
# TODOs
|
|
|
|
## Migrate auth to the `saml` addon (replaces oauth2-proxy + ldapauth + double-login)
|
|
|
|
**Why:** Friendica currently authenticates in two steps: oauth2-proxy gates
|
|
the vhost (Keycloak-Authorization-Code-Flow, 2FA-enforceable), then the user
|
|
must fill Friendica's own `/login` form because stock Friendica has **no
|
|
header-trusted auto-login** — Owa.php / OAuth/Token.php only read
|
|
`HTTP_AUTHORIZATION` for API endpoints, never for the web session. The
|
|
ldapauth addon stays enabled solely as a first-login bootstrap that
|
|
materialises the `friendica.user` row from openldap.
|
|
|
|
The double-login is UX-hostile (creds typed twice) and the second hop
|
|
silently bypasses any 2FA Keycloak enforced on the first hop — anyone with
|
|
the LDAP password can reach the app even when WebAuthn/OTP is required at
|
|
the IdP. Friendica's stock `saml` addon (already on disk under
|
|
`/var/www/html/addon/saml/`) supports a SAML2 AuthnRequest → IdP-initiated
|
|
SSO with auto-account-creation, which collapses the chain to a single
|
|
2FA-gated round-trip.
|
|
|
|
**Migration outline (~4-6h):**
|
|
|
|
1. Enable `addons.saml: {}` in `meta/services.yml` (and drop `addons.ldapauth: {}`
|
|
plus `services.oauth2` once SAML autocreate is verified).
|
|
2. Template `saml.config.php.j2` analogous to `ldapauth.config.php.j2`:
|
|
IdP-metadata-URL, SP-Entity-ID, SP-ACS-URL, NameID format, attribute map
|
|
(`email`/`firstName`/`lastName`/`groups`), signing/encryption cert paths.
|
|
3. Mount the rendered `saml.config.php` in `compose.yml.j2` (analogous to
|
|
ldapauth).
|
|
4. Provision a SAML client in Keycloak (extend `roles/web-app-keycloak`'s
|
|
client-provisioning logic which currently only handles OIDC clients).
|
|
Attribute mappers, SP-metadata import, signing certificate alignment.
|
|
5. Drop `services.sso.enabled` for friendica — SAML handles SSO end-to-
|
|
end, oauth2-proxy in front would double-gate.
|
|
6. Rewrite `files/playwright/playwright.spec.js` to use the generic admin/biber
|
|
persona flows (remove `PERSONA_*_BLOCKED=true` from
|
|
`templates/playwright.env.j2`, drop the bespoke `loginViaOauth2ProxyAndFriendica`
|
|
helper, drop the FRIENDICA_BASE_URL env var).
|
|
|
|
**Risks / unknowns:**
|
|
|
|
- Friendica's `saml` addon is community-maintained — last-commit recency
|
|
AND config-format compatibility need verification before committing to
|
|
it as the canonical SSO path.
|
|
- SAML cert lifecycle (rotation, alignment between Friendica SP and
|
|
Keycloak IdP) is a new maintenance burden — clarify ownership before
|
|
shipping.
|
|
- First-login autocreate via SAML's `auto_register` option must be tested
|
|
with both the `administrator` and `biber` openldap-sourced identities
|
|
before ldapauth is removed.
|