mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
kevinveenbirkenbachandClaude Opus 5.5
250b89ba4c
Core `auth`, the list of enabled auth plugins, was written only by
05_ldap_sync.yml. Variant 1 of meta/variants.yml is SSO without LDAP and
skips that file, while 04_oidc.yml sets every mdl_user row to
auth='oidc'. Those users point at a plugin the site never enabled.
Moodle 5.3 rejects such a user in validate_auth_not_disabled(), so after
the second deploy of variant 1 the MCP service account, now auth='oidc',
gets "wsaccessusernologin" and "List the MCP tools with the minted
bearer" fails all 30 attempts (main run 39841510219, job 120466819062).
Before 5.3 only a literal 'nologin' was refused, which hid the gap. Users
of variant 1 could not log in at all for the same reason.
04_oidc.yml now enables oidc itself; 05_ldap_sync.yml runs after it and
widens the list to oidc,ldap where both are on. alternateloginurl moves
out of the loop that passes --component=auth_oidc, because core reads it
from mdl_config, not from the plugin's config.
Cherry-picked from dcb8f6866b on feature/store-i18n, with main's
MOODLE_OIDC_PLUGIN_URL_PATH kept for the login URL (Moodle 5.3 serves
the plugin under auth/oidc).
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
128 lines
6.4 KiB
YAML
128 lines
6.4 KiB
YAML
---
|
|
# Configure Moodle's auth_oidc plugin (variant 0 only). Variant 1
|
|
# disables the OIDC shared service so this file is not included.
|
|
|
|
- name: "🔎 Check OIDC plugin presence"
|
|
shell: >
|
|
container exec --user root {{ MOODLE_CONTAINER_ADDRESS }} test -d {{ MOODLE_OIDC_PLUGIN_DIR }}
|
|
register: oidc_plugin_check
|
|
changed_when: false
|
|
failed_when: false
|
|
|
|
- name: "🛑 Fail if OIDC plugin is missing"
|
|
fail:
|
|
msg: "auth_oidc plugin not found at {{ MOODLE_OIDC_PLUGIN_DIR }} — image build is incomplete"
|
|
when: oidc_plugin_check.rc != 0
|
|
|
|
- name: "▶️ Run Moodle DB upgrade for OIDC plugin"
|
|
shell: >
|
|
container exec --user {{ MOODLE_RUNTIME_USER }} {{ MOODLE_CONTAINER_ADDRESS }}
|
|
php {{ MOODLE_CLI_DIR }}/upgrade.php --non-interactive
|
|
changed_when: false
|
|
failed_when: false
|
|
|
|
- name: "🔧 Set Moodle OIDC configuration via CLI"
|
|
no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
|
|
loop:
|
|
- { name: "idptype", value: 3 }
|
|
- { name: "clientauthmethod", value: 1 }
|
|
- { name: "clientid", value: "{{ OIDC.CLIENT.ID }}" }
|
|
- { name: "clientsecret", value: "{{ OIDC.CLIENT.SECRET }}" }
|
|
- { name: "opname", value: "{{ OIDC.BUTTON_TEXT }}" }
|
|
- { name: "oidcscope", value: "{{ MOODLE_OIDC_SCOPES }}" }
|
|
- { name: "authendpoint", value: "{{ OIDC.CLIENT.AUTHORIZE_URL }}" }
|
|
- { name: "tokenendpoint", value: "{{ OIDC.CLIENT.TOKEN_URL }}" }
|
|
- { name: "bindingusernameclaim", value: "{{ OIDC.ATTRIBUTES.USERNAME }}" }
|
|
- { name: "single_sign_off", value: 1 }
|
|
- { name: "logouturi", value: "{{ OIDC.CLIENT.LOGOUT_URL }}" }
|
|
- { name: "icon", value: "moodle:t/lock" }
|
|
- { name: "field_map_firstname", value: "given_name" }
|
|
- { name: "field_lock_firstname", value: "locked" }
|
|
- { name: "field_updatelocal_firstname", value: "oneveryloginupdate" }
|
|
- { name: "field_map_lastname", value: "family_name" }
|
|
- { name: "field_lock_lastname", value: "locked" }
|
|
- { name: "field_updatelocal_lastname", value: "oneveryloginupdate" }
|
|
- { name: "field_map_middlename", value: "middle_name" }
|
|
- { name: "field_lock_middlename", value: "locked" }
|
|
- { name: "field_updatelocal_middlename", value: "oneveryloginupdate" }
|
|
- { name: "field_map_alternatename", value: "nickname" }
|
|
- { name: "field_lock_alternatename", value: "locked" }
|
|
- { name: "field_updatelocal_alternatename", value: "oneveryloginupdate" }
|
|
- { name: "field_map_email", value: "email" }
|
|
- { name: "field_lock_email", value: "locked" }
|
|
- { name: "field_updatelocal_email", value: "oneveryloginupdate" }
|
|
- { name: "field_map_phone1", value: "phone_number" }
|
|
- { name: "field_lock_phone1", value: "locked" }
|
|
- { name: "field_updatelocal_phone1", value: "oneveryloginupdate" }
|
|
- { name: "field_map_phone2", value: "phone_number_alt" }
|
|
- { name: "field_lock_phone2", value: "locked" }
|
|
- { name: "field_updatelocal_phone2", value: "oneveryloginupdate" }
|
|
- { name: "field_map_address", value: "address" }
|
|
- { name: "field_lock_address", value: "locked" }
|
|
- { name: "field_updatelocal_address", value: "oneveryloginupdate" }
|
|
- { name: "field_map_city", value: "locality" }
|
|
- { name: "field_lock_city", value: "locked" }
|
|
- { name: "field_updatelocal_city", value: "oneveryloginupdate" }
|
|
- { name: "field_map_country", value: "country" }
|
|
- { name: "field_lock_country", value: "locked" }
|
|
- { name: "field_updatelocal_country", value: "oneveryloginupdate" }
|
|
- { name: "field_map_institution", value: "institution" }
|
|
- { name: "field_lock_institution", value: "locked" }
|
|
- { name: "field_updatelocal_institution", value: "oneveryloginupdate" }
|
|
- { name: "field_map_department", value: "department" }
|
|
- { name: "field_lock_department", value: "locked" }
|
|
- { name: "field_updatelocal_department", value: "oneveryloginupdate" }
|
|
- { name: "field_map_description", value: "description" }
|
|
- { name: "field_lock_description", value: "locked" }
|
|
- { name: "field_updatelocal_description", value: "oneveryloginupdate" }
|
|
- { name: "field_map_idnumber", value: "id_number" }
|
|
- { name: "field_lock_idnumber", value: "locked" }
|
|
- { name: "field_updatelocal_idnumber", value: "oneveryloginupdate" }
|
|
- { name: "field_map_url", value: "website" }
|
|
- { name: "field_lock_url", value: "locked" }
|
|
- { name: "field_updatelocal_url", value: "oneveryloginupdate" }
|
|
- { name: "field_map_lang", value: "locale" }
|
|
- { name: "field_lock_lang", value: "locked" }
|
|
- { name: "field_updatelocal_lang", value: "oneveryloginupdate" }
|
|
- { name: "field_map_timezone", value: "zoneinfo" }
|
|
- { name: "field_lock_timezone", value: "locked" }
|
|
- { name: "field_updatelocal_timezone", value: "oneveryloginupdate" }
|
|
- { name: "field_map_firstnamephonetic", value: "name_phonetic_given" }
|
|
- { name: "field_lock_firstnamephonetic", value: "locked" }
|
|
- { name: "field_updatelocal_firstnamephonetic", value: "oneveryloginupdate" }
|
|
- { name: "field_map_lastnamephonetic", value: "name_phonetic_family" }
|
|
- { name: "field_lock_lastnamephonetic", value: "locked" }
|
|
- { name: "field_updatelocal_lastnamephonetic", value: "oneveryloginupdate" }
|
|
loop_control:
|
|
label: "{{ item.name }}"
|
|
shell: >
|
|
container exec --user {{ MOODLE_RUNTIME_USER }} {{ MOODLE_CONTAINER_ADDRESS }}
|
|
php {{ MOODLE_CLI_DIR }}/cfg.php --component=auth_oidc
|
|
--name={{ item.name }} --set="{{ item.value }}"
|
|
changed_when: false
|
|
|
|
- name: "🟢 Enable the auth_oidc plugin in Moodle's core auth list"
|
|
shell: >
|
|
container exec --user {{ MOODLE_RUNTIME_USER }} {{ MOODLE_CONTAINER_ADDRESS }}
|
|
php {{ MOODLE_CLI_DIR }}/cfg.php --name=auth --set=oidc
|
|
changed_when: false
|
|
|
|
- name: "🔀 Point the Moodle login page at the auth_oidc entry point"
|
|
shell: >
|
|
container exec --user {{ MOODLE_RUNTIME_USER }} {{ MOODLE_CONTAINER_ADDRESS }}
|
|
php {{ MOODLE_CLI_DIR }}/cfg.php
|
|
--name=alternateloginurl
|
|
--set={{ (lookup('tls', application_id, 'url.base') ~ MOODLE_OIDC_PLUGIN_URL_PATH ~ '/') | quote }}
|
|
changed_when: false
|
|
|
|
- name: "🔧 Set auth = 'oidc' for all users except guest"
|
|
shell: >
|
|
container exec {{ MOODLE_DB_CONTAINER_ADDRESS }}
|
|
mariadb -u {{ lookup('database', application_id, 'username') }}
|
|
-p{{ lookup('database', application_id, 'password') | quote }}
|
|
-e "UPDATE {{ lookup('database', application_id, 'name') }}.mdl_user SET auth = 'oidc' WHERE username != 'guest';"
|
|
args:
|
|
executable: /bin/bash
|
|
changed_when: false
|
|
no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
|