mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
kevinveenbirkenbachandClaude Opus 5
d5b6e90a8c
meta/services.yml pinned sso.flavor: oauth2, so an oauth2-proxy fronted the whole role. That gated the storefront too and left /admin behind a proxy the administrator persona could not log out of, while tasks/setup/oidc.yml -- the only OIDC wiring -- installed a literal placeholder plugin name behind an || true and wrote InfxOidc.config.* keys that no plugin reads. tasks/03_setup.yml and tasks/04_cleanup.yml were included by nothing, so none of it ever ran. The flavor moves to oidc, which drops the proxy on its own because sso_proxy.yml keys off is_proxy_gated: the storefront becomes public and /admin authenticates through heptacom/shopware-platform-admin-open-auth against Keycloak. The plugin is baked into files/Dockerfile beside the existing composer require, installed and activated by tasks/setup/oidc.yml, and its Keycloak client row is written idempotently by files/ensure/oidc_client.php over the Admin API -- GET by provider, then PATCH or POST -- because the plugin keeps its configuration in the heptacom_admin_open_auth_client DAL entity, not in system_config. The web service gains container_extra_hosts. With the proxy gone the token exchange runs inside the shopware container, which under swarm resolves clearnet only and could not reach the keycloak onion. The LDAP plugin tasks are deleted rather than wired. No admin-LDAP extension for 6.7 is installable unattended -- the only real one is a paid Store extension needing a licence token -- and arming tasks/03_setup.yml would have fired the INFX_LDAP_PLUGIN placeholder on every deploy that ships OpenLDAP, since meta/services.yml derives ldap.enabled from group membership. Directory identities reach the backend through the Keycloak LDAP federation instead. PERSONA_BIBER_BLOCKED becomes unconditional: biber has an account in no variant. test-admin-native.js keeps the authenticated journey and now drives the AdminOpenAuth provider link when SSO is on. Verified by execution: the provisioning payload and both idempotency branches against a stub; composer resolving 9.1.0 against shopware/core 6.7.13.0 without conflict; the install gate rejecting a no-plugins-found run and accepting both success shapes. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
15 lines
553 B
YAML
15 lines
553 B
YAML
---
|
|
- name: "🔴 Deactivate {{ SHOPWARE_OIDC_PLUGIN }}"
|
|
ansible.builtin.shell:
|
|
cmd: >- # nocheck: container-exec-resolver runtime-resolved CID, delegated to the hosting node
|
|
container exec -i --user {{ SHOPWARE_USER }}
|
|
-e SHOPWARE_ROOT={{ SHOPWARE_ROOT | quote }}
|
|
-e PLUGIN_NAME={{ SHOPWARE_OIDC_PLUGIN | quote }}
|
|
{{ SHOPWARE_WEB_LOCAL_CID | quote }}
|
|
sh
|
|
stdin: |
|
|
set -e
|
|
cd "$SHOPWARE_ROOT"
|
|
php bin/console plugin:deactivate --skip-asset-build --clearCache "$PLUGIN_NAME"
|
|
changed_when: false
|