mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
kevinveenbirkenbachandClaude Opus 5.5
b0856dcf7b
Snipe-IT v8.8.1 refuses any `login_remote_user_header_name` matching `/^HTTP_/i`, so the configured `HTTP_X_FORWARDED_PREFERRED_USERNAME` stopped minting sessions behind oauth2-proxy. Apache in the image now copies `X-Forwarded-Preferred-Username` into the server variable `INFINITO_SSO_USER`, and only when the request also carries `X-Infinito-Sso-Proxy` equal to the new per-inventory `sso_proxy_secret`; an empty secret keeps the bridge closed. openresty sends that header on every proxied request, so a client reaching the container directly cannot log in by forging the identity header. A deploy-time check asserts both directions (forged 200, with secret 302). Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
44 lines
1.9 KiB
YAML
44 lines
1.9 KiB
YAML
# @See https://raw.githubusercontent.com/snipe/snipe-it/master/app/Http/Controllers/Auth/LoginController.php
|
|
---
|
|
- name: "⏳ snipe-it: wait until settings table is seeded"
|
|
ansible.builtin.shell:
|
|
cmd: "container exec -i {{ SNIPE_IT_CONTAINER_ADDRESS }} php"
|
|
stdin: "{{ lookup('file', 'php/wait_settings.php') }}"
|
|
register: snipe_sso_settings_ready
|
|
retries: 60
|
|
delay: 5
|
|
until: snipe_sso_settings_ready.rc == 0
|
|
changed_when: false
|
|
failed_when: snipe_sso_settings_ready.rc != 0
|
|
|
|
- name: "📌 snipe-it: apply trusted-header SSO configuration via Setting model"
|
|
ansible.builtin.shell:
|
|
cmd: >-
|
|
container exec -i
|
|
-e SNIPE_IT_SSO_ENABLED=1
|
|
-e SNIPE_IT_SSO_HEADER_NAME={{ SNIPE_IT_SSO_HEADER_NAME | quote }}
|
|
-e SNIPE_IT_SSO_LOGOUT_URL={{ SNIPE_IT_SSO_LOGOUT_URL | quote }}
|
|
{{ SNIPE_IT_CONTAINER_ADDRESS }} php
|
|
stdin: "{{ lookup('file', 'php/apply/sso_config.php') }}"
|
|
changed_when: true
|
|
|
|
- name: "🧹 snipe-it: clear Laravel caches"
|
|
ansible.builtin.shell:
|
|
cmd: "container exec {{ SNIPE_IT_CONTAINER_ADDRESS }} php artisan optimize:clear"
|
|
changed_when: true
|
|
|
|
- name: "🔒 snipe-it: the SSO header bridge logs in only proxy-secret requests"
|
|
ansible.builtin.shell:
|
|
cmd: >-
|
|
container exec {{ SNIPE_IT_CONTAINER_ADDRESS }} sh -c
|
|
'{{ 30 | curl }} -s -o /dev/null -w "%{http_code}" -H "X-Forwarded-Preferred-Username: $1" {{ item.proxy_header }} http://localhost/login'
|
|
_ {{ lookup('users', 'administrator').username | quote }}
|
|
loop:
|
|
- { label: "forged header without the proxy secret", proxy_header: "", expected: "200" }
|
|
- { label: "header with the proxy secret", proxy_header: '-H "{{ SNIPE_IT_SSO_PROXY_HEADER }}: $INFINITO_SSO_PROXY_SECRET"', expected: "302" }
|
|
loop_control:
|
|
label: "{{ item.label }}"
|
|
register: snipe_it_sso_bridge_probe
|
|
changed_when: false
|
|
failed_when: snipe_it_sso_bridge_probe.stdout != item.expected
|