mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2025-08-30 07:18:09 +02:00
Kevin Veen-Birkenbach
dd9a9b6d84
Discussion: https://chatgpt.com/share/68b10c0a-c308-800f-93ac-2ffb386cf58b - Split tasks into 01_install, 02_debug, 03_admin, 04_extensions, 05_oidc. - Ensure unzip+git+composer on demand in the container; run Composer as www-data with COMPOSER_HOME=/tmp/composer. - Idempotently unpack/install PluggableAuth & OpenIDConnect; run composer install only if vendor/ is missing. - Add sanity check for Jumbojett\OpenIDConnectClient. - Copy oidc.php only when changed and append a single require_once to LocalSettings.php. - Use REL1_44-compatible numeric array for $wgPluggableAuth_Config; set $wgPluggableAuth_ButtonLabelMessage. - Debug: add debug.php that logs to STDERR (visible via docker logs); toggle cleanly with MODE_DEBUG. - Enable OIDC feature in config; add paths/OIDC/extension vars in vars/main.yml. fix(services): include SYS_SERVICE_GROUP_CLEANUP in StartPre lock (ssd-hdd, docker-hard). fix(desktop/joomla): simplify MODE_DEBUG templating. chore: minor cleanups and renames.
28 lines
1.0 KiB
Django/Jinja
28 lines
1.0 KiB
Django/Jinja
<?php
|
||
// ### OIDC (PluggableAuth) – BEGIN (managed by Ansible)
|
||
wfLoadExtension( 'PluggableAuth' );
|
||
wfLoadExtension( 'OpenIDConnect' );
|
||
|
||
$wgPluggableAuth_EnableAutoLogin = false; // don’t auto-redirect to IdP
|
||
$wgPluggableAuth_EnableLocalLogin = true; // keep local user/pass login
|
||
$wgPluggableAuth_ButtonLabelMessage = '{{ MEDIAWIKI_OIDC_BUTTON_TEXT }}';
|
||
|
||
// PluggableAuth expects a list of providers (numeric array) on REL1_44
|
||
$wgPluggableAuth_Config = [
|
||
[
|
||
'plugin' => 'OpenIDConnect',
|
||
'data' => [
|
||
// For Keycloak, use the REALM URL, e.g. https://auth.example/realms/<realm>
|
||
'providerURL' => '{{ MEDIAWIKI_OIDC_ISSUER }}',
|
||
'clientID' => '{{ MEDIAWIKI_OIDC_CLIENT_ID }}',
|
||
'clientsecret' => '{{ MEDIAWIKI_OIDC_CLIENT_SECRET }}',
|
||
'scope' => [ 'openid', 'profile', 'email' ],
|
||
],
|
||
],
|
||
];
|
||
|
||
// Helpful defaults
|
||
$wgOpenIDConnect_UseEmailNameAsUserName = true;
|
||
$wgOpenIDConnect_MigrateUsers = true;
|
||
// ### OIDC (PluggableAuth) – END
|