Commit Graph

61 Commits (2d057ec6bc878091fcb1d1af6117001d533e858e)

Author SHA1 Message Date
Evilham 2d057ec6bc
[sso-admin] Fix regression on new installations
When introducing typing, we erroneously started passing an empty parent
Id instead of None, and the underlying Keycloak library failed to create
the groups.

Closes #15
2022-08-29 12:22:58 +02:00
Evilham 3f08973d7c
[wordpress] Reduce diff / upstream contribution
Now that https://github.com/keycloak/keycloak/pull/12966 has landed on
keycloak we can use that commit as a base for our file, therefore
reducing the resulting diff.
2022-08-29 12:08:42 +02:00
Jose Antonio Exposito Garcia b58e43f5d4 install package in worpdress docker for plugin gsite 2022-08-26 12:55:06 +00:00
Evilham 701be40cf5
[sso-admin] load svg from DOMAIN
This was previously using digitaldemocratic.net
2022-08-08 13:10:47 +02:00
Evilham c39f780cce
[dd.conf.sample] Document how MANAGED_EMAIL_DOMAIN 2022-08-08 12:19:26 +02:00
Evilham 519146a58f
[sso-admin] Fix bug in user_parser 2022-08-08 12:05:42 +02:00
Evilham 3fa0d48858
[dd-ctl] Adapt update subcommand with all actions
This way existing installations can just run ./dd-ctl update and have a
working environment with the latest version.
2022-08-08 11:58:04 +02:00
Evilham e3b1513725
[dd-ctl] [moodle] Do not use plugin dd.conf vars
This was a bad design choice since it doesn't allow us to easily manage
the intended plugin version and therefore keep them up to date.

As a short-term mechanism, we change the used variables to have the
_OVERRIDE suffix and default in dd-ctl to the actual URLs, while also
removing them from dd.conf.sample.

This solves the issue in both current and future installations; in a
near future we want to have these dependencies in a .tsv file where they
can easily be managed.
2022-08-08 11:42:28 +02:00
Evilham 80ff9cce22
[dd-ctl] [nc] forms plugin branch + occ upgrade
When installing / upgrading plugins it is often the case that occ
upgrade needs to run.
2022-08-08 11:40:57 +02:00
elena 151ddd5515 moodle plugins BBB and JITSI last version 2022-08-08 10:11:20 +02:00
Evilham f46162269e
[custom.sample] Apply x-net pink to sample files 2022-08-08 09:52:44 +02:00
Evilham 8309771a1c
[sso-avatars] Also use env var for minio container
From minio's documentation:
- MINIO_ACCESS_KEY and MINIO_SECRET_KEY are deprecated in lieu of
  MINIO_ROOT_USER and MINIO_ROOT_PASSWORD respectively
- In order to rotate secrets we only need to change
  MINIO_ROOT_{USER,PASSWORD}

Using this commit and the previous one affecting keycloak we can use
per-instance keys as opposed to the current state.
In order to achieve this, AVATARS_ACCESS_KEY and AVATARS_SECRET_KEY must
be set to the desired values.

The only guidelines as to how to generate ACCESS_KEY and SECRET_KEY are:

> Specify a unique, random, and long string for both the ACCESSKEY and
> SECRETKEY. Your organization may have specific internal or regulatory
> requirements around generating values for use with access or secret keys.

See:
- https://docs.min.io/minio/baremetal/reference/minio-server/minio-server.html#envvar.MINIO_ACCESS_KEY
- https://docs.min.io/minio/baremetal/security/minio-identity-management/user-management.html
2022-08-08 09:40:51 +02:00
Evilham 1ba5e51c41
bugfix in user_parser 2022-08-06 21:47:57 +02:00
Evilham 38d4e517b3
[sso-avatars] Actually use environment variables
This was needed because previously the DEFAULT_SERVER_URL was hardcoded
in the compiled keycloak module and that URL has changed.

For consistency sso-admin uses the same environment variables (except it
needs AVATARS_SERVER_HOST instead of AVATARS_SERVER_URL).
2022-08-06 21:47:35 +02:00
elena beb0350e9a Merge branch 'main' into develop 2022-08-05 15:42:57 +02:00
elena 6ad8df956e Merge branch 'develop' of https://gitlab.com/DD-workspace/DD into develop 2022-08-05 15:42:52 +02:00
elena bf0aeaf991 ADMIN: fix moodle db name 2022-08-05 15:42:27 +02:00
Evilham 7bcb222d18
[nc] user_saml: update to 5.0.2
We checked this works fine in multiple environments.

Reviewed with:	@elena61
2022-08-05 11:58:00 +02:00
elena 5c3967cbe6
variable format changed 2022-08-05 10:55:13 +02:00
elena 77342f6e8a
FIX: role changed on admin and on moodle 2022-08-05 10:55:11 +02:00
elena d9d9fc8ef0 variable format changed 2022-08-05 09:43:58 +02:00
Evilham 86baf7bd69
[sso-admin] Add compatibility keys in outgoing API 2022-08-04 14:42:17 +02:00
Evilham 822ed98ab4
[dd-sso-admin] bugfix and add tracing for 3p cbs 2022-08-04 14:05:02 +02:00
elena 8152d24b29 Merge branch 'main' into develop 2022-08-04 09:48:39 +02:00
Evilham 0eb8f5f549
[sso-admin] Fix issue when editing users
Co-written with:	@elena61
2022-08-04 09:24:37 +02:00
Xnet Xnet cb219ac87f Update README.md 2022-08-03 11:46:10 +00:00
elena 2830f8da46 Nextcloud - fix js line comments 2022-08-03 11:25:40 +02:00
elena 7392aeb0f2 Nextcloud fix theme name 2022-08-03 11:09:52 +02:00
Evilham 71237cabb6
[dd-ctl] Remove some docker calls 2022-08-03 10:29:25 +02:00
Evilham e07249a1cb
[dd-sso] Fix leftover old container names 2022-08-03 09:30:15 +02:00
Evilham cf05b9675c
[dd-sso] Fix minio issue and MailViews API
Email service sends a JSON with: {"config": {...}, "users": [...]}
2022-08-03 08:16:19 +02:00
Evilham d26df2779e
[nc] Add temporary queue processing from admin
This should run scripts every minute and delete them on correct execution.
2022-08-03 08:15:14 +02:00
Evilham ac66814947
[sso-admin] Fix permsissions for node_modules, ncq
node_modules needs proper permissions on image build and the Nextcloud
queue on run-time.

We also realised the user must be www-data for compatibility with the NC
image.
2022-08-01 23:04:39 +02:00
Evilham df29999e62
[sso-admin] Generate script for NC mail accounts
This must be executed from cron on dd-apps-nextcloud-app.
2022-08-01 14:32:51 +02:00
Evilham da52d322af
[sso-admin] Add cache decorator for python 3.7 2022-08-01 12:59:10 +02:00
Evilham 7bf216ef69
[sso-admin] Change container not to run as root 2022-08-01 12:47:30 +02:00
elena 5af70cd6ea solved conflict main merge 2022-08-01 09:23:49 +02:00
elena 9cb2b68543 FIX: role changed on admin and on moodle 2022-08-01 09:12:55 +02:00
Evilham c19ff6cd8d
[sso-admin] Add third-party integrations
The endpoints for the mail integration are added here.

The ThirdPartyIntegrationKeys class in admin.lib.keys is intended to be
used on both the sending and receiving part of communications.

Implementations in other languages should closely follow its design, so
we are sure communication happens as it is expected.

Broadly speaking:

- Each party receives a name (DD is always "DD") that is well-known to
  all communicating parties
- Each party sets up an endpoint sharing their public key in JWK format
  See: https://datatracker.ietf.org/doc/html/rfc7517
  And the many JWK implementations around. This class uses python-jose's
- In a key_store folder, the remote party's public key will be cached
  and the local private key will be generated and saved
- Any data exchanged between the two parties must:
  - Be first encrypted with the remote party's public key
    See: https://datatracker.ietf.org/doc/html/rfc7516
  - Then signed with the local party's private key, by adding its
    payload to a 'data' claim.
    See: https://datatracker.ietf.org/doc/html/rfc7515
  - Have an Authorization header with a signed JWT containing the local
    party's name as the 'kid' header.
    This aids the remote party in deciding which key needs to be used.
2022-07-31 12:18:13 +02:00
Evilham 74b209b55b
[dd-ctl] [nc] Add patches while they land upstream
See: https://github.com/nextcloud/mail/pull/6908
2022-07-30 23:05:51 +02:00
Evilham 38cc2a0564
[sso-admin] Improve data and custom dir handling
While there also improve the default permissions for the secrets
directory.
2022-07-30 09:41:20 +02:00
Evilham 4421c5a5df
[sso-admin] Fix import and config issues
FileStorage is in werkzeug.datastructures, this didn't get caught by
mypy due to lack of type hints.

AdminFlaskApp now loads the configuration earlier, otherwise the
connection to other systems gets started with the wrong values.
While there, use .update since values from the environment are exactly what
we want to be using and the way it was written, they are expected to be
set up.

We also had swapped creation of the admin.lib.admin.Admin object and
processing admin.lib.postup.Postup; which loads some secrets needed for
moodle.
2022-07-29 20:30:43 +02:00
Evilham 64c0869e46
[sso-admin] Update requirements file 2022-07-29 19:28:42 +02:00
Evilham f80664a38b
[sso-admin] Add license entry to package.json
This was the intended license as stated in all source files.

This commit silences a warning when building the corresponding docker
images.
2022-07-29 19:05:04 +02:00
Evilham 6b4fd5482e
[sso-admin] Fix issues detected with mypy
While there, refactor thread handling in AppViews since it was not
practical.

Some issues found with mypy and fixed by this commit:

src/admin/views/ApiViews.py:240: error: Name "user_ddid" is not defined
src/admin/lib/nextcloud.py:331: error: Name "group" is not defined
src/admin/lib/nextcloud.py:394: error: Name "ProviderUserNotExists" is not defined
src/admin/lib/admin.py:1604: error: Trying to read deleted variable "se"
src/admin/lib/admin.py:1798: error: Trying to read deleted variable "se"
src/admin/lib/admin.py:1903: error: Name "group" is not defined
2022-07-29 17:25:25 +02:00
Evilham 81fff214d5
[sso-admin] Disentangle module and add type hints
With this commit, code from the admin module can be re-used and thanks
to adding type-hints in most places we are able to discover some bugs.

This commit attempts to fix only that which was necessary to:

- Add a reasonable amount of type hints
- Disentangle the module

There are already some issues that have been discovered by mypy.
2022-07-29 14:02:49 +02:00
Evilham e98323913d
[sso-admin] Add base for QA checks
This is all relative to the dd-sso/admin directory.

With https://pipenv.pypa.io/en/latest/ it is simple to setup a
development environment (pipenv install --dev).

By running:

    echo "PYTHONPATH=$(pwd)/src" > .env

The admin module will be loaded in the virtualenvironment and e.g.
running mypy src/admin will throw different errors in the existing code.
2022-07-29 13:10:33 +02:00
Evilham 1f962dbef7
[sso-admin] Fix secret handling in check script 2022-07-28 18:28:22 +02:00
Evilham 4fb3b02a46
[sso-admin] Remove left over OIDC code
This was left over by a previous contributor and is not being used and
was never really used; it looks like we can safely remove these.
2022-07-28 18:27:27 +02:00
Evilham 4324812807
[correu] Add registration for SAML client 2022-07-28 16:28:47 +02:00