Merge pull request #192 from silinternational/release/9.3.0

Release 9.3.0 -- SSP 2.x prep and AppConfig
silinternational · Apr 9, 2024 · a1f6471 · a1f6471
2 parents 03b9554 + e911725
commit a1f6471
Show file tree

Hide file tree

Showing 10 changed files with 83 additions and 25 deletions.
diff --git a/.github/workflows/test-and-publish.yml b/.github/workflows/test-and-publish.yml
@@ -3,9 +3,6 @@ name: Test and Publish
 on:
   push:
 
-env:
-  IMAGE_NAME: ${{ vars.DOCKER_ORG }}/ssp-base
-
 jobs:
   tests:
     name: Tests
@@ -38,7 +35,7 @@ jobs:
         id: meta
         uses: docker/metadata-action@v5
         with:
-          images: ${{ env.IMAGE_NAME }}
+          images: ${{ vars.DOCKER_ORG }}/${{ github.event.repository.name }}
       - name: Build and push Docker image
         uses: docker/build-push-action@v5
         with:

diff --git a/Dockerfile b/Dockerfile
@@ -9,7 +9,7 @@ RUN apt-get update -y \
         php-gmp \
         php-memcached \
     && apt-get clean \
-    && rm -rf /var/lib/apt/lists/*    
+    && rm -rf /var/lib/apt/lists/*
 
 # Create required directories
 RUN mkdir -p /data
@@ -36,12 +36,8 @@ WORKDIR /data
 # Install/cleanup composer dependencies
 COPY composer.json /data/
 COPY composer.lock /data/
-# TODO/FIXME: Disabled the self-update due to a breaking change between composer 2.6.6 and 2.7.1 that affects the
-# loading of the simplesamlphp/simplesamlphp/modules folder. The Docker build fails on the sildisco/sspoverrides line.
-# It is not well understood what changed in composer, but since the overrides will need to be redesigned during
-# the SimpleSAMLphp 2.x upgrade, this issue is deferred until then.
-#RUN composer self-update --no-interaction
-RUN composer install --prefer-dist --no-interaction --no-dev --optimize-autoloader --no-scripts --no-progress
+RUN composer self-update --no-interaction
+RUN COMPOSER_ALLOW_SUPERUSER=1 composer install --prefer-dist --no-interaction --no-dev --optimize-autoloader --no-scripts --no-progress
 
 # Copy in SSP override files
 ENV SSP_PATH /data/vendor/simplesamlphp/simplesamlphp
@@ -59,6 +55,9 @@ COPY tests /data/tests
 RUN cp $SSP_PATH/modules/sildisco/sspoverrides/www_saml2_idp/SSOService.php $SSP_PATH/www/saml2/idp/
 RUN chmod a+x /data/run.sh /data/run-tests.sh
 
+ADD https://github.com/silinternational/config-shim/releases/latest/download/config-shim.gz config-shim.gz
+RUN gzip -d config-shim.gz && chmod 755 config-shim && mv config-shim /usr/local/bin
+
 EXPOSE 80
 ENTRYPOINT ["/usr/local/bin/s3-expand"]
 CMD ["/data/run.sh"]
diff --git a/README.md b/README.md
@@ -11,6 +11,26 @@ must be installed.
 
 [Vagrant](https://www.vagrantup.com) for Windows users.
 
+## Configuration
+By default, configuration is read from environment variables. These are documented
+in the `local.env.dist` file. Optionally, you can define configuration in AWS AppConfig.
+To do this, set the following environment variables to point to the configuration in
+AWS:
+
+* `AWS_REGION` - the AWS region in use
+* `APP_ID` - the application ID or name
+* `CONFIG_ID` - the configuration profile ID or name
+* `ENV_ID` - the environment ID or name
+
+In addition, the AWS API requires authentication. It is best to use an access role
+such as an [ECS Task Role](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task-iam-roles.html).
+If that is not an option, you can specify an access token using the `AWS_ACCESS_KEY_ID` and
+`AWS_SECRET_ACCESS_KEY` variables.
+
+The content of the configuration profile takes the form of a typical .env file, using
+`#` for comments and `=` for variable assignment. Any variables read from AppConfig
+will overwrite variables set in the execution environment.
+
 ## Local testing
 
 1. `cp local.env.dist local.env` within project root and make adjustments as needed.

diff --git a/development/idp-local/config/config.php b/development/idp-local/config/config.php
@@ -56,8 +56,6 @@
 // Options: https://github.com/silinternational/simplesamlphp-module-material/blob/develop/README.md#branding
 $THEME_COLOR_SCHEME = Env::get('THEME_COLOR_SCHEME', null);
 
-$IDPDISCO_LAYOUT = Env::get('IDPDISCO_LAYOUT', 'links'); // Options: [links,dropdown]
-
 $SECURE_COOKIE = Env::get('SECURE_COOKIE', true);
 $SESSION_DURATION = (int)(Env::get('SESSION_DURATION', (60 * 60 * 10))); // 10 hours.
 $SESSION_STORE_TYPE = Env::get('SESSION_STORE_TYPE', 'phpsession');
@@ -595,6 +593,12 @@
     'module.enable' => [
         // Setting to TRUE enables.
         'authgoogle' => $GOOGLE_ENABLE,
+        'expirychecker' => true,
+        'material' => true,
+        'mfa' => true,
+        'profilereview' => true,
+        'silauth' => true,
+        'sildisco' => true,
     ],
 
 
@@ -1066,7 +1070,7 @@
      *
      * Options: [links,dropdown]
      */
-    'idpdisco.layout' => $IDPDISCO_LAYOUT,
+    'idpdisco.layout' => 'links',
 
 
     /*************************************

diff --git a/development/idp2-local/config/config.php b/development/idp2-local/config/config.php
@@ -56,7 +56,6 @@
 $SESSION_REMEMBERME_LIFETIME = (int)(Env::get('SESSION_REMEMBERME_LIFETIME', (14 * 86400))); // 14 days
 $SECURE_COOKIE = Env::get('SECURE_COOKIE', true);
 $THEME_USE = Env::get('THEME_USE', 'default');
-$IDPDISCO_LAYOUT = Env::get('IDPDISCO_LAYOUT', 'dropdown'); // Options: [links,dropdown]
 $SAML20_IDP_ENABLE = Env::get('SAML20_IDP_ENABLE', true);
 $GOOGLE_ENABLE = Env::get('GOOGLE_ENABLE', false);
 
@@ -327,6 +326,12 @@
     'module.enable' => [
         // Setting to TRUE enables.
         'authgoogle' => $GOOGLE_ENABLE,
+        'expirychecker' => true,
+        'material' => true,
+        'mfa' => true,
+        'profilereview' => true,
+        'silauth' => true,
+        'sildisco' => true,
     ],
 
     /*
@@ -541,7 +546,7 @@
      * Options: [links,dropdown]
      *
      */
-    'idpdisco.layout' => $IDPDISCO_LAYOUT,
+    'idpdisco.layout' => 'links',
 
     /*
      * Whether simpleSAMLphp should sign the response or the assertion in SAML 1.1 authentication

diff --git a/development/sp-local/config/config.php b/development/sp-local/config/config.php
@@ -38,7 +38,6 @@
 $SESSION_REMEMBERME_LIFETIME = (int)(Env::get('SESSION_REMEMBERME_LIFETIME', (14 * 86400))); // 14 days
 $SECURE_COOKIE = Env::get('SECURE_COOKIE', true);
 $THEME_USE = Env::get('THEME_USE', 'default');
-$IDPDISCO_LAYOUT = Env::get('IDPDISCO_LAYOUT', 'dropdown'); // Options: [links,dropdown]
 $SAML20_IDP_ENABLE = Env::get('SAML20_IDP_ENABLE', true);
 $GOOGLE_ENABLE = Env::get('GOOGLE_ENABLE', false);
 
@@ -297,6 +296,12 @@
     'module.enable' => [
         // Setting to TRUE enables.
         'authgoogle' => $GOOGLE_ENABLE,
+        'expirychecker' => true,
+        'material' => true,
+        'mfa' => true,
+        'profilereview' => true,
+        'silauth' => true,
+        'sildisco' => true,
     ],
 
     /*
@@ -511,7 +516,7 @@
      * Options: [links,dropdown]
      *
      */
-    'idpdisco.layout' => $IDPDISCO_LAYOUT,
+    'idpdisco.layout' => 'links',
 
     /*
      * Whether simpleSAMLphp should sign the response or the assertion in SAML 1.1 authentication

diff --git a/development/sp2-local/config/config.php b/development/sp2-local/config/config.php
@@ -38,7 +38,6 @@
 $SESSION_REMEMBERME_LIFETIME = (int)(Env::get('SESSION_REMEMBERME_LIFETIME', (14 * 86400))); // 14 days
 $SECURE_COOKIE = Env::get('SECURE_COOKIE', true);
 $THEME_USE = Env::get('THEME_USE', 'default');
-$IDPDISCO_LAYOUT = Env::get('IDPDISCO_LAYOUT', 'dropdown'); // Options: [links,dropdown]
 $SAML20_IDP_ENABLE = Env::get('SAML20_IDP_ENABLE', true);
 $GOOGLE_ENABLE = Env::get('GOOGLE_ENABLE', false);
 
@@ -297,6 +296,12 @@
     'module.enable' => [
         // Setting to TRUE enables.
         'authgoogle' => $GOOGLE_ENABLE,
+        'expirychecker' => true,
+        'material' => true,
+        'mfa' => true,
+        'profilereview' => true,
+        'silauth' => true,
+        'sildisco' => true,
     ],
 
     /*
@@ -511,7 +516,7 @@
      * Options: [links,dropdown]
      *
      */
-    'idpdisco.layout' => $IDPDISCO_LAYOUT,
+    'idpdisco.layout' => 'links',
 
     /*
      * Whether simpleSAMLphp should sign the response or the assertion in SAML 1.1 authentication

diff --git a/dockerbuild/run.sh b/dockerbuild/run.sh
@@ -17,7 +17,11 @@ cd /data
 cat /etc/*release | grep PRETTY
 php -v | head -n 1
 
-apache2ctl -k start -D FOREGROUND
+if [[ -z "${APP_ID}" ]]; then
+  apache2ctl -k start -D FOREGROUND
+else
+  config-shim --app $APP_ID --config $CONFIG_ID --env $ENV_ID apache2ctl -k start -D FOREGROUND
+fi
 
 # endless loop with a wait is needed for the trap to work
 while true

diff --git a/dockerbuild/ssp-overrides/config.php b/dockerbuild/ssp-overrides/config.php
@@ -56,8 +56,6 @@
 // Options: https://github.com/silinternational/simplesamlphp-module-material/blob/develop/README.md#branding
 $THEME_COLOR_SCHEME = Env::get('THEME_COLOR_SCHEME', null);
 
-$IDPDISCO_LAYOUT = Env::get('IDPDISCO_LAYOUT', 'links'); // Options: [links,dropdown]
-
 $SECURE_COOKIE = Env::get('SECURE_COOKIE', true);
 $SESSION_DURATION = (int)(Env::get('SESSION_DURATION', (60 * 60 * 10))); // 10 hours.
 $SESSION_STORE_TYPE = Env::get('SESSION_STORE_TYPE', 'phpsession');
@@ -595,6 +593,12 @@
     'module.enable' => [
         // Setting to TRUE enables.
         'authgoogle' => $GOOGLE_ENABLE,
+        'expirychecker' => true,
+        'material' => true,
+        'mfa' => true,
+        'profilereview' => true,
+        'silauth' => true,
+        'sildisco' => true,
     ],
 
 
@@ -1066,7 +1070,7 @@
      *
      * Options: [links,dropdown]
      */
-    'idpdisco.layout' => $IDPDISCO_LAYOUT,
+    'idpdisco.layout' => 'links',
 
 
     /*************************************

diff --git a/local.env.dist b/local.env.dist
@@ -14,9 +14,24 @@ COMPOSER_AUTH={"github-oauth":{"github.com":"token-here"}}
 COMPOSER_CACHE_DIR=/composer
 GOOGLE_ENABLE=
 HUB_MODE=false
-IDPDISCO_LAYOUT=
 ENABLE_DEBUG=
 
+
+# === AWS AppConfig (optional) ===
+
+# The AWS region in use
+#AWS_REGION=
+
+# The AppConfig Application ID (or name)
+#APP_ID=
+
+# The AppConfig Configuration Profile ID (or name)
+#CONFIG_ID=
+
+# The AppConfig Environment ID (or name)
+#ENV_ID=
+
+
 # LOGGING_LEVEL default is NOTICE, or may be one of: ERR, WARNING, NOTICE, INFO, DEBUG
 LOGGING_LEVEL=