forked from infra/ansible
Remove OpenID from Fedora
This change will remove routing and configuration for OpenID in Fedora. Which was originally announced to sunset on 1st May 2026. Signed-off-by: Michal Konecny <mkonecny@redhat.com>
This commit is contained in:
parent
1250c0d961
commit
f6b50eb89c
5 changed files with 0 additions and 91 deletions
|
|
@ -160,38 +160,9 @@ backend oci-registry-backend
|
|||
frontend ipsilon-frontend
|
||||
bind 0.0.0.0:10020
|
||||
|
||||
option http-buffer-request
|
||||
# Define ipsilon OpenID only instance
|
||||
acl path_openidc path_beg /openidc
|
||||
acl path_openid path_beg /openid
|
||||
acl is_openid_cookie req.cook(OPENID) true
|
||||
{% if env == 'staging' %}
|
||||
acl host_is_id_sub hdr(host) -m reg -i ^.+\.id\.stg\.fedoraproject\.org$
|
||||
{% else %}
|
||||
acl host_is_id_sub hdr(host) -m reg -i ^.+\.id\.fedoraproject\.org$
|
||||
{% endif %}
|
||||
|
||||
use_backend ipsilon-backend if path_openidc
|
||||
use_backend ipsilon-backend-openid if path_openid
|
||||
use_backend ipsilon-backend-openid if is_openid_cookie
|
||||
use_backend ipsilon-backend-openid if host_is_id_sub
|
||||
|
||||
default_backend ipsilon-backend
|
||||
|
||||
backend ipsilon-backend-openid
|
||||
balance hdr(appserver)
|
||||
cookie OPENID insert indirect nocache attr Max-Age=300
|
||||
{% if env == "staging" %}
|
||||
server ipsilon01 ipsilon01:80 cookie true check inter 10s rise 1 fall 3
|
||||
{% else %}
|
||||
server ipsilon03 ipsilon03:80 cookie true check inter 10s rise 1 fall 3
|
||||
{% endif %}
|
||||
option httpchk GET /
|
||||
|
||||
backend ipsilon-backend
|
||||
balance hdr(appserver)
|
||||
server ipsilon01 ipsilon01:80 check inter 10s rise 1 fall 3
|
||||
http-response set-header x-xrds-location "https://id{{ env_suffix }}.fedoraproject.org/openid/XRDS"
|
||||
{% if env == "production" %}
|
||||
server ipsilon02 ipsilon02:80 check inter 10s rise 1 fall 3
|
||||
{% endif %}
|
||||
|
|
|
|||
|
|
@ -1,15 +0,0 @@
|
|||
--- layout.html 2025-10-03 10:54:25.879128022 +0000
|
||||
+++ layout.html 2025-10-03 10:56:46.554758341 +0000
|
||||
@@ -21,6 +21,12 @@
|
||||
{%- endif %}
|
||||
</head>
|
||||
<body>
|
||||
+ <div class="alert-danger">
|
||||
+ <h1 align="center">
|
||||
+ You are using OpenID to authenticate. This authentication method will go away on 1st May 2026. Please consider migrating to OpenID Connect.
|
||||
+ For more info look at https://forge.fedoraproject.org/infra/tickets/issues/10241
|
||||
+ </h1>
|
||||
+ </div>
|
||||
<div class="navbar navbar-light masthead">
|
||||
<div class="container justify-content-between">
|
||||
<img alt="logo" src="{{ basepath }}/ui/res/FedoraAccounts.png" height=40px />
|
||||
|
|
@ -7,7 +7,6 @@
|
|||
update_cache: yes
|
||||
name:
|
||||
- ipsilon
|
||||
- ipsilon-openid
|
||||
- ipsilon-saml2
|
||||
- ipsilon-openidc
|
||||
- ipsilon-authgssapi
|
||||
|
|
@ -51,15 +50,6 @@
|
|||
tags:
|
||||
- ipsilon
|
||||
|
||||
- name: Apply patch for OpenID banner
|
||||
ansible.posix.patch:
|
||||
src: openid_banner.patch
|
||||
dest: /usr/share/ipsilon/themes/Fedora/templates/layout.html
|
||||
when: openid is defined and openid
|
||||
tags:
|
||||
- ipsilon
|
||||
- patch
|
||||
|
||||
- name: Apply patch for forge.fp.o links
|
||||
ansible.posix.patch:
|
||||
src: forge_fp_o.patch
|
||||
|
|
@ -87,7 +77,6 @@
|
|||
--admin-user=admin
|
||||
--ipa=yes
|
||||
--openidc=yes
|
||||
--openid=yes
|
||||
--saml2=yes
|
||||
--info-sssd=yes
|
||||
--form=yes
|
||||
|
|
|
|||
|
|
@ -11,27 +11,6 @@ fas aws groups=[["aws-master", "arn:aws:iam::125523088429:role/aws-master"], ["a
|
|||
global enabled=allow
|
||||
|
||||
[provider_config]
|
||||
{% if openid is defined and openid %}
|
||||
global enabled=openid
|
||||
|
||||
openid endpoint url=https://id{{env_suffix}}.fedoraproject.org/openid/
|
||||
openid identity url template=http://%(username)s.id{{env_suffix}}.fedoraproject.org/
|
||||
{% if env == 'staging' %}
|
||||
openid trusted roots=
|
||||
{% else %}
|
||||
openid trusted roots=https://ask.fedoraproject.org/,https://fedorahosted.org/,https://badges.fedoraproject.org,https://apps.fedoraproject.org/datagrepper/,https://apps.fedoraproject.org/calendar/,http://notifications.fedoraproject.org/,http://copr.fedoraproject.org/,https://copr.fedoraproject.org/,https://admin.fedoraproject.org/voting/,https://admin.fedoraproject.org,https://apps.fedoraproject.org/,https://release-monitoring.org/,http://pagure.io/,http://admin.fedoraproject.org/mirrormanager/,https://koschei.fedoraproject.org/,https://bodhi.fedoraproject.org,https://lists.fedoraproject.org/,https://openqa.fedoraproject.org/,https://src.fedoraproject.org/
|
||||
{% endif %}
|
||||
{% if env == 'staging' %}
|
||||
openid database url=postgresql://{{ ipsilon_db_user }}:{{ ipsilon_stg_db_pass }}@{{ ipsilon_db_host }}/{{ ipsilon_db_openid_name }}
|
||||
{% else %}
|
||||
openid database url=postgresql://{{ ipsilon_db_user }}:{{ ipsilon_db_pass }}@{{ ipsilon_db_host }}/{{ ipsilon_db_openid_name }}
|
||||
{% endif %}
|
||||
openid untrusted roots=
|
||||
openid enabled extensions=Fedora Teams,Attribute Exchange,CLAs,Simple Registration,API
|
||||
openid default attribute mapping=[["*", "*"], ["_groups", "groups"], [["_extras", "cla"], "cla"], ["fullname", "name"], ["_username", "nickname"], ["_username", "preferred_username"], ["fasIRCNick", "ircnick"], ["fasLocale", "locale"], ["fasTimeZone", "zoneinfo"], ["fasTimeZone", "timezone"], ["fasWebsiteURL", "website"], ["fasGPGKeyId", "gpg_keyid"], ["ipaSshPubKey", "ssh_key"], ["fasIsPrivate", "privacy"], ["fullname", "human_name"]]
|
||||
|
||||
# End of OpenID configuration
|
||||
{% else %}
|
||||
global enabled=saml2,openidc
|
||||
|
||||
openidc enabled extensions=fedora-account,waiverdb,wiki,src,kerneltest
|
||||
|
|
@ -80,5 +59,3 @@ saml2 session database url=postgresql://{{ ipsilon_db_user }}:{{ ipsilon_db_pass
|
|||
{% else %}
|
||||
{% include "saml2_data" %}
|
||||
{% endif %}
|
||||
|
||||
{% endif %}
|
||||
|
|
|
|||
|
|
@ -6,19 +6,6 @@ Alias /.well-known /var/lib/ipsilon/root/public/well-known
|
|||
Alias /cache /var/cache/ipsilon
|
||||
Redirect /.well-known/webfinger /webfinger
|
||||
|
||||
# This is for mapping $username.id.fp.o -> id.fp.o/id/$username
|
||||
RewriteEngine on
|
||||
RewriteMap lowercase int:tolower
|
||||
{% if env == "staging" %}
|
||||
RewriteCond ${lowercase:%{SERVER_NAME}} ^[a-z0-9_\.-]+\.id\.stg\.fedoraproject\.org$
|
||||
RewriteRule ^(.+) /${lowercase:%{SERVER_NAME}}$1 [C]
|
||||
{% else %}
|
||||
RewriteCond ${lowercase:%{SERVER_NAME}} ^[a-z0-9_\.-]+\.id\.fedoraproject\.org$
|
||||
RewriteRule ^(.+) /${lowercase:%{SERVER_NAME}}$1 [C]
|
||||
RewriteRule ^/([a-z0-9_\.-]+)\.id\.fedoraproject\.org/.* /openid/id/$1/ [PT]
|
||||
{% endif %}
|
||||
|
||||
|
||||
WSGIScriptAlias / /usr/libexec/ipsilon/ipsilon
|
||||
WSGIDaemonProcess ipsilon user=ipsilon group=ipsilon home=/var/lib/ipsilon/root display-name=ipsilon processes=6 threads=2 maximum-requests=1000
|
||||
WSGISocketPrefix run/wsgi
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue