Skip to content

Commit 35c912e

Browse files
zlamalpzlamalp
committed
Update instanceConfig.json templates for NGUI v16.0.0+
- Removed unused properties. - Updated config for referencing other available apps. - Profile now shows admin warning message by default. - Changed MFA settings. They are now global for NGU and apps use only necessary properties. - Fixed reference to MFA API in profile apache CSP rules.
1 parent 24788ce commit 35c912e

File tree

8 files changed

+50
-16
lines changed

8 files changed

+50
-16
lines changed

‎defaults/main.yml‎

Lines changed: 33 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -246,6 +246,7 @@ perun_ngui_footer:
246246

247247
perun_ngui_logo: "😀"
248248
perun_ngui_theme: {}
249+
perun_ngui_mfa: {}
249250

250251
# shared password strength hints for new GUI
251252
perun_ngui_password_help:
@@ -287,7 +288,6 @@ perun_ngui_admin_supported_languages: ['en']
287288
perun_ngui_admin_member_profile_attributes_friendly_names: []
288289
perun_ngui_admin_login_namespace_attributes: []
289290
perun_ngui_admin_password_namespace_attributes: []
290-
perun_ngui_admin_pwd_reset_base_url: "https://{{ perun_rpc_hostname }}/fed/pwd-reset/"
291291
perun_ngui_admin_log_out_enabled: true
292292
perun_ngui_admin_brandings: "{ '{{ perun_ngui_admin_hostname}}': {} }" #Ansible cannot substitute variables in dictionary keys, this is a workaround
293293
perun_ngui_admin_apache_special_config1: ""
@@ -296,6 +296,9 @@ perun_ngui_admin_user_deletion_forced: false
296296
perun_ngui_admin_enforce_consents: false
297297
perun_ngui_admin_warning_message: ""
298298
perun_ngui_admin_password_help: '{{ perun_ngui_password_help }}'
299+
perun_ngui_admin_other_apps:
300+
en:
301+
profile: "Profile"
299302

300303
#new GUI Profile
301304
perun_ngui_profile_enabled: no
@@ -321,7 +324,6 @@ perun_ngui_profile_password_namespace_attributes: []
321324
perun_ngui_profile_consolidator_url: "https://{{ perun_rpc_hostname }}/fed-ic/ic/"
322325
perun_ngui_profile_consolidator_url_cert: "https://{{ perun_rpc_hostname }}/cert-ic/ic/"
323326
perun_ngui_profile_registrar_base_url: "https://{{ perun_rpc_hostname }}/fed/registrar/"
324-
perun_ngui_profile_pwd_reset_base_url: "https://{{ perun_rpc_hostname }}/fed/pwd-reset/"
325327
perun_ngui_profile_page_attributes:
326328
- friendly_name: organization
327329
display_name_en: Organization
@@ -338,7 +340,6 @@ perun_ngui_profile_page_attributes:
338340
display_name_cs: Preferovaný mail
339341
tooltip_en: ''
340342
tooltip_cs: ''
341-
perun_ngui_profile_mfa: {}
342343
perun_ngui_profile_display_identity_certificates: true
343344
perun_ngui_profile_external_services: []
344345
perun_ngui_profile_displayed_tabs: ['profile', 'identities', 'groups', 'privacy', 'authentication', 'ssh_keys']
@@ -349,8 +350,11 @@ perun_ngui_profile_header_label_cs: "Profil uživatele"
349350
perun_ngui_profile_document_title:
350351
en: "{{ perun_ngui_profile_header_label_en }}"
351352
cs: "{{ perun_ngui_profile_header_label_cs }}"
352-
perun_ngui_profile_admin_gui_label_en: "IAM Administration"
353-
perun_ngui_profile_admin_gui_label_cs: "Správa IAM"
353+
perun_ngui_profile_other_apps:
354+
en:
355+
admin: "IAM Administration"
356+
cs:
357+
admin: "Správa IAM"
354358
perun_ngui_profile_link_to_admin_gui_by_roles: [
355359
"PERUNADMIN",
356360
"PERUNOBSERVER",
@@ -370,13 +374,13 @@ perun_ngui_profile_preferred_unix_group_names: []
370374
perun_ngui_profile_footer: '{{ perun_ngui_footer }}'
371375
perun_ngui_profile_theme: '{{ perun_ngui_theme }}'
372376
perun_ngui_profile_log_out_enabled: true
373-
perun_ngui_profile_logo_padding: ""
374377
perun_ngui_profile_logo: '{{ perun_ngui_logo }}'
375378
perun_ngui_profile_brandings: "{ '{{ perun_ngui_profile_hostname}}': {} }" #Ansible cannot substitute variables in dictionary keys, this is a workaround
376379
perun_ngui_profile_use_new_consolidator: false
377380
perun_ngui_profile_local_account_namespace: ""
378381
perun_ngui_profile_password_help: '{{ perun_ngui_password_help }}'
379382
perun_ngui_profile_password_help_cs: '{{ perun_ngui_password_help_cs }}'
383+
perun_ngui_profile_warning_message: '{{ perun_ngui_admin_warning_message }}'
380384

381385
#new GUI Consolidator
382386

@@ -385,6 +389,9 @@ perun_ngui_consolidator_hostname: "perun.aai.example.org"
385389
perun_ngui_consolidator_hostname_aliases: []
386390
perun_ngui_consolidator_tls_cert_same_as_host: yes
387391
perun_ngui_consolidator_document_title: "Consolidator"
392+
perun_ngui_consolidator_other_apps:
393+
en:
394+
profile: "Profile"
388395
perun_ngui_consolidator_client_id: "xxx-xxxx-xxxx-xxx-xx-xxx"
389396
perun_ngui_consolidator_oauth_authority: '{{ perun_ngui_oauth_authority }}'
390397
perun_ngui_consolidator_oauth_csp_url: '{{ perun_ngui_consolidator_oauth_authority }}'
@@ -447,10 +454,10 @@ perun_ngui_pwdreset_oauth_scopes: "openid profile perun_api offline_access"
447454
perun_ngui_pwdreset_oauth_response_type: "code"
448455
perun_ngui_pwdreset_oauth_offline_access_consent_prompt: '{{ perun_ngui_oauth_offline_access_consent_prompt }}'
449456
perun_ngui_pwdreset_oauth_filters: '{{ perun_ngui_admin_oauth_filters }}'
450-
perun_ngui_pwdreset_mfa: {}
451457
perun_ngui_pwdreset_password_help: '{{ perun_ngui_password_help }}'
452458
perun_ngui_pwdreset_password_help_cs: '{{ perun_ngui_password_help_cs }}'
453459
perun_ngui_pwdreset_brandings: "{ '{{ perun_ngui_pwdreset_hostname }}': {} }"
460+
perun_ngui_pwdreset_default_namespace: ""
454461

455462
#new GUI Publications
456463
perun_ngui_publications_enabled: no
@@ -481,7 +488,25 @@ perun_ngui_publications_header_label_cs: "Publikace"
481488
perun_ngui_publications_document_title:
482489
en: "{{ perun_ngui_publications_header_label_en }}"
483490
cs: "{{ perun_ngui_publications_header_label_cs }}"
484-
491+
perun_ngui_publications_other_apps:
492+
en:
493+
admin: "IAM Administration"
494+
profile: "Profile"
495+
perun_ngui_publications_link_to_admin_gui_by_roles: [
496+
"PERUNADMIN",
497+
"PERUNOBSERVER",
498+
"VOADMIN",
499+
"VOOBSERVER",
500+
"GROUPADMIN",
501+
"GROUPOBSERVER",
502+
"RESOURCEADMIN",
503+
"RESOURCEOBSERVER",
504+
"FACILITYADMIN",
505+
"FACILITYOBSERVER",
506+
"TRUSTEDFACILITYADMIN",
507+
"SPONSOR",
508+
"TOPGROUPCREATOR"
509+
]
485510

486511
# virtual host for API
487512
perun_api_enabled: no

‎templates/instance_configs/consolidatorInstanceConfig.json.j2‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,11 +19,14 @@
1919
},
2020
"proxy_logout": {{ perun_ngui_consolidator_proxy_logout|bool|to_json }},
2121
"document_title": "{{ perun_ngui_consolidator_document_title }}",
22+
"other_apps": {{ perun_ngui_consolidator_other_apps|to_nice_json(indent=2,ensure_ascii=False)|indent(2) }},
23+
"link_to_admin_gui_by_roles": {{ perun_ngui_publications_link_to_admin_gui_by_roles|to_nice_json(indent=2,ensure_ascii=False)|indent(2) }},
2224
"instance_favicon": {{ perun_ngui_consolidator_instance_favicon|to_json }},
2325
"path_to_idp_provider_userinfo": {{ perun_ngui_consolidator_path_to_idp_provider_userinfo|to_nice_json(indent=2,ensure_ascii=False)|indent(2) }},
2426
"path_to_idp_logo_userinfo": {{ perun_ngui_consolidator_path_to_idp_logo_userinfo|to_nice_json(indent=2,ensure_ascii=False)|indent(2) }},
2527
"path_to_idp_logo_width_userinfo": {{ perun_ngui_consolidator_path_to_idp_logo_width_userinfo|to_nice_json(indent=2,ensure_ascii=False)|indent(2) }},
2628
"path_to_idp_logo_height_userinfo": {{ perun_ngui_consolidator_path_to_idp_logo_height_userinfo|to_nice_json(indent=2,ensure_ascii=False)|indent(2) }},
29+
"mfa": {{ perun_ngui_mfa|to_nice_json(indent=2,ensure_ascii=False)|indent(2) }},
2730
"support_mail": "{{ perun_email }}",
2831
"footer": {{ perun_ngui_footer|to_nice_json(indent=2,ensure_ascii=False)|indent(2) }},
2932
"logo": {{ perun_ngui_logo|to_json }},

‎templates/instance_configs/instanceConfig.json.j2‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -33,10 +33,10 @@
3333
"oauth_offline_access_consent_prompt": {{ perun_ngui_oauth_offline_access_consent_prompt|bool|to_json }},
3434
"filters": {{ perun_ngui_admin_oauth_filters|to_nice_json(indent=2,ensure_ascii=False)|indent(4) }}
3535
},
36+
"mfa": {{ perun_ngui_mfa|to_nice_json(indent=2,ensure_ascii=False)|indent(2) }},
3637
"proxy_logout": {{ perun_ngui_admin_proxy_logout|bool|to_json }},
3738
"login_namespace_attributes": {{ perun_ngui_admin_login_namespace_attributes|to_nice_json(indent=2,ensure_ascii=False)|indent(2) }},
3839
"password_namespace_attributes": {{ perun_ngui_admin_password_namespace_attributes|to_nice_json(indent=2,ensure_ascii=False)|indent(2) }},
39-
"pwd_reset_base_url": "{{ perun_ngui_admin_pwd_reset_base_url }}",
4040
"password_help": {{ perun_ngui_admin_password_help|to_nice_json(indent=2,ensure_ascii=False)|indent(2) }},
4141
{% if perun_rpc_group_nameSecondaryRegex is defined %}
4242
"group_name_secondary_regex": {{ perun_rpc_group_nameSecondaryRegex|to_json }},
@@ -48,6 +48,7 @@
4848
"member_profile_attributes_friendly_names": {{ perun_ngui_admin_member_profile_attributes_friendly_names|to_json }},
4949
"footer": {{ perun_ngui_footer|to_nice_json(indent=2,ensure_ascii=False)|indent(2) }},
5050
"log_out_enabled": {{ perun_ngui_admin_log_out_enabled|bool|to_json }},
51+
"other_apps": {{ perun_ngui_admin_other_apps|to_nice_json(indent=2,ensure_ascii=False)|indent(2) }},
5152
"logo": {{ perun_ngui_logo|to_json }},
5253
"theme": {{ perun_ngui_theme|to_nice_json(indent=2,ensure_ascii=False)|indent(2) }},
5354
"brandings": {{ perun_ngui_admin_brandings|to_nice_json(indent=2,ensure_ascii=False)|indent(2) }},

‎templates/instance_configs/linkerInstanceConfig.json.j2‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@
1717
"oauth_offline_access_consent_prompt": {{ perun_ngui_linker_oauth_offline_access_consent_prompt|bool|to_json }},
1818
"user_info_endpoint_url": "{{ perun_ngui_linker_user_info_endpoint_url }}"
1919
},
20+
"mfa": {{ perun_ngui_mfa|to_nice_json(indent=2,ensure_ascii=False)|indent(2) }},
2021
"document_title": "{{ perun_ngui_linker_document_title }}",
2122
"instance_favicon": {{ perun_ngui_linker_instance_favicon|to_json }},
2223
"support_mail": "{{ perun_email }}"

‎templates/instance_configs/profileInstanceConfig.json.j2‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -28,9 +28,8 @@
2828
"consolidator_url": "{{ perun_ngui_profile_consolidator_url }}",
2929
"consolidator_url_cert": "{{ perun_ngui_profile_consolidator_url_cert }}",
3030
"registrar_base_url": "{{ perun_ngui_profile_registrar_base_url }}",
31-
"pwd_reset_base_url": "{{ perun_ngui_profile_pwd_reset_base_url }}",
3231
"profile_page_attributes": {{ perun_ngui_profile_page_attributes|to_nice_json(indent=2,ensure_ascii=False)|indent(2) }},
33-
"mfa": {{ perun_ngui_profile_mfa|to_nice_json(indent=2,ensure_ascii=False)|indent(2) }},
32+
"mfa": {{ perun_ngui_mfa|to_nice_json(indent=2,ensure_ascii=False)|indent(2) }},
3433
"password_help": {{ perun_ngui_profile_password_help|to_nice_json(indent=2,ensure_ascii=False)|indent(2) }},
3534
"password_help_cs": {{ perun_ngui_profile_password_help_cs|to_nice_json(indent=2,ensure_ascii=False)|indent(2) }},
3635
"display_identity_certificates": {{ perun_ngui_profile_display_identity_certificates|to_json }},
@@ -39,14 +38,16 @@
3938
"custom_labels": {{ perun_ngui_profile_custom_labels|to_nice_json(indent=2,ensure_ascii=False)|indent(2) }},
4039
"header_label_en": "{{ perun_ngui_profile_header_label_en }}",
4140
"header_label_cs": "{{ perun_ngui_profile_header_label_cs }}",
42-
"admin_gui_label_en": "{{ perun_ngui_profile_admin_gui_label_en }}",
43-
"admin_gui_label_cs": "{{ perun_ngui_profile_admin_gui_label_cs }}",
4441
"link_to_admin_gui_by_roles": {{ perun_ngui_profile_link_to_admin_gui_by_roles|to_nice_json(indent=2,ensure_ascii=False)|indent(2) }},
4542
"preferred_unix_group_names": {{ perun_ngui_profile_preferred_unix_group_names|to_nice_json(indent=2,ensure_ascii=False)|indent(2) }},
4643
"footer": {{ perun_ngui_profile_footer|to_nice_json(indent=2,ensure_ascii=False)|indent(2) }},
4744
"theme": {{ perun_ngui_profile_theme|to_nice_json(indent=2,ensure_ascii=False)|indent(2) }},
4845
"log_out_enabled": {{ perun_ngui_profile_log_out_enabled|to_json }},
49-
"logo_padding": {{ perun_ngui_profile_logo_padding|to_json }},
46+
{% if perun_ngui_profile_warning_message %}
47+
"display_warning": true,
48+
"warning_message": "{{ perun_ngui_profile_warning_message }}",
49+
{% endif %}
50+
"other_apps": {{ perun_ngui_profile_other_apps|to_nice_json(indent=2,ensure_ascii=False)|indent(2) }},
5051
"logo": {{ perun_ngui_profile_logo|to_json }},
5152
"brandings": {{ perun_ngui_profile_brandings|to_nice_json(indent=2,ensure_ascii=False)|indent(2) }},
5253
"use_new_consolidator": {{ perun_ngui_profile_use_new_consolidator|to_json }},

‎templates/instance_configs/publicationsInstanceConfig.json.j2‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@
2222
"oauth_offline_access_consent_prompt": {{ perun_ngui_publications_oauth_offline_access_consent_prompt|to_json }},
2323
"filters": {{ perun_ngui_publications_oauth_filters|to_nice_json(indent=2,ensure_ascii=False)|indent(4) }}
2424
},
25+
"mfa": {{ perun_ngui_mfa|to_nice_json(indent=2,ensure_ascii=False)|indent(2) }},
2526
{% if perun_ngui_publications_warning_message %}
2627
"display_warning": true,
2728
"warning_message": "{{ perun_ngui_publications_warning_message }}",
@@ -32,6 +33,7 @@
3233
"logo": {{ perun_ngui_publications_logo|to_json }},
3334
"header_label_en": "{{ perun_ngui_publications_header_label_en }}",
3435
"header_label_cs": "{{ perun_ngui_publications_header_label_cs }}",
36+
"other_apps": {{ perun_ngui_publications_other_apps|to_nice_json(indent=2,ensure_ascii=False)|indent(2) }},
3537
"footer": {{ perun_ngui_publications_footer|to_nice_json(indent=2,ensure_ascii=False)|indent(2) }},
3638
"theme": {{ perun_ngui_publications_theme|to_nice_json(indent=2,ensure_ascii=False)|indent(2) }},
3739
"brandings": {{ perun_ngui_publications_brandings|to_nice_json(indent=2,ensure_ascii=False)|indent(2) }}

‎templates/instance_configs/pwdresetInstanceConfig.json.j2‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@
2222
"oauth_offline_access_consent_prompt": {{ perun_ngui_pwdreset_oauth_offline_access_consent_prompt|to_json }},
2323
"filters": {{ perun_ngui_pwdreset_oauth_filters|to_nice_json(indent=2,ensure_ascii=False)|indent(4) }}
2424
},
25-
"mfa": {{ perun_ngui_pwdreset_mfa|to_nice_json(indent=2,ensure_ascii=False)|indent(2) }},
25+
"mfa": {{ perun_ngui_mfa|to_nice_json(indent=2,ensure_ascii=False)|indent(2) }},
2626
{% if perun_ngui_pwdreset_warning_message %}
2727
"display_warning": true,
2828
"warning_message": "{{ perun_ngui_pwdreset_warning_message }}",
@@ -33,6 +33,7 @@
3333
"footer": {{ perun_ngui_pwdreset_footer|to_nice_json(indent=2,ensure_ascii=False)|indent(2) }},
3434
"theme": {{ perun_ngui_pwdreset_theme|to_nice_json(indent=2,ensure_ascii=False)|indent(2) }},
3535
"brandings": {{ perun_ngui_pwdreset_brandings|to_nice_json(indent=2,ensure_ascii=False)|indent(2) }},
36+
"default_namespace": "{{ perun_ngui_pwdreset_default_namespace }}",
3637
"password_help": {{ perun_ngui_pwdreset_password_help|to_nice_json(indent=2,ensure_ascii=False)|indent(2) }},
3738
"password_help_cs": {{ perun_ngui_pwdreset_password_help_cs|to_nice_json(indent=2,ensure_ascii=False)|indent(2) }}
3839
}

‎templates/sites-enabled/perun-profile.conf.j2‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -83,7 +83,7 @@
8383
# https://scotthelme.co.uk/hardening-your-http-response-headers/#x-xss-protection
8484
Header always set X-XSS-Protection "1; mode=block"
8585
# https://scotthelme.co.uk/content-security-policy-an-introduction/
86-
Header always set Content-Security-Policy "default-src 'self' ; connect-src 'self' {{ perun_ngui_profile_oauth_csp_url }} https://{{ perun_ngui_profile_api_hostname if perun_ngui_profile_api_hostname is defined else perun_api_hostname }} {{ perun_ngui_profile_mfa.api_url if perun_ngui_profile_mfa.api_url is defined else '' }} ; img-src 'self' data: ; font-src https://fonts.gstatic.com https://fonts.googleapis.com ; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com"
86+
Header always set Content-Security-Policy "default-src 'self' ; connect-src 'self' {{ perun_ngui_profile_oauth_csp_url }} https://{{ perun_ngui_profile_api_hostname if perun_ngui_profile_api_hostname is defined else perun_api_hostname }} {{ perun_ngui_mfa.api_url if perun_ngui_mfa.api_url is defined else '' }} ; img-src 'self' data: ; font-src https://fonts.gstatic.com https://fonts.googleapis.com ; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com"
8787
# https://scotthelme.co.uk/a-new-security-header-referrer-policy/
8888
Header always set Referrer-Policy "no-referrer-when-downgrade"
8989
# https://scotthelme.co.uk/a-new-security-header-feature-policy/

0 commit comments

Comments
 (0)