Github actions docker build: Add Teams to the list of apps

environments/template/group_vars/template.yml

@@ -39,6 +39,7 @@ account_gui_version: "6.0.2"
 dashboard_server_version: "12.3.4"
 dashboard_gui_version: "12.3.4"
 
+
 statistics_version: "1.1.7"
 
 databases:
@@ -267,6 +268,8 @@ teams:
     - "nl:surfnet:diensten:teams_super_users"
     - "nl:surfnet:diensten:teams_super_admin_users"
 
+teams_allow_spd_api: '.'
+
 engineblock:
   idp_url: https://engine.{{ base_domain }}/authentication/idp/single-sign-on
   idp_entity_id: https://engine.{{ base_domain }}/authentication/idp/metadata

environments/vm/group_vars/vm.yml

@@ -156,6 +156,8 @@ teams:
     - "nl:surfnet:diensten:teams_super_users"
     - "nl:surfnet:diensten:teams_super_admin_users"
 
+teams_allow_spd_api: '.'
+
 engineblock:
   idp_url: https://engine.{{ base_domain }}/authentication/idp/single-sign-on
   idp_entity_id: https://engine.{{ base_domain }}/authentication/idp/metadata

environments/vm/secrets/vm.yml

@@ -30,7 +30,7 @@ engine_parameters_secret: secret
 
 profile_secret: secret
 
-teams_authz_client_secret: secret
+teams_authz_client_secret: secretsecret
 teams_migration_secret_key: secret
 
 engine_api_metadata_push_password: secret
@@ -46,7 +46,7 @@ myconext_geo2lite_license_key: secret
 engine_api_profile_password: secret
 engine_api_deprovision_password: secret
 
-voot_oidcng_checkToken_secret: secret
+voot_oidcng_checkToken_secret: secretsecret
 
 external_group_provider_secrets:
   teams: secret

roles/manage-gui/templates/manage.conf.j2

@@ -76,10 +76,11 @@ Listen {{ apache_app_listen_address.manage }}:{{ loadbalancing.manage.port }}
       Require all granted
     </Location>
 
-    <Location ~ "(.*)(eot|svg|ttf|woff2|woff|html|js|js\.map|css|css\.map|png|jpg|ico)$">
+
+    <Location ~ "(.*)(eot|svg|ttf|woff2|woff|html|js|css|png|jpg|ico)$">
       Require all granted
     </Location>
-
+    
     <Location ~ "/(asset-)?manifest.json$">
       Require all granted
     </Location>

roles/manage-server/files/metadata_configuration/oauth20_rs.schema.json.j2

@@ -143,6 +143,18 @@
           "type": "string",
           "info": "Explains why the SP answered no on the subject of the SURFmarket DPA."
         },
+        "coin:privacy:dpa_type": {
+          "type": "string",
+          "enum": [
+            "dpa_not_applicable",
+            "dpa_in_surf_agreement",
+            "dpa_model_surf",
+            "dpa_supplied_by_service",
+            "other"
+          ],
+          "default": "dpa_supplied_by_service",
+          "info": "Determines what DPA this service has to offer"
+        },
         "coin:privacy:privacy_policy": {
           "type": "boolean",
           "info": "Does the SP publish an applicable privacy policy on a web page?"
@@ -192,6 +204,11 @@
           "type": "string",
           "info": "The friendly name of the organization. e.g. University of Harderwijk."
         },
+        "^mdui:PrivacyStatementURL:({{ supported_language_codes | replace(',','|') }})$": {
+          "type": "string",
+          "format": "url",
+          "info": "The URL to the Privacy Statement of the service."
+        },
         "^contacts:([0-3]{1}):surName$": {
           "type": "string",
           "multiplicity": 4,

roles/manage-server/files/metadata_configuration/single_tenant_template.schema.json.j2

@@ -427,6 +427,18 @@
           "type": "string",
           "info": "Explains why the SP answered no on the subject of the SURFmarket DPA."
         },
+        "coin:privacy:dpa_type": {
+          "type": "string",
+          "enum": [
+            "dpa_not_applicable",
+            "dpa_in_surf_agreement",
+            "dpa_model_surf",
+            "dpa_supplied_by_service",
+            "other"
+          ],
+          "default": "dpa_supplied_by_service",
+          "info": "Determines what DPA this service has to offer"
+        },
         "coin:privacy:privacy_policy": {
           "type": "boolean",
           "info": "Does the SP publish an applicable privacy policy on a web page?"

roles/springboot/defaults/main.yml

@@ -65,6 +65,7 @@ springboot_server_services:
     port: "{{ manage_springapp_tcpport }}"
     min_heapsize: "{{ manage_min_heapsize | default('512m') }}"
     max_heapsize: "{{ manage_max_heapsize | default('512m') }}"
+    java_binary: "/usr/lib/jvm/jre-11-openjdk/bin/java"
     config:
       "{{ manage }}"
   - name: oidcng
@@ -87,6 +88,7 @@ springboot_server_services:
     type: server
     min_heapsize: "{{ voot_min_heapsize | default('128m') }}"
     max_heapsize: "{{ voot_max_heapsize | default('128m') }}"
+    java_binary: "/usr/lib/jvm/jre-11-openjdk/bin/java"
     config:
       "{{ voot }}"
   - name: teams

tests/Dockerfile.centos-7-ga

@@ -16,7 +16,7 @@ rm -f /lib/systemd/system/anaconda.target.wants/*;
 
 RUN yum clean all && \
     yum -y update && \
-    yum -y install python3
+    yum -y install python3 
 
 VOLUME [ "/sys/fs/cgroup" ]
 

tests/githubactions-build.sh

@@ -13,8 +13,9 @@ ANSIBLE_USER=root
 
 # start docker container
 docker run --detach                                         \
-	-v /sys/fs/cgroup:/sys/fs/cgroup:ro                     \
+	-v /sys/fs/cgroup:/sys/fs/cgroup:rw                     \
 	-t                                                      \
+	--cgroupns=host                                         \
 	--privileged                                            \
 	--publish 443:443                                       \
 	--name ansible-test-ga                                  \
@@ -57,7 +58,6 @@ mkdir -p environments-external
 /bin/mv environments-external/github/group_vars/vm.yml environments-external/github/group_vars/github.yml
 sed -i 's/192.168.66.98/0.0.0.0/g' environments-external/github/group_vars/github.yml
 sed -i 's/192.168.66.99/127.0.0.1/g' environments-external/github/group_vars/github.yml
-sed -i 's/oidc_push_enabled: true/oidc_push_enabled: false/g' environments-external/github/group_vars/github.yml
 # Change the hostname in the inventory
 /bin/cp environments/template/inventory environments-external/github/
 sed -i 's/%env%/github/g' environments-external/github/inventory
@@ -68,7 +68,6 @@ sed -i 's/%target_host%/ansible-test-ga ansible_connection=docker/g' environment
 
 # Remove ipv6 listening address in Haproxy
 sed -i '/haproxy_sni_ip\.ipv6/d' roles/haproxy/templates/haproxy_frontend.cfg.j2
-
 echo
 echo "================================================================="
 echo "================================================================="
@@ -77,13 +76,18 @@ echo "================================================================="
 echo "================================================================="
 echo
 
-./provision github $ANSIBLE_USER $ANSIBLE_SECRETS -e springboot_service_to_deploy=manage,mujina-sp,mujina-idp -e @tests/github.yml -t core
+./provision github $ANSIBLE_USER $ANSIBLE_SECRETS -e springboot_service_to_deploy=teams,voot,oidcng,manage,mujina-sp,mujina-idp -e @tests/github.yml -t core
 
 # Make the image a bit smaller
 docker exec ansible-test-ga systemctl stop mysql mongod
 docker exec ansible-test-ga yum -y remove mongodb-org-mongos mongodb-org-tools
 docker exec ansible-test-ga rm -rf /var/lib/mongo/journal/*
 docker exec ansible-test-ga rm -rf /var/lib/mysql/ib_logfile*
+
+# The latest systemd update breaks mongo on docker (systemd[1]: New main PID 951 does not belong to service, and PID file is not owned by root. Refusing)
+# dowgrading it fixes the issue
+docker exec ansible-test-ga yum -y downgrade http://vault.centos.org/7.6.1810/updates/x86_64/Packages/systemd-219-62.el7_6.9.x86_64.rpm http://vault.centos.org/7.6.1810/updates/x86_64/Packages/systemd-libs-219-62.el7_6.9.x86_64.rpm http://vault.centos.org/7.6.1810/updates/x86_64/Packages/systemd-sysv-219-62.el7_6.9.x86_64.rpm
+
 docker stop ansible-test-ga ansible-test-ga
 
 exit $status