diff --git a/roles/ipsilon/files/fedora-scopes.py b/roles/ipsilon/files/fedora-scopes.py deleted file mode 100644 index d0242588ed..0000000000 --- a/roles/ipsilon/files/fedora-scopes.py +++ /dev/null @@ -1,14 +0,0 @@ -from __future__ import absolute_import - -from ipsilon.providers.openidc.plugins.common import OpenidCExtensionBase - - -class OpenidCExtension(OpenidCExtensionBase): - name = 'fedora' - display_name = 'Fedora' - scopes = { - 'fedora': { - 'display_name': 'Fedora', - 'claims': ['cla', 'zoneinfo', 'groups'] - } - } diff --git a/roles/ipsilon/files/oidc_scopes/account-scopes.py b/roles/ipsilon/files/oidc_scopes/account-scopes.py new file mode 100644 index 0000000000..9fb1190ebb --- /dev/null +++ b/roles/ipsilon/files/oidc_scopes/account-scopes.py @@ -0,0 +1,22 @@ +from __future__ import absolute_import + +from ipsilon.providers.openidc.plugins.common import OpenidCExtensionBase + + +class OpenidCExtension(OpenidCExtensionBase): + name = 'fedora-account' + display_name = 'Fedora Account Information' + scopes = { + 'fedora': { # NOTE: This is temporary! DO NOT USE IN NEW PROJECTS! + 'display_name': 'Fedora', + 'claims': ['cla', 'zoneinfo', 'groups'] + }, + 'https://id.fedoraproject.org/scope/groups': { + 'display_name': 'Fedora Account Groups list', + 'claims': ['groups'] + }, + 'https://id.fedoraproject.org/scope/cla': { + 'display_name': 'Fedora Account CLA status', + 'claims': ['cla'] + }, + } diff --git a/roles/ipsilon/tasks/main.yml b/roles/ipsilon/tasks/main.yml index a51db06bba..28e3fe4f28 100644 --- a/roles/ipsilon/tasks/main.yml +++ b/roles/ipsilon/tasks/main.yml @@ -23,6 +23,16 @@ dest=/usr/lib/python2.7/site-packages/ipsilon/providers/openid/extensions/api.py owner=root group=root mode=0644 +- name: Copy OpenID Connect scope registrations + copy: src=oidc_scopes/{{item}}.py + dest=/usr/lib/python2.7/site-packages/ipsilon/providers/openidc/plugins/{{item}}.py + owner=root group=root mode=0644 + with_items: + - account-scopes + tags: + - ipsilon + - ipsilon/oidc_scopes + - name: Apply hotfix for taiga to get POST results copy: src=openid_server.py dest=/usr/lib/python2.7/site-packages/openid/server/server.py diff --git a/roles/ipsilon/templates/configuration.conf b/roles/ipsilon/templates/configuration.conf index 27146a61ca..9b5d0d9750 100644 --- a/roles/ipsilon/templates/configuration.conf +++ b/roles/ipsilon/templates/configuration.conf @@ -39,7 +39,7 @@ openidc endpoint url=https://id{{env_suffix}}.fedoraproject.org/openidc/ openidc idp key file=/etc/ipsilon/openidc{{env_suffix}}.key openidc database url=postgresql://{{ ipsilon_db_user }}:{{ ipsilon_db_pass }}@{{ ipsilon_db_host }}/{{ ipsilon_db_openid_name }} openidc static database url=configfile:///etc/ipsilon/openidc.static.cfg -openidc enabled extensions= +openidc enabled extensions=fedora-account openidc documentation url=https://fedoraproject.org/wiki/Infrastructure/Authentication openidc policy url=https://fedoraproject.org/wiki/Legal:PrivacyPolicy openidc tos url=https://fedoraproject.org/wiki/Legal:PrivacyPolicy