ansible/roles/ipsilon/templates/configuration.conf

[login_config]
{% if env == "production" %}
global enabled=gssapi,fas
fas FAS url=https://admin{{env_suffix}}.fedoraproject.org/accounts/
fas FAS Proxy client user Agent=Fedora Ipsilon
fas FAS Insecure Auth=False
{% else %}
global enabled=gssapi,form
{% endif %}

[info_config]
{% if env == "production" %}
global enabled=fas
fas FAS url=https://admin{{env_suffix}}.fedoraproject.org/accounts/
fas FAS Proxy client user Agent=Fedora Ipsilon
fas FAS Insecure Auth=False
fas Bind Username={{ ipsilon_fasinfo_username }}
fas Bind Password={{ ipsilon_fasinfo_prod_password }}
{% else %}
sssd preconfigured = True
global enabled = sssd
{% endif %}

[authz_config]
global enabled=allow

[provider_config]
global enabled=openid,saml2,openidc

{% if env == "production" %}
openidc enabled extensions=fedora-account,mbs,beaker,waiverdb,odcs,wiki,src,fpdc,kerneltest
{% else %}
openidc enabled extensions=fedora-account,mbs,beaker,waiverdb,odcs,wiki,src,fpdc,kerneltest
{% endif %}

{% if env == 'staging' %}
openidc subject salt={{ ipsilon_stg_openidc_subject_salt }}
{% else %}
openidc subject salt={{ ipsilon_openidc_subject_salt }}
{% endif %}
openidc endpoint url=https://id{{env_suffix}}.fedoraproject.org/openidc/
openidc idp key file=/etc/ipsilon/openidc.key
openidc database url=postgresql://{{ ipsilon_db_user }}:{{ ipsilon_db_pass }}@{{ ipsilon_db_host }}/{{ ipsilon_db_openid_name }}
openidc static database url=configfile:///etc/ipsilon/openidc.static.cfg
openidc documentation url=https://fedoraproject.org/wiki/Infrastructure/Authentication
openidc policy url=https://fedoraproject.org/wiki/Legal:PrivacyPolicy
openidc tos url=https://fedoraproject.org/wiki/Legal:PrivacyPolicy
openidc idp sig key id=20161031-sig
openidc allow dynamic client registration=False
{% if env == 'staging' %}
openidc default attribute mapping=[["*", "*"]]
openidc default attribute mapping=[["*", "*"], ["_groups", "groups"], [["_extras", "cla"], "cla"], ["fullname", "name"], ["_username", "nickname"], ["_username", "preferred_username"], ["fasIRCNick", "ircnick"], ["fasLocale", "locale"], ["fasTimeZone", "zoneinfo"], ["fasTimeZone", "timezone"], ["fasGPGKeyId", "gpgkeyids"], ["fasIsPrivate", "privacy"], ["fullname", "human_name"], ["nsAccountLock", "locked"]]
{% else %}
openidc default attribute mapping=[["*", "*"], ["timezone", "zoneinfo"], ["_groups", "groups"], [["_extras", "cla"], "cla"], ["fullname", "name"], ["_username", "preferred_username"]]
{% endif %}

openid endpoint url=https://id{{env_suffix}}.fedoraproject.org/openid/
openid identity url template=http://%(username)s.id{{env_suffix}}.fedoraproject.org/
{% if env == 'staging' %}
openid trusted roots=
{% else %}
openid trusted roots=https://ask.fedoraproject.org/,https://fedorahosted.org/,https://badges.fedoraproject.org,https://apps.fedoraproject.org/nuancier/,https://apps.fedoraproject.org/datagrepper/,https://apps.fedoraproject.org/calendar/,http://apps.fedoraproject.org/notifications/,http://copr.fedoraproject.org/,https://copr.fedoraproject.org/,https://admin.fedoraproject.org/voting/,https://apps.fedoraproject.org/github2fedmsg,https://admin.fedoraproject.org,https://apps.fedoraproject.org/,https://release-monitoring.org/,http://pagure.io/,http://admin.fedoraproject.org/mirrormanager/,https://koschei.fedoraproject.org/,https://bodhi.fedoraproject.org,https://lists.fedoraproject.org/,https://openqa.fedoraproject.org/,https://src.fedoraproject.org/
{% endif %}
openid database url=postgresql://{{ ipsilon_db_user }}:{{ ipsilon_db_pass }}@{{ ipsilon_db_host }}/{{ ipsilon_db_openid_name }}
openid untrusted roots=
openid enabled extensions=Fedora Teams,Attribute Exchange,CLAs,Simple Registration,API

saml2 idp storage path=/etc/ipsilon/saml2
saml2 idp metadata file=metadata.xml
{% if env == 'staging' %}
saml2 idp nameid salt={{ ipsilon_stg_saml2_nameid_salt }}
{% else %}
saml2 idp nameid salt={{ ipsilon_saml2_nameid_salt }}
{% endif %}
saml2 idp certificate file=idp.crt
saml2 idp key file=idp.key
saml2 allow self registration=False
saml2 default nameid=transient
saml2 default email domain=fedoraproject.org
saml2 session database url=postgresql://{{ ipsilon_db_user }}:{{ ipsilon_db_pass }}@{{ ipsilon_db_host }}/{{ ipsilon_db_saml2_name }}

[saml2_data]
{% if env == 'staging' %}
{% include "saml2_data_stg" %}
{% else %}
{% include "saml2_data" %}
{% endif %}