diff --git a/roles/ipsilon/files/oidc_scopes/wiki.py b/roles/ipsilon/files/oidc_scopes/wiki.py new file mode 100644 index 0000000000..b2031fe975 --- /dev/null +++ b/roles/ipsilon/files/oidc_scopes/wiki.py @@ -0,0 +1,14 @@ +from __future__ import absolute_import + +from ipsilon.providers.openidc.plugins.common import OpenidCExtensionBase + + +class OpenidCExtension(OpenidCExtensionBase): + name = 'wiki' + display_name = 'Fedora Wiki' + scopes = { + 'https://fedoraproject.org/wiki/api': { + 'display_name': 'Fedora Wiki API access', + 'claims': [], + }, + } diff --git a/roles/ipsilon/tasks/main.yml b/roles/ipsilon/tasks/main.yml index 6e6d74f0b9..81c9573723 100644 --- a/roles/ipsilon/tasks/main.yml +++ b/roles/ipsilon/tasks/main.yml @@ -49,6 +49,19 @@ - ipsilon - ipsilon/oidc_scopes +- name: Copy OpenID Connect scope registrations (STAGING) + copy: src=oidc_scopes/{{item}}.py + dest=/usr/lib/python2.7/site-packages/ipsilon/providers/openidc/plugins/{{item}}.py + owner=root group=root mode=0644 + when: env == "staging" + with_items: + - wiki + notify: + - reload apache + tags: + - ipsilon + - ipsilon/oidc_scopes + - name: Apply hotfix for taiga to get POST results copy: src=openid_server.py dest=/usr/lib/python2.7/site-packages/openid/server/server.py diff --git a/roles/ipsilon/templates/configuration.conf b/roles/ipsilon/templates/configuration.conf index 64857adbe8..5316696cec 100644 --- a/roles/ipsilon/templates/configuration.conf +++ b/roles/ipsilon/templates/configuration.conf @@ -25,7 +25,7 @@ global enabled=persona,openid,saml2,openidc {% if env == "production" %} openidc enabled extensions=fedora-account,mbs,beaker,waiverdb,odcs {% else %} -openidc enabled extensions=fedora-account,mbs,beaker,waiverdb,odcs +openidc enabled extensions=fedora-account,mbs,beaker,waiverdb,odcs,wiki {% endif %} {% if env == 'staging' %} diff --git a/roles/mediawiki/templates/LocalSettings.php.fp.j2 b/roles/mediawiki/templates/LocalSettings.php.fp.j2 index 1cbb3028fc..3ddf293698 100644 --- a/roles/mediawiki/templates/LocalSettings.php.fp.j2 +++ b/roles/mediawiki/templates/LocalSettings.php.fp.j2 @@ -569,7 +569,7 @@ $wgOpenIDConnect_MigrateUsersByEmail = false; $wgOpenIDConnect_ForceLogout = false; $wgOpenIDConnectAPI_Issuer = 'https://id{{ env_suffix }}.fedoraproject.org/openidc/'; $wgOpenIDConnectAPI_TokenInfoURL = "https://id{{ env_suffix }}.fedoraproject.org/openidc/TokenInfo"; -$wgOpenIDConnectAPI_TokenScope = "fedoraproject.org/wiki/api"; +$wgOpenIDConnectAPI_TokenScope = "https://fedoraproject.org/wiki/api"; # Fixed for OIDC redirect url generation {% if env == "staging" %}