Skip to content

Commit 31daf74

Browse files
pmeulenpmeulen
committed
Merge branch 'simplify-stepup-bootstrap'
2 parents 65e6ea7 + 36eb087 commit 31daf74

File tree

4 files changed

+109
-20
lines changed

4 files changed

+109
-20
lines changed

‎stepup/README.md‎

Lines changed: 32 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,9 @@ First, you need to create an entry in your hosts file (/etc/hosts on *nix system
2121
127.0.0.1 selfservice.dev.openconext.local ssp.dev.openconext.local gateway.dev.openconext.local middleware.dev.openconext.local ra.dev.openconext.local demogssp.dev.openconext.local tiqr.dev.openconext.local webauthn.dev.openconext.local azuremfa.dev.openconext.local
2222
```
2323

24-
Secondly you need to create the `stepup/gateway/surfnet_yubikey.yaml` filewith your Yubikey API credentials. If you do not have API credentials, you can get them at <https://upgrade.yubico.com/getapikey/>. You require a Yubikey to get an API key.
24+
Secondly you need to create the `stepup/gateway/surfnet_yubikey.yaml` file with your Yubikey API credentials.
25+
If you do not have API credentials, you can get them at <https://upgrade.yubico.com/getapikey/>.
26+
You require a Yubikey to get an API key. There credential are used to verify the Yubikey OTP's.
2527

2628
```yaml
2729
surfnet_yubikey_api_client:
@@ -30,36 +32,49 @@ surfnet_yubikey_api_client:
3032
client_secret: 'YOUR_SECRET'
3133
```
3234
33-
You should then get the apps initialised
34-
You can then bring up the containers using docker compose:
35-
36-
Initialise the middelware database:
35+
Start the containers using docker compose:
3736
```
3837
docker compose up -d
39-
docker compose exec middleware /var/www/html/bin/console doctrine:migrations:migrate --env=prod --em=deploy
40-
docker compose exec middleware chown -R www-data /var/www/html/var/cache/prod/
38+
```
39+
or use the included script:
40+
```
41+
./start-dev-env.sh
4142
```
4243

43-
Then the webauthn db
44+
Initialise (bootstrap) the middleware, gateway and webauthn database schema's and push
45+
the configuration to the middleware. This is done by running the following script:
4446
```
45-
docker compose exec webauthn /var/www/html/bin/console doctrine:migrations:migrate --env=prod
47+
./bootstrap.sh
4648
```
4749

48-
Then you will need to provision the middleware config:
50+
Then, bootstrap the SRAA. For this, you will need to have a Yubikey.
51+
Use the following command to bootstrap the SRAA:
4952
```
50-
cd middleware
51-
./middleware-push-config.sh
52-
./middleware-push-whitelist.sh
53-
./middleware-push-institution.sh
53+
./bootstrap-admin-sraa.sh
5454
```
55-
Then, bootstrap the SRAA. For this, you will need to have a Yubikey. Replace Yubikey_ID with the number that is printed on your yubikey. It should be 8 characters. If it is less, prepend it with 0's
55+
56+
You can now login to the RA application using the admin account. The URL is:
57+
https://ra.dev.openconext.local
58+
The username and password for the admin account are:
5659
```
57-
docker compose exec middleware /var/www/html/bin/console middleware:bootstrap:identity-with-yubikey urn:collab:person:dev.openconext.local:admin dev.openconext.local "Your Name" Your@email nl_NL Yubikey_ID
60+
username: admin
61+
password: admin
5862
```
5963

6064
Mailcatcher is included. You can view the email by going to http://localhost:1080
6165

62-
A SimpleSAMLPHP sp is included. It can be accessed at https://ssp.dev.openconext.local/simplesaml/sp.php
66+
A SimpleSAMLPHP SP is included to test authentication from an SP. It can be accessed at https://ssp.dev.openconext.local/simplesaml/sp.php
67+
68+
The selfservice application is available at https://selfservice.dev.openconext.local
69+
70+
There are many user accounts available for testing. See http://ssp.dev.openconext.local/#test-accounts
71+
We recommend that you use the admin account only to activate additional RA and RAA accounts and do not
72+
use the admin account itself for testing.
73+
74+
# Version info
75+
You can use the included `version-info.sh` script to get the version info of the different stepup
76+
components from the docker containers. This script will show the `version`, `revision` and `created`
77+
tags of the running containers.
6378

6479
# Starting a project in development mode
6580

‎stepup/bootstrap-admin-sraa.sh‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
#!/usr/bin/env bash
2+
3+
# This script is used to bootstrap the admin (SRAA) user in the stepup docker dev environment
4+
5+
# It must be run the first time after the dev environment database has been bootstrapped, before the first login of
6+
# the "admin" user
7+
8+
# Get the directory of this script
9+
DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
10+
11+
# Ask the user for an OTP from their Yubikey
12+
echo "Please insert the Yubikey you want to use with the admin account and press press the button to generate an OTP"
13+
read -r -p "Yubikey OTP: " otp
14+
15+
# The Yubikey OTP is a 44 character string, so we need to check that the length is correct
16+
if [ ${#otp} -ne 44 ]; then
17+
echo "Error: The Yubikey OTP is not the correct length (44 characters)"
18+
exit 1
19+
fi
20+
21+
# Get the Yubikey ID from the OTP. The ID is the first 12 characters of the OTP.
22+
# The ID is ModHex encoded, so we need to decode it to get the decimal value
23+
24+
# Get first 12 characters of the OTP
25+
yubikey_id_modhex=${otp:0:12}
26+
echo "Yubikey ID (ModHex): ${yubikey_id_modhex}"
27+
# Decode the ModHex ID to decimal
28+
yubikey_id_hex=$(echo "${yubikey_id_modhex}" | tr 'cbdefghijklnrtuv' '0123456789abcdef')
29+
echo "Yubikey ID (Hex): ${yubikey_id_hex}"
30+
# Convert the hex ID to decimal
31+
yubikey_id_dec=$((0x"${yubikey_id_hex}"))
32+
# Prefix the ID with "0" to make it at least 8 characters long
33+
yubikey_id=$(printf "%08d" "${yubikey_id_dec}")
34+
echo "Yubikey ID: ${yubikey_id}"
35+
echo ""
36+
37+
# Ask the user to confirm
38+
read -r -p "Do you want to bootstrap the admin user as SRAA with Yubikey ID '${yubikey_id}'? (y/n): " confirm
39+
if [[ ! $confirm =~ ^[Yy]$ ]]; then
40+
echo "Aborting"
41+
exit 1
42+
fi
43+
44+
# Change to script directory
45+
cd "${DIR}" || exit 1
46+
47+
# Run middleware bootstrap console command:
48+
echo ""
49+
echo 'docker compose exec middleware /var/www/html/bin/console middleware:bootstrap:identity-with-yubikey urn:collab:person:dev.openconext.local:admin dev.openconext.local "Admin (SRAA)" admin@dev.openconext.local en_EN ${yubikey_id}'
50+
docker compose exec middleware /var/www/html/bin/console middleware:bootstrap:identity-with-yubikey urn:collab:person:dev.openconext.local:admin dev.openconext.local "Admin (SRAA)" admin@dev.openconext.local en_GB ${yubikey_id}
51+
if [ $? -ne 0 ]; then
52+
echo "Error: Failed to bootstrap the admin user"
53+
exit 1
54+
fi
55+
56+
echo "Successfully bootstrapped the admin user with Yubikey ID '${yubikey_id}'"
57+
echo "You can now login to the RA interface at https://ra.dev.openconext.local with the following credentials:"
58+
echo "User: admin"
59+
echo "Password: admin"
60+
echo ""
61+

‎stepup/bootstrap-database.sh‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -63,3 +63,10 @@ if ! "${DIR}/middleware/middleware-push-institution.sh"; then
6363
exit 1
6464
fi
6565
echo ""
66+
67+
echo "Successfully initialized/upgraded the stepup database schemas and pushed the configuration"
68+
echo ""
69+
echo "Next step: bootstrap the admin (SRAA) user in the stepup docker dev environment"
70+
echo " Do this *before* the first login of the \"admin\" user"
71+
echo " You can use the script `stepup/bootstrap-admin-sraa.sh` to do this"
72+
echo ""

‎stepup/start-dev-env.sh‎

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ if [ -f .env ]; then
99
echo "Sourcing .env file"
1010
source .env
1111
else
12-
echo "no .env file not found."
12+
echo ".env file is not present"
1313
fi
1414

1515
if [ "${STEPUP_VERSION}" == "test" ]; then
@@ -74,8 +74,14 @@ while true; do
7474
esac
7575
done
7676

77+
# Start docker compose with the smoketest profile when APP_ENV=smoketest
78+
if [ "${APP_ENV}" == "smoketest" ]; then
79+
extra_compose_args="--profile smoketest"
80+
echo -e "${GREEN}Starting in smoketest mode because APP_ENV=smoketest${ENDCOLOR}"
81+
fi
82+
7783
# Use docker compose to start the environment but with the modified override file(s)
7884
echo -e "Starting the ${MODE} environment with the following command:\n"
7985

80-
echo -e "docker compose --profile smoketest -f docker-compose.yml ${docker_compose_args[@]} ${extra_compose_args} up ${d_option} ${@:$number_of_dev_envs}\n"
81-
docker compose --profile smoketest -f docker-compose.yml ${docker_compose_args[@]} ${extra_compose_args} up ${d_option} ${@:$number_of_dev_envs}
86+
echo -e "docker compose -f docker-compose.yml ${docker_compose_args[@]} ${extra_compose_args} up ${d_option} ${@:$number_of_dev_envs}\n"
87+
docker compose -f docker-compose.yml ${docker_compose_args[@]} ${extra_compose_args} up ${d_option} ${@:$number_of_dev_envs}

0 commit comments

Comments
 (0)