search

georchestra / ansible

Ansible playbooks to deploy a fullblown geOrchestra instance
ISC License
16 stars 12 forks source link

[ CAS ] Error missing /etc/cas/saml #133

Open pierrejego opened 8 months ago

pierrejego commented 8 months ago

When deploying playbook ( master ) on new Debian 12 via vagrant, proxycas webapp won't start cas-server application because a folder is missing.

Caused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'samlIdPObjectSignatureValidator' defined in class path resource [org/apereo/cas/config/Sam
lIdPEndpointsConfiguration.class]: Bean instantiation via factory method failed; nested exception is org.springframework.beans.BeanInstantiationException: Failed to instantiate [org.apereo.cas
.support.saml.web.idp.profile.builders.enc.validate.SamlObjectSignatureValidator]: Factory method 'samlIdPObjectSignatureValidator' threw exception; nested exception is org.springframework.bea
ns.factory.BeanCreationException: Error creating bean with name 'samlIdPMetadataGenerator' defined in class path resource [org/apereo/cas/config/SamlIdPMetadataConfiguration.class]: Invocation
 of init method failed; nested exception is java.lang.IllegalArgumentException: Metadata directory location /etc/cas/saml cannot be located/created

I could not find any configuration link to /etc/cas/saml in datadir but in cas-server docs there is some touch : https://apereo.github.io/cas/7.0.x/installation/Configuring-SAML2-DynamicMetadata.html

Create empty folder /etc/cas/sam fix to problem but might not be the answer.

pmauduit commented 8 months ago

Is your datadir uptodate ? especially these 2 lines: https://github.com/georchestra/datadir/blob/master/cas/config/cas.properties#L52-L53

pmauduit commented 8 months ago

oh, or maybe the cas.properties is templated into the ansible playbook ...

pmauduit commented 8 months ago

it is templated indeeed, but @landryb updated it last week: https://github.com/georchestra/ansible/blame/master/roles/georchestra/templates/cas/cas.properties.j2

pierrejego commented 8 months ago

I have the last version of playbook, I see the templating, but in the final datadir /etc/georchestra/cas/config neither cas.properties or log4j2.xml are updated. There are not coming from master datadir ( last two lines are missing and log4J2.xml point to /var/log.

Could they come from the debian package ?

landryb commented 8 months ago

the playbook deploys the datadir and the templates after installing the debian package, so if you run ansible-playbook -t config --diff you should be able to see what is updated in the datadir

as for the empty /etc/georchestra/cas/saml dir it should exist since it's in the datadir repo at https://github.com/georchestra/datadir/tree/master/cas/saml

landryb commented 8 months ago

i was wrong in my previous comment and misread yours.. after checking, the datadir is deployed/customized before deploying debian packages, which apparently overrides the customizations done by the playbook since config files are also shipped by the debian package. That is.. a definitely strange behaviour, because by default when left unattended/without user interaction (ie when run from ansible), dpkg shouldn't override already present files...

pmauduit commented 8 months ago

That is.. a definitely strange behaviour, because by default when left unattended/without user interaction (ie when run from ansible), dpkg shouldn't override already present files...

It gets back to one point brought during the codesprint: what about dropping the default /etc/georchestra/webapp brought by the packages ? Maybe it would make more sense to have a sample configuration into /usr/share/doc/ ?

landryb commented 8 months ago

can repro on a test instance, after removing georchestra-cas and running ansible-playbook -t config:

landryb commented 8 months ago

the way ansible installs the packages via apt, it should use --force-confdef & --force-confold as dpkg options, per https://docs.ansible.com/ansible/latest/collections/ansible/builtin/apt_module.html#parameter-dpkg_options - and to my understanding that explicitely says 'keep existing files'.

or i'm not reading https://dyn.manpages.debian.org/bookworm/dpkg/dpkg.1.en.html#force~2 right...

landryb commented 8 months ago

@pierrejego can you check what happens if you add:

diff --git a/roles/georchestra/tasks/wars.yml b/roles/georchestra/tasks/wars.yml
index b5d9f64..dcb816d 100644
--- a/roles/georchestra/tasks/wars.yml
+++ b/roles/georchestra/tasks/wars.yml
@@ -20,6 +20,7 @@
   apt:
     pkg: "{{ item.value.pkg }}"
     update_cache: true
+    dpkg_options: force-confold
     state: latest # noqa: package-latest
   with_dict: "{{ georchestra_wars }}"
   when: item.value.enabled and item.key != 'cadastrapp' and item.value.pkg is defined
landryb commented 8 months ago

That is.. a definitely strange behaviour, because by default when left unattended/without user interaction (ie when run from ansible), dpkg shouldn't override already present files...

It gets back to one point brought during the codesprint: what about dropping the default /etc/georchestra/webapp brought by the packages ? Maybe it would make more sense to have a sample configuration into /usr/share/doc/ ?

that or /usr/share/doc/georchestra-datadir ? since we have /usr/share/doc/georchestra-*/copyright...

pmauduit commented 8 months ago

that or /usr/share/doc/georchestra-datadir ? since we have /usr/share/doc/georchestra-*/copyright...

Maybe it would deserve a new package, then (I'd expect that in debian conventions, you would need to have /usr/share/doc/<packagename> or so). It also reminds me that we never solved the issue with /etc/georchestra/default.properties (which package should take care of it ?)