Splitting CI images into separate ones

[blizzz]

Resolves #688 and should make it easier to maintain

Far from ready, contains temporary code (e.g. concurring drone.yml and MSGH Action)

TODOs in the commit message while in draft

[blizzz]

Progress! Env tests passing!

[SystemKeeper]

Posting here, but some infos are also related to nextcloud/docker-ci#535

• Host is wrong in attribute-filter.xml, should be <PolicyRequirementRule xsi:type="Requester" value="http://localhost:8080/index.php/apps/user_saml/saml/metadata" /> (port is missing)
• Comment out all imports in /opt/shibboleth-idp/conf/attributes/default-rules.xml, otherwise we will see duplicated attributes (which is a result of using v3 files in v4, see https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1265631499/ReleaseNotes#Attribute-Related-Changes for details). Alternatively look how the new AttributeRegistry works...
• In nextcloud.xml we are also missing the port in <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="http://localhost:8080/index.php/apps/user_saml/saml/acs" index="1"/>
• /opt/shibboleth-idp/conf/oidc-credentials.xml needs to exist and should look like:

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans" xmlns:context="http://www.springframework.org/schema/context" xmlns:util="http://www.springframework.org/schema/util" xmlns:p="http://www.springframework.org/schema/p" xmlns:c="http://www.springframework.org/schema/c" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd                            http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd                            http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd" default-init-method="initialize" default-destroy-method="destroy">
  <!-- This file contains default oidc signing credentials. This file should be imported to credentials.xml -->
  <!-- The list of ALL of your OP's ID Token / UserInfo response signing credentials for the default security configuration. 
        If you define additional signing credentials, for example for new supported signing algorithms, make sure to include them 
        within this list. -->
  <bean class="net.shibboleth.idp.profile.spring.factory.BasicX509CredentialFactoryBean" id="shibboleth.oidc.PEMSigningCredential" p:certificateResource="%{idp.signing.cert}" p:entityId-ref="issuer" p:keyNames="Signing" p:privateKeyResource="%{idp.signing.key}"/>
  <bean class="net.shibboleth.idp.profile.spring.factory.BasicX509CredentialFactoryBean" id="shibboleth.oidc.PEMEncryptionCredential" p:certificateResource="%{idp.encryption.cert}" p:entityId-ref="issuer" p:keyNames="Encryption" p:privateKeyResource="%{idp.encryption.key}"/>
  <util:list id="shibboleth.oidc.SigningCredentials">
    <ref bean="shibboleth.oidc.PEMSigningCredential"/>
  </util:list>
  <!-- The list of ALL of your OP's Request Object decryption credentials for the default security configuration. If you 
        define additional decryption credentials, for example to support new algorithm, make sure to include them within 
        this list. -->
  <util:list id="shibboleth.oidc.EncryptionCredentials">
    <ref bean="shibboleth.oidc.PEMEncryptionCredential"/>
  </util:list>
  <!-- If you need to publish key set different from shibboleth.oidc.EncryptionCredentials, define a list named as shibboleth.oidc.EncryptionCredentialsToPublish -->
  <alias name="shibboleth.oidc.EncryptionCredentials" alias="shibboleth.oidc.EncryptionCredentialsToPublish"/>
  <!--
    Example of case having two active encryption credentials but then stop publishing the second before removing it from active configuration.
    <util:list id="shibboleth.oidc.EncryptionCredentialsToPublish">
        <ref bean="shibboleth.oidc.OnlyNewDefaultRSAEncryptionCredential" />
    </util:list>
    -->
  <!-- If you need to publish key set different from shibboleth.oidc.SigningCredentials, define a list named as shibboleth.oidc.SigningCredentialsToPublish -->
  <alias name="shibboleth.oidc.SigningCredentials" alias="shibboleth.oidc.SigningCredentialsToPublish"/>
  <!--
    Example of case publishing signing credential before taking it to active configuration: 
    
    <util:list id="shibboleth.oidc.SigningCredentialsToPublish">
        <ref bean="shibboleth.oidc.DefaultRSSigningCredential" />
        <ref bean="shibboleth.oidc.DefaultESSigningCredential" />
        <ref bean="shibboleth.oidc.UpcomingDefaultRSSigningCredential" />
    </util:list>
    -->
</beans>

(from https://github.com/CSCfi/shibboleth-idp-dockerized/blob/master/opt/shibboleth-idp/conf/credentials-oidc.xml, haven't compared, but should be the same I guess, note the order, the file in the container is called credentials-oidc.xml, but we need oidc-credentials.xml! See import in credentials.xml).

After that:

8 scenarios (8 passed)
119 steps (119 passed)
0m27.67s (10.09Mb)

😎

[blizzz]

@SystemKeeper muchos gracias! Some changes i had already locally like that, but you also saved me some more digging ❤️

[blizzz]

[blizzz]

will remove require on drone once it's merged – there are no tests for drone anymore and the file was removed.

[juliusknorr]

Changes look good 👍

Long way but nice work 🥳

[blizzz]

/backport to stable-5.2

[backportbot-nextcloud]

The backport to stable-5.2 failed. Please do this backport manually.

# Switch to the target branch and update it
git checkout stable-5.2
git pull origin stable-5.2

# Create the new backport branch
git checkout -b fix/foo-stable-5.2

# Cherry pick the change from the commit sha1 of the change against the default branch
# This might cause conflicts. Resolve them.
git cherry-pick abc123

# Push the cherry pick commit to the remote repository and open a pull request
git push origin fix/foo-stable-5.2

More info at https://docs.nextcloud.com/server/latest/developer_manual/getting_started/development_process.html#manual-backport