From dcc8bb3bbf52c4c6867bffe59c519f1ca5437052 Mon Sep 17 00:00:00 2001 From: Bas Zoetekouw Date: Sat, 17 Oct 2026 15:28:17 +0200 Subject: [PATCH 1/6] Add check for incompatible options --- roles/engine/tasks/main.yml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/roles/engine/tasks/main.yml b/roles/engine/tasks/main.yml index e6de43420..bf461fe85 100644 --- a/roles/engine/tasks/main.yml +++ b/roles/engine/tasks/main.yml @@ -1,4 +1,9 @@ --- +- name: "Check for conflicting variables" + ansible.builtin.assert: + that: "not (engine_wayf_show_remember_choice|bool and engine_wayf_show_remember_choice_per_sp|bool)" + fail_msg: "`engine_wayf_show_remember_choice` and `engine_wayf_show_remember_choice_per_sp` cannot be both enabled" + - name: "Add group engine" ansible.builtin.group: name: "engine" From 8068d703175a08463ad26bf7dd79c62167c3c6dc Mon Sep 17 00:00:00 2001 From: Bas Zoetekouw Date: Sat, 17 Oct 2026 15:31:28 +0200 Subject: [PATCH 2/6] Add new parameters for remember my choice --- roles/engine/templates/parameters.yml.j2 | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/roles/engine/templates/parameters.yml.j2 b/roles/engine/templates/parameters.yml.j2 index eb4427eb9..bc1ad18cb 100644 --- a/roles/engine/templates/parameters.yml.j2 +++ b/roles/engine/templates/parameters.yml.j2 @@ -195,6 +195,12 @@ parameters: ## set the IdPs that need to be displayed prominently wayf.preferred_idp_entity_ids: {{ engine_wayf_preferred_idp_entity_ids }} + # options for `feature_enable_wayf_remember_choice_per_idp` + wayf.remember_choice_per_idp_lifetime: 7776000 # 90 days + wayf.remember_choice_per_idp_max: 16 # do not increase too much; limited by cookie size + wayf.reset_choice_per_idp_redirect: "https://profile.openconext.org/" + wayf.reset_choice_allowed_redirect_hosts: ["profile.openconext.org"] + ## Toggle display & content of global site notice global.site_notice.show: {{ engine_site_notice_show }} global.site_notice.allowed.tags: '

    1. ' @@ -242,6 +248,7 @@ parameters: feature_stepup_send_user_attributes: {{ engine_feature_send_user_attributes | bool | to_json }} feature_enable_sram_interrupt: {{ engine_feature_enable_sbs_interrupt | bool | to_json }} feature_hide_bookmarkable_url: {{ engine_feature_hide_bookmarkable_url | bool | to_json }} + feature_enable_wayf_remember_choice_per_idp: {{ engine_wayf_show_remember_choice_per_sp | bool | to_json }} ########################################################################################## ## PROFILE SETTINGS ########################################################################################## From 12b6d5ea9a555ff1e580a57c495ea7d569d7df58 Mon Sep 17 00:00:00 2001 From: Bas Zoetekouw Date: Sat, 17 Oct 2026 15:41:59 +0200 Subject: [PATCH 3/6] Remove coin:guest_qualifier --- environments/example/group_vars/template.yml | 3 --- .../metadata_configuration/saml20_idp.schema.json.j2 | 10 ---------- roles/engine/templates/parameters.yml.j2 | 2 -- 3 files changed, 15 deletions(-) diff --git a/environments/example/group_vars/template.yml b/environments/example/group_vars/template.yml index 5a99ee1dd..baf7fe69b 100644 --- a/environments/example/group_vars/template.yml +++ b/environments/example/group_vars/template.yml @@ -79,9 +79,6 @@ tls_star_cert: star.{{ base_domain }}.pem tls_star_cert_key: star.{{ base_domain }}.key tls_ca: star.{{ base_domain }}_ca.pem -# Value for the isMemberOf attribute for users from IdPs that are marked as 'guest'. -guest_qualifier: "urn:collab:org:{{ base_domain }}" - engine_database_name: eb engine_database_host: "{{ mariadb_host }}" engine_database_port: 3306 diff --git a/environments/example/templates/manage/metadata_configuration/saml20_idp.schema.json.j2 b/environments/example/templates/manage/metadata_configuration/saml20_idp.schema.json.j2 index a4930372f..6b5467b8d 100644 --- a/environments/example/templates/manage/metadata_configuration/saml20_idp.schema.json.j2 +++ b/environments/example/templates/manage/metadata_configuration/saml20_idp.schema.json.j2 @@ -321,16 +321,6 @@ "type": "string", "info": "Type of institution contract." }, - "coin:guest_qualifier": { - "type": "string", - "enum": [ - "All", - "Some", - "None" - ], - "default": "All", - "info": "Services can use the guest attribute to offer guests a different set of functionality, the default behavior is to consider all users from an IdP as guest. Select: 1. All (default): All of the users from this IdP are marked as guests. 2 None: None of the users from this IdP marked as guests and all will be considered members. 3 Some: Most users will be a guest, and some of the users will be marked as members. When the IdP provides the attribute urn:oid:1.3.6.1.4.1.1076.20.100.10.10.1 (surfPersonAffiliation) with value member OpenConext considers it a member." - }, "coin:schachomeorganization": { "type": "string", "info": "The Identity Providers organization using the organization’s domain name; syntax in accordance with RFC 1035. Usually the domain name of the organization. e.g. uniharderwijk.nl." diff --git a/roles/engine/templates/parameters.yml.j2 b/roles/engine/templates/parameters.yml.j2 index bc1ad18cb..a928d4bc1 100644 --- a/roles/engine/templates/parameters.yml.j2 +++ b/roles/engine/templates/parameters.yml.j2 @@ -153,8 +153,6 @@ parameters: engineblock.metadata_push_memory_limit: {{ engine_metadata_push_memory_limit }} ## Minimum execution time in milliseconds when a received response is deemed invalid (default: 5000 ms) minimum_execution_time_on_invalid_received_response: {{ engine_minimum_execution_time_on_invalid_received_response | int }} - ## The value for guest qualifier. Can be overridden for specific environments - addgueststatus_guestqualifier: '{{ guest_qualifier | default('') }}' ## Language cookie settings cookie.path: {{ cookie_path | default('/') }} From 6e93f9b02947950e7b5965e7b9f22fc98ebcf94d Mon Sep 17 00:00:00 2001 From: Bas Zoetekouw Date: Tue, 3 Nov 2026 16:21:16 +0100 Subject: [PATCH 4/6] Set correct WAYF reset_choice_per_idp_redirect vars --- README.md | 1 - roles/engine/templates/parameters.yml.j2 | 4 ++-- 2 files changed, 2 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index 88a3628c1..5afccf824 100644 --- a/README.md +++ b/README.md @@ -154,4 +154,3 @@ These files are licensed under version 2.0 of the Apache License, as described i * You can ask questions on the [OpenConext mailing list](https://openconext.org/get-involved/mailing-lists/) * Or you can join our [Slack Workspace](https://edu.nl/ocslk) - diff --git a/roles/engine/templates/parameters.yml.j2 b/roles/engine/templates/parameters.yml.j2 index a928d4bc1..787aafea9 100644 --- a/roles/engine/templates/parameters.yml.j2 +++ b/roles/engine/templates/parameters.yml.j2 @@ -196,8 +196,8 @@ parameters: # options for `feature_enable_wayf_remember_choice_per_idp` wayf.remember_choice_per_idp_lifetime: 7776000 # 90 days wayf.remember_choice_per_idp_max: 16 # do not increase too much; limited by cookie size - wayf.reset_choice_per_idp_redirect: "https://profile.openconext.org/" - wayf.reset_choice_allowed_redirect_hosts: ["profile.openconext.org"] + wayf.reset_choice_per_idp_redirect: "https://profile.{{ base_domain }}/my-profile" + wayf.reset_choice_allowed_redirect_hosts: ["profile.{{ base_domain }}"] ## Toggle display & content of global site notice global.site_notice.show: {{ engine_site_notice_show }} From 3dbcd7abe8a26cabd31093f238317e97ef9db680 Mon Sep 17 00:00:00 2001 From: Bas Zoetekouw Date: Fri, 6 Nov 2026 10:43:54 +0100 Subject: [PATCH 5/6] add missing default option --- roles/engine/defaults/main.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/roles/engine/defaults/main.yml b/roles/engine/defaults/main.yml index 6608b2ae8..082a8cdb5 100644 --- a/roles/engine/defaults/main.yml +++ b/roles/engine/defaults/main.yml @@ -23,6 +23,7 @@ engine_api_feature_deprovision: true # Cutoff point for showing unfiltered IdPs on the WAYF engine_wayf_cutoff_point_for_showing_unfiltered_idps: 50 engine_wayf_show_remember_choice: false +engine_wayf_show_remember_choice_per_sp: false engine_wayf_preferred_idp_entity_ids: [] # Required for the Symfony routing. From 60e03d51e5dc251e88eea37d54a1367f7253974c Mon Sep 17 00:00:00 2001 From: Bas Zoetekouw Date: Fri, 6 Nov 2026 10:53:13 +0100 Subject: [PATCH 6/6] add comment to misleading feature name --- roles/engine/templates/parameters.yml.j2 | 1 + 1 file changed, 1 insertion(+) diff --git a/roles/engine/templates/parameters.yml.j2 b/roles/engine/templates/parameters.yml.j2 index 787aafea9..0adc65d10 100644 --- a/roles/engine/templates/parameters.yml.j2 +++ b/roles/engine/templates/parameters.yml.j2 @@ -246,6 +246,7 @@ parameters: feature_stepup_send_user_attributes: {{ engine_feature_send_user_attributes | bool | to_json }} feature_enable_sram_interrupt: {{ engine_feature_enable_sbs_interrupt | bool | to_json }} feature_hide_bookmarkable_url: {{ engine_feature_hide_bookmarkable_url | bool | to_json }} + # TODO: feature flag is misnamed. The remember-my-choice is configurable for individual _SPs_ feature_enable_wayf_remember_choice_per_idp: {{ engine_wayf_show_remember_choice_per_sp | bool | to_json }} ########################################################################################## ## PROFILE SETTINGS