Release/705 Engineblock 7.3

README.md

@@ -154,4 +154,3 @@ These files are licensed under version 2.0 of the Apache License, as described i
 
 * You can ask questions on the [OpenConext mailing list](https://openconext.org/get-involved/mailing-lists/) 
 * Or you can join our [Slack Workspace](https://edu.nl/ocslk)
-

environments/example/group_vars/template.yml

@@ -79,9 +79,6 @@ tls_star_cert: star.{{ base_domain }}.pem
 tls_star_cert_key: star.{{ base_domain }}.key
 tls_ca: star.{{ base_domain }}_ca.pem
 
-# Value for the isMemberOf attribute for users from IdPs that are marked as 'guest'.
-guest_qualifier: "urn:collab:org:{{ base_domain }}"
-
 engine_database_name: eb
 engine_database_host: "{{ mariadb_host }}"
 engine_database_port: 3306

environments/example/templates/manage/metadata_configuration/saml20_idp.schema.json.j2

@@ -321,16 +321,6 @@
           "type": "string",
           "info": "Type of institution contract."
         },
-        "coin:guest_qualifier": {
-          "type": "string",
-          "enum": [
-            "All",
-            "Some",
-            "None"
-          ],
-          "default": "All",
-          "info": "Services can use the guest attribute to offer guests a different set of functionality, the default behavior is to consider all users from an IdP as guest. Select: 1. All (default): All of the users from this IdP are marked as guests. 2 None: None of the users from this IdP marked as guests and all will be considered members. 3 Some: Most users will be a guest, and some of the users will be marked as members. When the IdP provides the attribute urn:oid:1.3.6.1.4.1.1076.20.100.10.10.1 (surfPersonAffiliation) with value member OpenConext considers it a member."
-        },
         "coin:schachomeorganization": {
           "type": "string",
           "info": "The Identity Providers organization using the organization’s domain name; syntax in accordance with RFC 1035. Usually the domain name of the organization. e.g. uniharderwijk.nl."

roles/engine/defaults/main.yml

@@ -23,6 +23,7 @@ engine_api_feature_deprovision: true
 # Cutoff point for showing unfiltered IdPs on the WAYF
 engine_wayf_cutoff_point_for_showing_unfiltered_idps: 50
 engine_wayf_show_remember_choice: false
+engine_wayf_show_remember_choice_per_sp: false
 engine_wayf_preferred_idp_entity_ids: []
 
 # Required for the Symfony routing.

roles/engine/tasks/main.yml

@@ -1,4 +1,9 @@
 ---
+- name: "Check for conflicting variables"
+  ansible.builtin.assert:
+    that: "not (engine_wayf_show_remember_choice|bool and engine_wayf_show_remember_choice_per_sp|bool)"
+    fail_msg: "`engine_wayf_show_remember_choice` and `engine_wayf_show_remember_choice_per_sp` cannot be both enabled"
+
 - name: "Add group engine"
   ansible.builtin.group:
     name: "engine"

roles/engine/templates/parameters.yml.j2

@@ -153,8 +153,6 @@ parameters:
   engineblock.metadata_push_memory_limit: {{ engine_metadata_push_memory_limit }}
   ## Minimum execution time in milliseconds when a received response is deemed invalid (default: 5000 ms)
   minimum_execution_time_on_invalid_received_response: {{ engine_minimum_execution_time_on_invalid_received_response | int }}
-  ## The value for guest qualifier. Can be overridden for specific environments
-  addgueststatus_guestqualifier: '{{ guest_qualifier | default('') }}'
 
   ## Language cookie settings
   cookie.path: {{ cookie_path | default('/') }}
@@ -195,6 +193,12 @@ parameters:
   ## set the IdPs that need to be displayed prominently
   wayf.preferred_idp_entity_ids: {{ engine_wayf_preferred_idp_entity_ids }}
 
+  # options for `feature_enable_wayf_remember_choice_per_idp`
+  wayf.remember_choice_per_idp_lifetime: 7776000  # 90 days
+  wayf.remember_choice_per_idp_max: 16  # do not increase too much; limited by cookie size
+  wayf.reset_choice_per_idp_redirect: "https://profile.{{ base_domain }}/my-profile"
+  wayf.reset_choice_allowed_redirect_hosts: ["profile.{{ base_domain }}"]
+
   ## Toggle display & content of global site notice
   global.site_notice.show: {{ engine_site_notice_show }}
   global.site_notice.allowed.tags: '<a><u><i><br><wbr><strong><em><blink><marquee><p><ul><ol><dl><li><dd><dt><div><span><blockquote><hr><h2></h2><h3><h4><h5><h6>'
@@ -242,6 +246,8 @@ parameters:
   feature_stepup_send_user_attributes: {{ engine_feature_send_user_attributes | bool | to_json }}
   feature_enable_sram_interrupt: {{ engine_feature_enable_sbs_interrupt | bool | to_json }}
   feature_hide_bookmarkable_url: {{ engine_feature_hide_bookmarkable_url | bool | to_json }}
+  # TODO: feature flag is misnamed.  The remember-my-choice is configurable for individual _SPs_
+  feature_enable_wayf_remember_choice_per_idp: {{ engine_wayf_show_remember_choice_per_sp | bool | to_json }}
   ##########################################################################################
   ## PROFILE SETTINGS
   ##########################################################################################