---
# Configure Moodle's auth_oidc plugin (variant 0 only). Variant 1
# disables the OIDC shared service so this file is not included.
- name: "🔎 Check the auth_oidc plugin is baked into the image"
shell: >
container exec --user root {{ MOODLE_CONTAINER_ADDRESS }} test -d {{ MOODLE_OIDC_PLUGIN_SOURCE_DIR }}
register: moodle_oidc_plugin_source
changed_when: false
failed_when: moodle_oidc_plugin_source.rc not in [0, 1]
- name: "🛑 Refuse a Moodle image built without the auth_oidc plugin"
ansible.builtin.assert:
that:
- moodle_oidc_plugin_source.rc == 0
fail_msg: >-
{{ MOODLE_OIDC_PLUGIN_SOURCE_DIR }} is missing, so the Moodle image was built
without the auth_oidc plugin and the code volume cannot receive it.
- name: "📋 Sync the auth_oidc plugin from the image into the code volume"
shell: >
container exec --user {{ MOODLE_RUNTIME_USER }} {{ MOODLE_CONTAINER_ADDRESS }}
sh -c 'diff -rq {{ MOODLE_OIDC_PLUGIN_SOURCE_DIR }} {{ MOODLE_OIDC_PLUGIN_DIR }} >/dev/null 2>&1 && exit 0;
rm -rf {{ MOODLE_OIDC_PLUGIN_SYNC_DIR }}
&& cp -aT {{ MOODLE_OIDC_PLUGIN_SOURCE_DIR }} {{ MOODLE_OIDC_PLUGIN_SYNC_DIR }}
&& rm -rf {{ MOODLE_OIDC_PLUGIN_DIR }}
&& mv {{ MOODLE_OIDC_PLUGIN_SYNC_DIR }} {{ MOODLE_OIDC_PLUGIN_DIR }}
&& echo synced'
register: moodle_oidc_plugin_sync
changed_when: "'synced' in moodle_oidc_plugin_sync.stdout"
- name: "🔎 Check OIDC plugin presence"
shell: >
container exec --user root {{ MOODLE_CONTAINER_ADDRESS }} test -d {{ MOODLE_OIDC_PLUGIN_DIR }}
register: oidc_plugin_check
changed_when: false
failed_when: false
- name: "🛑 Fail if OIDC plugin is missing"
fail:
msg: "auth_oidc plugin not found at {{ MOODLE_OIDC_PLUGIN_DIR }} after the sync from {{ MOODLE_OIDC_PLUGIN_SOURCE_DIR }}"
when: oidc_plugin_check.rc != 0
- name: "▶️ Run Moodle DB upgrade for OIDC plugin"
shell: >
container exec --user {{ MOODLE_RUNTIME_USER }} {{ MOODLE_CONTAINER_ADDRESS }}
php {{ MOODLE_CLI_DIR }}/upgrade.php --non-interactive
changed_when: false
- name: "🔧 Set Moodle OIDC configuration via CLI"
include_tasks: utils/plugin_config.yml
vars:
moodle_plugin_config_component: auth_oidc
moodle_plugin_config_settings:
idptype: 3
clientauthmethod: 1
clientid: "{{ OIDC.CLIENT.ID }}"
clientsecret: "{{ OIDC.CLIENT.SECRET }}"
opname: "{{ OIDC.BUTTON_TEXT }}"
oidcscope: "{{ MOODLE_OIDC_SCOPES }}"
authendpoint: "{{ OIDC.CLIENT.AUTHORIZE_URL }}"
tokenendpoint: "{{ OIDC.CLIENT.TOKEN_URL }}"
bindingusernameclaim: "{{ OIDC.ATTRIBUTES.USERNAME }}"
single_sign_off: 1
logouturi: "{{ OIDC.CLIENT.LOGOUT_URL }}"
icon: "moodle:t/lock"
field_map_firstname: "given_name"
field_lock_firstname: "locked"
field_updatelocal_firstname: "oneveryloginupdate"
field_map_lastname: "family_name"
field_lock_lastname: "locked"
field_updatelocal_lastname: "oneveryloginupdate"
field_map_middlename: "middle_name"
field_lock_middlename: "locked"
field_updatelocal_middlename: "oneveryloginupdate"
field_map_alternatename: "nickname"
field_lock_alternatename: "locked"
field_updatelocal_alternatename: "oneveryloginupdate"
field_map_email: "email"
field_lock_email: "locked"
field_updatelocal_email: "oneveryloginupdate"
field_map_phone1: "phone_number"
field_lock_phone1: "locked"
field_updatelocal_phone1: "oneveryloginupdate"
field_map_phone2: "phone_number_alt"
field_lock_phone2: "locked"
field_updatelocal_phone2: "oneveryloginupdate"
field_map_address: "address"
field_lock_address: "locked"
field_updatelocal_address: "oneveryloginupdate"
field_map_city: "locality"
field_lock_city: "locked"
field_updatelocal_city: "oneveryloginupdate"
field_map_country: "country"
field_lock_country: "locked"
field_updatelocal_country: "oneveryloginupdate"
field_map_institution: "institution"
field_lock_institution: "locked"
field_updatelocal_institution: "oneveryloginupdate"
field_map_department: "department"
field_lock_department: "locked"
field_updatelocal_department: "oneveryloginupdate"
field_map_description: "description"
field_lock_description: "locked"
field_updatelocal_description: "oneveryloginupdate"
field_map_idnumber: "id_number"
field_lock_idnumber: "locked"
field_updatelocal_idnumber: "oneveryloginupdate"
field_map_url: "website"
field_lock_url: "locked"
field_updatelocal_url: "oneveryloginupdate"
field_map_lang: "locale"
field_lock_lang: "locked"
field_updatelocal_lang: "oneveryloginupdate"
field_map_timezone: "zoneinfo"
field_lock_timezone: "locked"
field_updatelocal_timezone: "oneveryloginupdate"
field_map_firstnamephonetic: "name_phonetic_given"
field_lock_firstnamephonetic: "locked"
field_updatelocal_firstnamephonetic: "oneveryloginupdate"
field_map_lastnamephonetic: "name_phonetic_family"
field_lock_lastnamephonetic: "locked"
field_updatelocal_lastnamephonetic: "oneveryloginupdate"
- name: "🟢 Enable the auth_oidc plugin in Moodle's core auth list"
shell: >
container exec --user {{ MOODLE_RUNTIME_USER }} {{ MOODLE_CONTAINER_ADDRESS }}
php {{ MOODLE_CLI_DIR }}/cfg.php --name=auth --set=oidc
changed_when: false
- name: "🔀 Point the Moodle login page at the auth_oidc entry point"
shell: >
container exec --user {{ MOODLE_RUNTIME_USER }} {{ MOODLE_CONTAINER_ADDRESS }}
php {{ MOODLE_CLI_DIR }}/cfg.php
--name=alternateloginurl
--set={{ (lookup('tls', application_id, 'url.base') ~ MOODLE_OIDC_PLUGIN_URL_PATH ~ '/') | quote }}
changed_when: false
- name: "🔧 Set auth = 'oidc' for all users except guest"
shell: >
container exec -e MYSQL_PWD {{ MOODLE_DB_CONTAINER_ADDRESS }}
mariadb -u {{ lookup('database', application_id, 'username') }}
-e "UPDATE {{ lookup('database', application_id, 'name') }}.mdl_user SET auth = 'oidc' WHERE username != 'guest';"
args:
executable: /bin/bash
environment:
MYSQL_PWD: "{{ lookup('database', application_id, 'password') }}"
changed_when: false
no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
