04_sso.yml

# @See https://raw.githubusercontent.com/snipe/snipe-it/master/app/Http/Controllers/Auth/LoginController.php
---
- name: "⏳ snipe-it: wait until settings table is seeded"
  ansible.builtin.shell:
    cmd: "container exec -i {{ SNIPE_IT_CONTAINER_ADDRESS }} php"
    stdin: "{{ lookup('file', 'php/wait_settings.php') }}"
  register: snipe_sso_settings_ready
  retries: 60
  delay: 5
  until: snipe_sso_settings_ready.rc == 0
  changed_when: false
  failed_when: snipe_sso_settings_ready.rc != 0

- name: "📌 snipe-it: apply trusted-header SSO configuration via Setting model"
  ansible.builtin.shell:
    cmd: >-
      container exec -i
      -e SNIPE_IT_SSO_ENABLED=1
      -e SNIPE_IT_SSO_HEADER_NAME={{ SNIPE_IT_SSO_HEADER_NAME | quote }}
      -e SNIPE_IT_SSO_LOGOUT_URL={{ SNIPE_IT_SSO_LOGOUT_URL | quote }}
      {{ SNIPE_IT_CONTAINER_ADDRESS }} php
    stdin: "{{ lookup('file', 'php/apply/sso_config.php') }}"
  changed_when: true

- name: "🧹 snipe-it: clear Laravel caches"
  ansible.builtin.shell:
    cmd: "container exec {{ SNIPE_IT_CONTAINER_ADDRESS }} php artisan optimize:clear"
  changed_when: true

- name: "🔒 snipe-it: the SSO header bridge logs in only proxy-secret requests"
  ansible.builtin.shell:
    cmd: >-
      container exec {{ SNIPE_IT_CONTAINER_ADDRESS }} sh -c
      '{{ 30 | curl }} -s -o /dev/null -w "%{http_code}" -H "X-Forwarded-Preferred-Username: $1" {{ item.proxy_header }} http://localhost/login'
      _ {{ lookup('users', IAM_PLATFORM_ADMIN_USER_KEY).username | quote }}
  loop:
    - { label: "forged header without the proxy secret", proxy_header: "", expected: "200" }
    - { label: "header with the proxy secret", proxy_header: '-H "{{ SNIPE_IT_SSO_PROXY_HEADER }}: $INFINITO_SSO_PROXY_SECRET"', expected: "302" }
  loop_control:
    label: "{{ item.label }}"
  register: snipe_it_sso_bridge_probe
  changed_when: false
  failed_when: snipe_it_sso_bridge_probe.stdout != item.expected