Merge develop into main

.env

@@ -44,11 +44,13 @@ ADMIN_OIDC_METADATA_URL=
 ADMIN_OIDC_CLIENT_ID=
 ADMIN_OIDC_CLIENT_SECRET=
 ADMIN_OIDC_REDIRECT_ROUTE=default
+ADMIN_OIDC_ALLOW_HTTP=false
 
 BOARD_MEMBER_OIDC_METADATA_URL=
 BOARD_MEMBER_OIDC_CLIENT_ID=
 BOARD_MEMBER_OIDC_CLIENT_SECRET=
 BOARD_MEMBER_OIDC_REDIRECT_ROUTE=authenticate-board-member
+BOARD_MEMBER_OIDC_ALLOW_HTTP=false
 
 CLI_REDIRECT=default
 LEEWAY=10

CHANGELOG.md

@@ -10,6 +10,18 @@ about writing changes to this log.
 
 ## [Unreleased]
 
+- [PR-377](https://github.com/itk-dev/naevnssekretariatet/pull/377)
+  Improved `tvist1:digital-post-envelope:list` command and added Digital post
+  debug command.
+- [PR-382](https://github.com/itk-dev/naevnssekretariatet/pull/382)
+  Added `--digital-post-id` filter on `tvist1:digital-post-envelope:list`.
+- [PR-380](https://github.com/itk-dev/naevnssekretariatet/pull/380)
+  Updated `itk-dev/openid-connect-bundle` to use authorization code flow.
+- [PR-380](https://github.com/itk-dev/naevnssekretariatet/pull/380)
+  Added [OpenId Connect Server
+  Mock](https://github.com/Soluto/oidc-server-mock) for mocking
+  OIDC IdPs during development.
+
 ## [1.5.3] - 2023-12-19
 
 - [PR-377](https://github.com/itk-dev/naevnssekretariatet/pull/377)

README.md

@@ -103,26 +103,92 @@ must be done in order to login via Azure B2C:
 
 ```sh
 ###> itk-dev/openid-connect-bundle ###
-CONFIGURATION_URL=APP_CONFIGURATION_URL
-CLIENT_ID=APP_CLIENT_ID
-CLIENT_SECRET=APP_CLIENT_SECRET
-CALLBACK_URI=APP_CALLBACK_URI
-CLI_REDIRECT=APP_CLI_REDIRECT_URI
+ADMIN_OIDC_METADATA_URL=APP_ADMIN_ADMIN_OIDC_METADATA_URL
+ADMIN_OIDC_CLIENT_ID=APP_ADMIN_CLIENT_ID
+ADMIN_OIDC_CLIENT_SECRET=APP_ADMIN_CLIENT_SECRET
+ADMIN_OIDC_REDIRECT_ROUTE=APP_ADMIN_CLI_REDIRECT_ROUTE
+ADMIN_OIDC_ALLOW_HTTP=false # Set to true if mocking IdP
+
+BOARD_MEMBER_OIDC_METADATA_URL=APP_BOARD_MEMBER_OIDC_METADATA_URL
+BOARD_MEMBER_OIDC_CLIENT_ID=APP_BOARD_MEMBER_OIDC_CLIENT_ID
+BOARD_MEMBER_OIDC_CLIENT_SECRET=APP_BOARD_MEMBER_OIDC_CLIENT_SECRET
+BOARD_MEMBER_OIDC_REDIRECT_ROUTE=APP_BOARD_MEMBER_OIDC_REDIRECT_ROUTE
+BOARD_MEMBER_OIDC_ALLOW_HTTP=false # Set to true if mocking OIDC IdP
+
 LEEWAY=APP_LEEWAY
 ###< itk-dev/openid-connect-bundle ###
 ```
 
 Example configuration:
 
 ```sh
-CONFIGURATION_URL='https://.../.well-known/openid-configuration...'
-CLIENT_ID={app.client.id}
-CLIENT_SECRET={app.client.secret}
-CALLBACK_URI={app.callback.uri}
-CLI_REDIRECT={app.cli.redirect}
+ADMIN_OIDC_METADATA_URL='https://.../.well-known/openid-configuration...'
+ADMIN_OIDC_CLIENT_ID={app.admin.client.id}
+ADMIN_OIDC_CLIENT_SECRET={app.admin.client.secret}
+ADMIN_OIDC_REDIRECT_ROUTE={app.admin.cli.redirect}
+ADMIN_OIDC_ALLOW_HTTP=false # Set to true if mocking OIDC IdP
+
+BOARD_MEMBER_OIDC_METADATA_URL='https://.../.well-known/openid-configuration...'
+BOARD_MEMBER_OIDC_CLIENT_ID={app.board.client.id}
+BOARD_MEMBER_OIDC_CLIENT_SECRET={app.board.client.secret}
+BOARD_MEMBER_OIDC_REDIRECT_ROUTE={app.board.cli.redirect}
+BOARD_MEMBER_OIDC_ALLOW_HTTP=false # Set to true if mocking OIDC IdP
+
 LEEWAY=10
 ```
 
+#### Mocking OpenID Connect IdP for local development
+
+We use [OpenId Connect Server Mock](https://github.com/Soluto/oidc-server-mock).
+
+**Note**: The following assumes that [the itkdev-docker-compose helper
+script](https://github.com/itk-dev/devops_itkdev-docker#helper-scripts) is used
+for development.
+
+Start docker compose show with the `test`
+[profile](https://docs.docker.com/compose/profiles/):
+
+```sh
+docker compose --profile test up --detach
+```
+
+Remember to add `--profile test` when stopping (or downing) to stop (or down)
+all containers:
+
+```sh
+docker compose --profile test stop
+```
+
+See [`docker-compose.override.yml`](docker-compose.override.yml) for
+the configuration of the mocked IdPs (`idp-admin` and `idp-board-member`).
+
+Simply overwrite the above variables as such
+
+```sh
+ADMIN_OIDC_METADATA_URL='http://idp-admin.naevnssekretariatet.local.itkdev.dk/.well-known/openid-configuration'
+ADMIN_OIDC_CLIENT_ID='client-id'
+ADMIN_OIDC_CLIENT_SECRET='client-secret'
+ADMIN_OIDC_REDIRECT_ROUTE=default
+ADMIN_OIDC_ALLOW_HTTP=true
+
+BOARD_MEMBER_OIDC_METADATA_URL='http://idp-board-member.naevnssekretariatet.local.itkdev.dk/.well-known/openid-configuration'
+BOARD_MEMBER_OIDC_CLIENT_ID='client-id'
+BOARD_MEMBER_OIDC_CLIENT_SECRET='client-secret'
+BOARD_MEMBER_OIDC_REDIRECT_ROUTE=authenticate-board-member
+BOARD_MEMBER_OIDC_ALLOW_HTTP=true
+```
+
+And you should be redirected to the mocked IdP. Here you can
+sign in with the configured users. See `USERS_CONFIGURATION_INLINE` in
+[`docker-compose.override.yml`](docker-compose.override.yml). This is
+also where any modifying of claims and users can be done. Run
+
+```sh
+docker compose up -d
+```
+
+to reload the mock OIDC IdP configuration.
+
 #### CLI login
 
 In order to use the CLI login feature the following

composer.json

@@ -36,8 +36,8 @@
         "itk-dev/azure-key-vault-php": "^1.0",
         "itk-dev/beskedfordeler-symfony": "^1.0",
         "itk-dev/datafordeler-php-client": "^1.0",
-        "itk-dev/openid-connect-bundle": "^2.0",
-        "itk-dev/serviceplatformen": "dev-feature/tvist1",
+        "itk-dev/openid-connect-bundle": "^3.1",
+        "itk-dev/serviceplatformen": "^1.5",
         "knplabs/knp-paginator-bundle": "^5.6",
         "league/oauth2-client": "^2.6",
         "lexik/form-filter-bundle": "^7.0",