Merge lp:~roadmr/canonical-identity-provider/ssl-utilities into lp:canonical-identity-provider/release

[Daniel Manrique]

Add run-ssl makefile target and README instructions

This is preliminary to U2F-enablement work as U2F only works over a secure connection - this makes dev/testing on non-localhost easier/possible.

[Guillermo Gonzalez (verterok)]

LGTM

review: Approve

=== modified file 'Makefile'
--- Makefile	2019-04-30 19:14:58 +0000
+++ Makefile	2019-08-30 16:20:39 +0000
@@ -186,8 +186,15 @@
 	$(DJANGO_MANAGE) $(ARGS)
 
 run: ARGS=0.0.0.0:8000
+run: PID_ID=gunicorn
 run: collectstatic django-check  ## Start development server
-	$(ENV)/bin/gunicorn django_project.wsgi:application --workers=2 --reload --pid=logs/gunicorn.pid --bind=$(ARGS) --timeout=99999 --error-logfile=- --access-logfile=-
+	$(ENV)/bin/gunicorn django_project.wsgi:application --workers=2 --reload --pid=logs/$(PID_ID).pid --bind=$(ARGS) --timeout=99999 --error-logfile=- --access-logfile=- $(SSL_CONFIG)
+
+run-ssl: dev-sso.crt
+	$(MAKE) run SSL_CONFIG="--certfile=dev-sso.crt --keyfile=dev-sso.key --ssl-version 2" ARGS=0.0.0.0:8443 SSO_ROOT_URL=https://sso-xenial:8443 PID_ID=gunicorn-ssl
+
+dev-sso.crt:
+	openssl req -x509 -nodes -newkey rsa:4096 -keyout dev-sso.key -out dev-sso.crt -days 365 -subj '/CN=sso-xenial'
 
 start: bootstrap start-db
 
 
=== modified file 'README'
--- README	2019-03-13 20:49:20 +0000
+++ README	2019-08-30 16:20:39 +0000
@@ -242,6 +242,29 @@
 
        Add the output config (LP_API_URL etc.) to "../local_config/settings.py"
 
+14. (Optional) Use SSL for the development service
+
+     Testing some features on a development instance might require this: an
+     example is SAML because SAML only works over a secure connection.
+
+     There's a run-ssl target just for this. It will start the service on port
+     8443 with a self-signed certificate (which is created if it didn't exist).
+
+     Importantly, a non-ssl process must also be running ("make run") because
+     internal API communication goes over http.
+
+       $ # On one terminal/tmux window
+       $ make run
+       $ # On another terminal/tmux window
+       $ make run-ssl
+       $ # Test that SSL works
+       $ curl -k --head https://sso-xenial:8443
+         HTTP/1.1 200 OK
+
+     If the self-signed certificates are not enough for your purposes, you can
+     place any certificate in dev-sso.crt and its key in dev-sso.key in the
+     project's root and run-ssl will use those.
+
 
 BAZAAR
 ------