Merge ~pjdc/charm-k8s-mattermost/+git/charm-k8s-mattermost:sso into charm-k8s-mattermost:master

[Paul Collins]

add sso setting

[Paul Collins (pjdc)]

Note pre-req.

[🤖 Canonical IS Merge Bot (canonical-is-mergebot)]

This merge proposal is being monitored by mergebot. Change the status to Approved to merge.

[Tom Haddon (mthaddon)]

Two small comments inline

[🤖 Canonical IS Merge Bot (canonical-is-mergebot)]

Change cannot be self approved, setting status to needs review.

[Paul Collins (pjdc)]

review: Approve (self)

[🤖 Canonical IS Merge Bot (canonical-is-mergebot)]

Change cannot be self approved, setting status to needs review.

diff --git a/README.md b/README.md
index 7394b0f..8f5220c 100644
--- a/README.md
+++ b/README.md
@@ -67,3 +67,24 @@ know what the source addresses or address range is for the next step.
 
 (In the case of postgresql, `--via` is needed so that the charm can
 configure `pga_hba.conf` to let the k8s pods connect to the database.)
+
+## Authentication
+
+This charm supports configuring [Ubuntu SSO](https://login.ubuntu.com)
+as the authentication method.  This requires the following:
+
+ * a Mattermost Enterprise Edition licence to be obtained and activated
+ * a SAML config for the Mattermost installation to be added to `login.ubuntu.com`
+ * the SAML config will need to have a new certificate generated (refer to "Canonical RT#107985" when requesting this)
+    * this is because the default certificate available via the [SAML metadata URL](https://login.ubuntu.com/+saml/metadata) has expired
+ * the new certificate to be installed in the Mattermost database (see below)
+
+### Installing the SAML Identity Provider Certificate
+
+Invoke `psql` against the mattermost database on the current primary
+and use the following query to install the certificate:
+
+    INSERT INTO configurationfiles (name, createat, updateat, data)
+        VALUES ('saml-idp.crt', (extract(epoch from now()) * 1000)::bigint ,(extract(epoch from now()) * 1000)::bigint, $$-----BEGIN CERTIFICATE-----
+    [...]
+    -----END CERTIFICATE-----$$);
diff --git a/config.yaml b/config.yaml
index e15f8cd..ae1fbef 100644
--- a/config.yaml
+++ b/config.yaml
@@ -126,3 +126,10 @@ options:
 
           This requires configuration on the S3 side, as well as a suitable Mattermost licence.
         default: false
+    sso:
+        type: boolean
+        description: |
+          Whether to use Ubuntu SSO to log in.
+
+          This will not work unless the administrators of login.ubuntu.com have created a suitable SAML config first.
+        default: false
diff --git a/src/charm.py b/src/charm.py
index 9b0474d..2831af0 100755
--- a/src/charm.py
+++ b/src/charm.py
@@ -43,6 +43,8 @@ DATABASE_NAME = 'mattermost'
 LICENCE_SECRET_KEY_NAME = 'licence'
 REQUIRED_S3_SETTINGS = ['s3_bucket', 's3_region', 's3_access_key_id', 's3_secret_access_key']
 REQUIRED_SETTINGS = ['mattermost_image_path']
+REQUIRED_SSO_SETTINGS = ['licence', 'site_url']
+SAML_IDP_CRT = 'saml-idp.crt'
 
 
 class MattermostDBMasterAvailableEvent(EventBase):
@@ -214,7 +216,10 @@ class MattermostK8sCharm(CharmBase):
         if config['s3_enabled']:
             missing.extend([setting for setting in REQUIRED_S3_SETTINGS if not config[setting]])
 
-        return missing
+        if config['sso']:
+            missing.extend([setting for setting in REQUIRED_SSO_SETTINGS if not config[setting]])
+
+        return sorted(list(set(missing)))
 
     def _make_s3_pod_config(self):
         config = self.model.config
@@ -358,6 +363,34 @@ class MattermostK8sCharm(CharmBase):
 
         return pod_spec
 
+    def _update_pod_spec_for_sso(self, pod_spec):
+        config = self.model.config
+        if not config['sso'] or [setting for setting in REQUIRED_SSO_SETTINGS if not config[setting]]:
+            return pod_spec
+        pod_spec = copy.deepcopy(pod_spec)
+        site_hostname = urlparse(config['site_url']).hostname
+
+        pod_spec['containers'][0]['envConfig'].update({
+            'MM_SAMLSETTINGS_ENABLE': 'true',
+            'MM_SAMLSETTINGS_IDPURL': 'https://login.ubuntu.com/saml/',
+            'MM_SAMLSETTINGS_VERIFY': 'true',
+            'MM_SAMLSETTINGS_ENCRYPT': 'false',  # per POC
+            'MM_SAMLSETTINGS_IDPDESCRIPTORURL': 'https://login.ubuntu.com',
+            'MM_SAMLSETTINGS_IDPMETADATAURL': 'https://login.ubuntu.com/+saml/metadata',
+            'MM_SAMLSETTINGS_ASSERTIONCONSUMERSERVICEURL': 'https://{}/login/sso/saml'.format(site_hostname),
+            'MM_SAMLSETTINGS_LOGINBUTTONTEXT': 'Ubuntu SSO',
+            'MM_SAMLSETTINGS_EMAILATTRIBUTE': 'email',
+            'MM_SAMLSETTINGS_USERNAMEATTRIBUTE': 'username',
+            'MM_SAMLSETTINGS_IDATTRIBUTE': 'openid',
+            'MM_SAMLSETTINGS_FIRSTNAMEATTRIBUTE': 'fullname',
+            'MM_SAMLSETTINGS_LASTNAMEATTRIBUTE': '',
+            'MM_SAMLSETTINGS_IDPCERTIFICATEFILE': SAML_IDP_CRT,
+            # Otherwise we have to install xmlsec1 and Mattermost forks on every login(!).
+            'MM_EXPERIMENTALSETTINGS_USENEWSAMLLIBRARY': 'true',
+        })
+
+        return pod_spec
+
     def configure_pod(self, event):
         if not state_get('db_uri'):
             self.unit.status = WaitingStatus('Waiting for database relation')
@@ -378,6 +411,7 @@ class MattermostK8sCharm(CharmBase):
         pod_spec = self._update_pod_spec_for_k8s_ingress(pod_spec)
         pod_spec = self._update_pod_spec_for_licence(pod_spec)
         pod_spec = self._update_pod_spec_for_clustering(pod_spec)
+        pod_spec = self._update_pod_spec_for_sso(pod_spec)
 
         self.unit.status = MaintenanceStatus('Setting pod spec')
         self.model.pod.set_spec(pod_spec)
diff --git a/tests/unit/test_charm.py b/tests/unit/test_charm.py
index 8a970b6..7e8c809 100644
--- a/tests/unit/test_charm.py
+++ b/tests/unit/test_charm.py
@@ -20,6 +20,7 @@ CONFIG_IMAGE_NO_CREDS = {
     'mattermost_image_username': '',
     'mattermost_image_password': '',
     's3_enabled': False,
+    'sso': False,
 }
 
 CONFIG_IMAGE_NO_IMAGE = {
@@ -28,6 +29,7 @@ CONFIG_IMAGE_NO_IMAGE = {
     'mattermost_image_username': '',
     'mattermost_image_password': '',
     's3_enabled': False,
+    'sso': False,
 }
 
 CONFIG_IMAGE_NO_PASSWORD = {
@@ -36,6 +38,7 @@ CONFIG_IMAGE_NO_PASSWORD = {
     'mattermost_image_username': 'production',
     'mattermost_image_password': '',
     's3_enabled': False,
+    'sso': False,
 }
 
 CONFIG_NO_S3_SETTINGS_S3_ENABLED = {
@@ -49,6 +52,7 @@ CONFIG_NO_S3_SETTINGS_S3_ENABLED = {
     's3_region': '',
     's3_access_key_id': '',
     's3_secret_access_key': '',
+    'sso': False,
 }
 
 CONFIG_NO_S3_SETTINGS_S3_DISABLED_NO_DEFAULTS = {
@@ -57,6 +61,7 @@ CONFIG_NO_S3_SETTINGS_S3_DISABLED_NO_DEFAULTS = {
     'mattermost_image_username': '',
     'mattermost_image_password': '',
     's3_enabled': False,
+    'sso': False,
 }
 
 RANGE_BAD = '10.242.0.0/8,91.189.92.242/25'