Upgrade Composer, use Composer to install SimpleSAMLphp, update Apache config templates

Author: V-Brooks

src/roles/apache-php/templates/httpd.conf.j2

@@ -448,8 +448,8 @@ Listen 8080
 
 	{% if saml_secret is defined -%}
 	# Use SimpleSamlPhp to handle authentication
-	Alias /simplesaml {{ m_simplesamlphp_path }}/www
-	<Directory {{ m_simplesamlphp_path }}/www>
+	Alias /simplesaml {{ m_simplesamlphp_path }}/public
+	<Directory {{ m_simplesamlphp_path }}/public>
 		Require all granted
 		Options All -Indexes
 	</Directory>

src/roles/apache-php/templates/php-fpm-httpd.conf.j2

@@ -448,8 +448,8 @@ Listen 8080
 
 	{% if saml_secret is defined -%}
 	# Use SimpleSamlPhp to handle authentication
-	Alias /simplesaml {{ m_simplesamlphp_path }}/www
-	<Directory {{ m_simplesamlphp_path }}/www>
+	Alias /simplesaml {{ m_simplesamlphp_path }}/public
+	<Directory {{ m_simplesamlphp_path }}/public>
 		Require all granted
 		Options All -Indexes
 	</Directory>

src/roles/composer/tasks/main.yml

@@ -28,9 +28,9 @@
   when: not composer_bin.stat.exists
 
 # Enforce composer 1.x per #1272. Per #1273 we should make Meza support Composer 2.x.
-- name: Set Composer to version 2.3.6
+- name: Set Composer to version 2.8.12
   shell: >
-    {{ php_executable }} {{ composer_path }} self-update 2.3.6
+    {{ php_executable }} {{ composer_path }} self-update 2.8.12
   register: composer_update
   changed_when: "'Updating to version' in composer_update.stdout"
   when: composer_keep_updated

src/roles/saml/tasks/main.yml

@@ -32,49 +32,82 @@
     recurse: yes
   when: simplesamlphp_exists.stat.exists and simplesamlphp_exists.stat.isdir
 
-- name: Get simplesamlphp tarball
-  become: yes
-  become_user: "meza-ansible"
-  get_url:
-    url: "https://github.com/simplesamlphp/simplesamlphp/releases/download/v{{ simplesamlphp_version }}/simplesamlphp-{{ simplesamlphp_version }}.tar.gz"
-    dest: "{{ m_home }}/meza-ansible/"
-  register: new_simplesamlphp_archive
-
-- name: Remove simplesamlphp directory if new version available
+- name: "Create {{ m_simplesamlphp_path }} if it doesn't exist"
   file:
     path: "{{ m_simplesamlphp_path }}"
-    state: absent
-  when: new_simplesamlphp_archive.changed
+    state: directory
+    owner: "{{ m_simplesamlphp_owner }}"
+    group: "{{ m_simplesamlphp_group }}"
+    mode: "{{ m_simplesamlphp_mode }}"
 
-# Do this check again now in case the above command removed the directory, but something went
-# wrong and it was never created (script crashed). Without this check the deploy could be put
-# in a state where it might never recreate SimpleSamlPhp
-- name: "Check if {{ m_simplesamlphp_path }} exists again"
+- name: Check if SimpleSAMLphp is already installed with correct version
   stat:
-    path: "{{ m_simplesamlphp_path }}"
-  register: simplesamlphp_exists2
-
-- name: "Create empty directory for {{ m_simplesamlphp_path }} if installing new version"
+    path: "{{ m_simplesamlphp_path }}/composer.json"
+  register: simplesamlphp_composer
+
+- name: Check current SimpleSAMLphp version if installed
+  shell: |
+    if [ -f "{{ m_simplesamlphp_path }}/composer.lock" ]; then
+      grep -A 3 '"name": "simplesamlphp/simplesamlphp"' {{ m_simplesamlphp_path }}/composer.lock | grep '"version"' | head -1 | cut -d'"' -f4
+    else
+      echo "not_installed"
+    fi
+  register: current_ssp_version
+  changed_when: false
+  when: simplesamlphp_composer.stat.exists
+
+- name: Install SimpleSAMLphp {{ simplesamlphp_version }} via Composer (fresh install)
+  become: yes
+  become_user: "{{ m_simplesamlphp_owner }}"
+  composer:
+    command: create-project
+    arguments: simplesamlphp/simplesamlphp:{{ simplesamlphp_version }} .
+    working_dir: "{{ m_simplesamlphp_path }}"
+    no_dev: no
+  when: not simplesamlphp_composer.stat.exists
+
+- name: Update SimpleSAMLphp to {{ simplesamlphp_version }} via Composer
+  become: yes
+  become_user: "{{ m_simplesamlphp_owner }}"
+  composer:
+    command: require
+    arguments: simplesamlphp/simplesamlphp:{{ simplesamlphp_version }}
+    working_dir: "{{ m_simplesamlphp_path }}"
+    no_dev: no
+  when: 
+    - simplesamlphp_composer.stat.exists
+    - current_ssp_version.stdout != simplesamlphp_version
+    - current_ssp_version.stdout != "v{{ simplesamlphp_version }}"
+
+- name: Ensure required SimpleSAMLphp directories exist
   file:
-    path: "{{ m_simplesamlphp_path }}"
+    path: "{{ m_simplesamlphp_path }}/{{ item }}"
     state: directory
     owner: "{{ m_simplesamlphp_owner }}"
     group: "{{ m_simplesamlphp_group }}"
-    mode: "{{ m_simplesamlphp_mode }}"
-  when: not simplesamlphp_exists2.stat.exists
+    mode: "0755"
+  loop:
+    - config
+    - metadata
+    - log
+    - cache
+    - cert
+
+- name: Ensure log directory is writable
+  file:
+    path: "{{ m_simplesamlphp_path }}/log"
+    state: directory
+    owner: "{{ m_simplesamlphp_owner }}"
+    group: "{{ m_simplesamlphp_group }}"
+    mode: "0775"
 
-- name: Unarchive simplesamlphp tarball if new
-  become: yes
-  unarchive:
-    src: "{{ m_home }}/meza-ansible/simplesamlphp-{{ simplesamlphp_version }}.tar.gz"
-    dest: "{{ m_simplesamlphp_path }}"
+- name: Ensure cache directory is writable
+  file:
+    path: "{{ m_simplesamlphp_path }}/cache"
+    state: directory
     owner: "{{ m_simplesamlphp_owner }}"
     group: "{{ m_simplesamlphp_group }}"
-    mode: "{{ m_simplesamlphp_mode }}"
-    remote_src: yes
-    extra_opts:
-      - "--strip-components=1"
-  when: not simplesamlphp_exists2.stat.exists or new_simplesamlphp_archive.changed
+    mode: "0775"
 
 - name: Ensure Extension:PluggableAuth installed
   become: yes