From e7e74c2e4c42c8ba6b247d56b414d0f3175bf0bf Mon Sep 17 00:00:00 2001 From: Okke Harsta Date: Tue, 25 Aug 2026 15:17:34 +0200 Subject: [PATCH 01/11] Fix for https://github.com/OpenConext/OpenConext-myconext/issues/1170 --- roles/myconext/templates/application.yml.j2 | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/roles/myconext/templates/application.yml.j2 b/roles/myconext/templates/application.yml.j2 index 70a23da11..0bf1740d5 100644 --- a/roles/myconext/templates/application.yml.j2 +++ b/roles/myconext/templates/application.yml.j2 @@ -133,6 +133,10 @@ feature: allow_location: "classpath:/deny-allow/allowed.json" # Do we allow the create-from-institution flow create_eduid_institution_enabled: {{ myconext.feature_create_eduid_institution_enabled }} + # Do we email the eduID account when an institutional account gets linked to it + send_link_notification_to_eduid_account: True + # Do we email the institutional account when it gets linked to an eduID account + send_link_notification_to_linked_account: True # Do we show the landing page for the create-from-institution flow create_eduid_institution_landing: {{ myconext.feature_create_eduid_institution_landing }} # Do we default remember the user for a longer period From a15895f804d72c3c07528e02c2e44a5e74f03b68 Mon Sep 17 00:00:00 2001 From: Okke Harsta Date: Fri, 28 Aug 2026 11:19:22 +0200 Subject: [PATCH 02/11] Log full authentication details in DEBUG mode --- roles/mujina-idp/templates/logback.xml.j2 | 1 + roles/mujina-sp/templates/logback.xml.j2 | 3 ++- 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/roles/mujina-idp/templates/logback.xml.j2 b/roles/mujina-idp/templates/logback.xml.j2 index 1c2ddfb3b..6a725649d 100644 --- a/roles/mujina-idp/templates/logback.xml.j2 +++ b/roles/mujina-idp/templates/logback.xml.j2 @@ -8,6 +8,7 @@ + diff --git a/roles/mujina-sp/templates/logback.xml.j2 b/roles/mujina-sp/templates/logback.xml.j2 index 1c2ddfb3b..afbd5a39b 100644 --- a/roles/mujina-sp/templates/logback.xml.j2 +++ b/roles/mujina-sp/templates/logback.xml.j2 @@ -8,7 +8,8 @@ - + + From 482f3b60a83bd127a2b8bab1f8b1f072b85323de Mon Sep 17 00:00:00 2001 From: Okke Harsta Date: Fri, 28 Aug 2026 13:41:12 +0200 Subject: [PATCH 03/11] Use JRE Alpine image instead of JDK --- roles/mujina-sp/templates/logback.xml.j2 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/mujina-sp/templates/logback.xml.j2 b/roles/mujina-sp/templates/logback.xml.j2 index afbd5a39b..6a725649d 100644 --- a/roles/mujina-sp/templates/logback.xml.j2 +++ b/roles/mujina-sp/templates/logback.xml.j2 @@ -9,7 +9,7 @@ - + From b0eb46d1fc5a7f33872ac7a2a4c56c438af9394c Mon Sep 17 00:00:00 2001 From: Okke Harsta Date: Fri, 28 Aug 2026 14:38:55 +0200 Subject: [PATCH 04/11] New metadata field: eduIDInstitutionGuid See https://github.com/OpenConext/OpenConext-myconext/issues/1169 --- .../metadata_configuration/oidc10_rp.schema.json.j2 | 5 +++++ .../metadata_configuration/saml20_idp.schema.json.j2 | 5 +++++ .../metadata_configuration/saml20_sp.schema.json.j2 | 5 +++++ 3 files changed, 15 insertions(+) diff --git a/roles/manage/templates/metadata_configuration/oidc10_rp.schema.json.j2 b/roles/manage/templates/metadata_configuration/oidc10_rp.schema.json.j2 index d7f47571c..91c784400 100644 --- a/roles/manage/templates/metadata_configuration/oidc10_rp.schema.json.j2 +++ b/roles/manage/templates/metadata_configuration/oidc10_rp.schema.json.j2 @@ -372,6 +372,11 @@ "format": "uuid", "info": "This is a 128 bit number also known as a globally unique identifier (GUID or UUID) for this service." }, + "eduIDInstitutionGuid": { + "type": "string", + "format": "uuid", + "info": "This is a 128 bit number used in the eduID generation for this service." + }, "coin:no_consent_required": { "type": "boolean", "info": "Select this option to skip the consent for a user.", diff --git a/roles/manage/templates/metadata_configuration/saml20_idp.schema.json.j2 b/roles/manage/templates/metadata_configuration/saml20_idp.schema.json.j2 index a4930372f..a47dd26e5 100644 --- a/roles/manage/templates/metadata_configuration/saml20_idp.schema.json.j2 +++ b/roles/manage/templates/metadata_configuration/saml20_idp.schema.json.j2 @@ -313,6 +313,11 @@ "format": "uuid", "info": "This is a 128 bit number also known as a globally unique identifier (GUID or UUID) for this Identity Provider." }, + "eduIDInstitutionGuid": { + "type": "string", + "format": "uuid", + "info": "This is a 128 bit number used in the eduID generation for this service." + }, "coin:institution_type": { "type": "string", "info": "Client category this institution belongs to." diff --git a/roles/manage/templates/metadata_configuration/saml20_sp.schema.json.j2 b/roles/manage/templates/metadata_configuration/saml20_sp.schema.json.j2 index 9914fbef1..06fae95c6 100644 --- a/roles/manage/templates/metadata_configuration/saml20_sp.schema.json.j2 +++ b/roles/manage/templates/metadata_configuration/saml20_sp.schema.json.j2 @@ -459,6 +459,11 @@ "format": "uuid", "info": "This is a 128 bit number also known as a globally unique identifier (GUID or UUID) for this service." }, + "eduIDInstitutionGuid": { + "type": "string", + "format": "uuid", + "info": "This is a 128 bit number used in the eduID generation for this service." + }, "coin:trusted_proxy": { "type": "boolean", "default": false, From b887e3a2f60d76d205434d76175e31112fe43553 Mon Sep 17 00:00:00 2001 From: Okke Harsta Date: Fri, 28 Aug 2026 15:07:48 +0200 Subject: [PATCH 05/11] IdP does not need eduIDInstitutionGuid --- .../metadata_configuration/saml20_idp.schema.json.j2 | 5 ----- 1 file changed, 5 deletions(-) diff --git a/roles/manage/templates/metadata_configuration/saml20_idp.schema.json.j2 b/roles/manage/templates/metadata_configuration/saml20_idp.schema.json.j2 index a47dd26e5..a4930372f 100644 --- a/roles/manage/templates/metadata_configuration/saml20_idp.schema.json.j2 +++ b/roles/manage/templates/metadata_configuration/saml20_idp.schema.json.j2 @@ -313,11 +313,6 @@ "format": "uuid", "info": "This is a 128 bit number also known as a globally unique identifier (GUID or UUID) for this Identity Provider." }, - "eduIDInstitutionGuid": { - "type": "string", - "format": "uuid", - "info": "This is a 128 bit number used in the eduID generation for this service." - }, "coin:institution_type": { "type": "string", "info": "Client category this institution belongs to." From 7f0b31f56bc2dd673af2d37ce694c7fa7c66c696 Mon Sep 17 00:00:00 2001 From: Okke Harsta Date: Wed, 2 Sep 2026 11:33:19 +0200 Subject: [PATCH 06/11] Disable SSL healthcheck --- roles/myconext/templates/application.yml.j2 | 3 +++ 1 file changed, 3 insertions(+) diff --git a/roles/myconext/templates/application.yml.j2 b/roles/myconext/templates/application.yml.j2 index 0bf1740d5..fa171e363 100644 --- a/roles/myconext/templates/application.yml.j2 +++ b/roles/myconext/templates/application.yml.j2 @@ -371,6 +371,9 @@ management: access: none metrics: access: unrestricted + health: + ssl: + enabled: false info: git: mode: full From d8005f9434925ca078bbd369781a734fc6bd56dd Mon Sep 17 00:00:00 2001 From: Okke Harsta Date: Wed, 2 Sep 2026 15:03:37 +0200 Subject: [PATCH 07/11] Always return 200 in health --- roles/myconext/templates/application.yml.j2 | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/roles/myconext/templates/application.yml.j2 b/roles/myconext/templates/application.yml.j2 index fa171e363..b684ae1db 100644 --- a/roles/myconext/templates/application.yml.j2 +++ b/roles/myconext/templates/application.yml.j2 @@ -365,6 +365,12 @@ management: health: access: unrestricted show-details: always + status: + http-mapping: + down: 200 + out_of_service: 200 + unknown: 200 + warning: 200 prometheus: access: read_only mappings: From 72cb9a2a71fb7c3727ee4160079a083e391a0315 Mon Sep 17 00:00:00 2001 From: Okke Harsta Date: Thu, 3 Sep 2026 09:53:07 +0200 Subject: [PATCH 08/11] Desperate try... --- roles/myconext/templates/application.yml.j2 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/myconext/templates/application.yml.j2 b/roles/myconext/templates/application.yml.j2 index b684ae1db..3b9d4263f 100644 --- a/roles/myconext/templates/application.yml.j2 +++ b/roles/myconext/templates/application.yml.j2 @@ -368,7 +368,7 @@ management: status: http-mapping: down: 200 - out_of_service: 200 + out-of-service: 200 unknown: 200 warning: 200 prometheus: From fe63f9f52ea4233df8728635976e54619e126f07 Mon Sep 17 00:00:00 2001 From: Okke Harsta Date: Thu, 3 Sep 2026 10:27:30 +0200 Subject: [PATCH 09/11] Remove readinessstate --- roles/myconext/templates/application.yml.j2 | 2 ++ 1 file changed, 2 insertions(+) diff --git a/roles/myconext/templates/application.yml.j2 b/roles/myconext/templates/application.yml.j2 index 3b9d4263f..fce98037f 100644 --- a/roles/myconext/templates/application.yml.j2 +++ b/roles/myconext/templates/application.yml.j2 @@ -380,6 +380,8 @@ management: health: ssl: enabled: false + readinessstate: + enabled: false info: git: mode: full From fc8eca2c843d59b202179819fb36fa0c5e7a5b70 Mon Sep 17 00:00:00 2001 From: Okke Harsta Date: Thu, 3 Sep 2026 11:45:07 +0200 Subject: [PATCH 10/11] Fix for probes --- roles/myconext/templates/application.yml.j2 | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/roles/myconext/templates/application.yml.j2 b/roles/myconext/templates/application.yml.j2 index fce98037f..1dd48f484 100644 --- a/roles/myconext/templates/application.yml.j2 +++ b/roles/myconext/templates/application.yml.j2 @@ -371,6 +371,8 @@ management: out-of-service: 200 unknown: 200 warning: 200 + probes: + enabled: false prometheus: access: read_only mappings: @@ -378,10 +380,10 @@ management: metrics: access: unrestricted health: - ssl: - enabled: false - readinessstate: - enabled: false + ssl: + enabled: false + readinessstate: + enabled: off info: git: mode: full From 3e2e5ebcc3a94571311db493a657964645061832 Mon Sep 17 00:00:00 2001 From: Ricardo van der Heijden <20791917+ricardovdheijden@users.noreply.github.com> Date: Thu, 3 Sep 2026 12:06:13 +0200 Subject: [PATCH 11/11] #648 Adds mijn-myconext to the template, applies for all environments --- roles/myconext/templates/application.yml.j2 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/myconext/templates/application.yml.j2 b/roles/myconext/templates/application.yml.j2 index 1dd48f484..d48a72d10 100644 --- a/roles/myconext/templates/application.yml.j2 +++ b/roles/myconext/templates/application.yml.j2 @@ -172,7 +172,7 @@ feature: use_global_uid: {{ myconext.feature_use_global_uid }} # SP entityIds that always receive the global uid in the uid and eduPersonPrincipalName SAML attributes, # even when use_global_uid is false. - force_global_uid_entities: "{{ myconext.feature_force_global_uid_entities }}" + force_global_uid_entities: {{ myconext.feature_force_global_uid_entities + ['mijn.' + myconext_base_domain] }} default_affiliate_email_domain: eduid.nl