---
#-
# name: "Copying the shibboleth files"
# template: src=files/{{ item.src }} dest="{{ item.dest }}" mode=0644
# with_items: shibboleth_file
# become: true

-
  name: "Setting shibboleth2.xml sp.example.org"
  become: true
  replace:
  args:
   dest: /etc/shibboleth/shibboleth2.xml
   regexp: sp.example.org
   replace: "{{ ansible_hostname }}.{{ domain }}"
   backup: yes

-
 name: "Remove SSO entityID"
 lineinfile:
 args:
   dest: /etc/shibboleth/shibboleth2.xml
   regexp: '^(\s*)<SSO entityID="https://idp.example.org/idp/shibboleth"'
   line: '\1<SSO'
   backrefs: true
 become: true

-
  name: "Setting shibboleth2.xml handlerSSL"
  become: true
  replace:
  args:
   dest: /etc/shibboleth/shibboleth2.xml
   regexp: 'handlerSSL="false"'
   replace: 'handlerSSL="true"   handlerURL="https://{{ ansible_hostname }}.{{ domain }}/Shibboleth.sso"'


-
  name: "Setting shibboleth2.xml supportContact"
  become: true
  replace:
  args:
   dest: /etc/shibboleth/shibboleth2.xml
   regexp: 'supportContact="root@localhost"'
   replace: 'supportContact="{{ admin_email }}"'


-
  name: "Enabling MetadataProvider"
  become: true
  replace:
  args:
   dest: /etc/shibboleth/shibboleth2.xml
   regexp: '<!-- Example of remotely supplied batch of signed metadata. -->\s+<!--\s+<MetadataProvider'
   replace: '<!-- Example of remotely supplied batch of signed metadata. -->\n\t<MetadataProvider'

-
  name: "Enabling MetadataProvider"
  become: true
  replace:
  args:
   dest: /etc/shibboleth/shibboleth2.xml
   regexp: '</MetadataProvider>\s+-->'
   replace: '</MetadataProvider>'
-
  name: "Setting shibboleth2.xml Federation URI"
  become: true
  replace:
  args:
   dest: /etc/shibboleth/shibboleth2.xml
   regexp: 'uri="http://federation.org/federation-metadata.xml"'
   replace: 'uri="{{ aaf_federation_url }}/metadata.aaf.signed.complete.xml"'

-
  name: "Setting shibboleth2.xml backingFilePath"
  become: true
  replace:
  args:
   dest: /etc/shibboleth/shibboleth2.xml
   regexp: 'backingFilePath="federation-metadata.xml"'
   replace: 'backingFilePath="metadata.aaf.xml"'

- name: copy AAF metadata cert
  copy: src=files/{{ shib_metadata_cert }} dest=/etc/shibboleth/aaf-metadata-cert.pem mode=644
  become: true


- name: "Setting shibboleth2.xml aaf Certificate"
  become: true
  replace:
  args:
   dest: /etc/shibboleth/shibboleth2.xml
   regexp: 'type="Signature" certificate="fedsigner.pem"'
   replace: 'type="Signature" certificate="aaf-metadata-cert.pem"'

-
  name: "Setting shibboleth2.xml AAF Discovery URL"
  become: true
  replace:
  args:
   dest: /etc/shibboleth/shibboleth2.xml
   regexp: 'discoveryURL=".*"'
   replace: 'discoveryURL="{{ aaf_discovery_url }}"'

- name: make shib private directory
  file: path=/etc/shibboleth/private state=directory mode=700 owner="_shibd"
  become: true

- name: copy shib key
  become: true
  copy: src=files/{{ shib_key }} dest=/etc/shibboleth/private/{{ shib_key }} owner="_shibd" mode=600

- name: make shib certs directory
  file: path=/etc/shibboleth/certs state=directory mode=755 owner="_shibd"
  become: true

- name: copy shib cert
  become: true
  copy: src=files/{{ shib_cert }} dest=/etc/shibboleth/certs/{{ shib_cert }} owner="_shibd" mode=644

-
  name: "Setting shibboleth2.xml Credential Resolver"
  become: true
  replace:
  args:
   dest: /etc/shibboleth/shibboleth2.xml
   regexp: '<CredentialResolver type="File" key=".*" certificate=".*"/>'
   replace: '<CredentialResolver type="File" key="/etc/shibboleth/private/{{ shib_key }}" certificate="/etc/shibboleth/certs/{{ shib_cert }}"/>'

-
 name: "Templating attribute-map.xml"
 become: true
 template:
 args:
   src: attribute-map.xml.j2
   dest: /etc/shibboleth/attribute-map.xml
 notify:
   - Restarting Apache
   - Restarting shibboleth
-
 name: "Starting shibboleth"
 become: true
 service: name=shibd state=started enabled=yes
