Update UAA, document env-var override for server redirect-uri

uaa-server/README.md

@@ -18,15 +18,15 @@ docker run -it -p 8080:8080 --name steeltoe-uaa -v $pwd/uaa.yml:/uaa/uaa.yml ste
 
 ## Customizing for your Cloud Foundry environment
 
-These instructions will help you build and deploy a custom image to use as an identity provider for [Single Sign-On for VMware Tanzu Application Service](https://techdocs.broadcom.com/us/en/vmware-tanzu/platform-services/single-sign-on-for-tanzu/1-16/sso-tanzu/index.html):
-
-1. Clone this repository.
-1. (Operator task) Create an [identity zone](https://techdocs.broadcom.com/us/en/vmware-tanzu/platform/tanzu-platform-for-cloud-foundry/10-3/tpcf/t-uaa-uaa-concepts.html)
-1. Change the `redirect-uri` entry for `ssotile` in [uaa.yml](uaa.yml#132) to match your identity zone.
-1. (OPTIONAL) Customize the name of the image you're about to build by renaming the `uaa-server` directory
-1. `.\build.ps1 uaa-server`.
-1. Push the image to an image repository accessible from your Cloud Foundry environment.
-1. Deploy the image with a command similar to this:
-   * `cf push steeltoe-uaa --docker-image steeltoe.azurecr.io/uaa-server`
-1. (Operator task) [Add the new identity provider with OpenID Connect](https://techdocs.broadcom.com/us/en/vmware-tanzu/platform/single-sign-on/1-16/sso/configure-external-id.html#config-ext-prov)
+These instructions will help you deploy this image to use as an identity provider for Tanzu [Single Sign-On](https://techdocs.broadcom.com/us/en/vmware-tanzu/platform/single-sign-on/1-17/sso/index.html):
+
+1. (Operator task) Create an [identity zone](https://techdocs.broadcom.com/us/en/vmware-tanzu/platform/elastic-application-runtime/10-4/eart/t-uaa-uaa-concepts.html#iz) and note its auth domain (e.g. `https://<sso-plan>.login.<your-system-domain>`)
+   * Pick an all-lowercase, dash-separated identity provider name for this connection (e.g. `steeltoe-uaa`) — you'll use this same value in both of the next two steps
+1. Deploy the image, setting the `ssotile` client's `redirect-uri` to `<auth domain>/login/callback/<identity provider name>`. UAA always uses this fixed path for external OAuth/OIDC providers, and (as of UAA 78.15.0+) matches redirect URIs exactly, so wildcards like a trailing `/**` won't match:
+   * `cf push steeltoe-uaa --docker-image steeltoe.azurecr.io/uaa-server -m 1G --no-start`
+   * `cf set-env steeltoe-uaa UAA_CONFIG_YAML '{oauth: {clients: {ssotile: {redirect-uri: "https://<sso-plan>.login.<your-system-domain>/login/callback/steeltoe-uaa"}}}}'`
+   * `cf start steeltoe-uaa`
+1. (Operator task) [Add the new identity provider with OpenID Connect](https://techdocs.broadcom.com/us/en/vmware-tanzu/platform/single-sign-on/1-17/sso/configure-external-id.html#config-ext-prov), using the same name from step 2 for **Identity Provider Name**
    * Use the `ssotile` credentials from uaa.yml
+
+If you need to customize anything beyond `redirect-uri`, edit [uaa.yml](uaa.yml) and build your own image with `.\build.ps1 uaa-server`.

uaa-server/metadata/IMAGE_VERSION

@@ -1 +1 @@
-78.3.0
+79.7.0

uaa-server/uaa.yml

@@ -131,10 +131,7 @@
         - openid
         - profile
         description: Credentials for use with UAA server in Cloud Foundry environment
-
-        # CHANGE THIS VALUE TO MATCH YOUR ENVIRONMENT
-        redirect-uri: https://steeltoe.login.sys.dhaka.cf-app.com/**
-
+        redirect-uri: http://localhost:8080
         resource_ids: sampleapi.read
         scope: openid,profile,sampleapi.read
         secret: sso_secret