From 35751e3cf89abf69f11dff7f9a3396d8068becc8 Mon Sep 17 00:00:00 2001 From: Markus Krogh Date: Fri, 29 Sep 2017 17:42:03 +0200 Subject: Use ENV for persistentiId, logging --- compose-prod.yml | 22 ++ idp/Dockerfile | 8 +- idp/shib-entrypoint.sh | 64 ++++- idp/template-config/attribute-filter.xml | 384 ++++++++++++++++--------- idp/template-config/attribute-resolver.xml | 225 ++++++--------- idp/template-config/edupersontargetdid.xml.add | 16 ++ idp/template-config/logback.xml | 199 +++++++++++++ 7 files changed, 651 insertions(+), 267 deletions(-) create mode 100644 compose-prod.yml create mode 100644 idp/template-config/edupersontargetdid.xml.add create mode 100644 idp/template-config/logback.xml diff --git a/compose-prod.yml b/compose-prod.yml new file mode 100644 index 0000000..b3094d2 --- /dev/null +++ b/compose-prod.yml @@ -0,0 +1,22 @@ +version: '3' +services: + shibboleth-docker: + build: ./idp + environment: + - JAVA_OPTIONS=-Xmx1G + - IDP_HOSTNAME=idp.nordu.net + - IDP_SCOPE=nordu.net + - IDP_DEBUG=true + env_file: ./data/production/env + volumes: + - ./data/production/idp-data:/opt/data + nginx: + image: nginx + volumes: + - ./data/production/certs:/opt/certs + - ./data/production/nginx:/etc/nginx/conf.d + links: + - shibboleth-docker + ports: + - '80:80' + - '443:443' diff --git a/idp/Dockerfile b/idp/Dockerfile index 3dd2d6c..908233f 100644 --- a/idp/Dockerfile +++ b/idp/Dockerfile @@ -1,7 +1,7 @@ FROM jetty:9-alpine -EXPOSE 80 443 MAINTAINER Jesper B. Rosenkilde +USER root ENV IDP_VERSION 3.3.0 COPY install.properties /opt/ COPY nordu-ldap.properties /opt/ @@ -10,7 +10,7 @@ COPY shibboleth-identity-provider-${IDP_VERSION}.tar.gz /opt/ COPY template-config/ /opt/template-config COPY shibboleth.db.ddl /tmp/ WORKDIR /opt -RUN apk --no-cache add bash apache-ant sqlite curl && \ +RUN echo $(id) && apk --no-cache add bash apache-ant sqlite curl && \ #curl -O https://shibboleth.net/downloads/identity-provider/${IDP_VERSION}/shibboleth-identity-provider-${IDP_VERSION}.tar.gz && \ sha256sum -c shibboleth-identity-provider-$IDP_VERSION.tar.gz.sha256 && \ tar xf shibboleth-identity-provider-$IDP_VERSION.tar.gz && \ @@ -28,5 +28,7 @@ RUN chown -R jetty:jetty /opt/shibboleth-idp COPY jetty_base $JETTY_BASE COPY shib-entrypoint.sh /shib-entrypoint.sh -ENTRYPOINT /shib-entrypoint.sh +USER jetty +ENTRYPOINT ["/shib-entrypoint.sh"] WORKDIR $JETTY_BASE +CMD ["java","-jar","/usr/local/jetty/start.jar"] diff --git a/idp/shib-entrypoint.sh b/idp/shib-entrypoint.sh index eec7dcd..7803c11 100755 --- a/idp/shib-entrypoint.sh +++ b/idp/shib-entrypoint.sh @@ -6,4 +6,66 @@ if [ -f /metadata/sp-metadata.xml ]; then sed -i -e '/sp.nordu.dev/ s///' /opt/shibboleth-idp/conf/metadata-providers.xml fi -/docker-entrypoint.sh "$@" +IDP_PROPERTIES=${IDP_PROPERTIES:-/opt/shibboleth-idp/conf/idp.properties} +if [ -n "$IDP_HOSTNAME" ]; then + sed -i -e "s/idp.nordu.dev/$IDP_HOSTNAME/" $IDP_PROPERTIES +fi +if [ -n "$IDP_SCOPE" ]; then + sed -i -e "/idp.scope=/ s/nordu.dev/$IDP_HOSTNAME/" $IDP_PROPERTIES +fi + +# FTICKS +if [ -n "$FTICKS_FEDERATION" ]; then + sed -i -e '/idp.fticks.federation=/ s/^#//' \ + -e "/idp.fticks.federation=/ s/MyFederation/$FTICKS_FEDERATION/" \ + -e '/idp.fticks.algorithm=/ s/^#//' $IDP_PROPERTIES + if [ -n "$FTICKS_SALT" ]; then + sed -i -e '/idp.fticks.salt=/ s/^#//' \ + -e "/idp.fticks.salt=/ s/=.*/=$FTICKS_SALT/" $IDP_PROPERTIES + fi + + if [ -n "$FTICKS_HOST" ]; then + sed -i -e '/idp.fticks.loghost=/ s/^#//' \ + -e "/idp.fticks.loghost=/ s/=.*/=$FTICKS_HOST/" $IDP_PROPERTIES + fi + if [ -n "$FTICKS_PORT" ]; then + sed -i -e '/idp.fticks.logport=/ s/^#//' \ + -e "/idp.fticks.logport=/ s/=.*/=$FTICKS_PORT/" $IDP_PROPERTIES + fi +fi + +# PersistentID + +if [ -n "$IDP_PERSISTENTID_SALT" ]; then + if ! grep '' /opt/shibboleth-idp/conf/saml-nameid.xml ; then + sed -i -e '// a ' /opt/shibboleth-idp/conf/saml-nameid.xml + fi + + source_attr=${IDP_PERSISTENTID_SOURCE:-uid} + sed -i -e '/idp.persistentId.sourceAttribute/ s/^#//' \ + -e "/idp.persistentId.sourceAttribute/ s/changethistosomethingreal/$source_attr/" \ + -e '/idp.persistentId.salt/ s/^#//' \ + -e "/idp.persistentId.salt/ s/changethistosomethingrandom/$IDP_PERSISTENTID_SALT/" /opt/shibboleth-idp/conf/saml-nameid.properties + # add xml conf to attribute-resolver + if ! grep "%{idp.persistentId.sourceAttribute}" /opt/shibboleth-idp/conf/attribute-resolver.xml ; then + sed -i '//r /opt/template-config/edupersontargetdid.xml.add' /opt/shibboleth-idp/conf/attribute-resolver.xml + fi +fi + +if [ -n "$IDP_DEBUG" ]; then + echo "idp.loglevel.messages=DEBUG" >> $IDP_PROPERTIES + echo "idp.loglevel.encryption=DEBUG" >> $IDP_PROPERTIES +fi + +DATADIR=/opt/data +# overwrite signing keys if present +if [ -f ${DATADIR}/credentials/idp-signing.key -a -f ${DATADIR}/credentials/idp-signing.crt ]; then + cp ${DATADIR}/credentials/idp-signing.key /opt/shibboleth-idp/credentials/idp-signing.key + cp ${DATADIR}/credentials/idp-signing.crt /opt/shibboleth-idp/credentials/idp-signing.crt +fi + +if [ $IDP_DEBUG ]; then + sed -i -e '/idp.loglevel.messages/ s/INFO/DEBUG/' -e '/idp.loglevel.encryption/ s/INFO/DEBUG/' /opt/shibboleth-idp/conf/logback.xml +fi + +/docker-entrypoint.sh java -jar /usr/local/jetty/start.jar $JAVA_OPTIONS diff --git a/idp/template-config/attribute-filter.xml b/idp/template-config/attribute-filter.xml index eae2abe..3514282 100644 --- a/idp/template-config/attribute-filter.xml +++ b/idp/template-config/attribute-filter.xml @@ -9,9 +9,9 @@ and their options. --> + xmlns="urn:mace:shibboleth:2.0:afp" + xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" + xsi:schemaLocation="urn:mace:shibboleth:2.0:afp http://shibboleth.net/schema/idp/shibboleth-afp.xsd"> @@ -19,139 +19,265 @@ + + + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/idp/template-config/attribute-resolver.xml b/idp/template-config/attribute-resolver.xml index 1020fc4..92fb1bb 100644 --- a/idp/template-config/attribute-resolver.xml +++ b/idp/template-config/attribute-resolver.xml @@ -17,38 +17,31 @@ --> + xmlns="urn:mace:shibboleth:2.0:resolver" + xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" + xsi:schemaLocation="urn:mace:shibboleth:2.0:resolver http://shibboleth.net/schema/idp/shibboleth-attribute-resolver.xsd"> - - - + + + - - - - - + + + - - - + + + - - - + + + - - - + + + - - - + + + - - + + - - + + - - + + - - + + @@ -129,101 +122,91 @@ - - - - - - - - + + + + + - - - - - + + + + + - - - - - + + + + + - + - - - - - + + + + + - - - - - + + + + + - + - - - + + + - - - - + ldapURL="%{idp.attribute.resolver.LDAP.ldapURL}" + baseDN="%{idp.attribute.resolver.LDAP.baseDN}"> + + + - - - - memberOf + ldapURL="%{idp.attribute.resolver.LDAP.ldapURL}" + baseDN="%{idp.attribute.resolver.LDAP.baseDN}"> + + + + memberOf - - - NORDUnet A/S - - - nordu.net - - - urn:schac:homeOrganizationType:int:NREN - - - NORDUNet - + + + NORDUnet A/S + + + nordu.net + + + urn:schac:homeOrganizationType:int:NREN + + + NORDUNet + urn:mace:dir:entitlement:common-lib-terms urn:mace:terena.org:tcs:escience-user @@ -233,34 +216,8 @@ urn:mace:swami.se:gmai:sunet-iaas:admin urn:mace:swami.se:gmai:sunet-iaas:user - - - - - - - + + diff --git a/idp/template-config/edupersontargetdid.xml.add b/idp/template-config/edupersontargetdid.xml.add new file mode 100644 index 0000000..8601da6 --- /dev/null +++ b/idp/template-config/edupersontargetdid.xml.add @@ -0,0 +1,16 @@ + + + + + + + + + + + diff --git a/idp/template-config/logback.xml b/idp/template-config/logback.xml new file mode 100644 index 0000000..6afa4ef --- /dev/null +++ b/idp/template-config/logback.xml @@ -0,0 +1,199 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + ${idp.logfiles}/idp-process.log + + + ${idp.logfiles}/idp-process-%d{yyyy-MM-dd}.log.gz + ${idp.loghistory:-180} + + + + UTF-8 + %date{ISO8601} - %level [%logger:%line] - %msg%n%ex{short} + + + + + + + VelocityStatusMatcher + ResourceManager : unable to find resource 'status.vm' in any resource loader. + + VelocityStatusMatcher.matches(formattedMessage) + + DENY + + + + + + 0 + + + + + + WARN + + + ${idp.logfiles}/idp-warn.log + + + ${idp.logfiles}/idp-warn-%d{yyyy-MM-dd}.log.gz + ${idp.loghistory:-180} + + + + UTF-8 + %date{ISO8601} - %level [%logger:%line] - %msg%n%ex{short} + + + + + + + VelocityStatusMatcher + ResourceManager : unable to find resource 'status.vm' in any resource loader. + + VelocityStatusMatcher.matches(formattedMessage) + + DENY + + + + + + ${idp.logfiles}/idp-audit.log + + + ${idp.logfiles}/idp-audit-%d{yyyy-MM-dd}.log.gz + ${idp.loghistory:-180} + + + + UTF-8 + %msg%n + + + + + + ${idp.logfiles}/idp-consent-audit.log + + + ${idp.logfiles}/idp-consent-audit-%d{yyyy-MM-dd}.log.gz + ${idp.loghistory:-180} + + + + UTF-8 + %msg%n + + + + + + ${idp.home}/logs/idp-audit-fticks.log + + ${idp.home}/logs/idp-audit-fticks%d{yyyy-MM-dd}.log.gz + 180 + + + UTF-8 + %msg%n + + + + + ${idp.fticks.loghost:-localhost} + ${idp.fticks.logport:-514} + AUTH + [%thread] %logger %msg + + + + + + + + + + + + + + + + + + + + + -- cgit v1.1