From b10d86d52123d1c4aab9f584739aed06ac700f73 Mon Sep 17 00:00:00 2001 From: Jj! Date: Tue, 14 Sep 2021 16:57:52 -0500 Subject: [PATCH 1/3] move things about a bit for reuse --- testbed/authentication/directory/certs/ca.crt | 18 ------- .../directory/certs/dhparam.pem | 8 --- .../authentication/directory/certs/ldap.crt | 18 ------- .../authentication/directory/certs/ldap.key | 6 --- testbed/authentication/docker-compose.yml | 10 ++-- .../directory/001_eduperson.ldif | 0 .../directory/999_users.ldif | 0 .../{authentication => }/directory/Dockerfile | 0 testbed/directory/certs/ca.crt | 29 +++++++++++ testbed/directory/certs/dhparam.pem | 13 +++++ testbed/directory/certs/ldap.crt | 29 +++++++++++ testbed/directory/certs/ldap.key | 52 +++++++++++++++++++ .../reverse-proxy/certs/star.unicon.local.crt | 30 +++++++++++ .../reverse-proxy/certs/star.unicon.local.key | 52 +++++++++++++++++++ .../configuration/certificates.yml | 9 ++++ 15 files changed, 219 insertions(+), 55 deletions(-) delete mode 100644 testbed/authentication/directory/certs/ca.crt delete mode 100644 testbed/authentication/directory/certs/dhparam.pem delete mode 100644 testbed/authentication/directory/certs/ldap.crt delete mode 100644 testbed/authentication/directory/certs/ldap.key rename testbed/{authentication => }/directory/001_eduperson.ldif (100%) rename testbed/{authentication => }/directory/999_users.ldif (100%) rename testbed/{authentication => }/directory/Dockerfile (100%) create mode 100644 testbed/directory/certs/ca.crt create mode 100644 testbed/directory/certs/dhparam.pem create mode 100644 testbed/directory/certs/ldap.crt create mode 100644 testbed/directory/certs/ldap.key create mode 100644 testbed/reverse-proxy/certs/star.unicon.local.crt create mode 100644 testbed/reverse-proxy/certs/star.unicon.local.key create mode 100644 testbed/reverse-proxy/configuration/certificates.yml diff --git a/testbed/authentication/directory/certs/ca.crt b/testbed/authentication/directory/certs/ca.crt deleted file mode 100644 index 158140b15..000000000 --- a/testbed/authentication/directory/certs/ca.crt +++ /dev/null @@ -1,18 +0,0 @@ ------BEGIN CERTIFICATE----- -MIIC0zCCAlmgAwIBAgIUCfQ+m0pgZ/BjYAJvxrn/bdGNZokwCgYIKoZIzj0EAwMw -gZYxCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxBMUEgQ2FyIFdhc2gxJDAiBgNVBAsT -G0luZm9ybWF0aW9uIFRlY2hub2xvZ3kgRGVwLjEUMBIGA1UEBxMLQWxidXF1ZXJx -dWUxEzARBgNVBAgTCk5ldyBNZXhpY28xHzAdBgNVBAMTFmRvY2tlci1saWdodC1i -YXNlaW1hZ2UwHhcNMTUxMjIzMTM1MzAwWhcNMjAxMjIxMTM1MzAwWjCBljELMAkG -A1UEBhMCVVMxFTATBgNVBAoTDEExQSBDYXIgV2FzaDEkMCIGA1UECxMbSW5mb3Jt -YXRpb24gVGVjaG5vbG9neSBEZXAuMRQwEgYDVQQHEwtBbGJ1cXVlcnF1ZTETMBEG -A1UECBMKTmV3IE1leGljbzEfMB0GA1UEAxMWZG9ja2VyLWxpZ2h0LWJhc2VpbWFn -ZTB2MBAGByqGSM49AgEGBSuBBAAiA2IABMZf/12pupAgl8Sm+j8GmjNeNbSFAZWW -oTmIvf2Mu4LWPHy4bTldkQgHUbBpT3xWz8f0lB/ru7596CHsGoL2A28hxuclq5hb -Ux1yrIt3bJIY3TuiX25HGTe6kGCJPB1aLaNmMGQwDgYDVR0PAQH/BAQDAgEGMBIG -A1UdEwEB/wQIMAYBAf8CAQIwHQYDVR0OBBYEFE+l6XolXDAYnGLTl4W6ULKHrm74 -MB8GA1UdIwQYMBaAFE+l6XolXDAYnGLTl4W6ULKHrm74MAoGCCqGSM49BAMDA2gA -MGUCMQCXLZj8okyxW6UTL7hribUUbu63PbjuwIXnwi420DdNsvA9A7fcQEXScWFL -XAGC8rkCMGcqwXZPSRfwuI9r+R11gTrP92hnaVxs9sjRikctpkQpOyNlIXFPopFK -8FdfWPypvA== ------END CERTIFICATE----- \ No newline at end of file diff --git a/testbed/authentication/directory/certs/dhparam.pem b/testbed/authentication/directory/certs/dhparam.pem deleted file mode 100644 index 73b8c1e61..000000000 --- a/testbed/authentication/directory/certs/dhparam.pem +++ /dev/null @@ -1,8 +0,0 @@ ------BEGIN DH PARAMETERS----- -MIIBCAKCAQEA7adhygsX/CvbcQBlSEKBmm0D0+hVfIttcftyFTuDPNok4yDJUBUF -zzc7X/i3PUMzANhShBrngBaXbOhVk3QcjMC623TPhFmILx0r236+aQEUGnlwN73M -RUFM6EblYgH4+E4nv+JLwzHdO72+qMAd92rtzVMiaDlCWghH6wdAFoasTsT6Posc -F5T8WCkzFAZeVhNGRKPP6k3l2BjvRJzkwYMMJrxaIYznMEK6H5CYIqZcpeAB3d2B -NaZXLxFCemLrSS16UHrH1modEe8yjrOaE5+ZesGAA9onsNRZkAJp0x/pRaO/+rHn -Q5QVCQCzxY16UsLzH0q/P80xPMU7BMoocwIBAg== ------END DH PARAMETERS----- diff --git a/testbed/authentication/directory/certs/ldap.crt b/testbed/authentication/directory/certs/ldap.crt deleted file mode 100644 index 1e6c74550..000000000 --- a/testbed/authentication/directory/certs/ldap.crt +++ /dev/null @@ -1,18 +0,0 @@ ------BEGIN CERTIFICATE----- -MIIC+DCCAn2gAwIBAgIUUjr8VSD3Ze+xx2wTk+B7wb2AMhEwCgYIKoZIzj0EAwMw -gZYxCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxBMUEgQ2FyIFdhc2gxJDAiBgNVBAsT -G0luZm9ybWF0aW9uIFRlY2hub2xvZ3kgRGVwLjEUMBIGA1UEBxMLQWxidXF1ZXJx -dWUxEzARBgNVBAgTCk5ldyBNZXhpY28xHzAdBgNVBAMTFmRvY2tlci1saWdodC1i -YXNlaW1hZ2UwHhcNMjAwOTE0MjAzODAwWhcNMjEwOTE0MjAzODAwWjCBiTELMAkG -A1UEBhMCVVMxEzARBgNVBAgTCk5ldyBNZXhpY28xFDASBgNVBAcTC0FsYnVxdWVy -cXVlMRUwEwYDVQQKEwxBMUEgQ2FyIFdhc2gxJDAiBgNVBAsTG0luZm9ybWF0aW9u -IFRlY2hub2xvZ3kgRGVwLjESMBAGA1UEAxMJZGlyZWN0b3J5MHYwEAYHKoZIzj0C -AQYFK4EEACIDYgAES273bAjfhMOi5t6arQFMA80plxRnNx299spxYjVLxABp0JCZ -fNxwCOxVCB1uBeHUAeUNgrh7bl5DL9rn5jEFfNUvLufU0VGzvcbsUqmKw+vGJtc/ -7zm1WytGncb2Ldc4o4GWMIGTMA4GA1UdDwEB/wQEAwIFoDAdBgNVHSUEFjAUBggr -BgEFBQcDAQYIKwYBBQUHAwIwDAYDVR0TAQH/BAIwADAdBgNVHQ4EFgQUhEBnUCZo -fZHO7R/hUHUgxEJgOOcwHwYDVR0jBBgwFoAUT6XpeiVcMBicYtOXhbpQsoeubvgw -FAYDVR0RBA0wC4IJZGlyZWN0b3J5MAoGCCqGSM49BAMDA2kAMGYCMQCOY/jUx+qB -kRQtDA+UF++/gI22HP8CVKrOA+9/xd68sowhlOoOK0MG22gc6gWVcicCMQCyRw8Z -ydB2NE11uJFrUOu2NYZnFwiYzCrTBuJccUYn/HROMdGFnxqvWfkU5lpQptY= ------END CERTIFICATE----- diff --git a/testbed/authentication/directory/certs/ldap.key b/testbed/authentication/directory/certs/ldap.key deleted file mode 100644 index 4c8d1130d..000000000 --- a/testbed/authentication/directory/certs/ldap.key +++ /dev/null @@ -1,6 +0,0 @@ ------BEGIN EC PRIVATE KEY----- -MIGkAgEBBDBXf/9AHrnYIt5+nudUpJ9wUb4zg15/ixrAUzZ2kj8uBf+qJBakq5hO -/V5/BV8AKAygBwYFK4EEACKhZANiAARLbvdsCN+Ew6Lm3pqtAUwDzSmXFGc3Hb32 -ynFiNUvEAGnQkJl83HAI7FUIHW4F4dQB5Q2CuHtuXkMv2ufmMQV81S8u59TRUbO9 -xuxSqYrD68Ym1z/vObVbK0adxvYt1zg= ------END EC PRIVATE KEY----- diff --git a/testbed/authentication/docker-compose.yml b/testbed/authentication/docker-compose.yml index 89881119f..1ed95975b 100644 --- a/testbed/authentication/docker-compose.yml +++ b/testbed/authentication/docker-compose.yml @@ -22,16 +22,16 @@ services: - "8443:8443" volumes: - /var/run/docker.sock:/var/run/docker.sock - - ./reverse-proxy/:/configuration/ - - ./reverse-proxy/certs/:/certs/ + - ../reverse-proxy/:/configuration/ + - ../reverse-proxy/certs/:/certs/ directory: - build: ./directory + build: ../directory networks: - idp volumes: - directory_data:/var/lib/ldap - directory_config:/etc/ldap/slapd.d - - ./directory/certs:/container/service/slapd/assets/certs + - ../directory/certs:/container/service/slapd/assets/certs environment: LDAP_BASE_DN: "dc=unicon,dc=local" LDAP_DOMAIN: "unicon.local" @@ -52,7 +52,7 @@ services: - reverse-proxy - idp volumes: - - ./directory/certs/ca.crt:/opt/shibboleth-idp/credentials/ldap-server.crt + - ../directory/certs/ca.crt:/opt/shibboleth-idp/credentials/ldap-server.crt - ./shibboleth-idp/metadata/dynamic:/opt/shibboleth-idp/metadata/dynamic healthcheck: disable: true diff --git a/testbed/authentication/directory/001_eduperson.ldif b/testbed/directory/001_eduperson.ldif similarity index 100% rename from testbed/authentication/directory/001_eduperson.ldif rename to testbed/directory/001_eduperson.ldif diff --git a/testbed/authentication/directory/999_users.ldif b/testbed/directory/999_users.ldif similarity index 100% rename from testbed/authentication/directory/999_users.ldif rename to testbed/directory/999_users.ldif diff --git a/testbed/authentication/directory/Dockerfile b/testbed/directory/Dockerfile similarity index 100% rename from testbed/authentication/directory/Dockerfile rename to testbed/directory/Dockerfile diff --git a/testbed/directory/certs/ca.crt b/testbed/directory/certs/ca.crt new file mode 100644 index 000000000..e05f05fe2 --- /dev/null +++ b/testbed/directory/certs/ca.crt @@ -0,0 +1,29 @@ +-----BEGIN CERTIFICATE----- +MIIFCzCCAvOgAwIBAgIULEwEJFwT49CiSPKOA5EHGVKGl0gwDQYJKoZIhvcNAQEL +BQAwFDESMBAGA1UEAwwJZGlyZWN0b3J5MCAXDTIxMDkxNDIxNDMwOFoYDzIwNTEw +OTE1MjE0MzA4WjAUMRIwEAYDVQQDDAlkaXJlY3RvcnkwggIiMA0GCSqGSIb3DQEB +AQUAA4ICDwAwggIKAoICAQC+/SikxGUFYUiKjghLFPRMaYLZUHyOMWOyCIQSkZrt +Si6llB7JhN+tCaFgibPSNrKzOpF7IRJBlaEMAKN47Fncy7uGPg/3KEtuCLRUxbYv +1LgjZl2J0w/SROYIX0bsMEuThojaIxuv4D1fdaF3S7/sKnXywIncZtAqMhISiC9q +Kq9xT4twiST7SDPY/u3pdVdAjBg4R5XlF69XWtKaeCoEup9lgvyLT5dQBxdA3q3N +Af8UnpgZjHPxa6na7BjXwOyy7uzlUmTd/M0UMHuAreCBXMJrfrVBTnFYKyPtDYAP +mFacA+lsX0a5QjOMIP0JW5dYAKw8SFU9rzGcqdB/a2mZwxvmrY5CFVI8SZho1JK8 +y4O3HQbzrqQ3b+t5UyZt1VnCDalAZyAP+Fp0TPhlIjQpm0hc7UVyhVuDAJJeV6Sk +TyAf8othu6wREsaOkfSNwrSGVX7CMxjXxEAIQfqaLfB7xAMc7mwUn/Lac6I6L2+w +a3Ds9xwpSoxHEAYVAJmpAtT8FFh5i0Fk6wqhUIO8IP5az7ATn1Q8MnYS/Mvne5JN +/6L2CABqz0ZDzqHosTQLZ1qEBO+mhXyWsE7Pc4Ky+pmTh8xsP356nLkchvBTUlYp +BzsBG+bDCNy8mQ0z+0oEngdZgTKYK+CqejDe0iOPw/ICkh3eImyQEa3m8qep+X78 +kwIDAQABo1MwUTAdBgNVHQ4EFgQUvNYYG2Stq3PcKD3IT3GlG64ma6gwHwYDVR0j +BBgwFoAUvNYYG2Stq3PcKD3IT3GlG64ma6gwDwYDVR0TAQH/BAUwAwEB/zANBgkq +hkiG9w0BAQsFAAOCAgEAaai3vJuEsDOIX74/byY50cMmqRo+lBZuPBZANJjaKSn3 +LORSW4PqwYfyzUkdw68dj2FPNmmg9p0xmSS1eMala2PW7UGwImjcmhV+YfdP15VE +t5FcaLvi32SfSyu9PWpRRyP2ahSzaM75HWMMKfbdzgGDGOkU6UIwKyWsO5UApjQ8 +b+w5IMAK9YvmuQGaaXePDM8sFM3+NQBvsdqnsCefxx0j8FmjF3PjpTmdcm4Rlk8E +yVigb/txwmKdJutcEeFWOnQVNxWugLmYW8P/s5W5IgpIm/8wdEz1bXXV0qGD/LgL +Rhr68OtmFoVp+C6Yf0fDS1yCtmkYlO+RyYtAMOv0G29Xe+MzLQW42fAHXvBGYh/0 +F258TLHjZDOs9nHIc4lQfT7k/MusY4g9RfYSXx8Ts7kXyfyGfj6D5E/kutfXQlH3 +DYjQ/B69dhU7bkEX8nc1xwzHU18pa+APbXqjaU3JewdxY6n+PIGN4ZLZrJ3zgNRj +tGykxlnPg8oAX3HX+ssh1OpU5VMPR+4hOdJkajk6U5Oyv77h4gsbUGCIGXC+0reA +k/jHoSCloifgQ4F3WdDGjPlWO6Hgvy2/KM+JqBX/9nF/Dc0bGfa3mmYXK56xQCPb +pNd6h2elVtlmt6iZgs4WA1uCwira5p0VCCutHgeGyWK4cAE60MFdRnzRZ2r1GuU= +-----END CERTIFICATE----- diff --git a/testbed/directory/certs/dhparam.pem b/testbed/directory/certs/dhparam.pem new file mode 100644 index 000000000..0ad3539ed --- /dev/null +++ b/testbed/directory/certs/dhparam.pem @@ -0,0 +1,13 @@ +-----BEGIN DH PARAMETERS----- +MIICCAKCAgEAivlNnloXfNvrvjLMALDtw4/H330xGfEZkO88vBG30xfDB8930JF/ +dpOQNB2lXhtyoCA5FYLI0Ml8VRzASR0nmVsjg1jqycRSZtPEUCyU5KLenWJerThQ +PCPPHgM9JNfSb9GVEnyBubgTJrRjRr0Fq6/T+sHI1DVFgrIcr1iIpwjzv6AtJ4GX +7ff3QxRI5wJ9EgSqGmyAZBBP91hvg702sENAru3TxL92uBY7yx1isr4Uo4v/CE/6 +DY9q5hEyVWZzb49msZ7WXiMvVwgH2P68O90x/Dzom27mQuutW0a5sHWLFvR6RzHl +f2LDO1uFl4RifVFUe2PNXbeb9KGTFx+4HFWPojYR2L1UlE+f1fdwh8PAPB0xBTgn +jMYra0dIJcCc9Mg/PbwJ9LMkIW7APuEvx90PlCmPs2ZI67EPAKlnDDtFsI6H0Sv8 +mAZt4oMBHFZoK2+4dcjLtDaqz8Stx9ICTFqk1YETcRlK9TQDRO0ngtkQJoKJtM7F +sSP/4LcX67Nd3aE9bSY977JQec6KTGXJCa2/dIIruni3p6oFmHzSlXH+TxbtaLku +VtYDqzRYR9vG5fsanOJlacoDpBtDEMlRVg+d5v811Z4cEH1RbEy/diGGEM/8DAxq +F5S9tqzQa7tk/1IuQX9SQcBWDmXEL76L8cxijmEeK1bRH9XwNLMjyEsCAQI= +-----END DH PARAMETERS----- diff --git a/testbed/directory/certs/ldap.crt b/testbed/directory/certs/ldap.crt new file mode 100644 index 000000000..e05f05fe2 --- /dev/null +++ b/testbed/directory/certs/ldap.crt @@ -0,0 +1,29 @@ +-----BEGIN CERTIFICATE----- +MIIFCzCCAvOgAwIBAgIULEwEJFwT49CiSPKOA5EHGVKGl0gwDQYJKoZIhvcNAQEL +BQAwFDESMBAGA1UEAwwJZGlyZWN0b3J5MCAXDTIxMDkxNDIxNDMwOFoYDzIwNTEw +OTE1MjE0MzA4WjAUMRIwEAYDVQQDDAlkaXJlY3RvcnkwggIiMA0GCSqGSIb3DQEB +AQUAA4ICDwAwggIKAoICAQC+/SikxGUFYUiKjghLFPRMaYLZUHyOMWOyCIQSkZrt +Si6llB7JhN+tCaFgibPSNrKzOpF7IRJBlaEMAKN47Fncy7uGPg/3KEtuCLRUxbYv +1LgjZl2J0w/SROYIX0bsMEuThojaIxuv4D1fdaF3S7/sKnXywIncZtAqMhISiC9q +Kq9xT4twiST7SDPY/u3pdVdAjBg4R5XlF69XWtKaeCoEup9lgvyLT5dQBxdA3q3N +Af8UnpgZjHPxa6na7BjXwOyy7uzlUmTd/M0UMHuAreCBXMJrfrVBTnFYKyPtDYAP +mFacA+lsX0a5QjOMIP0JW5dYAKw8SFU9rzGcqdB/a2mZwxvmrY5CFVI8SZho1JK8 +y4O3HQbzrqQ3b+t5UyZt1VnCDalAZyAP+Fp0TPhlIjQpm0hc7UVyhVuDAJJeV6Sk +TyAf8othu6wREsaOkfSNwrSGVX7CMxjXxEAIQfqaLfB7xAMc7mwUn/Lac6I6L2+w +a3Ds9xwpSoxHEAYVAJmpAtT8FFh5i0Fk6wqhUIO8IP5az7ATn1Q8MnYS/Mvne5JN +/6L2CABqz0ZDzqHosTQLZ1qEBO+mhXyWsE7Pc4Ky+pmTh8xsP356nLkchvBTUlYp +BzsBG+bDCNy8mQ0z+0oEngdZgTKYK+CqejDe0iOPw/ICkh3eImyQEa3m8qep+X78 +kwIDAQABo1MwUTAdBgNVHQ4EFgQUvNYYG2Stq3PcKD3IT3GlG64ma6gwHwYDVR0j +BBgwFoAUvNYYG2Stq3PcKD3IT3GlG64ma6gwDwYDVR0TAQH/BAUwAwEB/zANBgkq +hkiG9w0BAQsFAAOCAgEAaai3vJuEsDOIX74/byY50cMmqRo+lBZuPBZANJjaKSn3 +LORSW4PqwYfyzUkdw68dj2FPNmmg9p0xmSS1eMala2PW7UGwImjcmhV+YfdP15VE +t5FcaLvi32SfSyu9PWpRRyP2ahSzaM75HWMMKfbdzgGDGOkU6UIwKyWsO5UApjQ8 +b+w5IMAK9YvmuQGaaXePDM8sFM3+NQBvsdqnsCefxx0j8FmjF3PjpTmdcm4Rlk8E +yVigb/txwmKdJutcEeFWOnQVNxWugLmYW8P/s5W5IgpIm/8wdEz1bXXV0qGD/LgL +Rhr68OtmFoVp+C6Yf0fDS1yCtmkYlO+RyYtAMOv0G29Xe+MzLQW42fAHXvBGYh/0 +F258TLHjZDOs9nHIc4lQfT7k/MusY4g9RfYSXx8Ts7kXyfyGfj6D5E/kutfXQlH3 +DYjQ/B69dhU7bkEX8nc1xwzHU18pa+APbXqjaU3JewdxY6n+PIGN4ZLZrJ3zgNRj +tGykxlnPg8oAX3HX+ssh1OpU5VMPR+4hOdJkajk6U5Oyv77h4gsbUGCIGXC+0reA +k/jHoSCloifgQ4F3WdDGjPlWO6Hgvy2/KM+JqBX/9nF/Dc0bGfa3mmYXK56xQCPb +pNd6h2elVtlmt6iZgs4WA1uCwira5p0VCCutHgeGyWK4cAE60MFdRnzRZ2r1GuU= +-----END CERTIFICATE----- diff --git a/testbed/directory/certs/ldap.key b/testbed/directory/certs/ldap.key new file mode 100644 index 000000000..3756f05ce --- /dev/null +++ b/testbed/directory/certs/ldap.key @@ -0,0 +1,52 @@ +-----BEGIN PRIVATE KEY----- +MIIJRAIBADANBgkqhkiG9w0BAQEFAASCCS4wggkqAgEAAoICAQC+/SikxGUFYUiK +jghLFPRMaYLZUHyOMWOyCIQSkZrtSi6llB7JhN+tCaFgibPSNrKzOpF7IRJBlaEM +AKN47Fncy7uGPg/3KEtuCLRUxbYv1LgjZl2J0w/SROYIX0bsMEuThojaIxuv4D1f +daF3S7/sKnXywIncZtAqMhISiC9qKq9xT4twiST7SDPY/u3pdVdAjBg4R5XlF69X +WtKaeCoEup9lgvyLT5dQBxdA3q3NAf8UnpgZjHPxa6na7BjXwOyy7uzlUmTd/M0U +MHuAreCBXMJrfrVBTnFYKyPtDYAPmFacA+lsX0a5QjOMIP0JW5dYAKw8SFU9rzGc +qdB/a2mZwxvmrY5CFVI8SZho1JK8y4O3HQbzrqQ3b+t5UyZt1VnCDalAZyAP+Fp0 +TPhlIjQpm0hc7UVyhVuDAJJeV6SkTyAf8othu6wREsaOkfSNwrSGVX7CMxjXxEAI +QfqaLfB7xAMc7mwUn/Lac6I6L2+wa3Ds9xwpSoxHEAYVAJmpAtT8FFh5i0Fk6wqh +UIO8IP5az7ATn1Q8MnYS/Mvne5JN/6L2CABqz0ZDzqHosTQLZ1qEBO+mhXyWsE7P +c4Ky+pmTh8xsP356nLkchvBTUlYpBzsBG+bDCNy8mQ0z+0oEngdZgTKYK+CqejDe +0iOPw/ICkh3eImyQEa3m8qep+X78kwIDAQABAoICADYKjCWTLMKI9G3AIricBURZ +1pyHGbdiYkNOBZD7gksCYpCXiN6cqm3b+73FOQySTZ5JREEC6peELz2mMJtWxVak +jzs89GeLD0zjSaNzDkoadsANhwoonqFwvWZBD2Blif0EZFTU+lCZssQAFOAcnwHE +QfueX2Pt85j88gAsaL4xtdLqHxqIs94mYAVWnRsiCL5K5c+G8fMQ8JxXJqBuv/T2 +mYOvvKXur3IFj57bY3JOzk6XUZJpG6WEQVug0qa6AD/hO0boOYJWtfCwh0Gx8YSp +KpogEEmaWJgKHPBGkaXYBSnAMZxomSpygQN1kiPDtt8/0Xx9OyFpITCjHEvxqL9L +7ce0hebPoG7Ry+QD7YmeERzpdTSEulYywdeoRJMHQtH7AknH1xf77xYC7qGbCeRg +y9TMTQIt8f5gVcFBQlfEoNf+k5Z1LFHG0TpAGrOhy9KFurd+t3PLQAolsjtCA0NS +C366eztBCvQzdOyA70tQoEmbZer5s1AedqsfcSL1aaYm5DmpbfG33y3TLgV7Rl4r +O0jrtXneLSox6ew99hjYuqg1HOTQC5DMPT9KmfqZJQUBNxlpgqIyFOzZp0ooDKWY +6zEdgZLVd3vzX6Q5U7xpMR4/5rypPDtV9KnJxvfptmCK8cygmgFnmoLvuqvnb0k4 +Id/dY0nmBVZQvpdyRwsBAoIBAQDt5AwWhAnwSQRW7NSBltqx5pbDe27/Pl3HgrbC +3WU2sTyCyP6aeCj2wOWWsxQ4AKqGrWuUXUIQHsLJOo1+SlomMUWw+4Gw0ciYNDu3 +b+ZhUQAaM1QqnwVGOJwuEnM/AgG+V7aeuh8S044SW+G5YiHn8rSzsYk8OynEiOoV +E/qT66Jaljgl7+KNiQL1stdEHwnK3PwJOyFciZI4DVGumywwZHJT5230AO+MqcHN +5E7s4JQhTOcy7iwPCGLAe63FMWo7Lai2ApHVdXMSjmgVYKHxZo6NlsvpXNipQmCe +rdW7VCpTChpt/CGQ8I0JNwd0QmjKxEOfkp7xFi+7iEfH6BAJAoIBAQDNhxmCT2tQ +AfNxv9Hzw18tyV8nmMyOD45gu6rKNTgqnZIpoT12gCV5OB9cTvje/5j/LU8b6012 +gUZCG+90XF+1vFFRhr/k0q1gr+gmbrwxBghO/bflz+5JL4w/P9QLcgwr5ewVBkGV +3yu2MAmGrU4EjDb/ZFpDWgjzCw+q2yD6xoM+XU49O+4TDq6q1PidGGTgP7UyuWMD +U/rtjOmgULckA4bMi3zJ0OnoGR/uq1RmmjYLAZQ+Ea22YZuLp1OhUsS41yusIAS7 +otd3+jikqa/FBZnbxb3qXZdC19xwepYG8qf7w+LfJ28Lw9GIdcJfp9xh0BsS0lTW +KqbJRwdmZpa7AoIBAQDD+va2aeriKNVJY2yiogvjOcuEmiDUaKXLonU8TjZ++z6V +pE6UJV/iAQJjx35lsK7Lqv0Qyk+NhjoEm5dLrqdcBYWbi2fJqtouAgIcWjSagaeq +7hRt1Hn84tBP6GVHSDj1fb92PnExClZl64onNqAmPT3/N8iOdVMwlXb7DG2IBTzI +ki8JmfmzjmeA0OglN8jSdoGwfSU73h42zUo4pZ+e8nF5jBR6S3cOFCAUpf0bitye +HoPt4mcrr0Xju0BqTw5sWG5AHBfWmh7F78nxqp1fiZTxMoUk6JeZwZRlxWJqJKmF +pbImX+urQ3F9YPdkIP3B5jSrtpf4l8WVIm24VAc5AoIBAQDLJcBXBz0hBeylAF77 +vJ71WNePAf8eY83tW1HDMLtlk/4G2/MukBd6K7kDuqNPeAC4KQbKp9gXTEwvyAD1 +WODZd1xBYxmFiaAJs5WZd1bYdgf8W9hLdS0odbEAS4zCC2ZwdYDWfyqQgthn6i9g +SSiWYilyYrS9Yd76rHI+BP4iIdlT6VIOQJBfkeGfxYY/cP80kIP/sTJm9blO2DuM +VHvRQxMYVr9vk+m/miXv+LUh/UdxtYvblgnH/c6LSUbmbDM6KKRoK/XBqYGke1VF +nNu5uIGNs3S2lO+QCGFBZEmqcGsN9V7oB8hBLrqLUSpg9kBlBhfckL1+OwZEaMqt +srVFAoIBAQDG6mVeZ6IFBXVk0exij4DIeLHBeEQxnDKK9B7JgsmeaNKU1CFxJbUT +zOM0IsSpxExI2NdkShjHOTlCz43D+EBjpTc7+hLQeUBl8FTamegeU3ACiAuahQoS +PcNNmFGy1e2eNtP839X+39k5fciSvgY3FF58czNeYv2XQemS07IIll+9nV/j+Bsg +Fd2M/Oj2DIcXSE+9OnyIyC0smhXwR8dPhJOPH9C/ww4oQOgVYthBAehSBtiUle7v +qeG1QtF+ODvw94nUxtuesuZ/juHSxqtKXRm+Nho7Do4U9wXhAg5w4rzKZU3yMW/k +Fq6aGlx2+ZhVYPYkzyQGiiPhkx0V1T2d +-----END PRIVATE KEY----- diff --git a/testbed/reverse-proxy/certs/star.unicon.local.crt b/testbed/reverse-proxy/certs/star.unicon.local.crt new file mode 100644 index 000000000..efd24fe9f --- /dev/null +++ b/testbed/reverse-proxy/certs/star.unicon.local.crt @@ -0,0 +1,30 @@ +-----BEGIN CERTIFICATE----- +MIIFFTCCAv2gAwIBAgIUFsOsEwK1AdLuTYYEGCNzC9hIElcwDQYJKoZIhvcNAQEL +BQAwGTEXMBUGA1UEAwwOKi51bmljb24ubG9jYWwwIBcNMjEwOTE0MjE1NDU3WhgP +MjA1MTA5MTUyMTU0NTdaMBkxFzAVBgNVBAMMDioudW5pY29uLmxvY2FsMIICIjAN +BgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAnzMWyelX4++Z8iS8KuIJtroJvPsl +ZbVnh/T5TH2g1t7xkyYBaj2xOq5yUuUqJxw0sRpo3m3R5oUUeacTmEFr0N5tVSZe +vDohH1tjJGgz4YBDMxiN//jVCWs10K0HFdQW/t5xRY8Ahjl1R/1D+NX/jKgUKTQn +1EhH1ik8D2MiTvsFDjqI1mHjfsXjF0SZKp39bLNHSuR+STyRph8F/o5CEr6phYc2 +i9DBKYvHwyWUxHzC/STuWwHPtBq/8jmpQSoEmtjOCt3Dv4czEPa0S2nHnvQyt3Fm +Tb0l7xjdGJrCkt2h1ImP5xvdCDIBIfQnDmPA4wb1LFutRNYjQsY2zujAm7rMxJxB +Bp4EJHz94uKSk8FwhR7jO1BmLuKixKKetvgahOlp2VY0YD+NmZ7sKeKxqGvbiDyf +elQu4EEUSWDg0EPLFpM4WSrTKeMVxXkkT8BeLrg+VvUiB77aKkshcV67Tah2lPAg +dm78wvYT37buqJoJps8mfztiy8t0D412gtDDfTeV3wjX1w3enKARKG53yKtaQRcD +Uax3l/wajrAJX4anzUuJ5T5Jyg/4GSI0OQBfov56pNhaKxuvzBZnwS4qys6eLWei +qsRzqaoszX/sXkgY2BQDQ6b/gXPvY7W30kRByHd23+baSs/80ANU2tBxNs2ynAMd +etqA1Xu1e4ODt/cCAwEAAaNTMFEwHQYDVR0OBBYEFFrAjKwSavl2E88gmTdft4bB +3DtxMB8GA1UdIwQYMBaAFFrAjKwSavl2E88gmTdft4bB3DtxMA8GA1UdEwEB/wQF +MAMBAf8wDQYJKoZIhvcNAQELBQADggIBAAd98df4O+gSk7JCT5E1QDcOTQ0w25wp +gWE8+a4fElc7vyz5P4EEs5tpDTLfAanSLrASxnFSmRqPCrW9HV/mFAPdK9MLRgG5 +XLcjATbHgcXD071MsPJ2hO6sCPS+7LSE72873Dp89RBDNCb0pQb/4iMN0Y5BKznR +oklrWMAIr+0Ei0iBuPHyHgIMCco9a+5kwMxzhhSVYRY03pHjavo3kRXY86UMeDVx +1v122/Y5GS6ohegnkRI2QKwn/3KgOTa4f33oFk69yOSDLu7c1pzJoLgYMzKg7mTO +iPW2rhZDY+JXXYnHZmFPLgA5FqBxAnrE7wnIM8DFEMrmETNf7PRwfzFjjuYuGdSV +YZisBMjVkLJzX06tVK7OAmVkwzFWp+4P7XgD6NqvH84I+2A1on3kK7gOgqI/oMhE +VxpanKSuzjlEVtlxjSAyv7Y5nrwwEsuh7Nas+RboxTJRSzws7mi8F62QxYVz6S8D +K3cHfYcJXKRRpmpMGnau+Jb1Rf9eftm6kRO1qdjg6FV0iIidB2bO8dkt/me2kpD7 +hWASggtuW7CLHj+kztPOitAoImCQtk1QM17bMFxXyqlP3twOpnYXFdSTTM5qvAqy +rzrMHDtSL9gON7Iy5La9Q2imw6+jjxM6Stei1XWmI2BhIJe175NeVWxak6j2ZOvh +tEQh89PhqUVL +-----END CERTIFICATE----- diff --git a/testbed/reverse-proxy/certs/star.unicon.local.key b/testbed/reverse-proxy/certs/star.unicon.local.key new file mode 100644 index 000000000..8aec397bd --- /dev/null +++ b/testbed/reverse-proxy/certs/star.unicon.local.key @@ -0,0 +1,52 @@ +-----BEGIN PRIVATE KEY----- +MIIJQQIBADANBgkqhkiG9w0BAQEFAASCCSswggknAgEAAoICAQCfMxbJ6Vfj75ny +JLwq4gm2ugm8+yVltWeH9PlMfaDW3vGTJgFqPbE6rnJS5SonHDSxGmjebdHmhRR5 +pxOYQWvQ3m1VJl68OiEfW2MkaDPhgEMzGI3/+NUJazXQrQcV1Bb+3nFFjwCGOXVH +/UP41f+MqBQpNCfUSEfWKTwPYyJO+wUOOojWYeN+xeMXRJkqnf1ss0dK5H5JPJGm +HwX+jkISvqmFhzaL0MEpi8fDJZTEfML9JO5bAc+0Gr/yOalBKgSa2M4K3cO/hzMQ +9rRLacee9DK3cWZNvSXvGN0YmsKS3aHUiY/nG90IMgEh9CcOY8DjBvUsW61E1iNC +xjbO6MCbuszEnEEGngQkfP3i4pKTwXCFHuM7UGYu4qLEop62+BqE6WnZVjRgP42Z +nuwp4rGoa9uIPJ96VC7gQRRJYODQQ8sWkzhZKtMp4xXFeSRPwF4uuD5W9SIHvtoq +SyFxXrtNqHaU8CB2bvzC9hPftu6omgmmzyZ/O2LLy3QPjXaC0MN9N5XfCNfXDd6c +oBEobnfIq1pBFwNRrHeX/BqOsAlfhqfNS4nlPknKD/gZIjQ5AF+i/nqk2ForG6/M +FmfBLirKzp4tZ6KqxHOpqizNf+xeSBjYFANDpv+Bc+9jtbfSREHId3bf5tpKz/zQ +A1Ta0HE2zbKcAx162oDVe7V7g4O39wIDAQABAoICAAJ67Eb3AKyHZhGUqu3MGbSk +D1THYNzFx7ghg+TCLEhMrtzJAcqi7WjpoNRTx6VWVifQLoQQl+2MczY1+SMtGb3m +STPDZkRub2eqp8/AY9aGhgV8w3GScdc0uWDn4S1g4X7U/lTEFpEAwif99RoiU1ng +oHfH3Tr8aUoX2FyxAa7TUE/Zb5pPahjmglQxeGVmkrUn0duD1cfUTryUzSYbF0Jt +f/yZj6r79JZuHA2ZP0kUXIFPGvuF+rNmm0jtxwpB2lKDQCqBK/SG6a/A+CwYmMiM +K2IaPSrG4Jlp/L/OYWuiUkwaXIiQMZBYHxZlVFpwCWhACn/Hadqhr2jx55avn5iH +NPHGJiUuSkF4p183tUyYY2aDptu5cGQk4WpfiQjzt/FIkQDx8KF3eE4ZVMYT4mV2 +wPJE+Yg4dO+704uceoM/J5BwWQEUuUtNIlWIRogOYkjQzuMi9zyGu9uIFi5+JNb9 +LpNORfTWNOTYasEi9/v8+RxwSZ6FR2/MZaroU8kXljTgqhomP35gERlwB/yAjQxG +C9tO4lJwGfzyVMTU6x2R7mcRaiUSNIZ1AMN86JX+Z+RG+rGGNAEreu/osklscPxE +dhtPbi0FJzJl+bfW+9JWX7VkwNfA1Np/zqSydEI3dTwwe9ibAQ9QiAgkMbfeqIBX +G3hZLoqowGvtLeypbaxBAoIBAQDNYaIMjDFknqIAwVYkJXVyRA1qDsITBQJ5111+ +eHfRaEvnq+ksTRP1K6VAKM1RgGTRlTlMC+qthp1MWJrWT55d35+XS3JMUcrAB85k +P8hIJSe/zaiiI+KhRxF2ABSxdty/QPyfcvPXelGPlf7mbumGlTzPoiFwvzhTVqi3 +nSWWVVX8X5+PP0v1jGEHbTmdGOg9g22fiitEW4iovSUM/wRtT+bpEQlTKC7fwiaP +DN6XCTG3GRQZrPuiTGXrvyMYmAbHfImqYuEiwm0hXiqdxfB1WfmVZ0qMmrpzL9mc +HqEZraIxemSDNCxtDj/V4n9F0Pvs4ow5yEnFyxl8+FjtKpHhAoIBAQDGb6ctMByT +DM87lhgh1pn/8VGU5K1RaMzPtMXuY84htTsixFQ4jW7d3y3hLVHfDVJbvSaXXVp/ +gNk0mbkQ7gkcoJja99Ohe5kzMWcB0iRzX5ceoFWZ22uUU5g4Pg0cwscogPGdVjoW +sxKLczVhpN2tIVFTf6aHtBroU7wWHTVEorDquy8W5VzRvuzVNjpnrGXL1PtmA7m7 +f1a0eHN+cknJXarBcngJ0nVyGT2gbJSVfuPlmhrs7gg87zYeEqXs2gwgnM67HxRE +nYp4Or/K6qx1NcaPGTadYC5kANrP5L7nBJEoI9MvFBx7qvJop799fqHHCN05sH+8 +7rtXyXX+UbTXAoIBAB64iu/LjJvbaqooQUVY4Q99hHAn0vnbVvp4r4B6bpnBOxFl +UpSQ1vpmU+qb79JQHUSISLDKW4knSKIh4s9Jy4uJJqsP2wH1fhlpUYMHU2MPQ7nZ +/m56ZazwH3mCG5ZMDEsDYoZLQJQrtMWAj0dSsdWyvwzj2JKv17IHlWcZt4ScMSd1 ++j0IH8mT/POKcALCtgJ1hVFG7p/j/TYYTNF71+KuAAE+ziFFMnW/6dqd9zGqa2hS +9QG+MUmemeRAi/Ri0SjHxSPadIipgn9qQX+mGwjCs6WYdLtBbcBLGQbUQg7APTGf +eCd0B20so3nPzm/YCcbuQEFoZziR37ckwtB+/KECggEAOEs0gf1EHfNkVuMdtXvL +9G/hVPwKry2r7MC75gUqVSW0wQgxXFnDOe42dcsFjuGYm63tZMN3CPTkqadyePsO +WrC0rGnh/82wiHVbY4jaDmDv3iBeKGe2/T050brIvYAEP9lUse3kTMxAVo84dZrv +yE3LZISyGY1elMoscZmXowEEb5LqqPQogNhJF7Nqnj6qIkkpiKdF6YsWbdw954FE +rXuFFZwDscWiy9udQAWNoVt+C4TMXqqoa6DxGVbw+2BgUGArxanrdgu7XKBOCKLK +ifXXfoEInVzLzFLxwEiEX8VL6LdBEfoCmpLEciwkhtWFz5EUMWmA03hmbWEZuCw1 +wQKCAQAxLN0Q5TbiXic6sfesSrwLNrK1l6eSj6+fetYWZNrKLPXRWzuplOCWziOx +7qw0QQ0UM99WEhfsFX9fdfKwdd2w0QBvYjNxvmLmnQlA2KKKW3C26rKAYg+uO/B3 +ZY6H/regllbArysm/fBL+Zv9u1qL9t7dZNMAkBZApTfCkym9NPc5APQV4KMVRcMu +bMF+N0AabPLbBQtKl9wwoxa1eMxvS9uYIySK/3RZMu+JuuAm+QweJhBixdJ1ao10 +MLd83NCb5wn2nMSECBvizO1I9nxwoBw5RaGFyr6eEA6Vg7ciGdJxznUTdcCZ6dkI +ev8pvFafpDvSERVPbzkDg0bjNho3 +-----END PRIVATE KEY----- diff --git a/testbed/reverse-proxy/configuration/certificates.yml b/testbed/reverse-proxy/configuration/certificates.yml new file mode 100644 index 000000000..88abe448d --- /dev/null +++ b/testbed/reverse-proxy/configuration/certificates.yml @@ -0,0 +1,9 @@ +tls: + certificates: + - certFile: /certs/star.unicon.local.crt + keyFile: /certs/star.unicon.local.key + stores: + default: + defaultCertificate: + certFile: /certs/star.unicon.local.crt + keyFile: /certs/star.unicon.local.key \ No newline at end of file From 6150b4fe37afaec19ac5eb6b5dce19a9b5c41592 Mon Sep 17 00:00:00 2001 From: Jj! Date: Fri, 8 Oct 2021 09:49:38 -0500 Subject: [PATCH 2/3] initial integration --- testbed/integration/cheat.html | 73 + testbed/integration/docker-compose.yml | 103 + testbed/integration/shibboleth-idp/Dockerfile | 25 + .../config/shib-idp/conf/access-control.xml | 68 + .../config/shib-idp/conf/attribute-filter.xml | 160 + .../shib-idp/conf/attribute-resolver.xml | 270 + .../config/shib-idp/conf/cas-protocol.xml | 112 + .../config/shib-idp/conf/idp.properties | 226 + .../config/shib-idp/conf/idp.properties.dist | 226 + .../config/shib-idp/conf/ldap.properties | 61 + .../config/shib-idp/conf/ldap.properties.dist | 61 + .../shib-idp/conf/metadata-providers.xml | 103 + .../config/shib-idp/conf/relying-party.xml | 78 + .../config/shib-idp/conf/services.xml | 70 + .../config/shib-idp/metadata/idp-metadata.xml | 36 + .../config/tomcat/catalina.policy | 0 .../config/tomcat/catalina.properties | 150 + .../shibboleth-idp/config/tomcat/context.xml | 36 + .../config/tomcat/logging.properties | 64 + .../shibboleth-idp/config/tomcat/server.xml | 22 + .../config/tomcat/tomcat-users.xml | 44 + .../config/tomcat/tomcat-users.xsd | 59 + .../shibboleth-idp/config/tomcat/web.xml | 4684 +++++++++++++++++ .../credentials/shib-idp/idp-encryption.crt | 19 + .../credentials/shib-idp/idp-encryption.key | 28 + .../credentials/shib-idp/idp-signing.crt | 19 + .../credentials/shib-idp/idp-signing.key | 28 + .../credentials/shib-idp/inc-md-cert-mdq.pem | 28 + .../credentials/shib-idp/sealer.jks | Bin 0 -> 518 bytes .../credentials/shib-idp/sealer.kver | 2 + .../credentials/shib-idp/secrets.properties | 14 + .../credentials/tomcat/keystore.jks | Bin 0 -> 3840 bytes ...0bfe6fa4495100f5c193fa5b7ca4192c150923.xml | 25 + .../shibboleth-idp/wwwroot/robots.txt | 2 + testbed/integration/shibui/application.yml | 20 + 35 files changed, 6916 insertions(+) create mode 100644 testbed/integration/cheat.html create mode 100644 testbed/integration/docker-compose.yml create mode 100644 testbed/integration/shibboleth-idp/Dockerfile create mode 100644 testbed/integration/shibboleth-idp/config/shib-idp/conf/access-control.xml create mode 100644 testbed/integration/shibboleth-idp/config/shib-idp/conf/attribute-filter.xml create mode 100644 testbed/integration/shibboleth-idp/config/shib-idp/conf/attribute-resolver.xml create mode 100644 testbed/integration/shibboleth-idp/config/shib-idp/conf/cas-protocol.xml create mode 100644 testbed/integration/shibboleth-idp/config/shib-idp/conf/idp.properties create mode 100644 testbed/integration/shibboleth-idp/config/shib-idp/conf/idp.properties.dist create mode 100644 testbed/integration/shibboleth-idp/config/shib-idp/conf/ldap.properties create mode 100644 testbed/integration/shibboleth-idp/config/shib-idp/conf/ldap.properties.dist create mode 100644 testbed/integration/shibboleth-idp/config/shib-idp/conf/metadata-providers.xml create mode 100644 testbed/integration/shibboleth-idp/config/shib-idp/conf/relying-party.xml create mode 100644 testbed/integration/shibboleth-idp/config/shib-idp/conf/services.xml create mode 100644 testbed/integration/shibboleth-idp/config/shib-idp/metadata/idp-metadata.xml create mode 100644 testbed/integration/shibboleth-idp/config/tomcat/catalina.policy create mode 100644 testbed/integration/shibboleth-idp/config/tomcat/catalina.properties create mode 100644 testbed/integration/shibboleth-idp/config/tomcat/context.xml create mode 100644 testbed/integration/shibboleth-idp/config/tomcat/logging.properties create mode 100644 testbed/integration/shibboleth-idp/config/tomcat/server.xml create mode 100644 testbed/integration/shibboleth-idp/config/tomcat/tomcat-users.xml create mode 100644 testbed/integration/shibboleth-idp/config/tomcat/tomcat-users.xsd create mode 100644 testbed/integration/shibboleth-idp/config/tomcat/web.xml create mode 100644 testbed/integration/shibboleth-idp/credentials/shib-idp/idp-encryption.crt create mode 100644 testbed/integration/shibboleth-idp/credentials/shib-idp/idp-encryption.key create mode 100644 testbed/integration/shibboleth-idp/credentials/shib-idp/idp-signing.crt create mode 100644 testbed/integration/shibboleth-idp/credentials/shib-idp/idp-signing.key create mode 100644 testbed/integration/shibboleth-idp/credentials/shib-idp/inc-md-cert-mdq.pem create mode 100644 testbed/integration/shibboleth-idp/credentials/shib-idp/sealer.jks create mode 100644 testbed/integration/shibboleth-idp/credentials/shib-idp/sealer.kver create mode 100644 testbed/integration/shibboleth-idp/credentials/shib-idp/secrets.properties create mode 100644 testbed/integration/shibboleth-idp/credentials/tomcat/keystore.jks create mode 100644 testbed/integration/shibboleth-idp/metadata/dynamic/700bfe6fa4495100f5c193fa5b7ca4192c150923.xml create mode 100644 testbed/integration/shibboleth-idp/wwwroot/robots.txt create mode 100644 testbed/integration/shibui/application.yml diff --git a/testbed/integration/cheat.html b/testbed/integration/cheat.html new file mode 100644 index 000000000..c29eea878 --- /dev/null +++ b/testbed/integration/cheat.html @@ -0,0 +1,73 @@ + + +

Reload Service

+
+ + + +
+

Attribute Resolution

+
+ + + + + + + + + + + + + + + + + + + + + +
+ + + +
+ + + +
+ + + +
+ + + +
+ + + +
+ + +
+

Metadata Query

+
+ + + + + +
+ + + +
+ +
+ + diff --git a/testbed/integration/docker-compose.yml b/testbed/integration/docker-compose.yml new file mode 100644 index 000000000..eb448e56d --- /dev/null +++ b/testbed/integration/docker-compose.yml @@ -0,0 +1,103 @@ +version: "3.8" + +services: + reverse-proxy: + image: library/traefik:v2.5.2 + command: + - "--api.insecure=true" + - "--providers.docker=true" + - "--providers.docker.exposedbydefault=false" + - "--entrypoints.web-secure.address=:443" + - "--providers.file.directory=/configuration/" + - "--providers.file.watch=true" + # - "--log.level=DEBUG" + networks: + reverse-proxy: + aliases: + - idp.unicon.local + ports: + - "80:80" + - "8080:8080" + - "443:443" + - "8443:8443" + volumes: + - /var/run/docker.sock:/var/run/docker.sock + - ../reverse-proxy/:/configuration/ + - ../reverse-proxy/certs/:/certs/ + directory: + build: ../directory + networks: + - idp + volumes: + - directory_data:/var/lib/ldap + - directory_config:/etc/ldap/slapd.d + - ../directory/certs:/container/service/slapd/assets/certs + environment: + LDAP_BASE_DN: "dc=unicon,dc=local" + LDAP_DOMAIN: "unicon.local" + HOSTNAME: "directory" + LDAP_TLS_VERIFY_CLIENT: "try" + idp: + build: ./shibboleth-idp + labels: + - "traefik.http.routers.idp.rule=Host(`idp.unicon.local`)" + - "traefik.http.services.idp.loadbalancer.server.port=8080" + - "traefik.http.routers.idp.tls=true" + - "traefik.docker.network=integration_reverse-proxy" + - "traefik.enable=true" + depends_on: + - directory + - reverse-proxy + networks: + - reverse-proxy + - idp + volumes: + - ../directory/certs/ca.crt:/opt/shibboleth-idp/credentials/ldap-server.crt + - dynamic_metadata:/opt/shibboleth-idp/metadata/dynamic + - dynamic_config:/opt/shibboleth-idp/conf/dynamic + healthcheck: + disable: true + shib-idp-ui: + image: unicon/shibui:latest + labels: + - "traefik.http.routers.shibui.rule=Host(`shibui.unicon.local`)" + - "traefik.http.services.shibui.loadbalancer.server.port=8080" + - "traefik.http.routers.shibui.tls=true" + - "traefik.docker.network=integration_reverse-proxy" + - "traefik.enable=true" + networks: + - reverse-proxy + - backend + volumes: + - ./shibui:/conf + - ./shibui/application.yml:/application.yml + - dynamic_metadata:/var/shibboleth/dynamic_metadata + - dynamic_config:/var/shibboleth/dynamic_config + - ./shibboleth-idp/credentials/shib-idp/inc-md-cert-mdq.pem:/opt/shibboleth-idp/credentials/inc-md-cert-mdq.pem + environment: + - "IDP_HOME=/opt/shibboleth-idp" + database: + image: postgres:14-alpine + environment: + POSTGRES_PASSWORD: shibui + POSTGRES_USER: shibui + POSTGRES_DB: shibui + networks: + - backend + volumes: + - database_data:/var/lib/postgresql/data +networks: + reverse-proxy: + idp: + backend: +volumes: + directory_data: + driver: local + directory_config: + driver: local + dynamic_metadata: + driver: local + dynamic_config: + driver: local + database_data: + driver: local diff --git a/testbed/integration/shibboleth-idp/Dockerfile b/testbed/integration/shibboleth-idp/Dockerfile new file mode 100644 index 000000000..1a4087074 --- /dev/null +++ b/testbed/integration/shibboleth-idp/Dockerfile @@ -0,0 +1,25 @@ +FROM i2incommon/shib-idp:4.1.4_20210802 + +# The build args below can be used at build-time to tell the build process where to find your config files. This is for a completely burned-in config. +ARG TOMCFG=config/tomcat +ARG TOMCERT=credentials/tomcat +ARG TOMWWWROOT=wwwroot +ARG SHBCFG=config/shib-idp/conf +ARG SHBCREDS=credentials/shib-idp +ARG SHBVIEWS=config/shib-idp/views +ARG SHBEDWAPP=config/shib-idp/edit-webapp +ARG SHBMSGS=config/shib-idp/messages +ARG SHBMD=config/shib-idp/metadata + +# copy in the needed config files +ADD ${TOMCFG} /usr/local/tomcat/conf +ADD ${TOMCERT} /opt/certs +ADD ${TOMWWWROOT} /usr/local/tomcat/webapps/ROOT +ADD ${SHBCFG} /opt/shibboleth-idp/conf +ADD ${SHBCREDS} /opt/shibboleth-idp/credentials +#ADD ${SHBVIEWS} /opt/shibboleth-idp/views +#ADD ${SHBEDWAPP} /opt/shibboleth-idp/edit-webapp +#ADD ${SHBMSGS} /opt/shibboleth-idp/messages +ADD ${SHBMD} /opt/shibboleth-idp/metadata + +EXPOSE 8080 diff --git a/testbed/integration/shibboleth-idp/config/shib-idp/conf/access-control.xml b/testbed/integration/shibboleth-idp/config/shib-idp/conf/access-control.xml new file mode 100644 index 000000000..e8215e441 --- /dev/null +++ b/testbed/integration/shibboleth-idp/config/shib-idp/conf/access-control.xml @@ -0,0 +1,68 @@ + + + + + + + + + + + + + + + + + + + + diff --git a/testbed/integration/shibboleth-idp/config/shib-idp/conf/attribute-filter.xml b/testbed/integration/shibboleth-idp/config/shib-idp/conf/attribute-filter.xml new file mode 100644 index 000000000..d4d57250a --- /dev/null +++ b/testbed/integration/shibboleth-idp/config/shib-idp/conf/attribute-filter.xml @@ -0,0 +1,160 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/testbed/integration/shibboleth-idp/config/shib-idp/conf/attribute-resolver.xml b/testbed/integration/shibboleth-idp/config/shib-idp/conf/attribute-resolver.xml new file mode 100644 index 000000000..135b4bc53 --- /dev/null +++ b/testbed/integration/shibboleth-idp/config/shib-idp/conf/attribute-resolver.xml @@ -0,0 +1,270 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/testbed/integration/shibboleth-idp/config/shib-idp/conf/cas-protocol.xml b/testbed/integration/shibboleth-idp/config/shib-idp/conf/cas-protocol.xml new file mode 100644 index 000000000..374aa0523 --- /dev/null +++ b/testbed/integration/shibboleth-idp/config/shib-idp/conf/cas-protocol.xml @@ -0,0 +1,112 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/testbed/integration/shibboleth-idp/config/shib-idp/conf/idp.properties b/testbed/integration/shibboleth-idp/config/shib-idp/conf/idp.properties new file mode 100644 index 000000000..50af60005 --- /dev/null +++ b/testbed/integration/shibboleth-idp/config/shib-idp/conf/idp.properties @@ -0,0 +1,226 @@ +# Load any additional property resources from a comma-delimited list +idp.additionalProperties=/conf/ldap.properties, /conf/saml-nameid.properties, /conf/services.properties, /conf/authn/duo.properties, /credentials/secrets.properties + +# In most cases (and unless noted in the surrounding comments) the +# commented settings in the distributed files document default behavior. +# Uncomment them and change the value to change functionality. +# +# Uncommented properties are either required or ship non-defaulted. + +# Set the entityID of the IdP +idp.entityID=https://idp.unicon.local/idp/shibboleth + +# Set the file path which backs the IdP's own metadata publishing endpoint at /shibboleth. +# Set to empty value to disable and return a 404. +#idp.entityID.metadataFile=%{idp.home}/metadata/idp-metadata.xml + +# Set the scope used in the attribute resolver for scoped attributes +idp.scope=unicon.local + +# General cookie properties (maxAge only applies to persistent cookies) +#idp.cookie.secure = true +#idp.cookie.httpOnly = true +#idp.cookie.domain = +#idp.cookie.path = +#idp.cookie.maxAge = 31536000 +# These control operation of the SameSite filter, which is off by default. +#idp.cookie.sameSite = None +#idp.cookie.sameSiteCondition = shibboleth.Conditions.FALSE + +# Enable cross-site request forgery mitigation for views. +idp.csrf.enabled=true +# Name of the HTTP parameter that stores the CSRF token. +#idp.csrf.token.parameter = csrf_token + +# HSTS/CSP response headers +#idp.hsts = max-age=0 +# X-Frame-Options value, set to DENY or SAMEORIGIN to block framing +#idp.frameoptions = DENY +# Content-Security-Policy value, set to match X-Frame-Options default +#idp.csp = frame-ancestors 'none'; + +# Set the location of user-supplied web flow definitions +#idp.webflows = %{idp.home}/flows + +# Set the location of Velocity view templates +#idp.views = %{idp.home}/views + +# Settings for internal AES encryption key +#idp.sealer.keyStrategy = shibboleth.DataSealerKeyStrategy +#idp.sealer.storeType = JCEKS +#idp.sealer.updateInterval = PT15M +#idp.sealer.aliasBase = secret +idp.sealer.storeResource=%{idp.home}/credentials/sealer.jks +idp.sealer.versionResource=%{idp.home}/credentials/sealer.kver + +# Settings for public/private signing and encryption key(s) +# During decryption key rollover, point the ".2" properties at a second +# keypair, uncomment in credentials.xml, then publish it in your metadata. +idp.signing.key=%{idp.home}/credentials/idp-signing.key +idp.signing.cert=%{idp.home}/credentials/idp-signing.crt +idp.encryption.key=%{idp.home}/credentials/idp-encryption.key +idp.encryption.cert=%{idp.home}/credentials/idp-encryption.crt +#idp.encryption.key.2 = %{idp.home}/credentials/idp-encryption-old.key +#idp.encryption.cert.2 = %{idp.home}/credentials/idp-encryption-old.crt + +# Sets the bean ID to use as a default security configuration set +#idp.security.config = shibboleth.DefaultSecurityConfiguration + +# To downgrade to SHA-1, set to shibboleth.SigningConfiguration.SHA1 +#idp.signing.config = shibboleth.SigningConfiguration.SHA256 + +# The new install default for encryption is now AES-GCM. +idp.encryption.config=shibboleth.EncryptionConfiguration.GCM + +# Configures trust evaluation of keys used by services at runtime +# Internal default is Chaining, overriden for new installs +idp.trust.signatures=shibboleth.ExplicitKeySignatureTrustEngine +# Other options: +# shibboleth.ChainingSignatureTrustEngine, shibboleth.PKIXSignatureTrustEngine +idp.trust.certificates=shibboleth.ExplicitKeyX509TrustEngine +# Other options: +# shibboleth.ChainingX509TrustEngine, shibboleth.PKIXX509TrustEngine + +# If true, encryption will happen whenever a key to use can be located, but +# failure to encrypt won't result in request failure. +idp.encryption.optional = true + +# Configuration of client- and server-side storage plugins +#idp.storage.cleanupInterval = PT10M +idp.storage.htmlLocalStorage=true + +# Set to true to expose more detailed errors in responses to SPs +#idp.errors.detailed = false +# Set to false to skip signing of SAML response messages that signal errors +#idp.errors.signed = true +# Name of bean containing a list of Java exception classes to ignore +#idp.errors.excludedExceptions = ExceptionClassListBean +# Name of bean containing a property set mapping exception names to views +#idp.errors.exceptionMappings = ExceptionToViewPropertyBean +# Set if a different default view name for events and exceptions is needed +#idp.errors.defaultView = error + +# Set to false to disable the IdP session layer +#idp.session.enabled = true + +# Set to "shibboleth.StorageService" for server-side storage of user sessions +#idp.session.StorageService = shibboleth.ClientSessionStorageService + +# Size of session IDs +#idp.session.idSize = 32 +# Bind sessions to IP addresses +#idp.session.consistentAddress = true +# Inactivity timeout +#idp.session.timeout = PT60M +# Extra time to store sessions for logout +#idp.session.slop = PT0S +# Tolerate storage-related errors +#idp.session.maskStorageFailure = false +# Track information about SPs logged into +idp.session.trackSPSessions=true +# Support lookup by SP for SAML logout +idp.session.secondaryServiceIndex=true +# Length of time to track SP sessions +#idp.session.defaultSPlifetime = PT2H + +# Regular expression matching login flows to enable, e.g. IPAddress|Password +idp.authn.flows=Password + +# Default lifetime and timeout of various authentication methods +#idp.authn.defaultLifetime = PT60M +#idp.authn.defaultTimeout = PT30M + +# Whether to populate relying party user interface information for display +# during authentication, consent, terms-of-use. +#idp.authn.rpui = true + +# Whether to prioritize "active" results when an SP requests more than +# one possible matching login method (V2 behavior was to favor them) +#idp.authn.favorSSO = false + +# Whether to fail requests when a user identity after authentication +# doesn't match the identity in a pre-existing session. +#idp.authn.identitySwitchIsError = false + +# Set to "shibboleth.StorageService" or custom bean for alternate storage of consent +#idp.consent.StorageService = shibboleth.ClientPersistentStorageService + +# Set to "shibboleth.consent.AttributeConsentStorageKey" to use an attribute +# to key user consent storage records (and set the attribute name) +#idp.consent.attribute-release.userStorageKey = shibboleth.consent.PrincipalConsentStorageKey +#idp.consent.attribute-release.userStorageKeyAttribute = uid +#idp.consent.terms-of-use.userStorageKey = shibboleth.consent.PrincipalConsentStorageKey +#idp.consent.terms-of-use.userStorageKeyAttribute = uid + +# Suffix of message property used as value of consent storage records when idp.consent.compareValues is true. +# Defaults to text displayed to the user. +#idp.consent.terms-of-use.consentValueMessageCodeSuffix = .text + +# Flags controlling how built-in attribute consent feature operates +#idp.consent.allowDoNotRemember = true +#idp.consent.allowGlobal = true +#idp.consent.allowPerAttribute = false + +# Whether attribute values and terms of use text are compared +#idp.consent.compareValues = false +# Maximum number of consent records for space-limited storage (e.g. cookies) +#idp.consent.maxStoredRecords = 10 +# Maximum number of consent records for larger/server-side storage (0 = no limit) +#idp.consent.expandedMaxStoredRecords = 0 + +# Time in milliseconds to expire consent storage records. +#idp.consent.storageRecordLifetime = P1Y + +# Whether to lookup metadata, etc. for every SP involved in a logout +# for use by user interface logic; adds overhead so off by default. +#idp.logout.elaboration = false + +# Whether to require logout requests/responses be signed/authenticated. +#idp.logout.authenticated = true + +# Bean to determine whether user should be allowed to cancel logout +#idp.logout.promptUser=shibboleth.Conditions.FALSE + +# Message freshness and replay cache tuning +#idp.policy.messageLifetime = PT3M +#idp.policy.clockSkew = PT3M + +# Set to custom bean for alternate storage of replay cache +#idp.replayCache.StorageService = shibboleth.StorageService +#idp.replayCache.strict = true + +# Toggles whether to allow outbound messages via SAML artifact +#idp.artifact.enabled = true +# Suppresses typical signing/encryption when artifact binding used +#idp.artifact.secureChannel = true +# May differ to direct SAML 2 artifact lookups to specific server nodes +#idp.artifact.endpointIndex = 2 +# Set to custom bean for alternate storage of artifact map state +#idp.artifact.StorageService = shibboleth.StorageService + +# Comma-delimited languages to use if not match can be found with the +# browser-supported languages, defaults to an empty list. +idp.ui.fallbackLanguages=en,fr,de + +# Storage service used by CAS protocol +# Defaults to shibboleth.StorageService (in-memory) +# MUST be server-side storage (e.g. in-memory, memcached, database) +# NOTE that idp.session.StorageService requires server-side storage +# when CAS protocol is enabled +#idp.cas.StorageService=shibboleth.StorageService + +# CAS service registry implementation class +#idp.cas.serviceRegistryClass=net.shibboleth.idp.cas.service.PatternServiceRegistry + +# If true, CAS services provisioned with SAML metadata are identified via entityID +#idp.cas.relyingPartyIdFromMetadata=false + +# F-TICKS auditing - set a salt to include hashed username +#idp.fticks.federation=MyFederation +#idp.fticks.algorithm=SHA-256 +#idp.fticks.salt=somethingsecret +#idp.fticks.loghost=localhost +#idp.fticks.logport=514 + +# Set false if you want SAML bindings "spelled out" in audit log +idp.audit.shortenBindings=true diff --git a/testbed/integration/shibboleth-idp/config/shib-idp/conf/idp.properties.dist b/testbed/integration/shibboleth-idp/config/shib-idp/conf/idp.properties.dist new file mode 100644 index 000000000..7ea276654 --- /dev/null +++ b/testbed/integration/shibboleth-idp/config/shib-idp/conf/idp.properties.dist @@ -0,0 +1,226 @@ +# Load any additional property resources from a comma-delimited list +idp.additionalProperties=/conf/ldap.properties, /conf/saml-nameid.properties, /conf/services.properties, /conf/authn/duo.properties, /credentials/secrets.properties + +# In most cases (and unless noted in the surrounding comments) the +# commented settings in the distributed files document default behavior. +# Uncomment them and change the value to change functionality. +# +# Uncommented properties are either required or ship non-defaulted. + +# Set the entityID of the IdP +idp.entityID=https://idp.example.org/idp/shibboleth + +# Set the file path which backs the IdP's own metadata publishing endpoint at /shibboleth. +# Set to empty value to disable and return a 404. +#idp.entityID.metadataFile=%{idp.home}/metadata/idp-metadata.xml + +# Set the scope used in the attribute resolver for scoped attributes +idp.scope=example.org + +# General cookie properties (maxAge only applies to persistent cookies) +#idp.cookie.secure = true +#idp.cookie.httpOnly = true +#idp.cookie.domain = +#idp.cookie.path = +#idp.cookie.maxAge = 31536000 +# These control operation of the SameSite filter, which is off by default. +#idp.cookie.sameSite = None +#idp.cookie.sameSiteCondition = shibboleth.Conditions.FALSE + +# Enable cross-site request forgery mitigation for views. +idp.csrf.enabled=true +# Name of the HTTP parameter that stores the CSRF token. +#idp.csrf.token.parameter = csrf_token + +# HSTS/CSP response headers +#idp.hsts = max-age=0 +# X-Frame-Options value, set to DENY or SAMEORIGIN to block framing +#idp.frameoptions = DENY +# Content-Security-Policy value, set to match X-Frame-Options default +#idp.csp = frame-ancestors 'none'; + +# Set the location of user-supplied web flow definitions +#idp.webflows = %{idp.home}/flows + +# Set the location of Velocity view templates +#idp.views = %{idp.home}/views + +# Settings for internal AES encryption key +#idp.sealer.keyStrategy = shibboleth.DataSealerKeyStrategy +#idp.sealer.storeType = JCEKS +#idp.sealer.updateInterval = PT15M +#idp.sealer.aliasBase = secret +idp.sealer.storeResource=%{idp.home}/credentials/sealer.jks +idp.sealer.versionResource=%{idp.home}/credentials/sealer.kver + +# Settings for public/private signing and encryption key(s) +# During decryption key rollover, point the ".2" properties at a second +# keypair, uncomment in credentials.xml, then publish it in your metadata. +idp.signing.key=%{idp.home}/credentials/idp-signing.key +idp.signing.cert=%{idp.home}/credentials/idp-signing.crt +idp.encryption.key=%{idp.home}/credentials/idp-encryption.key +idp.encryption.cert=%{idp.home}/credentials/idp-encryption.crt +#idp.encryption.key.2 = %{idp.home}/credentials/idp-encryption-old.key +#idp.encryption.cert.2 = %{idp.home}/credentials/idp-encryption-old.crt + +# Sets the bean ID to use as a default security configuration set +#idp.security.config = shibboleth.DefaultSecurityConfiguration + +# To downgrade to SHA-1, set to shibboleth.SigningConfiguration.SHA1 +#idp.signing.config = shibboleth.SigningConfiguration.SHA256 + +# The new install default for encryption is now AES-GCM. +idp.encryption.config=shibboleth.EncryptionConfiguration.GCM + +# Configures trust evaluation of keys used by services at runtime +# Internal default is Chaining, overriden for new installs +idp.trust.signatures=shibboleth.ExplicitKeySignatureTrustEngine +# Other options: +# shibboleth.ChainingSignatureTrustEngine, shibboleth.PKIXSignatureTrustEngine +idp.trust.certificates=shibboleth.ExplicitKeyX509TrustEngine +# Other options: +# shibboleth.ChainingX509TrustEngine, shibboleth.PKIXX509TrustEngine + +# If true, encryption will happen whenever a key to use can be located, but +# failure to encrypt won't result in request failure. +#idp.encryption.optional = false + +# Configuration of client- and server-side storage plugins +#idp.storage.cleanupInterval = PT10M +idp.storage.htmlLocalStorage=true + +# Set to true to expose more detailed errors in responses to SPs +#idp.errors.detailed = false +# Set to false to skip signing of SAML response messages that signal errors +#idp.errors.signed = true +# Name of bean containing a list of Java exception classes to ignore +#idp.errors.excludedExceptions = ExceptionClassListBean +# Name of bean containing a property set mapping exception names to views +#idp.errors.exceptionMappings = ExceptionToViewPropertyBean +# Set if a different default view name for events and exceptions is needed +#idp.errors.defaultView = error + +# Set to false to disable the IdP session layer +#idp.session.enabled = true + +# Set to "shibboleth.StorageService" for server-side storage of user sessions +#idp.session.StorageService = shibboleth.ClientSessionStorageService + +# Size of session IDs +#idp.session.idSize = 32 +# Bind sessions to IP addresses +#idp.session.consistentAddress = true +# Inactivity timeout +#idp.session.timeout = PT60M +# Extra time to store sessions for logout +#idp.session.slop = PT0S +# Tolerate storage-related errors +#idp.session.maskStorageFailure = false +# Track information about SPs logged into +idp.session.trackSPSessions=true +# Support lookup by SP for SAML logout +idp.session.secondaryServiceIndex=true +# Length of time to track SP sessions +#idp.session.defaultSPlifetime = PT2H + +# Regular expression matching login flows to enable, e.g. IPAddress|Password +idp.authn.flows=Password + +# Default lifetime and timeout of various authentication methods +#idp.authn.defaultLifetime = PT60M +#idp.authn.defaultTimeout = PT30M + +# Whether to populate relying party user interface information for display +# during authentication, consent, terms-of-use. +#idp.authn.rpui = true + +# Whether to prioritize "active" results when an SP requests more than +# one possible matching login method (V2 behavior was to favor them) +#idp.authn.favorSSO = false + +# Whether to fail requests when a user identity after authentication +# doesn't match the identity in a pre-existing session. +#idp.authn.identitySwitchIsError = false + +# Set to "shibboleth.StorageService" or custom bean for alternate storage of consent +#idp.consent.StorageService = shibboleth.ClientPersistentStorageService + +# Set to "shibboleth.consent.AttributeConsentStorageKey" to use an attribute +# to key user consent storage records (and set the attribute name) +#idp.consent.attribute-release.userStorageKey = shibboleth.consent.PrincipalConsentStorageKey +#idp.consent.attribute-release.userStorageKeyAttribute = uid +#idp.consent.terms-of-use.userStorageKey = shibboleth.consent.PrincipalConsentStorageKey +#idp.consent.terms-of-use.userStorageKeyAttribute = uid + +# Suffix of message property used as value of consent storage records when idp.consent.compareValues is true. +# Defaults to text displayed to the user. +#idp.consent.terms-of-use.consentValueMessageCodeSuffix = .text + +# Flags controlling how built-in attribute consent feature operates +#idp.consent.allowDoNotRemember = true +#idp.consent.allowGlobal = true +#idp.consent.allowPerAttribute = false + +# Whether attribute values and terms of use text are compared +#idp.consent.compareValues = false +# Maximum number of consent records for space-limited storage (e.g. cookies) +#idp.consent.maxStoredRecords = 10 +# Maximum number of consent records for larger/server-side storage (0 = no limit) +#idp.consent.expandedMaxStoredRecords = 0 + +# Time in milliseconds to expire consent storage records. +#idp.consent.storageRecordLifetime = P1Y + +# Whether to lookup metadata, etc. for every SP involved in a logout +# for use by user interface logic; adds overhead so off by default. +#idp.logout.elaboration = false + +# Whether to require logout requests/responses be signed/authenticated. +#idp.logout.authenticated = true + +# Bean to determine whether user should be allowed to cancel logout +#idp.logout.promptUser=shibboleth.Conditions.FALSE + +# Message freshness and replay cache tuning +#idp.policy.messageLifetime = PT3M +#idp.policy.clockSkew = PT3M + +# Set to custom bean for alternate storage of replay cache +#idp.replayCache.StorageService = shibboleth.StorageService +#idp.replayCache.strict = true + +# Toggles whether to allow outbound messages via SAML artifact +#idp.artifact.enabled = true +# Suppresses typical signing/encryption when artifact binding used +#idp.artifact.secureChannel = true +# May differ to direct SAML 2 artifact lookups to specific server nodes +#idp.artifact.endpointIndex = 2 +# Set to custom bean for alternate storage of artifact map state +#idp.artifact.StorageService = shibboleth.StorageService + +# Comma-delimited languages to use if not match can be found with the +# browser-supported languages, defaults to an empty list. +idp.ui.fallbackLanguages=en,fr,de + +# Storage service used by CAS protocol +# Defaults to shibboleth.StorageService (in-memory) +# MUST be server-side storage (e.g. in-memory, memcached, database) +# NOTE that idp.session.StorageService requires server-side storage +# when CAS protocol is enabled +#idp.cas.StorageService=shibboleth.StorageService + +# CAS service registry implementation class +#idp.cas.serviceRegistryClass=net.shibboleth.idp.cas.service.PatternServiceRegistry + +# If true, CAS services provisioned with SAML metadata are identified via entityID +#idp.cas.relyingPartyIdFromMetadata=false + +# F-TICKS auditing - set a salt to include hashed username +#idp.fticks.federation=MyFederation +#idp.fticks.algorithm=SHA-256 +#idp.fticks.salt=somethingsecret +#idp.fticks.loghost=localhost +#idp.fticks.logport=514 + +# Set false if you want SAML bindings "spelled out" in audit log +idp.audit.shortenBindings=true diff --git a/testbed/integration/shibboleth-idp/config/shib-idp/conf/ldap.properties b/testbed/integration/shibboleth-idp/config/shib-idp/conf/ldap.properties new file mode 100644 index 000000000..2b1774cda --- /dev/null +++ b/testbed/integration/shibboleth-idp/config/shib-idp/conf/ldap.properties @@ -0,0 +1,61 @@ +# LDAP authentication configuration, see authn/ldap-authn-config.xml +# Note, this doesn't apply to the use of JAAS + +## Authenticator strategy, either anonSearchAuthenticator, bindSearchAuthenticator, directAuthenticator, adAuthenticator +idp.authn.LDAP.authenticator = bindSearchAuthenticator + +## Connection properties ## +idp.authn.LDAP.ldapURL=ldaps://directory +#set below to true if your LDAP server is configured for it +idp.authn.LDAP.useStartTLS = false +#idp.authn.LDAP.useSSL = false +# Time in milliseconds that connects will block +#idp.authn.LDAP.connectTimeout = PT3S +# Time in milliseconds to wait for responses +#idp.authn.LDAP.responseTimeout = PT3S + +## SSL configuration, either jvmTrust, certificateTrust, or keyStoreTrust +idp.authn.LDAP.sslConfig = certificateTrust +## If using certificateTrust above, set to the trusted certificate's path +idp.authn.LDAP.trustCertificates=%{idp.home}/credentials/ldap-server.crt +## If using keyStoreTrust above, set to the truststore path +idp.authn.LDAP.trustStore=%{idp.home}/credentials/ldap-server.truststore + +## Return attributes during authentication +idp.authn.LDAP.returnAttributes=passwordExpirationTime,loginGraceRemaining + +## DN resolution properties ## + +# Search DN resolution, used by anonSearchAuthenticator, bindSearchAuthenticator +# for AD: CN=Users,DC=example,DC=org +idp.authn.LDAP.baseDN=dc=unicon,dc=local +idp.authn.LDAP.subtreeSearch = true +idp.authn.LDAP.userFilter=(uid={user}) +# bind search configuration +# for AD: idp.authn.LDAP.bindDN=adminuser@domain.com +idp.authn.LDAP.bindDN=cn=admin,dc=unicon,dc=local + +# Format DN resolution, used by directAuthenticator, adAuthenticator +# for AD use idp.authn.LDAP.dnFormat=%s@domain.com +idp.authn.LDAP.dnFormat=uid=%s,dc=unicon,dc=local + +# LDAP attribute configuration, see attribute-resolver.xml +# Note, this likely won't apply to the use of legacy V2 resolver configurations +idp.attribute.resolver.LDAP.ldapURL=%{idp.authn.LDAP.ldapURL} +idp.attribute.resolver.LDAP.connectTimeout=%{idp.authn.LDAP.connectTimeout:PT3S} +idp.attribute.resolver.LDAP.responseTimeout=%{idp.authn.LDAP.responseTimeout:PT3S} +idp.attribute.resolver.LDAP.baseDN=%{idp.authn.LDAP.baseDN:undefined} +idp.attribute.resolver.LDAP.bindDN=%{idp.authn.LDAP.bindDN:undefined} +idp.attribute.resolver.LDAP.useStartTLS=%{idp.authn.LDAP.useStartTLS:true} +idp.attribute.resolver.LDAP.trustCertificates=%{idp.authn.LDAP.trustCertificates:undefined} +idp.attribute.resolver.LDAP.searchFilter=(uid=$resolutionContext.principal) + +# LDAP pool configuration, used for both authn and DN resolution +#idp.pool.LDAP.minSize = 3 +#idp.pool.LDAP.maxSize = 10 +#idp.pool.LDAP.validateOnCheckout = false +#idp.pool.LDAP.validatePeriodically = true +#idp.pool.LDAP.validatePeriod = PT5M +#idp.pool.LDAP.prunePeriod = PT5M +#idp.pool.LDAP.idleTime = PT10M +#idp.pool.LDAP.blockWaitTime = PT3S diff --git a/testbed/integration/shibboleth-idp/config/shib-idp/conf/ldap.properties.dist b/testbed/integration/shibboleth-idp/config/shib-idp/conf/ldap.properties.dist new file mode 100644 index 000000000..74d4b77f6 --- /dev/null +++ b/testbed/integration/shibboleth-idp/config/shib-idp/conf/ldap.properties.dist @@ -0,0 +1,61 @@ +# LDAP authentication configuration, see authn/ldap-authn-config.xml +# Note, this doesn't apply to the use of JAAS + +## Authenticator strategy, either anonSearchAuthenticator, bindSearchAuthenticator, directAuthenticator, adAuthenticator +#idp.authn.LDAP.authenticator = anonSearchAuthenticator + +## Connection properties ## +idp.authn.LDAP.ldapURL=ldap://localhost:10389 +#set below to true if your LDAP server is configured for it +idp.authn.LDAP.useStartTLS = false +#idp.authn.LDAP.useSSL = false +# Time in milliseconds that connects will block +#idp.authn.LDAP.connectTimeout = PT3S +# Time in milliseconds to wait for responses +#idp.authn.LDAP.responseTimeout = PT3S + +## SSL configuration, either jvmTrust, certificateTrust, or keyStoreTrust +#idp.authn.LDAP.sslConfig = certificateTrust +## If using certificateTrust above, set to the trusted certificate's path +idp.authn.LDAP.trustCertificates=%{idp.home}/credentials/ldap-server.crt +## If using keyStoreTrust above, set to the truststore path +idp.authn.LDAP.trustStore=%{idp.home}/credentials/ldap-server.truststore + +## Return attributes during authentication +idp.authn.LDAP.returnAttributes=passwordExpirationTime,loginGraceRemaining + +## DN resolution properties ## + +# Search DN resolution, used by anonSearchAuthenticator, bindSearchAuthenticator +# for AD: CN=Users,DC=example,DC=org +idp.authn.LDAP.baseDN=ou=people,dc=example,dc=org +#idp.authn.LDAP.subtreeSearch = false +idp.authn.LDAP.userFilter=(uid={user}) +# bind search configuration +# for AD: idp.authn.LDAP.bindDN=adminuser@domain.com +idp.authn.LDAP.bindDN=uid=myservice,ou=system + +# Format DN resolution, used by directAuthenticator, adAuthenticator +# for AD use idp.authn.LDAP.dnFormat=%s@domain.com +idp.authn.LDAP.dnFormat=uid=%s,ou=people,dc=example,dc=org + +# LDAP attribute configuration, see attribute-resolver.xml +# Note, this likely won't apply to the use of legacy V2 resolver configurations +idp.attribute.resolver.LDAP.ldapURL=%{idp.authn.LDAP.ldapURL} +idp.attribute.resolver.LDAP.connectTimeout=%{idp.authn.LDAP.connectTimeout:PT3S} +idp.attribute.resolver.LDAP.responseTimeout=%{idp.authn.LDAP.responseTimeout:PT3S} +idp.attribute.resolver.LDAP.baseDN=%{idp.authn.LDAP.baseDN:undefined} +idp.attribute.resolver.LDAP.bindDN=%{idp.authn.LDAP.bindDN:undefined} +idp.attribute.resolver.LDAP.useStartTLS=%{idp.authn.LDAP.useStartTLS:true} +idp.attribute.resolver.LDAP.trustCertificates=%{idp.authn.LDAP.trustCertificates:undefined} +idp.attribute.resolver.LDAP.searchFilter=(uid=$resolutionContext.principal) + +# LDAP pool configuration, used for both authn and DN resolution +#idp.pool.LDAP.minSize = 3 +#idp.pool.LDAP.maxSize = 10 +#idp.pool.LDAP.validateOnCheckout = false +#idp.pool.LDAP.validatePeriodically = true +#idp.pool.LDAP.validatePeriod = PT5M +#idp.pool.LDAP.prunePeriod = PT5M +#idp.pool.LDAP.idleTime = PT10M +#idp.pool.LDAP.blockWaitTime = PT3S diff --git a/testbed/integration/shibboleth-idp/config/shib-idp/conf/metadata-providers.xml b/testbed/integration/shibboleth-idp/config/shib-idp/conf/metadata-providers.xml new file mode 100644 index 000000000..bbe9759c8 --- /dev/null +++ b/testbed/integration/shibboleth-idp/config/shib-idp/conf/metadata-providers.xml @@ -0,0 +1,103 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + https://mdq.incommon.org/ + + + diff --git a/testbed/integration/shibboleth-idp/config/shib-idp/conf/relying-party.xml b/testbed/integration/shibboleth-idp/config/shib-idp/conf/relying-party.xml new file mode 100644 index 000000000..5127515ed --- /dev/null +++ b/testbed/integration/shibboleth-idp/config/shib-idp/conf/relying-party.xml @@ -0,0 +1,78 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/testbed/integration/shibboleth-idp/config/shib-idp/conf/services.xml b/testbed/integration/shibboleth-idp/config/shib-idp/conf/services.xml new file mode 100644 index 000000000..c38ff2aa3 --- /dev/null +++ b/testbed/integration/shibboleth-idp/config/shib-idp/conf/services.xml @@ -0,0 +1,70 @@ + + + + + + + %{idp.home}/conf/relying-party.xml + %{idp.home}/conf/credentials.xml + %{idp.home}/system/conf/relying-party-system.xml + + + + %{idp.home}/conf/metadata-providers.xml + ${idp.home}/conf/dynamic/metadata-providers.xml + %{idp.home}/system/conf/metadata-providers-system.xml + + + + %{idp.home}/conf/attribute-resolver.xml + + + + + %{idp.home}/conf/attribute-registry.xml + %{idp.home}/system/conf/attribute-registry-system.xml + %{idp.home}/conf/attributes/default-rules.xml + %{idp.home}/conf/attribute-resolver.xml + + + + %{idp.home}/conf/attribute-filter.xml + + + + %{idp.home}/conf/saml-nameid.xml + %{idp.home}/system/conf/saml-nameid-system.xml + + + + %{idp.home}/conf/access-control.xml + %{idp.home}/system/conf/access-control-system.xml + + + + %{idp.home}/conf/cas-protocol.xml + + + + + %{idp.home}/messages/messages + %{idp.home}/system/messages/messages + + + diff --git a/testbed/integration/shibboleth-idp/config/shib-idp/metadata/idp-metadata.xml b/testbed/integration/shibboleth-idp/config/shib-idp/metadata/idp-metadata.xml new file mode 100644 index 000000000..d9f0a4019 --- /dev/null +++ b/testbed/integration/shibboleth-idp/config/shib-idp/metadata/idp-metadata.xml @@ -0,0 +1,36 @@ + + + + unicon.local + + + + + +MIIDIDCCAgigAwIBAgIJAN45D3DbemrtMA0GCSqGSIb3DQEBCwUAMBsxGTAXBgNV +BAMMEGlkcC51bmljb24ubG9jYWwwHhcNMjAwNTI3MTgxMDE0WhcNMjUwNTI2MTgx +MDE0WjAbMRkwFwYDVQQDDBBpZHAudW5pY29uLmxvY2FsMIIBIjANBgkqhkiG9w0B +AQEFAAOCAQ8AMIIBCgKCAQEAoDNLPFL/47cSWKbfb89lVz3EsIlb4z8lZbZUNyzF +m3my5mioe9b6xrS8QF16l1ALb8SEwQzECPKuyRp1LQ5Rj79Ba38TDl+4BezjC7Ui +f9OwzXIYfcetEFZ85tjufIl3ryVbY2kQ1TRypqk72pF1uDLEnqXrnystRxi4x22f +wTu+KkTy0tL/5oV2tjJY0vtO3YAsjNpqqI6WqcbjewtJVIrG4OuOF3r9CPCU7hOY +fc4BtvSQhOgryJM+dF9PmpvALJO8LrMBsNdAO3gz37+mA1F/tD7WYP2XLvrHh+Wd +c0QJ/f8AzCJm5QV4lA/UH/0tKMQS178ti7+4Jyw38iHkYQIDAQABo2cwZTBEBgNV +HREEPTA7ghBpZHAudW5pY29uLmxvY2FshidodHRwczovL2lkcC51bmljb24ubG9j +YWwvaWRwL3NoaWJib2xldGgwHQYDVR0OBBYEFGFkPVcsjWlZDfUk1+SifxhP1l7I +MA0GCSqGSIb3DQEBCwUAA4IBAQBZUq9P9A9DsypasD6WcHNP/EyP5spKRRu2CTWm +Y645kOjg7qMIasHVwA5jSPU7ozgPRV6MpdjCJVWYjUpeSCwXx6YAEKFLZ9WXV26i +e1GFTP1lJqlpnJZqs1RBgvF7q/JxFvxSl8UpjoxNufBANC14T6T3EMQ9EvWLTdCM +cEuXxkwzpeEkh5MtCoicgQ1yvay2QGQBbfCauPAASd957+S7brRON4R2gPonCf18 +5rzh7Do7kFBc6pqAHCYGTUz7uY11EPktIC6AIlZmXV1J0wBCP6SoiZDFjwZsj6m6 +S1N5qGtWDOT5vZiT1nF+mNd990c8qjVcyQST42VyXCBnJ7DR + + + + + + + + + + diff --git a/testbed/integration/shibboleth-idp/config/tomcat/catalina.policy b/testbed/integration/shibboleth-idp/config/tomcat/catalina.policy new file mode 100644 index 000000000..e69de29bb diff --git a/testbed/integration/shibboleth-idp/config/tomcat/catalina.properties b/testbed/integration/shibboleth-idp/config/tomcat/catalina.properties new file mode 100644 index 000000000..a22f1dd3a --- /dev/null +++ b/testbed/integration/shibboleth-idp/config/tomcat/catalina.properties @@ -0,0 +1,150 @@ +# Licensed to the Apache Software Foundation (ASF) under one or more +# contributor license agreements. See the NOTICE file distributed with +# this work for additional information regarding copyright ownership. +# The ASF licenses this file to You under the Apache License, Version 2.0 +# (the "License"); you may not use this file except in compliance with +# the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +# +# List of comma-separated packages that start with or equal this string +# will cause a security exception to be thrown when +# passed to checkPackageAccess unless the +# corresponding RuntimePermission ("accessClassInPackage."+package) has +# been granted. +package.access=sun.,org.apache.catalina.,org.apache.coyote.,org.apache.jasper.,org.apache.tomcat. +# +# List of comma-separated packages that start with or equal this string +# will cause a security exception to be thrown when +# passed to checkPackageDefinition unless the +# corresponding RuntimePermission ("defineClassInPackage."+package) has +# been granted. +# +# by default, no packages are restricted for definition, and none of +# the class loaders supplied with the JDK call checkPackageDefinition. +# +package.definition=sun.,java.,org.apache.catalina.,org.apache.coyote.,\ +org.apache.jasper.,org.apache.naming.,org.apache.tomcat. + +# +# +# List of comma-separated paths defining the contents of the "common" +# classloader. Prefixes should be used to define what is the repository type. +# Path may be relative to the CATALINA_HOME or CATALINA_BASE path or absolute. +# If left as blank,the JVM system loader will be used as Catalina's "common" +# loader. +# Examples: +# "foo": Add this folder as a class repository +# "foo/*.jar": Add all the JARs of the specified folder as class +# repositories +# "foo/bar.jar": Add bar.jar as a class repository +# +# Note: Values are enclosed in double quotes ("...") in case either the +# ${catalina.base} path or the ${catalina.home} path contains a comma. +# Because double quotes are used for quoting, the double quote character +# may not appear in a path. +common.loader="${catalina.base}/lib","${catalina.base}/lib/*.jar","${catalina.home}/lib","${catalina.home}/lib/*.jar" + +# +# List of comma-separated paths defining the contents of the "server" +# classloader. Prefixes should be used to define what is the repository type. +# Path may be relative to the CATALINA_HOME or CATALINA_BASE path or absolute. +# If left as blank, the "common" loader will be used as Catalina's "server" +# loader. +# Examples: +# "foo": Add this folder as a class repository +# "foo/*.jar": Add all the JARs of the specified folder as class +# repositories +# "foo/bar.jar": Add bar.jar as a class repository +# +# Note: Values may be enclosed in double quotes ("...") in case either the +# ${catalina.base} path or the ${catalina.home} path contains a comma. +# Because double quotes are used for quoting, the double quote character +# may not appear in a path. +server.loader= + +# +# List of comma-separated paths defining the contents of the "shared" +# classloader. Prefixes should be used to define what is the repository type. +# Path may be relative to the CATALINA_BASE path or absolute. If left as blank, +# the "common" loader will be used as Catalina's "shared" loader. +# Examples: +# "foo": Add this folder as a class repository +# "foo/*.jar": Add all the JARs of the specified folder as class +# repositories +# "foo/bar.jar": Add bar.jar as a class repository +# Please note that for single jars, e.g. bar.jar, you need the URL form +# starting with file:. +# +# Note: Values may be enclosed in double quotes ("...") in case either the +# ${catalina.base} path or the ${catalina.home} path contains a comma. +# Because double quotes are used for quoting, the double quote character +# may not appear in a path. +shared.loader= + +# Default list of JAR files that should not be scanned using the JarScanner +# functionality. This is typically used to scan JARs for configuration +# information. JARs that do not contain such information may be excluded from +# the scan to speed up the scanning process. This is the default list. JARs on +# this list are excluded from all scans. The list must be a comma separated list +# of JAR file names. +# The list of JARs to skip may be over-ridden at a Context level for individual +# scan types by configuring a JarScanner with a nested JarScanFilter. +# The JARs listed below include: +# - Tomcat Bootstrap JARs +# - Tomcat API JARs +# - Catalina JARs +# - Jasper JARs +# - Tomcat JARs +# - Common non-Tomcat JARs +# - Test JARs (JUnit, Cobertura and dependencies) +tomcat.util.scan.StandardJarScanFilter.jarsToSkip=\ +bootstrap.jar,commons-daemon.jar,tomcat-juli.jar,\ +annotations-api.jar,el-api.jar,jsp-api.jar,servlet-api.jar,websocket-api.jar,\ +catalina.jar,catalina-ant.jar,catalina-ha.jar,catalina-storeconfig.jar,\ +catalina-tribes.jar,\ +jasper.jar,jasper-el.jar,ecj-*.jar,\ +tomcat-api.jar,tomcat-util.jar,tomcat-util-scan.jar,tomcat-coyote.jar,\ +tomcat-dbcp.jar,tomcat-jni.jar,tomcat-websocket.jar,\ +tomcat-i18n-en.jar,tomcat-i18n-es.jar,tomcat-i18n-fr.jar,tomcat-i18n-ja.jar,\ +tomcat-juli-adapters.jar,catalina-jmx-remote.jar,catalina-ws.jar,\ +tomcat-jdbc.jar,\ +tools.jar,\ +commons-beanutils*.jar,commons-codec*.jar,commons-collections*.jar,\ +commons-dbcp*.jar,commons-digester*.jar,commons-fileupload*.jar,\ +commons-httpclient*.jar,commons-io*.jar,commons-lang*.jar,commons-logging*.jar,\ +commons-math*.jar,commons-pool*.jar,\ +jstl.jar,taglibs-standard-spec-*.jar,\ +geronimo-spec-jaxrpc*.jar,wsdl4j*.jar,\ +ant.jar,ant-junit*.jar,aspectj*.jar,jmx.jar,h2*.jar,hibernate*.jar,httpclient*.jar,\ +jmx-tools.jar,jta*.jar,log4j*.jar,mail*.jar,slf4j*.jar,\ +xercesImpl.jar,xmlParserAPIs.jar,xml-apis.jar,\ +junit.jar,junit-*.jar,ant-launcher.jar,\ +cobertura-*.jar,asm-*.jar,dom4j-*.jar,icu4j-*.jar,jaxen-*.jar,jdom-*.jar,\ +jetty-*.jar,oro-*.jar,servlet-api-*.jar,tagsoup-*.jar,xmlParserAPIs-*.jar,\ +xom-*.jar + +# Default list of JAR files that should be scanned that overrides the default +# jarsToSkip list above. This is typically used to include a specific JAR that +# has been excluded by a broad file name pattern in the jarsToSkip list. +# The list of JARs to scan may be over-ridden at a Context level for individual +# scan types by configuring a JarScanner with a nested JarScanFilter. +tomcat.util.scan.StandardJarScanFilter.jarsToScan=\ +log4j-web*.jar,log4j-taglib*.jar,log4javascript*.jar,slf4j-taglib*.jar + +# String cache configuration. +tomcat.util.buf.StringCache.byte.enabled=true +#tomcat.util.buf.StringCache.char.enabled=true +#tomcat.util.buf.StringCache.trainThreshold=500000 +#tomcat.util.buf.StringCache.cacheSize=5000 + +# Allow for changes to HTTP request validation +# WARNING: Using this option will expose the server to CVE-2016-6816 +#tomcat.util.http.parser.HttpParser.requestTargetAllow=| diff --git a/testbed/integration/shibboleth-idp/config/tomcat/context.xml b/testbed/integration/shibboleth-idp/config/tomcat/context.xml new file mode 100644 index 000000000..98727cb7b --- /dev/null +++ b/testbed/integration/shibboleth-idp/config/tomcat/context.xml @@ -0,0 +1,36 @@ + + + + + + + + WEB-INF/web.xml + ${catalina.base}/conf/web.xml + + + + + + + diff --git a/testbed/integration/shibboleth-idp/config/tomcat/logging.properties b/testbed/integration/shibboleth-idp/config/tomcat/logging.properties new file mode 100644 index 000000000..cb5ed6611 --- /dev/null +++ b/testbed/integration/shibboleth-idp/config/tomcat/logging.properties @@ -0,0 +1,64 @@ +# Licensed to the Apache Software Foundation (ASF) under one or more +# contributor license agreements. See the NOTICE file distributed with +# this work for additional information regarding copyright ownership. +# The ASF licenses this file to You under the Apache License, Version 2.0 +# (the "License"); you may not use this file except in compliance with +# the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +handlers = 1catalina.org.apache.juli.AsyncFileHandler, 2localhost.org.apache.juli.AsyncFileHandler, 3manager.org.apache.juli.AsyncFileHandler, 4host-manager.org.apache.juli.AsyncFileHandler, java.util.logging.ConsoleHandler + +.handlers = 1catalina.org.apache.juli.AsyncFileHandler, java.util.logging.ConsoleHandler + +############################################################ +# Handler specific properties. +# Describes specific configuration info for Handlers. +############################################################ + +1catalina.org.apache.juli.AsyncFileHandler.level = FINE +1catalina.org.apache.juli.AsyncFileHandler.directory = ${catalina.base}/logs +1catalina.org.apache.juli.AsyncFileHandler.prefix = catalina. + +2localhost.org.apache.juli.AsyncFileHandler.level = FINE +2localhost.org.apache.juli.AsyncFileHandler.directory = ${catalina.base}/logs +2localhost.org.apache.juli.AsyncFileHandler.prefix = localhost. + +3manager.org.apache.juli.AsyncFileHandler.level = FINE +3manager.org.apache.juli.AsyncFileHandler.directory = ${catalina.base}/logs +3manager.org.apache.juli.AsyncFileHandler.prefix = manager. + +4host-manager.org.apache.juli.AsyncFileHandler.level = FINE +4host-manager.org.apache.juli.AsyncFileHandler.directory = ${catalina.base}/logs +4host-manager.org.apache.juli.AsyncFileHandler.prefix = host-manager. + +java.util.logging.ConsoleHandler.level = FINE +java.util.logging.ConsoleHandler.formatter = org.apache.juli.OneLineFormatter + + +############################################################ +# Facility specific properties. +# Provides extra control for each logger. +############################################################ + +org.apache.catalina.core.ContainerBase.[Catalina].[localhost].level = INFO +org.apache.catalina.core.ContainerBase.[Catalina].[localhost].handlers = 2localhost.org.apache.juli.AsyncFileHandler + +org.apache.catalina.core.ContainerBase.[Catalina].[localhost].[/manager].level = INFO +org.apache.catalina.core.ContainerBase.[Catalina].[localhost].[/manager].handlers = 3manager.org.apache.juli.AsyncFileHandler + +org.apache.catalina.core.ContainerBase.[Catalina].[localhost].[/host-manager].level = INFO +org.apache.catalina.core.ContainerBase.[Catalina].[localhost].[/host-manager].handlers = 4host-manager.org.apache.juli.AsyncFileHandler + +# For example, set the org.apache.catalina.util.LifecycleBase logger to log +# each component that extends LifecycleBase changing state: +#org.apache.catalina.util.LifecycleBase.level = FINE + +# To see debug messages in TldLocationsCache, uncomment the following line: +#org.apache.jasper.compiler.TldLocationsCache.level = FINE diff --git a/testbed/integration/shibboleth-idp/config/tomcat/server.xml b/testbed/integration/shibboleth-idp/config/tomcat/server.xml new file mode 100644 index 000000000..f4b875bca --- /dev/null +++ b/testbed/integration/shibboleth-idp/config/tomcat/server.xml @@ -0,0 +1,22 @@ + + + + + + + + + + + + + + + + + diff --git a/testbed/integration/shibboleth-idp/config/tomcat/tomcat-users.xml b/testbed/integration/shibboleth-idp/config/tomcat/tomcat-users.xml new file mode 100644 index 000000000..fcac27d05 --- /dev/null +++ b/testbed/integration/shibboleth-idp/config/tomcat/tomcat-users.xml @@ -0,0 +1,44 @@ + + + + + + + diff --git a/testbed/integration/shibboleth-idp/config/tomcat/tomcat-users.xsd b/testbed/integration/shibboleth-idp/config/tomcat/tomcat-users.xsd new file mode 100644 index 000000000..44e17d0b5 --- /dev/null +++ b/testbed/integration/shibboleth-idp/config/tomcat/tomcat-users.xsd @@ -0,0 +1,59 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/testbed/integration/shibboleth-idp/config/tomcat/web.xml b/testbed/integration/shibboleth-idp/config/tomcat/web.xml new file mode 100644 index 000000000..cf08cfe40 --- /dev/null +++ b/testbed/integration/shibboleth-idp/config/tomcat/web.xml @@ -0,0 +1,4684 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + default + org.apache.catalina.servlets.DefaultServlet + + debug + 0 + + + listings + false + + 1 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + jsp + org.apache.jasper.servlet.JspServlet + + fork + false + + + xpoweredBy + false + + 3 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + default + / + + + + + jsp + *.jsp + *.jspx + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + 30 + + + + + + + + + + + + + 123 + application/vnd.lotus-1-2-3 + + + 3dml + text/vnd.in3d.3dml + + + 3ds + image/x-3ds + + + 3g2 + video/3gpp2 + + + 3gp + video/3gpp + + + 7z + application/x-7z-compressed + + + aab + application/x-authorware-bin + + + aac + audio/x-aac + + + aam + application/x-authorware-map + + + aas + application/x-authorware-seg + + + abs + audio/x-mpeg + + + abw + application/x-abiword + + + ac + application/pkix-attr-cert + + + acc + application/vnd.americandynamics.acc + + + ace + application/x-ace-compressed + + + acu + application/vnd.acucobol + + + acutc + application/vnd.acucorp + + + adp + audio/adpcm + + + aep + application/vnd.audiograph + + + afm + application/x-font-type1 + + + afp + application/vnd.ibm.modcap + + + ahead + application/vnd.ahead.space + + + ai + application/postscript + + + aif + audio/x-aiff + + + aifc + audio/x-aiff + + + aiff + audio/x-aiff + + + aim + application/x-aim + + + air + application/vnd.adobe.air-application-installer-package+zip + + + ait + application/vnd.dvb.ait + + + ami + application/vnd.amiga.ami + + + anx + application/annodex + + + apk + application/vnd.android.package-archive + + + appcache + text/cache-manifest + + + application + application/x-ms-application + + + apr + application/vnd.lotus-approach + + + arc + application/x-freearc + + + art + image/x-jg + + + asc + application/pgp-signature + + + asf + video/x-ms-asf + + + asm + text/x-asm + + + aso + application/vnd.accpac.simply.aso + + + asx + video/x-ms-asf + + + atc + application/vnd.acucorp + + + atom + application/atom+xml + + + atomcat + application/atomcat+xml + + + atomsvc + application/atomsvc+xml + + + atx + application/vnd.antix.game-component + + + au + audio/basic + + + avi + video/x-msvideo + + + avx + video/x-rad-screenplay + + + aw + application/applixware + + + axa + audio/annodex + + + axv + video/annodex + + + azf + application/vnd.airzip.filesecure.azf + + + azs + application/vnd.airzip.filesecure.azs + + + azw + application/vnd.amazon.ebook + + + bat + application/x-msdownload + + + bcpio + application/x-bcpio + + + bdf + application/x-font-bdf + + + bdm + application/vnd.syncml.dm+wbxml + + + bed + application/vnd.realvnc.bed + + + bh2 + application/vnd.fujitsu.oasysprs + + + bin + application/octet-stream + + + blb + application/x-blorb + + + blorb + application/x-blorb + + + bmi + application/vnd.bmi + + + bmp + image/bmp + + + body + text/html + + + book + application/vnd.framemaker + + + box + application/vnd.previewsystems.box + + + boz + application/x-bzip2 + + + bpk + application/octet-stream + + + btif + image/prs.btif + + + bz + application/x-bzip + + + bz2 + application/x-bzip2 + + + c + text/x-c + + + c11amc + application/vnd.cluetrust.cartomobile-config + + + c11amz + application/vnd.cluetrust.cartomobile-config-pkg + + + c4d + application/vnd.clonk.c4group + + + c4f + application/vnd.clonk.c4group + + + c4g + application/vnd.clonk.c4group + + + c4p + application/vnd.clonk.c4group + + + c4u + application/vnd.clonk.c4group + + + cab + application/vnd.ms-cab-compressed + + + caf + audio/x-caf + + + cap + application/vnd.tcpdump.pcap + + + car + application/vnd.curl.car + + + cat + application/vnd.ms-pki.seccat + + + cb7 + application/x-cbr + + + cba + application/x-cbr + + + cbr + application/x-cbr + + + cbt + application/x-cbr + + + cbz + application/x-cbr + + + cc + text/x-c + + + cct + application/x-director + + + ccxml + application/ccxml+xml + + + cdbcmsg + application/vnd.contact.cmsg + + + cdf + application/x-cdf + + + cdkey + application/vnd.mediastation.cdkey + + + cdmia + application/cdmi-capability + + + cdmic + application/cdmi-container + + + cdmid + application/cdmi-domain + + + cdmio + application/cdmi-object + + + cdmiq + application/cdmi-queue + + + cdx + chemical/x-cdx + + + cdxml + application/vnd.chemdraw+xml + + + cdy + application/vnd.cinderella + + + cer + application/pkix-cert + + + cfs + application/x-cfs-compressed + + + cgm + image/cgm + + + chat + application/x-chat + + + chm + application/vnd.ms-htmlhelp + + + chrt + application/vnd.kde.kchart + + + cif + chemical/x-cif + + + cii + application/vnd.anser-web-certificate-issue-initiation + + + cil + application/vnd.ms-artgalry + + + cla + application/vnd.claymore + + + class + application/java + + + clkk + application/vnd.crick.clicker.keyboard + + + clkp + application/vnd.crick.clicker.palette + + + clkt + application/vnd.crick.clicker.template + + + clkw + application/vnd.crick.clicker.wordbank + + + clkx + application/vnd.crick.clicker + + + clp + application/x-msclip + + + cmc + application/vnd.cosmocaller + + + cmdf + chemical/x-cmdf + + + cml + chemical/x-cml + + + cmp + application/vnd.yellowriver-custom-menu + + + cmx + image/x-cmx + + + cod + application/vnd.rim.cod + + + com + application/x-msdownload + + + conf + text/plain + + + cpio + application/x-cpio + + + cpp + text/x-c + + + cpt + application/mac-compactpro + + + crd + application/x-mscardfile + + + crl + application/pkix-crl + + + crt + application/x-x509-ca-cert + + + cryptonote + application/vnd.rig.cryptonote + + + csh + application/x-csh + + + csml + chemical/x-csml + + + csp + application/vnd.commonspace + + + css + text/css + + + cst + application/x-director + + + csv + text/csv + + + cu + application/cu-seeme + + + curl + text/vnd.curl + + + cww + application/prs.cww + + + cxt + application/x-director + + + cxx + text/x-c + + + dae + model/vnd.collada+xml + + + daf + application/vnd.mobius.daf + + + dart + application/vnd.dart + + + dataless + application/vnd.fdsn.seed + + + davmount + application/davmount+xml + + + dbk + application/docbook+xml + + + dcr + application/x-director + + + dcurl + text/vnd.curl.dcurl + + + dd2 + application/vnd.oma.dd2+xml + + + ddd + application/vnd.fujixerox.ddd + + + deb + application/x-debian-package + + + def + text/plain + + + deploy + application/octet-stream + + + der + application/x-x509-ca-cert + + + dfac + application/vnd.dreamfactory + + + dgc + application/x-dgc-compressed + + + dib + image/bmp + + + dic + text/x-c + + + dir + application/x-director + + + dis + application/vnd.mobius.dis + + + dist + application/octet-stream + + + distz + application/octet-stream + + + djv + image/vnd.djvu + + + djvu + image/vnd.djvu + + + dll + application/x-msdownload + + + dmg + application/x-apple-diskimage + + + dmp + application/vnd.tcpdump.pcap + + + dms + application/octet-stream + + + dna + application/vnd.dna + + + doc + application/msword + + + docm + application/vnd.ms-word.document.macroenabled.12 + + + docx + application/vnd.openxmlformats-officedocument.wordprocessingml.document + + + dot + application/msword + + + dotm + application/vnd.ms-word.template.macroenabled.12 + + + dotx + application/vnd.openxmlformats-officedocument.wordprocessingml.template + + + dp + application/vnd.osgi.dp + + + dpg + application/vnd.dpgraph + + + dra + audio/vnd.dra + + + dsc + text/prs.lines.tag + + + dssc + application/dssc+der + + + dtb + application/x-dtbook+xml + + + dtd + application/xml-dtd + + + dts + audio/vnd.dts + + + dtshd + audio/vnd.dts.hd + + + dump + application/octet-stream + + + dv + video/x-dv + + + dvb + video/vnd.dvb.file + + + dvi + application/x-dvi + + + dwf + model/vnd.dwf + + + dwg + image/vnd.dwg + + + dxf + image/vnd.dxf + + + dxp + application/vnd.spotfire.dxp + + + dxr + application/x-director + + + ecelp4800 + audio/vnd.nuera.ecelp4800 + + + ecelp7470 + audio/vnd.nuera.ecelp7470 + + + ecelp9600 + audio/vnd.nuera.ecelp9600 + + + ecma + application/ecmascript + + + edm + application/vnd.novadigm.edm + + + edx + application/vnd.novadigm.edx + + + efif + application/vnd.picsel + + + ei6 + application/vnd.pg.osasli + + + elc + application/octet-stream + + + emf + application/x-msmetafile + + + eml + message/rfc822 + + + emma + application/emma+xml + + + emz + application/x-msmetafile + + + eol + audio/vnd.digital-winds + + + eot + application/vnd.ms-fontobject + + + eps + application/postscript + + + epub + application/epub+zip + + + es3 + application/vnd.eszigno3+xml + + + esa + application/vnd.osgi.subsystem + + + esf + application/vnd.epson.esf + + + et3 + application/vnd.eszigno3+xml + + + etx + text/x-setext + + + eva + application/x-eva + + + evy + application/x-envoy + + + exe + application/octet-stream + + + exi + application/exi + + + ext + application/vnd.novadigm.ext + + + ez + application/andrew-inset + + + ez2 + application/vnd.ezpix-album + + + ez3 + application/vnd.ezpix-package + + + f + text/x-fortran + + + f4v + video/x-f4v + + + f77 + text/x-fortran + + + f90 + text/x-fortran + + + fbs + image/vnd.fastbidsheet + + + fcdt + application/vnd.adobe.formscentral.fcdt + + + fcs + application/vnd.isac.fcs + + + fdf + application/vnd.fdf + + + fe_launch + application/vnd.denovo.fcselayout-link + + + fg5 + application/vnd.fujitsu.oasysgp + + + fgd + application/x-director + + + fh + image/x-freehand + + + fh4 + image/x-freehand + + + fh5 + image/x-freehand + + + fh7 + image/x-freehand + + + fhc + image/x-freehand + + + fig + application/x-xfig + + + flac + audio/flac + + + fli + video/x-fli + + + flo + application/vnd.micrografx.flo + + + flv + video/x-flv + + + flw + application/vnd.kde.kivio + + + flx + text/vnd.fmi.flexstor + + + fly + text/vnd.fly + + + fm + application/vnd.framemaker + + + fnc + application/vnd.frogans.fnc + + + for + text/x-fortran + + + fpx + image/vnd.fpx + + + frame + application/vnd.framemaker + + + fsc + application/vnd.fsc.weblaunch + + + fst + image/vnd.fst + + + ftc + application/vnd.fluxtime.clip + + + fti + application/vnd.anser-web-funds-transfer-initiation + + + fvt + video/vnd.fvt + + + fxp + application/vnd.adobe.fxp + + + fxpl + application/vnd.adobe.fxp + + + fzs + application/vnd.fuzzysheet + + + g2w + application/vnd.geoplan + + + g3 + image/g3fax + + + g3w + application/vnd.geospace + + + gac + application/vnd.groove-account + + + gam + application/x-tads + + + gbr + application/rpki-ghostbusters + + + gca + application/x-gca-compressed + + + gdl + model/vnd.gdl + + + geo + application/vnd.dynageo + + + gex + application/vnd.geometry-explorer + + + ggb + application/vnd.geogebra.file + + + ggt + application/vnd.geogebra.tool + + + ghf + application/vnd.groove-help + + + gif + image/gif + + + gim + application/vnd.groove-identity-message + + + gml + application/gml+xml + + + gmx + application/vnd.gmx + + + gnumeric + application/x-gnumeric + + + gph + application/vnd.flographit + + + gpx + application/gpx+xml + + + gqf + application/vnd.grafeq + + + gqs + application/vnd.grafeq + + + gram + application/srgs + + + gramps + application/x-gramps-xml + + + gre + application/vnd.geometry-explorer + + + grv + application/vnd.groove-injector + + + grxml + application/srgs+xml + + + gsf + application/x-font-ghostscript + + + gtar + application/x-gtar + + + gtm + application/vnd.groove-tool-message + + + gtw + model/vnd.gtw + + + gv + text/vnd.graphviz + + + gxf + application/gxf + + + gxt + application/vnd.geonext + + + gz + application/x-gzip + + + h + text/x-c + + + h261 + video/h261 + + + h263 + video/h263 + + + h264 + video/h264 + + + hal + application/vnd.hal+xml + + + hbci + application/vnd.hbci + + + hdf + application/x-hdf + + + hh + text/x-c + + + hlp + application/winhlp + + + hpgl + application/vnd.hp-hpgl + + + hpid + application/vnd.hp-hpid + + + hps + application/vnd.hp-hps + + + hqx + application/mac-binhex40 + + + htc + text/x-component + + + htke + application/vnd.kenameaapp + + + htm + text/html + + + html + text/html + + + hvd + application/vnd.yamaha.hv-dic + + + hvp + application/vnd.yamaha.hv-voice + + + hvs + application/vnd.yamaha.hv-script + + + i2g + application/vnd.intergeo + + + icc + application/vnd.iccprofile + + + ice + x-conference/x-cooltalk + + + icm + application/vnd.iccprofile + + + ico + image/x-icon + + + ics + text/calendar + + + ief + image/ief + + + ifb + text/calendar + + + ifm + application/vnd.shana.informed.formdata + + + iges + model/iges + + + igl + application/vnd.igloader + + + igm + application/vnd.insors.igm + + + igs + model/iges + + + igx + application/vnd.micrografx.igx + + + iif + application/vnd.shana.informed.interchange + + + imp + application/vnd.accpac.simply.imp + + + ims + application/vnd.ms-ims + + + in + text/plain + + + ink + application/inkml+xml + + + inkml + application/inkml+xml + + + install + application/x-install-instructions + + + iota + application/vnd.astraea-software.iota + + + ipfix + application/ipfix + + + ipk + application/vnd.shana.informed.package + + + irm + application/vnd.ibm.rights-management + + + irp + application/vnd.irepository.package+xml + + + iso + application/x-iso9660-image + + + itp + application/vnd.shana.informed.formtemplate + + + ivp + application/vnd.immervision-ivp + + + ivu + application/vnd.immervision-ivu + + + jad + text/vnd.sun.j2me.app-descriptor + + + jam + application/vnd.jam + + + jar + application/java-archive + + + java + text/x-java-source + + + jisp + application/vnd.jisp + + + jlt + application/vnd.hp-jlyt + + + jnlp + application/x-java-jnlp-file + + + joda + application/vnd.joost.joda-archive + + + jpe + image/jpeg + + + jpeg + image/jpeg + + + jpg + image/jpeg + + + jpgm + video/jpm + + + jpgv + video/jpeg + + + jpm + video/jpm + + + js + application/javascript + + + jsf + text/plain + + + json + application/json + + + jsonml + application/jsonml+json + + + jspf + text/plain + + + kar + audio/midi + + + karbon + application/vnd.kde.karbon + + + kfo + application/vnd.kde.kformula + + + kia + application/vnd.kidspiration + + + kml + application/vnd.google-earth.kml+xml + + + kmz + application/vnd.google-earth.kmz + + + kne + application/vnd.kinar + + + knp + application/vnd.kinar + + + kon + application/vnd.kde.kontour + + + kpr + application/vnd.kde.kpresenter + + + kpt + application/vnd.kde.kpresenter + + + kpxx + application/vnd.ds-keypoint + + + ksp + application/vnd.kde.kspread + + + ktr + application/vnd.kahootz + + + ktx + image/ktx + + + ktz + application/vnd.kahootz + + + kwd + application/vnd.kde.kword + + + kwt + application/vnd.kde.kword + + + lasxml + application/vnd.las.las+xml + + + latex + application/x-latex + + + lbd + application/vnd.llamagraphics.life-balance.desktop + + + lbe + application/vnd.llamagraphics.life-balance.exchange+xml + + + les + application/vnd.hhe.lesson-player + + + lha + application/x-lzh-compressed + + + link66 + application/vnd.route66.link66+xml + + + list + text/plain + + + list3820 + application/vnd.ibm.modcap + + + listafp + application/vnd.ibm.modcap + + + lnk + application/x-ms-shortcut + + + log + text/plain + + + lostxml + application/lost+xml + + + lrf + application/octet-stream + + + lrm + application/vnd.ms-lrm + + + ltf + application/vnd.frogans.ltf + + + lvp + audio/vnd.lucent.voice + + + lwp + application/vnd.lotus-wordpro + + + lzh + application/x-lzh-compressed + + + m13 + application/x-msmediaview + + + m14 + application/x-msmediaview + + + m1v + video/mpeg + + + m21 + application/mp21 + + + m2a + audio/mpeg + + + m2v + video/mpeg + + + m3a + audio/mpeg + + + m3u + audio/x-mpegurl + + + m3u8 + application/vnd.apple.mpegurl + + + m4a + audio/mp4 + + + m4b + audio/mp4 + + + m4r + audio/mp4 + + + m4u + video/vnd.mpegurl + + + m4v + video/mp4 + + + ma + application/mathematica + + + mac + image/x-macpaint + + + mads + application/mads+xml + + + mag + application/vnd.ecowin.chart + + + maker + application/vnd.framemaker + + + man + text/troff + + + mar + application/octet-stream + + + mathml + application/mathml+xml + + + mb + application/mathematica + + + mbk + application/vnd.mobius.mbk + + + mbox + application/mbox + + + mc1 + application/vnd.medcalcdata + + + mcd + application/vnd.mcd + + + mcurl + text/vnd.curl.mcurl + + + mdb + application/x-msaccess + + + mdi + image/vnd.ms-modi + + + me + text/troff + + + mesh + model/mesh + + + meta4 + application/metalink4+xml + + + metalink + application/metalink+xml + + + mets + application/mets+xml + + + mfm + application/vnd.mfmp + + + mft + application/rpki-manifest + + + mgp + application/vnd.osgeo.mapguide.package + + + mgz + application/vnd.proteus.magazine + + + mid + audio/midi + + + midi + audio/midi + + + mie + application/x-mie + + + mif + application/x-mif + + + mime + message/rfc822 + + + mj2 + video/mj2 + + + mjp2 + video/mj2 + + + mk3d + video/x-matroska + + + mka + audio/x-matroska + + + mks + video/x-matroska + + + mkv + video/x-matroska + + + mlp + application/vnd.dolby.mlp + + + mmd + application/vnd.chipnuts.karaoke-mmd + + + mmf + application/vnd.smaf + + + mmr + image/vnd.fujixerox.edmics-mmr + + + mng + video/x-mng + + + mny + application/x-msmoney + + + mobi + application/x-mobipocket-ebook + + + mods + application/mods+xml + + + mov + video/quicktime + + + movie + video/x-sgi-movie + + + mp1 + audio/mpeg + + + mp2 + audio/mpeg + + + mp21 + application/mp21 + + + mp2a + audio/mpeg + + + mp3 + audio/mpeg + + + mp4 + video/mp4 + + + mp4a + audio/mp4 + + + mp4s + application/mp4 + + + mp4v + video/mp4 + + + mpa + audio/mpeg + + + mpc + application/vnd.mophun.certificate + + + mpe + video/mpeg + + + mpeg + video/mpeg + + + mpega + audio/x-mpeg + + + mpg + video/mpeg + + + mpg4 + video/mp4 + + + mpga + audio/mpeg + + + mpkg + application/vnd.apple.installer+xml + + + mpm + application/vnd.blueice.multipass + + + mpn + application/vnd.mophun.application + + + mpp + application/vnd.ms-project + + + mpt + application/vnd.ms-project + + + mpv2 + video/mpeg2 + + + mpy + application/vnd.ibm.minipay + + + mqy + application/vnd.mobius.mqy + + + mrc + application/marc + + + mrcx + application/marcxml+xml + + + ms + text/troff + + + mscml + application/mediaservercontrol+xml + + + mseed + application/vnd.fdsn.mseed + + + mseq + application/vnd.mseq + + + msf + application/vnd.epson.msf + + + msh + model/mesh + + + msi + application/x-msdownload + + + msl + application/vnd.mobius.msl + + + msty + application/vnd.muvee.style + + + mts + model/vnd.mts + + + mus + application/vnd.musician + + + musicxml + application/vnd.recordare.musicxml+xml + + + mvb + application/x-msmediaview + + + mwf + application/vnd.mfer + + + mxf + application/mxf + + + mxl + application/vnd.recordare.musicxml + + + mxml + application/xv+xml + + + mxs + application/vnd.triscape.mxs + + + mxu + video/vnd.mpegurl + + + n-gage + application/vnd.nokia.n-gage.symbian.install + + + n3 + text/n3 + + + nb + application/mathematica + + + nbp + application/vnd.wolfram.player + + + nc + application/x-netcdf + + + ncx + application/x-dtbncx+xml + + + nfo + text/x-nfo + + + ngdat + application/vnd.nokia.n-gage.data + + + nitf + application/vnd.nitf + + + nlu + application/vnd.neurolanguage.nlu + + + nml + application/vnd.enliven + + + nnd + application/vnd.noblenet-directory + + + nns + application/vnd.noblenet-sealer + + + nnw + application/vnd.noblenet-web + + + npx + image/vnd.net-fpx + + + nsc + application/x-conference + + + nsf + application/vnd.lotus-notes + + + ntf + application/vnd.nitf + + + nzb + application/x-nzb + + + oa2 + application/vnd.fujitsu.oasys2 + + + oa3 + application/vnd.fujitsu.oasys3 + + + oas + application/vnd.fujitsu.oasys + + + obd + application/x-msbinder + + + obj + application/x-tgif + + + oda + application/oda + + + + odb + application/vnd.oasis.opendocument.database + + + + odc + application/vnd.oasis.opendocument.chart + + + + odf + application/vnd.oasis.opendocument.formula + + + odft + application/vnd.oasis.opendocument.formula-template + + + + odg + application/vnd.oasis.opendocument.graphics + + + + odi + application/vnd.oasis.opendocument.image + + + + odm + application/vnd.oasis.opendocument.text-master + + + + odp + application/vnd.oasis.opendocument.presentation + + + + ods + application/vnd.oasis.opendocument.spreadsheet + + + + odt + application/vnd.oasis.opendocument.text + + + oga + audio/ogg + + + ogg + audio/ogg + + + ogv + video/ogg + + + + ogx + application/ogg + + + omdoc + application/omdoc+xml + + + onepkg + application/onenote + + + onetmp + application/onenote + + + onetoc + application/onenote + + + onetoc2 + application/onenote + + + opf + application/oebps-package+xml + + + opml + text/x-opml + + + oprc + application/vnd.palm + + + org + application/vnd.lotus-organizer + + + osf + application/vnd.yamaha.openscoreformat + + + osfpvg + application/vnd.yamaha.openscoreformat.osfpvg+xml + + + otc + application/vnd.oasis.opendocument.chart-template + + + otf + application/x-font-otf + + + + otg + application/vnd.oasis.opendocument.graphics-template + + + + oth + application/vnd.oasis.opendocument.text-web + + + oti + application/vnd.oasis.opendocument.image-template + + + + otp + application/vnd.oasis.opendocument.presentation-template + + + + ots + application/vnd.oasis.opendocument.spreadsheet-template + + + + ott + application/vnd.oasis.opendocument.text-template + + + oxps + application/oxps + + + oxt + application/vnd.openofficeorg.extension + + + p + text/x-pascal + + + p10 + application/pkcs10 + + + p12 + application/x-pkcs12 + + + p7b + application/x-pkcs7-certificates + + + p7c + application/pkcs7-mime + + + p7m + application/pkcs7-mime + + + p7r + application/x-pkcs7-certreqresp + + + p7s + application/pkcs7-signature + + + p8 + application/pkcs8 + + + pas + text/x-pascal + + + paw + application/vnd.pawaafile + + + pbd + application/vnd.powerbuilder6 + + + pbm + image/x-portable-bitmap + + + pcap + application/vnd.tcpdump.pcap + + + pcf + application/x-font-pcf + + + pcl + application/vnd.hp-pcl + + + pclxl + application/vnd.hp-pclxl + + + pct + image/pict + + + pcurl + application/vnd.curl.pcurl + + + pcx + image/x-pcx + + + pdb + application/vnd.palm + + + pdf + application/pdf + + + pfa + application/x-font-type1 + + + pfb + application/x-font-type1 + + + pfm + application/x-font-type1 + + + pfr + application/font-tdpfr + + + pfx + application/x-pkcs12 + + + pgm + image/x-portable-graymap + + + pgn + application/x-chess-pgn + + + pgp + application/pgp-encrypted + + + pic + image/pict + + + pict + image/pict + + + pkg + application/octet-stream + + + pki + application/pkixcmp + + + pkipath + application/pkix-pkipath + + + plb + application/vnd.3gpp.pic-bw-large + + + plc + application/vnd.mobius.plc + + + plf + application/vnd.pocketlearn + + + pls + audio/x-scpls + + + pml + application/vnd.ctc-posml + + + png + image/png + + + pnm + image/x-portable-anymap + + + pnt + image/x-macpaint + + + portpkg + application/vnd.macports.portpkg + + + pot + application/vnd.ms-powerpoint + + + potm + application/vnd.ms-powerpoint.template.macroenabled.12 + + + potx + application/vnd.openxmlformats-officedocument.presentationml.template + + + ppam + application/vnd.ms-powerpoint.addin.macroenabled.12 + + + ppd + application/vnd.cups-ppd + + + ppm + image/x-portable-pixmap + + + pps + application/vnd.ms-powerpoint + + + ppsm + application/vnd.ms-powerpoint.slideshow.macroenabled.12 + + + ppsx + application/vnd.openxmlformats-officedocument.presentationml.slideshow + + + ppt + application/vnd.ms-powerpoint + + + pptm + application/vnd.ms-powerpoint.presentation.macroenabled.12 + + + pptx + application/vnd.openxmlformats-officedocument.presentationml.presentation + + + pqa + application/vnd.palm + + + prc + application/x-mobipocket-ebook + + + pre + application/vnd.lotus-freelance + + + prf + application/pics-rules + + + ps + application/postscript + + + psb + application/vnd.3gpp.pic-bw-small + + + psd + image/vnd.adobe.photoshop + + + psf + application/x-font-linux-psf + + + pskcxml + application/pskc+xml + + + ptid + application/vnd.pvi.ptid1 + + + pub + application/x-mspublisher + + + pvb + application/vnd.3gpp.pic-bw-var + + + pwn + application/vnd.3m.post-it-notes + + + pya + audio/vnd.ms-playready.media.pya + + + pyv + video/vnd.ms-playready.media.pyv + + + qam + application/vnd.epson.quickanime + + + qbo + application/vnd.intu.qbo + + + qfx + application/vnd.intu.qfx + + + qps + application/vnd.publishare-delta-tree + + + qt + video/quicktime + + + qti + image/x-quicktime + + + qtif + image/x-quicktime + + + qwd + application/vnd.quark.quarkxpress + + + qwt + application/vnd.quark.quarkxpress + + + qxb + application/vnd.quark.quarkxpress + + + qxd + application/vnd.quark.quarkxpress + + + qxl + application/vnd.quark.quarkxpress + + + qxt + application/vnd.quark.quarkxpress + + + ra + audio/x-pn-realaudio + + + ram + audio/x-pn-realaudio + + + rar + application/x-rar-compressed + + + ras + image/x-cmu-raster + + + rcprofile + application/vnd.ipunplugged.rcprofile + + + rdf + application/rdf+xml + + + rdz + application/vnd.data-vision.rdz + + + rep + application/vnd.businessobjects + + + res + application/x-dtbresource+xml + + + rgb + image/x-rgb + + + rif + application/reginfo+xml + + + rip + audio/vnd.rip + + + ris + application/x-research-info-systems + + + rl + application/resource-lists+xml + + + rlc + image/vnd.fujixerox.edmics-rlc + + + rld + application/resource-lists-diff+xml + + + rm + application/vnd.rn-realmedia + + + rmi + audio/midi + + + rmp + audio/x-pn-realaudio-plugin + + + rms + application/vnd.jcp.javame.midlet-rms + + + rmvb + application/vnd.rn-realmedia-vbr + + + rnc + application/relax-ng-compact-syntax + + + roa + application/rpki-roa + + + roff + text/troff + + + rp9 + application/vnd.cloanto.rp9 + + + rpss + application/vnd.nokia.radio-presets + + + rpst + application/vnd.nokia.radio-preset + + + rq + application/sparql-query + + + rs + application/rls-services+xml + + + rsd + application/rsd+xml + + + rss + application/rss+xml + + + rtf + application/rtf + + + rtx + text/richtext + + + s + text/x-asm + + + s3m + audio/s3m + + + saf + application/vnd.yamaha.smaf-audio + + + sbml + application/sbml+xml + + + sc + application/vnd.ibm.secure-container + + + scd + application/x-msschedule + + + scm + application/vnd.lotus-screencam + + + scq + application/scvp-cv-request + + + scs + application/scvp-cv-response + + + scurl + text/vnd.curl.scurl + + + sda + application/vnd.stardivision.draw + + + sdc + application/vnd.stardivision.calc + + + sdd + application/vnd.stardivision.impress + + + sdkd + application/vnd.solent.sdkm+xml + + + sdkm + application/vnd.solent.sdkm+xml + + + sdp + application/sdp + + + sdw + application/vnd.stardivision.writer + + + see + application/vnd.seemail + + + seed + application/vnd.fdsn.seed + + + sema + application/vnd.sema + + + semd + application/vnd.semd + + + semf + application/vnd.semf + + + ser + application/java-serialized-object + + + setpay + application/set-payment-initiation + + + setreg + application/set-registration-initiation + + + sfd-hdstx + application/vnd.hydrostatix.sof-data + + + sfs + application/vnd.spotfire.sfs + + + sfv + text/x-sfv + + + sgi + image/sgi + + + sgl + application/vnd.stardivision.writer-global + + + sgm + text/sgml + + + sgml + text/sgml + + + sh + application/x-sh + + + shar + application/x-shar + + + shf + application/shf+xml + + + + sid + image/x-mrsid-image + + + sig + application/pgp-signature + + + sil + audio/silk + + + silo + model/mesh + + + sis + application/vnd.symbian.install + + + sisx + application/vnd.symbian.install + + + sit + application/x-stuffit + + + sitx + application/x-stuffitx + + + skd + application/vnd.koan + + + skm + application/vnd.koan + + + skp + application/vnd.koan + + + skt + application/vnd.koan + + + sldm + application/vnd.ms-powerpoint.slide.macroenabled.12 + + + sldx + application/vnd.openxmlformats-officedocument.presentationml.slide + + + slt + application/vnd.epson.salt + + + sm + application/vnd.stepmania.stepchart + + + smf + application/vnd.stardivision.math + + + smi + application/smil+xml + + + smil + application/smil+xml + + + smv + video/x-smv + + + smzip + application/vnd.stepmania.package + + + snd + audio/basic + + + snf + application/x-font-snf + + + so + application/octet-stream + + + spc + application/x-pkcs7-certificates + + + spf + application/vnd.yamaha.smaf-phrase + + + spl + application/x-futuresplash + + + spot + text/vnd.in3d.spot + + + spp + application/scvp-vp-response + + + spq + application/scvp-vp-request + + + spx + audio/ogg + + + sql + application/x-sql + + + src + application/x-wais-source + + + srt + application/x-subrip + + + sru + application/sru+xml + + + srx + application/sparql-results+xml + + + ssdl + application/ssdl+xml + + + sse + application/vnd.kodak-descriptor + + + ssf + application/vnd.epson.ssf + + + ssml + application/ssml+xml + + + st + application/vnd.sailingtracker.track + + + stc + application/vnd.sun.xml.calc.template + + + std + application/vnd.sun.xml.draw.template + + + stf + application/vnd.wt.stf + + + sti + application/vnd.sun.xml.impress.template + + + stk + application/hyperstudio + + + stl + application/vnd.ms-pki.stl + + + str + application/vnd.pg.format + + + stw + application/vnd.sun.xml.writer.template + + + sub + text/vnd.dvb.subtitle + + + sus + application/vnd.sus-calendar + + + susp + application/vnd.sus-calendar + + + sv4cpio + application/x-sv4cpio + + + sv4crc + application/x-sv4crc + + + svc + application/vnd.dvb.service + + + svd + application/vnd.svd + + + svg + image/svg+xml + + + svgz + image/svg+xml + + + swa + application/x-director + + + swf + application/x-shockwave-flash + + + swi + application/vnd.aristanetworks.swi + + + sxc + application/vnd.sun.xml.calc + + + sxd + application/vnd.sun.xml.draw + + + sxg + application/vnd.sun.xml.writer.global + + + sxi + application/vnd.sun.xml.impress + + + sxm + application/vnd.sun.xml.math + + + sxw + application/vnd.sun.xml.writer + + + t + text/troff + + + t3 + application/x-t3vm-image + + + taglet + application/vnd.mynfc + + + tao + application/vnd.tao.intent-module-archive + + + tar + application/x-tar + + + tcap + application/vnd.3gpp2.tcap + + + tcl + application/x-tcl + + + teacher + application/vnd.smart.teacher + + + tei + application/tei+xml + + + teicorpus + application/tei+xml + + + tex + application/x-tex + + + texi + application/x-texinfo + + + texinfo + application/x-texinfo + + + text + text/plain + + + tfi + application/thraud+xml + + + tfm + application/x-tex-tfm + + + tga + image/x-tga + + + thmx + application/vnd.ms-officetheme + + + tif + image/tiff + + + tiff + image/tiff + + + tmo + application/vnd.tmobile-livetv + + + torrent + application/x-bittorrent + + + tpl + application/vnd.groove-tool-template + + + tpt + application/vnd.trid.tpt + + + tr + text/troff + + + tra + application/vnd.trueapp + + + trm + application/x-msterminal + + + tsd + application/timestamped-data + + + tsv + text/tab-separated-values + + + ttc + application/x-font-ttf + + + ttf + application/x-font-ttf + + + ttl + text/turtle + + + twd + application/vnd.simtech-mindmapper + + + twds + application/vnd.simtech-mindmapper + + + txd + application/vnd.genomatix.tuxedo + + + txf + application/vnd.mobius.txf + + + txt + text/plain + + + u32 + application/x-authorware-bin + + + udeb + application/x-debian-package + + + ufd + application/vnd.ufdl + + + ufdl + application/vnd.ufdl + + + ulw + audio/basic + + + ulx + application/x-glulx + + + umj + application/vnd.umajin + + + unityweb + application/vnd.unity + + + uoml + application/vnd.uoml+xml + + + uri + text/uri-list + + + uris + text/uri-list + + + urls + text/uri-list + + + ustar + application/x-ustar + + + utz + application/vnd.uiq.theme + + + uu + text/x-uuencode + + + uva + audio/vnd.dece.audio + + + uvd + application/vnd.dece.data + + + uvf + application/vnd.dece.data + + + uvg + image/vnd.dece.graphic + + + uvh + video/vnd.dece.hd + + + uvi + image/vnd.dece.graphic + + + uvm + video/vnd.dece.mobile + + + uvp + video/vnd.dece.pd + + + uvs + video/vnd.dece.sd + + + uvt + application/vnd.dece.ttml+xml + + + uvu + video/vnd.uvvu.mp4 + + + uvv + video/vnd.dece.video + + + uvva + audio/vnd.dece.audio + + + uvvd + application/vnd.dece.data + + + uvvf + application/vnd.dece.data + + + uvvg + image/vnd.dece.graphic + + + uvvh + video/vnd.dece.hd + + + uvvi + image/vnd.dece.graphic + + + uvvm + video/vnd.dece.mobile + + + uvvp + video/vnd.dece.pd + + + uvvs + video/vnd.dece.sd + + + uvvt + application/vnd.dece.ttml+xml + + + uvvu + video/vnd.uvvu.mp4 + + + uvvv + video/vnd.dece.video + + + uvvx + application/vnd.dece.unspecified + + + uvvz + application/vnd.dece.zip + + + uvx + application/vnd.dece.unspecified + + + uvz + application/vnd.dece.zip + + + vcard + text/vcard + + + vcd + application/x-cdlink + + + vcf + text/x-vcard + + + vcg + application/vnd.groove-vcard + + + vcs + text/x-vcalendar + + + vcx + application/vnd.vcx + + + vis + application/vnd.visionary + + + viv + video/vnd.vivo + + + vob + video/x-ms-vob + + + vor + application/vnd.stardivision.writer + + + vox + application/x-authorware-bin + + + vrml + model/vrml + + + vsd + application/vnd.visio + + + vsf + application/vnd.vsf + + + vss + application/vnd.visio + + + vst + application/vnd.visio + + + vsw + application/vnd.visio + + + vtu + model/vnd.vtu + + + vxml + application/voicexml+xml + + + w3d + application/x-director + + + wad + application/x-doom + + + wav + audio/x-wav + + + wax + audio/x-ms-wax + + + + wbmp + image/vnd.wap.wbmp + + + wbs + application/vnd.criticaltools.wbs+xml + + + wbxml + application/vnd.wap.wbxml + + + wcm + application/vnd.ms-works + + + wdb + application/vnd.ms-works + + + wdp + image/vnd.ms-photo + + + weba + audio/webm + + + webm + video/webm + + + webp + image/webp + + + wg + application/vnd.pmi.widget + + + wgt + application/widget + + + wks + application/vnd.ms-works + + + wm + video/x-ms-wm + + + wma + audio/x-ms-wma + + + wmd + application/x-ms-wmd + + + wmf + application/x-msmetafile + + + + wml + text/vnd.wap.wml + + + + wmlc + application/vnd.wap.wmlc + + + + wmls + text/vnd.wap.wmlscript + + + + wmlsc + application/vnd.wap.wmlscriptc + + + wmv + video/x-ms-wmv + + + wmx + video/x-ms-wmx + + + wmz + application/x-msmetafile + + + woff + application/x-font-woff + + + wpd + application/vnd.wordperfect + + + wpl + application/vnd.ms-wpl + + + wps + application/vnd.ms-works + + + wqd + application/vnd.wqd + + + wri + application/x-mswrite + + + wrl + model/vrml + + + wsdl + application/wsdl+xml + + + wspolicy + application/wspolicy+xml + + + wtb + application/vnd.webturbo + + + wvx + video/x-ms-wvx + + + x32 + application/x-authorware-bin + + + x3d + model/x3d+xml + + + x3db + model/x3d+binary + + + x3dbz + model/x3d+binary + + + x3dv + model/x3d+vrml + + + x3dvz + model/x3d+vrml + + + x3dz + model/x3d+xml + + + xaml + application/xaml+xml + + + xap + application/x-silverlight-app + + + xar + application/vnd.xara + + + xbap + application/x-ms-xbap + + + xbd + application/vnd.fujixerox.docuworks.binder + + + xbm + image/x-xbitmap + + + xdf + application/xcap-diff+xml + + + xdm + application/vnd.syncml.dm+xml + + + xdp + application/vnd.adobe.xdp+xml + + + xdssc + application/dssc+xml + + + xdw + application/vnd.fujixerox.docuworks + + + xenc + application/xenc+xml + + + xer + application/patch-ops-error+xml + + + xfdf + application/vnd.adobe.xfdf + + + xfdl + application/vnd.xfdl + + + xht + application/xhtml+xml + + + xhtml + application/xhtml+xml + + + xhvml + application/xv+xml + + + xif + image/vnd.xiff + + + xla + application/vnd.ms-excel + + + xlam + application/vnd.ms-excel.addin.macroenabled.12 + + + xlc + application/vnd.ms-excel + + + xlf + application/x-xliff+xml + + + xlm + application/vnd.ms-excel + + + xls + application/vnd.ms-excel + + + xlsb + application/vnd.ms-excel.sheet.binary.macroenabled.12 + + + xlsm + application/vnd.ms-excel.sheet.macroenabled.12 + + + xlsx + application/vnd.openxmlformats-officedocument.spreadsheetml.sheet + + + xlt + application/vnd.ms-excel + + + xltm + application/vnd.ms-excel.template.macroenabled.12 + + + xltx + application/vnd.openxmlformats-officedocument.spreadsheetml.template + + + xlw + application/vnd.ms-excel + + + xm + audio/xm + + + xml + application/xml + + + xo + application/vnd.olpc-sugar + + + xop + application/xop+xml + + + xpi + application/x-xpinstall + + + xpl + application/xproc+xml + + + xpm + image/x-xpixmap + + + xpr + application/vnd.is-xpr + + + xps + application/vnd.ms-xpsdocument + + + xpw + application/vnd.intercon.formnet + + + xpx + application/vnd.intercon.formnet + + + xsl + application/xml + + + xslt + application/xslt+xml + + + xsm + application/vnd.syncml+xml + + + xspf + application/xspf+xml + + + xul + application/vnd.mozilla.xul+xml + + + xvm + application/xv+xml + + + xvml + application/xv+xml + + + xwd + image/x-xwindowdump + + + xyz + chemical/x-xyz + + + xz + application/x-xz + + + yang + application/yang + + + yin + application/yin+xml + + + z + application/x-compress + + + Z + application/x-compress + + + z1 + application/x-zmachine + + + z2 + application/x-zmachine + + + z3 + application/x-zmachine + + + z4 + application/x-zmachine + + + z5 + application/x-zmachine + + + z6 + application/x-zmachine + + + z7 + application/x-zmachine + + + z8 + application/x-zmachine + + + zaz + application/vnd.zzazz.deck+xml + + + zip + application/zip + + + zir + application/vnd.zul + + + zirz + application/vnd.zul + + + zmm + application/vnd.handheld-entertainment+xml + + + + + + + + + + + + + + + + + + index.html + index.htm + index.jsp + + + diff --git a/testbed/integration/shibboleth-idp/credentials/shib-idp/idp-encryption.crt b/testbed/integration/shibboleth-idp/credentials/shib-idp/idp-encryption.crt new file mode 100644 index 000000000..5587059bf --- /dev/null +++ b/testbed/integration/shibboleth-idp/credentials/shib-idp/idp-encryption.crt @@ -0,0 +1,19 @@ +-----BEGIN CERTIFICATE----- +MIIDIDCCAgigAwIBAgIJAJ2AOdYo1M8xMA0GCSqGSIb3DQEBCwUAMBsxGTAXBgNV +BAMMEGlkcC51bmljb24ubG9jYWwwHhcNMjAwNTI3MTgxMDE0WhcNMjUwNTI2MTgx +MDE0WjAbMRkwFwYDVQQDDBBpZHAudW5pY29uLmxvY2FsMIIBIjANBgkqhkiG9w0B +AQEFAAOCAQ8AMIIBCgKCAQEAp3MXVm6QP7qEhSQ16mIDjFAoUuBeqD7hzFlh4neY +9N1rlU3Ut+qUWQWPeuJtjl3c3RMR9Uctbaw9H7wrI0pn8YBRAOhJg3Xu4mwpQfMl +R4/QnE+Wno/S0khksfWtBU8B5DqR7UzhwjjRjJPfHCcKP+GXxVkfKNzNjf8VodVG +e0Nn81cJP3PbYYgMkax4jEKUcZ/6YZzc1UY53Vnjbi4nqQU7pDUhfAtusi7rRXFm +tB5z6qiwTM79aeW0SExYF1up6/06ImIU5RQY3f1ouonSUVSgmXc2/lGXQJdFJe7C +9ELkOUmzgLacGQ8OUA6Xy5lbz0xiTHqc8h+1v4/PTYRJVQIDAQABo2cwZTBEBgNV +HREEPTA7ghBpZHAudW5pY29uLmxvY2FshidodHRwczovL2lkcC51bmljb24ubG9j +YWwvaWRwL3NoaWJib2xldGgwHQYDVR0OBBYEFCMykG71ww3BiwZl9Mv9QyqjyJTL +MA0GCSqGSIb3DQEBCwUAA4IBAQA83eXZlUb9mPl9a9cgUdTaVvGLQ+mZj1AB5gS4 +GxOsDiUi648LDEjiCjhbvB9SM4j3n2mQ0G+hPk15Mv18EKOJkV8ft0N7JmZz6D+f +JVUO39ynWVKGnMM1H/93IltgzYwOHnfIoWcrErqCRjXxjHQgweZ6yCoYSLxHjVI/ +KsYkds46PY5Hrs7cnnFMehylmVnCqopUUwFBn6/XgQtj/ESkz8L/zJc0zuxJbCLB +rs3HcGkhBFOn77YBwQMsAKooiA07QLeqQYtYo+JcTD+t57eE40qNaMkioY06QlFr +gduIdTOHEVXbEPawoSgdYlg8qOG1dPyuKrhZu+Cbyq7bs8cG +-----END CERTIFICATE----- diff --git a/testbed/integration/shibboleth-idp/credentials/shib-idp/idp-encryption.key b/testbed/integration/shibboleth-idp/credentials/shib-idp/idp-encryption.key new file mode 100644 index 000000000..e188b6b9f --- /dev/null +++ b/testbed/integration/shibboleth-idp/credentials/shib-idp/idp-encryption.key @@ -0,0 +1,28 @@ +-----BEGIN PRIVATE KEY----- +MIIEvAIBADANBgkqhkiG9w0BAQEFAASCBKYwggSiAgEAAoIBAQCncxdWbpA/uoSF +JDXqYgOMUChS4F6oPuHMWWHid5j03WuVTdS36pRZBY964m2OXdzdExH1Ry1trD0f +vCsjSmfxgFEA6EmDde7ibClB8yVHj9CcT5aej9LSSGSx9a0FTwHkOpHtTOHCONGM +k98cJwo/4ZfFWR8o3M2N/xWh1UZ7Q2fzVwk/c9thiAyRrHiMQpRxn/phnNzVRjnd +WeNuLiepBTukNSF8C26yLutFcWa0HnPqqLBMzv1p5bRITFgXW6nr/ToiYhTlFBjd +/Wi6idJRVKCZdzb+UZdAl0Ul7sL0QuQ5SbOAtpwZDw5QDpfLmVvPTGJMepzyH7W/ +j89NhElVAgMBAAECggEAHPLWvAiNQ5c5RdNGxuh++Ij7D6jedHO6kZt6Qq6ucNa+ +vKch+VHCp8lATtxKWGx9vHKJjj/p6KX4Qz5Cru00Hxox5thBrUp8LATK9S3V6hNA +22UfAvaWWehOED4K1XodN5mwlLfP58Xu5EDEN5fAO98CYAnSSzwxBTVuRfYbIz/y +ZtbBnsrq+PSG1acPjlftbzRlSlVxSWmITCnNAH3zO5ugAnrbbvA2HPXQe042Xe25 +x0NS83zP/KK198THlzV+UeW1S08gyzWdF2sE+6UYL4Dp6weuPv4EafRRYWUgV0z8 +z8IE3PwPb8LdNgdP8v0Zhoz5lSC5Y3WL6YwbgRro2QKBgQDRdl7FLszcvr/yuHA4 +DFRnK6DrR1fqRnK7xlLTWgOIh27lC8wY/qRPP+7mVwOvECKasBE1sxRoURG/DDAa +QNVqJWszBOwHlIRvwMhbze9JXO5D6M3hWLZu+ZbWn+dGdVeBlyTX2y95V32ZzaUv +CNVjQ3FNF7U/6ZvqaCGeroZ/2wKBgQDMpyaexWYypvNOoExyoO46IH4fFVO7raCG +aWgDgmhyifTLIysgCdDAs7tPPkNhxt5BgSc5Awa9MVmpK2scttJnjnGwsHQyaGmD +fi6UTDkzN1ijL/hXtd5SnuynVWTDkdLvYfSr8t8zevmYddZRKjnzIaYG7IFueO0C +oQtKfMX6jwKBgDYMlFHPTL+dXQx1uUdNLy5cHK75ft8OBKcdetvcu1Ksl9n0nFrK +wn1Mowm+5E11HWjLC/XOWvK8EJc6vuLXXfqA41OL7pfaI/5uQYUm85r7puPRG+cN +LC4gq2KAan5M4yKmbLRic7Kc9+ULIpercNynV4IsHvH6BuiKrDo1ELHHAoGAE/EN +sFbn2HOwLa8tA9ZuoDdeUsUPPbBzfeVzfzQL3W1X7xtkLmEGeGCLFfOpOTPZoGRn +YATNeU3/wJ48d7XQ1spohaEMEYVfErMO8uBiin0QJAaeml1cZoyZ3sxRX0UsWqse +3kpyOV/4RkTlN094ChrzRKVzD0K1RZZPtVhnKj0CgYAPqNvfgj1YB9Ejc0wM6zGx +iElOKPAwmmUqr2odFs5YVmICp2sIi/OSIjL4WTzQ2PBtBaU8NVVFjchmrpYWQQNe +D7k8ZaGBjRivTnswS+xTdIKbsY9VchFXhGkFFUBswHWCLG7myvgNd/0JTvZtkK3C +4Bohg2T1ArE7WMcY4QgXNw== +-----END PRIVATE KEY----- diff --git a/testbed/integration/shibboleth-idp/credentials/shib-idp/idp-signing.crt b/testbed/integration/shibboleth-idp/credentials/shib-idp/idp-signing.crt new file mode 100644 index 000000000..1e8cc50ea --- /dev/null +++ b/testbed/integration/shibboleth-idp/credentials/shib-idp/idp-signing.crt @@ -0,0 +1,19 @@ +-----BEGIN CERTIFICATE----- +MIIDIDCCAgigAwIBAgIJAN45D3DbemrtMA0GCSqGSIb3DQEBCwUAMBsxGTAXBgNV +BAMMEGlkcC51bmljb24ubG9jYWwwHhcNMjAwNTI3MTgxMDE0WhcNMjUwNTI2MTgx +MDE0WjAbMRkwFwYDVQQDDBBpZHAudW5pY29uLmxvY2FsMIIBIjANBgkqhkiG9w0B +AQEFAAOCAQ8AMIIBCgKCAQEAoDNLPFL/47cSWKbfb89lVz3EsIlb4z8lZbZUNyzF +m3my5mioe9b6xrS8QF16l1ALb8SEwQzECPKuyRp1LQ5Rj79Ba38TDl+4BezjC7Ui +f9OwzXIYfcetEFZ85tjufIl3ryVbY2kQ1TRypqk72pF1uDLEnqXrnystRxi4x22f +wTu+KkTy0tL/5oV2tjJY0vtO3YAsjNpqqI6WqcbjewtJVIrG4OuOF3r9CPCU7hOY +fc4BtvSQhOgryJM+dF9PmpvALJO8LrMBsNdAO3gz37+mA1F/tD7WYP2XLvrHh+Wd +c0QJ/f8AzCJm5QV4lA/UH/0tKMQS178ti7+4Jyw38iHkYQIDAQABo2cwZTBEBgNV +HREEPTA7ghBpZHAudW5pY29uLmxvY2FshidodHRwczovL2lkcC51bmljb24ubG9j +YWwvaWRwL3NoaWJib2xldGgwHQYDVR0OBBYEFGFkPVcsjWlZDfUk1+SifxhP1l7I +MA0GCSqGSIb3DQEBCwUAA4IBAQBZUq9P9A9DsypasD6WcHNP/EyP5spKRRu2CTWm +Y645kOjg7qMIasHVwA5jSPU7ozgPRV6MpdjCJVWYjUpeSCwXx6YAEKFLZ9WXV26i +e1GFTP1lJqlpnJZqs1RBgvF7q/JxFvxSl8UpjoxNufBANC14T6T3EMQ9EvWLTdCM +cEuXxkwzpeEkh5MtCoicgQ1yvay2QGQBbfCauPAASd957+S7brRON4R2gPonCf18 +5rzh7Do7kFBc6pqAHCYGTUz7uY11EPktIC6AIlZmXV1J0wBCP6SoiZDFjwZsj6m6 +S1N5qGtWDOT5vZiT1nF+mNd990c8qjVcyQST42VyXCBnJ7DR +-----END CERTIFICATE----- diff --git a/testbed/integration/shibboleth-idp/credentials/shib-idp/idp-signing.key b/testbed/integration/shibboleth-idp/credentials/shib-idp/idp-signing.key new file mode 100644 index 000000000..3e93b9fbe --- /dev/null +++ b/testbed/integration/shibboleth-idp/credentials/shib-idp/idp-signing.key @@ -0,0 +1,28 @@ +-----BEGIN PRIVATE KEY----- +MIIEvAIBADANBgkqhkiG9w0BAQEFAASCBKYwggSiAgEAAoIBAQCgM0s8Uv/jtxJY +pt9vz2VXPcSwiVvjPyVltlQ3LMWbebLmaKh71vrGtLxAXXqXUAtvxITBDMQI8q7J +GnUtDlGPv0FrfxMOX7gF7OMLtSJ/07DNchh9x60QVnzm2O58iXevJVtjaRDVNHKm +qTvakXW4MsSepeufKy1HGLjHbZ/BO74qRPLS0v/mhXa2MljS+07dgCyM2mqojpap +xuN7C0lUisbg644Xev0I8JTuE5h9zgG29JCE6CvIkz50X0+am8Ask7wuswGw10A7 +eDPfv6YDUX+0PtZg/Zcu+seH5Z1zRAn9/wDMImblBXiUD9Qf/S0oxBLXvy2Lv7gn +LDfyIeRhAgMBAAECggEASJM0UF3ho036t8LRkpvIc19+TePMhwTCcnPJbz2PQEI/ +8/YR7hiUf5S9fANdWFNg+v9yjOq1nMAkwuKDlyfXd2HTx1lITsi6W6TXryQePv6u +KES6J7FgC/jCmOpKEI1OdUBdSIn+oDgkgLBGd1xSkmIdhSnxtqge2QiwHVjieO1a +O4zR2lI4eywWJJWWYxgftDNTWwtL94vmfi33up95kAXk8hxIZtMJ0MnNxTrCr1sh +i3yF/JETK0VzbI/eJecIXKtGZO0X01boWoeMSAZXJGkK/d0SGSSeISfADgFn4VxA +aktuq6byui0dSVuT8arA0lC2n4W8p8BVceKrEvH36QKBgQDR7h7m9WckQ9HqTIdH +ITdBNkevrId0GOdC8MRVvEMJQDBtVomdmmSVS4taQFdZ9yUqMw5PY2o6D7qI3KoK +DyzyPJalNzMoOvSR5Xieg9IjBEdYrz8PZr4aFUc0+fTR0C1mPiLMVyO0IftJOQzR +aCHJc+JIO6cYMirTKMjxdNVC5wKBgQDDW1pNrcGBmviEQAqdUfdZlFz26jv3jdgT +81QAgTUq0ieSkbxMTtd0ugk0r48HaRGl+4+agGYHIx8LjuKEHGrezjWF4k9VSsjD +vd1y6FSBVZKiKEOrrVRpuBi4bSDXM6anR6ovvWRjUoS24PrKdGgEYo8cib4QTTVh +088rDmN9dwKBgBANJ/m629cPBHbowRM0O/hVgSeyhmzfFpestyZjDbEgYlOJ4V3W +l0g/DXmqH8O2PPY8DyUM0et8lmOuk6XPQT2IWnBphxTVZSveotlj9OZOhnIGfEje +LzzpUZeAYTLFuyLtL1X2d7lnO8J+hTdhweuYW73wKbeU5mdc3/huWXwTAoGAL4t2 +KN2W8MIUpasoai1es7CGB5nuSkt9QS3BTfYkSG2pL+TEHRY7Ha+BOg9YEgeiQfE9 +e+6v5iDIF3oI6vo3kE5DfHgdsrZmsiztTl/44RlAfLKr9YZTuv8RFSGKEpYBg0jP +xJqlaf7VSeTrZIZ8IkUSa3GijjkcOtjf3Ky9zfUCgYB6Hk6Ixb2ksM2tdLFFm+/x +w+pzI6kaK5KW0kaNax2WwyzrvF0W3pQwVeFwPVgeWjdL0F4pXtHc4HGKwTNMEJfO +4B5Gi5unIrff9gCNpkwMlfLSTmvvhthzs8dNGTGjWzAuGqug2xQlPCWLK/c0mZSq +55MS3HX0pv+LFsKGr9+nZQ== +-----END PRIVATE KEY----- diff --git a/testbed/integration/shibboleth-idp/credentials/shib-idp/inc-md-cert-mdq.pem b/testbed/integration/shibboleth-idp/credentials/shib-idp/inc-md-cert-mdq.pem new file mode 100644 index 000000000..178dcf853 --- /dev/null +++ b/testbed/integration/shibboleth-idp/credentials/shib-idp/inc-md-cert-mdq.pem @@ -0,0 +1,28 @@ +-----BEGIN CERTIFICATE----- +MIIEvjCCAyagAwIBAgIJANpi9/mkU/zoMA0GCSqGSIb3DQEBCwUAMHQxCzAJBgNV +BAYTAlVTMQswCQYDVQQIDAJNSTESMBAGA1UEBwwJQW5uIEFyYm9yMRYwFAYDVQQK +DA1JbnRlcm5ldDIuZWR1MREwDwYDVQQLDAhJbkNvbW1vbjEZMBcGA1UEAwwQbWRx +LmluY29tbW9uLm9yZzAeFw0xODExMTMxNDI5NDNaFw0zODExMTAxNDI5NDNaMHQx +CzAJBgNVBAYTAlVTMQswCQYDVQQIDAJNSTESMBAGA1UEBwwJQW5uIEFyYm9yMRYw +FAYDVQQKDA1JbnRlcm5ldDIuZWR1MREwDwYDVQQLDAhJbkNvbW1vbjEZMBcGA1UE +AwwQbWRxLmluY29tbW9uLm9yZzCCAaIwDQYJKoZIhvcNAQEBBQADggGPADCCAYoC +ggGBAJ0+fUTzYVSP6ZOutOEhNdp3WPCPOYqnB4sQFz7IeGbFL1o0lZjx5Izm4Yho +4wNDd0h486iSkHxNf5dDhCqgz7ZRSmbusOl98SYn70PrUQj/Nzs3w47dPg9Tpb/x +y44PvNLS/rE56hPgCz/fbHoTTiJt5eosysa1ZebQ3LEyW3jGm+LGtLbdIfkynKVQ +vpp1FVeCamzdeB3ZRICAvqTYQKE1JQDGlWrEsSW0VVEGNjfbzMzr/g4l8JRdMabQ +Jig8tj3UIXnu7A2CKSMJSy3WZ3HX+85oHEbL+EV4PtpQz765c69tUIdNTJax9jQ2 +1c3wL0K27HE8jSRlrXImD50R3dXQBKH+iiynBWxRPdyMBa1YfK+zZEWPbLHshSTc +9hkylQv3awmPR/+Plz5AtTpe5yss/Ifyp01wz1jt42R+6jDE+WbUjp5XDBCAjGEE +0FPaYtxjZLkmNl367bdTN12OIn/ixPNH+Z/S/4skdBB9Gc4lb2fEBywJQY0OYNOd +WOxmPwIDAQABo1MwUTAdBgNVHQ4EFgQUMHZuwMaYSJM5mlu3Wc4Ts5xq4/swHwYD +VR0jBBgwFoAUMHZuwMaYSJM5mlu3Wc4Ts5xq4/swDwYDVR0TAQH/BAUwAwEB/zAN +BgkqhkiG9w0BAQsFAAOCAYEAMr4wfLrSoPTzfpXtvL+2vrKBJNnRfuJpOYTbPKUc +DOP2QfzRlczi7suYJvd5rLiRonq8rjyPUyM8gvTfbTps+JhJ6S9mS6dTBxOV1qPZ +3Ab+XKmq8LUtguGRabKgJgmJH0+inR/wVoal7EVHcWXfij9AT8DZOXW88shc6grh +jUaFZBu/2+q8c8ee0e4ip8B+CVEnCwDKI0d+nTcSmPvAE34CNa33F+QGpXawv5yv +VvIpSaLAeFQhc/jKcnNHfy+Zi7JmSnKZiMvQCbWANQmDjHg7pGmBW9nyQcm6P2/B +0AVcEj1YTpAR8Mbh1pUdIhoB+chaNnFEIZsXeRsdbbAFpxodInlJ7WekfuvSQ6sU +EXpoyBGOeuuTmR1va8k3QeL8Wc4yNu/g5LwjmtvPrh2jBF8xujc4J6VzP8K2BjA4 +xk4LnXgjHOT93dBAJhVYJkykDHwyvHUvsBHoP6lfjrt5P8zunK2mdP/AZKik+Rdt +1GGlErV2AyWShTOaDLW6NxdP +-----END CERTIFICATE----- diff --git a/testbed/integration/shibboleth-idp/credentials/shib-idp/sealer.jks b/testbed/integration/shibboleth-idp/credentials/shib-idp/sealer.jks new file mode 100644 index 0000000000000000000000000000000000000000..fe7529f3b5316452de44e17ac070d49f85864fa0 GIT binary patch literal 518 zcmX?i?%X*B1_mY|W&~np2KM6A1*azFq^9^MWu+#UxaAjlr&b0O<(B|C`9){LPendA*c}WsyrPIf zGApqxu>z(aS(}}i?Xtt$LkgG}SfUwtQ}dGZQ&Lj`5{nXZi%S@oqMf1{1b~7dds9=K z^Ycnl^GXUC>KK@O7&r^SsvL9DOBjTFKo;odB<7{-2bUCO=A~QvfP9mf1C$1-XRatH zEdrUh=Ck+@Hja=7Aa@l2JuPU!&%$x{&CI?1x9WJAn3;JUN?f1ev`i^`}ZL zGYvQ&t>F=+;4tA~mqGdA=sf4M<&C*rvz}zPo)0lu>w8!9%(5j4MbEW2wq0AyDX=>~ z%jsH|;&RJ=;UgoV*JS=gGobU*+OO;$^)}3IbGn0OuZUQ?yz5|mihHYo zr)TM0*7;Ma&+OMayX-%E7=1*k8+yz;T)pJ=wrrhge zI^qys!XOslX?@jQj}Sclj`Ccj8o!Be#^ASztuM<&)mpzOnbsKp8TGj E082o}-2eap literal 0 HcmV?d00001 diff --git a/testbed/integration/shibboleth-idp/credentials/shib-idp/sealer.kver b/testbed/integration/shibboleth-idp/credentials/shib-idp/sealer.kver new file mode 100644 index 000000000..81a9ede16 --- /dev/null +++ b/testbed/integration/shibboleth-idp/credentials/shib-idp/sealer.kver @@ -0,0 +1,2 @@ +#Thu Feb 06 17:19:55 UTC 2020 +CurrentVersion=1 diff --git a/testbed/integration/shibboleth-idp/credentials/shib-idp/secrets.properties b/testbed/integration/shibboleth-idp/credentials/shib-idp/secrets.properties new file mode 100644 index 000000000..e1963309a --- /dev/null +++ b/testbed/integration/shibboleth-idp/credentials/shib-idp/secrets.properties @@ -0,0 +1,14 @@ +# This is a reserved spot for most properties containing passwords or other secrets. +# Created by install at Wed May 27 18:10:14 UTC 2020 + +# Access to internal AES encryption key +idp.sealer.storePassword = e1ef1671-661c-43d6-be51-ae9888fa3879 +idp.sealer.keyPassword = e1ef1671-661c-43d6-be51-ae9888fa3879 + +# Default access to LDAP authn and attribute stores. +idp.authn.LDAP.bindDNCredential = admin +idp.attribute.resolver.LDAP.bindDNCredential = %{idp.authn.LDAP.bindDNCredential:undefined} + +# Salt used to generate persistent/pairwise IDs, must be kept secret +#idp.persistentId.salt = changethistosomethingrandom + diff --git a/testbed/integration/shibboleth-idp/credentials/tomcat/keystore.jks b/testbed/integration/shibboleth-idp/credentials/tomcat/keystore.jks new file mode 100644 index 0000000000000000000000000000000000000000..ea9ad03b73e121bbe04b2e84b31c446e69777826 GIT binary patch literal 3840 zcmc&$`A=Ne6`nUR1AdG!3%+K~oD1NpkDwgn_TcS%!?bS!)r{LU7h$bD4)xo*gU*eJ2 zz*Gy2z{cL_RW_tTwhM~EE0CmJP{RhO05TCSFJ(J03i;RLzZ@RXXJCD{{{%Q?6Lj~F zbER)RbE@+7U!Q{)m@WkSCMPr~z{TY^L$1_-_)}nEyH|{rcF_(|+oG;PS+X7mXGvh5 zgA6b?vjxtgaS6Wreds1g5Mqb;^)0Yq%(OUVubu6|09v5}LX2;-r(S#Zk1D*>p90w>dQ6yqiE3=+UqorEwK3uT~+s=NE4au{2!zR+9G z?!elGlwYN_21$khlgz||*x;}BUuI4!azT+c38z4DNWpc}g5g)w$2QF45RA`5bHjtx z)8M$W_kIY~31LHU0yGwVkTbha7cDWXiKBfg*^TgqA?c9gT&SwKG?+|FcVQx%fqAZv zS*a~_NfQz;k#d#FaK>%!vc$QmdPz zLuNpXq5)%xxvo|}<3Ka4SS!Q@S#+kdymw%?|3@zu;to#v14uHuKbMB*C(2^}qQz>^;+mu~Nxn4RgImF}LE(n6|zDoWyu6 zvH4K5tFtal}^22hig=eB{c9A(PU6+V@gKVGv3BF4E-JhDh#qc+%W#o!K#0Sg7 zg@<6Ox?F39z2O8U8)k>>qF8;ypT7vobE(3ss+2A~j0_fn4HD-pzVlMWwPKh#HRS`v zvAfDc=*Ybaj(qeem_B=`Sz+<51AL+iz4?4T_%wXJ|H>D?e;x*pQ?RS{IjW1#(fBM> zcz66fX%lTZ|NQaK#H*g|tV;+c!{I8jTKJ&tZL8^EKLP;~MEOMtr$Vu&HkooBY6Ikh z7eE5X2qzbmLybb15}@GP8V~5;)%6{y8+;2MgqZmFxxekh>4z{+CiqSs{MK~E;I#y} zepbZUxlHiVF8czU70B8H>9yQIdh2ZMY6*-a$bVsoOA);HJ7{M5e}V_@J9rTs>b8Sf z8o(r^UCgoMdKflR%lS|VOL|yZaz*WCb}&IqBj5>EfQMLJJW(cAup6m^!5rT#kjUZZ zr%VE1ml_l%2MwxHY_H4Z#P@&l>_7hed>gG8SVYqh=BsFF035X*{HPF`b;3*vuJ})j z!DMc;o>&iYki{kt&*qU8P`fJFgzgN6@7xBfQCN$YU;hEv#J!*M)LS4dg5G)Vjfn#q z*<#}Dr%e;aPVvl{(eUPK9(Ucz8PjG!W#uDDb1 zzYT#TM}h=`?kwX3BXMadk;&z%=wc+iv{<#U6b>yIc_(y_VR$_??s|{6&NB$tZFt@F z%Kg8u4++yweLHpdH_Bvd$1TjerZeN3W&wA_|Mj)BWuB+k2Fiw^|@Zk__5 z9=ts9z>)TOaM@hBxWMr3s;aOs;Xg;#ST;ruvUF3pz9-`FQ2%ro`GI??>}}t z3>AS0cyWdxe}5U|DFX2UaPfi3>3JBO00Funbjw}K5~#NG8VO2FtLHjj-@}&H=v?-v z-%&Tal3V621=N)mr>CZAD~q4Q_3W;s(K%yK!XN#n3C1<!Ip7GSCefVz&6T6HGwy9_vi+!nw*-#|W3pJp)n5nGUge%P72Cz(^@y+s+|toMz$M zaMH*(a#6Oq$?+NS>6tukpmmw~X!ajw6mA()-PZi=GQkatl}W5J)@wGTo zer!j5O)6omqI^DD^KDECJMqoG$F4y4Vcv5javmygnkTsZ!K;aCBQ`4wuWM%n+&DA7 zF*eV^m{q`GusXPhGzjYr2z>Y}aO-eC;|;SCZ2ja9{bIerR)9rv6g{irZHfv*-8?xZ zj?>k0?(Qu$z!uXCs6$Xzr>fwuZ#}hgX&1qJ-vfmpygerP)CPHR*aEOoeT!gaN|1^# zG2p*(U5spQn+fJJ&xZDRyt`j4S6H$&K$k Y3B{WU^riD3e!r>(wJ5I7Ded~d0mC}}@&Et; literal 0 HcmV?d00001 diff --git a/testbed/integration/shibboleth-idp/metadata/dynamic/700bfe6fa4495100f5c193fa5b7ca4192c150923.xml b/testbed/integration/shibboleth-idp/metadata/dynamic/700bfe6fa4495100f5c193fa5b7ca4192c150923.xml new file mode 100644 index 000000000..3d2f94edf --- /dev/null +++ b/testbed/integration/shibboleth-idp/metadata/dynamic/700bfe6fa4495100f5c193fa5b7ca4192c150923.xml @@ -0,0 +1,25 @@ + + + + + + + + + + + + + + + + + + + urn:oasis:names:tc:SAML:2.0:nameid-format:transient + urn:oasis:names:tc:SAML:2.0:nameid-format:persistent + urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress + urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified + + + diff --git a/testbed/integration/shibboleth-idp/wwwroot/robots.txt b/testbed/integration/shibboleth-idp/wwwroot/robots.txt new file mode 100644 index 000000000..1f53798bb --- /dev/null +++ b/testbed/integration/shibboleth-idp/wwwroot/robots.txt @@ -0,0 +1,2 @@ +User-agent: * +Disallow: / diff --git a/testbed/integration/shibui/application.yml b/testbed/integration/shibui/application.yml new file mode 100644 index 000000000..9ac3a21f9 --- /dev/null +++ b/testbed/integration/shibui/application.yml @@ -0,0 +1,20 @@ +server: + forward-headers-strategy: NATIVE +spring: + profiles: + include: + datasource: + platform: postgres + driver-class-name: org.postgresql.Driver + url: jdbc:postgresql://database:5432/shibui + username: shibui + password: shibui + jpa: + properties: + hibernate: + dialect: org.hibernate.dialect.PostgreSQLDialect +shibui: + default-password: "{noop}letmein7" + metadata-dir: /var/shibboleth/dynamic_metadata + metadataProviders: + target: file:/var/shibboleth/dynamic_config/metadata-providers.xml From 05e7a129303ad909620f8e874e67de8641ae308d Mon Sep 17 00:00:00 2001 From: Jj! Date: Fri, 15 Oct 2021 16:06:01 -0500 Subject: [PATCH 3/3] [SHIBUI-1751] integration sample using docker compose and shared volume --- testbed/integration/cheat.html | 39 +++- .../config/shib-idp/conf/attribute-filter.xml | 170 +++++++----------- .../shib-idp/conf/attribute-resolver.xml | 4 +- .../shib-idp/conf/metadata-providers.xml | 79 -------- .../config/shib-idp/conf/relying-party.xml | 2 +- 5 files changed, 101 insertions(+), 193 deletions(-) diff --git a/testbed/integration/cheat.html b/testbed/integration/cheat.html index c29eea878..74682f912 100644 --- a/testbed/integration/cheat.html +++ b/testbed/integration/cheat.html @@ -4,7 +4,15 @@

Reload Service

@@ -55,8 +63,8 @@

Attribute Resolution

-

Metadata Query

+

Metadata Query

@@ -69,5 +77,34 @@

Metadata Query

+
+

Reload Metadata

+ + + + + +
+ + + +
+ +
+
+

Unsolicited SSO

+ + + + + +
+ + + +
+ +
+metrics diff --git a/testbed/integration/shibboleth-idp/config/shib-idp/conf/attribute-filter.xml b/testbed/integration/shibboleth-idp/config/shib-idp/conf/attribute-filter.xml index d4d57250a..d55617ecd 100644 --- a/testbed/integration/shibboleth-idp/config/shib-idp/conf/attribute-filter.xml +++ b/testbed/integration/shibboleth-idp/config/shib-idp/conf/attribute-filter.xml @@ -18,30 +18,68 @@ Example rule relying on a locally applied tag in metadata to trigger attribute release of some specific attributes. Add additional attributes as desired. --> - - - - - - - - - - - - - - - + - - - - - - - - - - - - - - - - - - - - - + - - + - - - - - - - - - - - - - - - - - - - + attributeName="http://shibboleth.net/ns/attributes/releaseAllValues" + attributeNameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" + attributeValue="eduPersonEntitlement" /> + + diff --git a/testbed/integration/shibboleth-idp/config/shib-idp/conf/attribute-resolver.xml b/testbed/integration/shibboleth-idp/config/shib-idp/conf/attribute-resolver.xml index 135b4bc53..eb9ebbd79 100644 --- a/testbed/integration/shibboleth-idp/config/shib-idp/conf/attribute-resolver.xml +++ b/testbed/integration/shibboleth-idp/config/shib-idp/conf/attribute-resolver.xml @@ -141,8 +141,8 @@ - - + + diff --git a/testbed/integration/shibboleth-idp/config/shib-idp/conf/metadata-providers.xml b/testbed/integration/shibboleth-idp/config/shib-idp/conf/metadata-providers.xml index bbe9759c8..59dd76a66 100644 --- a/testbed/integration/shibboleth-idp/config/shib-idp/conf/metadata-providers.xml +++ b/testbed/integration/shibboleth-idp/config/shib-idp/conf/metadata-providers.xml @@ -20,84 +20,5 @@ http://www.w3.org/2001/04/xmlenc# http://www.w3.org/TR/xmlenc-core/xenc-schema.xsd http://www.w3.org/2009/xmlenc11# http://www.w3.org/TR/2013/REC-xmlenc-core1-20130411/xenc-schema-11.xsd"> - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://mdq.incommon.org/ - diff --git a/testbed/integration/shibboleth-idp/config/shib-idp/conf/relying-party.xml b/testbed/integration/shibboleth-idp/config/shib-idp/conf/relying-party.xml index 5127515ed..478731ac5 100644 --- a/testbed/integration/shibboleth-idp/config/shib-idp/conf/relying-party.xml +++ b/testbed/integration/shibboleth-idp/config/shib-idp/conf/relying-party.xml @@ -40,7 +40,7 @@ --> - +