From 54f2cab255c113b4ffaf79e64e6e9b19c915b7da Mon Sep 17 00:00:00 2001 From: Chad Redman Date: Sat, 6 Jan 2024 00:37:00 -0500 Subject: [PATCH] Build for 5.7.0 with supervisord, apache, shib-sp, shib-idp; mysql -> postgres --- TODO.md | 6 + base/Dockerfile | 277 +- .../etc/my.cnf.d/mariadb-server.cnf | 56 - .../conf/grouper-loader.properties | 12 + .../{ => grouper}/conf/grouper-ui.properties | 0 .../conf/grouper.hibernate.properties | 11 +- .../{ => grouper}/conf/grouper.properties | 0 .../grouperText/grouper.text.en.us.properties | 0 .../log4j.grouperContainerHost.properties | 0 .../{ => grouper}/conf/log4j2.xml | 0 .../{ => grouper}/conf/morphString.properties | 0 .../{ => grouper}/conf/subject.properties | 0 base/container_files/httpd/phpMyAdmin.conf | 77 - .../{seed-data => ldap}/domain.ldif | 0 .../{seed-data => ldap}/eduPerson.ldif | 0 .../{seed-data => ldap}/memberOf.ldif | 0 .../{seed-data => ldap}/users.ldif | 0 .../postgres/00-init_dbs_and_users.sql | 36 + base/container_files/postgres/pg_hba.conf | 7 + base/container_files/postgres/postgresql.conf | 23 + base/container_files/repos/shibboleth.repo | 10 + .../shibboleth-idp/conf/relying-party.xml | 76 + .../shibboleth-sp/attribute-map.xml | 103 +- .../shibboleth-sp/idp-metadata.xml | 2 +- .../shibboleth-sp/shibboleth2.xml | 267 +- .../tier-support/supervisord-training.conf | 13 +- base/container_files/usr-local-bin/grouper | 11 + .../usr-local-bin/grouperScriptHooks.sh | 18 - .../usr-local-bin/librarySetupPipe.sh | 110 + .../usr/share/phpmyadmin/config.inc.php | 160 - ex101/ex101.1.1/Dockerfile | 43 +- .../{seed-data => grouper}/bootstrap.gsh | 62 +- .../{seed-data => ldap}/users.ldif | 0 .../container_files/postgres/hr_depts.sql | 153 + .../container_files/postgres/hr_jobs.sql | 2953 +++++++++ .../container_files/postgres/sis_courses.sql | 645 ++ .../sis_enrollment.sql} | 5507 +---------------- .../container_files/postgres/sis_programs.sql | 1807 ++++++ ex201/ex201.end/Dockerfile | 27 +- .../{seed-data => grouper}/bootstrap.gsh | 0 .../container_files/seed-data/sisData.sql | 0 .../container_files/seed-data/users.ldif | 0 ex401/ex401.end/Dockerfile | 30 +- .../{seed-data => grouper}/bootstrap.gsh | 0 .../container_files/seed-data/sisData.sql | 0 .../container_files/seed-data/users.ldif | 0 46 files changed, 6457 insertions(+), 6045 deletions(-) delete mode 100644 base/container_files/etc/my.cnf.d/mariadb-server.cnf rename base/container_files/{ => grouper}/conf/grouper-loader.properties (94%) rename base/container_files/{ => grouper}/conf/grouper-ui.properties (100%) rename base/container_files/{ => grouper}/conf/grouper.hibernate.properties (82%) rename base/container_files/{ => grouper}/conf/grouper.properties (100%) rename base/container_files/{ => grouper}/conf/grouperText/grouper.text.en.us.properties (100%) rename base/container_files/{ => grouper}/conf/log4j.grouperContainerHost.properties (100%) rename base/container_files/{ => grouper}/conf/log4j2.xml (100%) rename base/container_files/{ => grouper}/conf/morphString.properties (100%) rename base/container_files/{ => grouper}/conf/subject.properties (100%) delete mode 100644 base/container_files/httpd/phpMyAdmin.conf rename base/container_files/{seed-data => ldap}/domain.ldif (100%) rename base/container_files/{seed-data => ldap}/eduPerson.ldif (100%) rename base/container_files/{seed-data => ldap}/memberOf.ldif (100%) rename base/container_files/{seed-data => ldap}/users.ldif (100%) create mode 100644 base/container_files/postgres/00-init_dbs_and_users.sql create mode 100644 base/container_files/postgres/pg_hba.conf create mode 100644 base/container_files/postgres/postgresql.conf create mode 100644 base/container_files/repos/shibboleth.repo create mode 100755 base/container_files/shibboleth-idp/conf/relying-party.xml delete mode 100644 base/container_files/usr-local-bin/grouperScriptHooks.sh create mode 100644 base/container_files/usr-local-bin/librarySetupPipe.sh delete mode 100644 base/container_files/usr/share/phpmyadmin/config.inc.php rename ex101/ex101.1.1/container_files/{seed-data => grouper}/bootstrap.gsh (94%) rename ex101/ex101.1.1/container_files/{seed-data => ldap}/users.ldif (100%) create mode 100644 ex101/ex101.1.1/container_files/postgres/hr_depts.sql create mode 100644 ex101/ex101.1.1/container_files/postgres/hr_jobs.sql create mode 100644 ex101/ex101.1.1/container_files/postgres/sis_courses.sql rename ex101/ex101.1.1/container_files/{seed-data/sisData.sql => postgres/sis_enrollment.sql} (57%) create mode 100644 ex101/ex101.1.1/container_files/postgres/sis_programs.sql rename ex201/ex201.end/container_files/{seed-data => grouper}/bootstrap.gsh (100%) delete mode 100644 ex201/ex201.end/container_files/seed-data/sisData.sql delete mode 100644 ex201/ex201.end/container_files/seed-data/users.ldif rename ex401/ex401.end/container_files/{seed-data => grouper}/bootstrap.gsh (100%) delete mode 100644 ex401/ex401.end/container_files/seed-data/sisData.sql delete mode 100644 ex401/ex401.end/container_files/seed-data/users.ldif diff --git a/TODO.md b/TODO.md index 99355f6..267f98e 100644 --- a/TODO.md +++ b/TODO.md @@ -2,6 +2,12 @@ TODO ===== +202403 +------ +- pgAdmin not working +- need content for data fields +- attributes app may not work; need to test + 202209 ------- - EduPersonEntitlement full sync is not logging diff --git a/base/Dockerfile b/base/Dockerfile index 3f7584b..ab2d7ba 100644 --- a/base/Dockerfile +++ b/base/Dockerfile @@ -1,8 +1,9 @@ -FROM tier/shib-idp:4.3.1_20230818 as idp -# latest 3.x is tier/shib-idp:3.4.7_20200702 +FROM tier/shib-idp:4.3.1_20231218 as idp + +#FROM i2incommon/grouper:4.10.2 as grouper4 # Grouper version for the entire GTE -FROM i2incommon/grouper:4.8.0 +FROM i2incommon/grouper:5.7.0 # Disable docker HEALTHCHECK inherited from tier/shib-sp HEALTHCHECK NONE @@ -17,107 +18,245 @@ LABEL author="tier-packaging@internet2.edu " \ ENV ENV=training \ USERTOKEN=gte-base -RUN dnf install -y procps-ng nano nc mariadb mariadb-server openldap-clients php php-json php-mysqlnd golang https://archive.fedoraproject.org/pub/archive/epel/8.7/Everything/x86_64/Packages/p/phpldapadmin-1.2.6.3-1.el8.noarch.rpm \ + +# Add shib-sp repo (similar to base shib-sp image build) +COPY container_files/repos/shibboleth.repo /etc/yum.repos.d/security:shibboleth.repo + +# Basic packages, add postgres, plus add back apache, supervisord, and shibboleth +# Add postgres (list available versions with `dnf module list postgresql`) +# Ref: https://www.baeldung.com/ops/postgresql-docker-setup +# Ref: https://www.digitalocean.com/community/tutorials/how-to-install-and-use-postgresql-on-rocky-linux-8 +RUN dnf install -y nano nc openldap-clients httpd mod_ssl https://archive.fedoraproject.org/pub/archive/epel/8.7/Everything/x86_64/Packages/p/phpldapadmin-1.2.6.3-1.el8.noarch.rpm \ && dnf install -y 'dnf-command(config-manager)' \ && dnf config-manager --set-enabled powertools \ && dnf install -y openldap-servers \ - && dnf clean all - -RUN mkdir -p /tmp/phpmyadmin \ - && cd /tmp/phpmyadmin \ - && wget https://files.phpmyadmin.net/phpMyAdmin/5.2.1/phpMyAdmin-5.2.1-all-languages.zip \ - && unzip phpMyAdmin-*.zip \ - && mv phpMyAdmin-*-all-languages /usr/share/phpmyadmin \ - && mkdir -p /run/php-fpm/ /usr/share/phpmyadmin/tmp/ - -COPY container_files/seed-data/ /seed-data/ - -# TODO get the my.cnf from the old server. These files are in cnf.d and don't have a lot of variables -RUN mysql_install_db --force \ - && chown -R mysql:mysql /var/lib/mysql/ /var/log/mariadb \ - && sed -i 's/^\(bind-address\s.*\)/# \1/' /etc/my.cnf.d/mariadb-server.cnf \ - && sed -i 's/^\(log_error\s.*\)/# \1/' /etc/my.cnf \ - && sed -i 's/\[mysqld\]/\[mysqld\]\ncharacter_set_server = utf8/' /etc/my.cnf \ - && sed -i 's/\[mysqld\]/\[mysqld\]\ncollation_server = utf8_general_ci/' /etc/my.cnf \ - && sed -i 's/\[mysqld\]/\[mysqld\]\nport = 3306/' /etc/my.cnf \ - && cat /etc/my.cnf \ - && echo "/usr/bin/mysqld_safe &" > /tmp/config \ - && echo "mysqladmin --silent --wait=30 ping || exit 1" >> /tmp/config \ - && echo "mysql -e 'CREATE USER \"root\"@\"%\"; GRANT ALL PRIVILEGES ON *.* TO \"root\"@\"%\" WITH GRANT OPTION; FLUSH PRIVILEGES'" >> /tmp/config \ - && echo "mysql -e 'CREATE DATABASE grouper CHARACTER SET utf8 COLLATE utf8_bin;'" >> /tmp/config \ - && bash /tmp/config \ - && rm -f /tmp/config -# && mysql grouper < /seed-data/sisData.sql - -# TODO error ERROR 1133 (28000) at line 1: Can't find any matching row in the user table - -# On Rocky Linux, slapd defaults to mdg not hdb -# use `ldapsearch -H ldapi:/// -Y EXTERNAL -b "cn=config" -LLL -Q "olcDatabase=*" dn` to config - -# On Rocky, don't need to import module memberOf (`cat /etc/openldap/slapd.d/cn=config/cn=module{0}.ldif`) + && dnf install -y --setopt=tsflags=nodocs epel-release \ + && dnf install -y supervisor \ + && dnf install -y shibboleth-3.4.1 \ + && dnf module -y enable postgresql:15 \ + && dnf install -y postgresql-server postgresql-contrib + + +# Install pgAdmin (ref: https://www.pgadmin.org/download/pgadmin-4-rpm/) +RUN rpm -i https://ftp.postgresql.org/pub/pgadmin/pgadmin4/yum/pgadmin4-redhat-repo-2-1.noarch.rpm \ + && dnf -y install pgadmin4-web + + +# Init ldap and add basic schemas and OU's +COPY container_files/ldap/ /tmp/base/ldap/ RUN cp /usr/share/openldap-servers/DB_CONFIG.example /var/lib/ldap/DB_CONFIG \ && mkdir -p /var/ldap/example \ && chown -R ldap:ldap /var/lib/ldap /etc/openldap/slapd.d /var/ldap \ && (/usr/sbin/slapd -h "ldap:/// ldaps:/// ldapi:///" -u ldap &) \ && while ! nc -z localhost 389 > /dev/null; do echo waiting for ldap to start; sleep 1; done \ - && ldapmodify -Y EXTERNAL -H ldapi:/// -f /seed-data/domain.ldif \ + && ldapmodify -Y EXTERNAL -H ldapi:/// -f /tmp/base/ldap/domain.ldif \ && ldapadd -H ldapi:/// -f /etc/openldap/schema/cosine.ldif \ && ldapadd -H ldapi:/// -f /etc/openldap/schema/inetorgperson.ldif \ - && ldapadd -H ldapi:/// -f /seed-data/memberOf.ldif \ - && ldapadd -H ldapi:/// -f /seed-data/eduPerson.ldif \ - && ldapadd -x -D cn=root,dc=internet2,dc=edu -w password -f /seed-data/users.ldif \ + && ldapadd -H ldapi:/// -f /tmp/base/ldap/memberOf.ldif \ + && ldapadd -H ldapi:/// -f /tmp/base/ldap/eduPerson.ldif \ + && ldapadd -x -D cn=root,dc=internet2,dc=edu -w password -f /tmp/base/ldap/users.ldif \ && pkill -HUP slapd \ && while nc -z localhost 389 > /dev/null; do echo waiting for ldap to stop; sleep 1; done -RUN go install github.com/mailhog/MailHog@v1.0.1 -COPY container_files/conf/ /opt/grouper/grouperWebapp/WEB-INF/classes/ -#COPY container_files/conf/grouperText/* /opt/grouper/grouperWebapp/WEB-INF/classes/grouperText/ +# install Go app for MailHog +RUN dnf install -y golang \ + && go install github.com/mailhog/MailHog@v1.0.1 + + +# Init grouper databases and grouper, needs ldap and db to be up +COPY container_files/grouper/conf /opt/grouper/grouperWebapp/WEB-INF/classes/ +COPY container_files/postgres/00-init_dbs_and_users.sql /tmp/base/postgres/00-init_dbs_and_users.sql RUN (/usr/sbin/slapd -h "ldap:/// ldaps:/// ldapi:///" -u ldap &) \ - && while ! nc -z localhost 389 > /dev/null; do echo waiting for ldap to start; sleep 1; done; \ - (mysqld_safe & ) \ - && while ! nc -z localhost 3306 > /dev/null; do echo waiting for mysqld to start; sleep 3; done; \ - cd /opt/grouper/grouperWebapp/WEB-INF/bin \ - && ./gsh.sh -registry -check -runscript -noprompt \ + && while ! nc -z localhost 389 > /dev/null; do echo waiting for ldap to start; sleep 1; done \ + && su -l postgres -c /usr/bin/initdb \ + && su -l postgres -c "pg_ctl -D /var/lib/pgsql/data -l /tmp/pg_logfile start" \ + && while ! nc -z localhost 5432 > /dev/null; do echo waiting for postgres to start; sleep 3; done \ + && psql -U postgres -f /tmp/base/postgres/00-init_dbs_and_users.sql \ + && cd /opt/grouper/grouperWebapp/WEB-INF \ + && ./bin/gsh.sh -registry -check -runscript -noprompt \ && pkill -HUP slapd \ - && while nc -z localhost 389 > /dev/null; do echo waiting for ldap to stop; sleep 1; done; \ - pkill -u mysql mysqld \ - && while nc -z localhost 3306 > /dev/null; do echo waiting for mysqld to stop; sleep 1; done + && while nc -z localhost 389 > /dev/null; do echo waiting for ldap to stop; sleep 1; done \ + && su -l postgres -c "pg_ctl -D /var/lib/pgsql/data stop" \ + && while nc -z localhost 5432 > /dev/null; do echo waiting for postgres to stop; sleep 1; done + +# overwrite max_connections and other properties +COPY container_files/postgres/postgresql.conf /var/lib/pgsql/data/postgresql.conf +COPY container_files/postgres/pg_hba.conf /var/lib/pgsql/data/pg_hba.conf + +## Built-in script postgresql-setup does not work due to systemd; use initdb script instead +#&& postgresql-setup --initdb + +# Install IDP COPY --from=idp /opt/shibboleth-idp/ /opt/shibboleth-idp/ -COPY container_files/etc/ /etc/ -COPY container_files/httpd/* /etc/httpd/conf.d/ COPY container_files/shibboleth-idp/ /opt/shibboleth-idp/ -COPY container_files/shibboleth-sp/* /etc/shibboleth/ + +RUN chown -R tomcat /opt/shibboleth-idp/ \ + && chmod -R 700 /opt/shibboleth-idp/ \ + && ANT_OPTS="-Didp.noprompt=true -Didp.target.dir=/opt/shibboleth-idp" /opt/shibboleth-idp/bin/build.sh + + +# From I2 Shib-SP, generate Apache cert +RUN openssl req -new -nodes -newkey rsa:2048 -subj "/commonName=localhost.localdomain" -batch -keyout /etc/pki/tls/private/localhost.key -out localhost.csr \ + && openssl x509 -req -days 1825 -in localhost.csr -signkey /etc/pki/tls/private/localhost.key -out /etc/pki/tls/certs/localhost.crt + + + # Needed for phpldapadmin CGI + RUN mkdir -p /run/php-fpm/ + + +# Copy general support files +COPY container_files/etc/ /etc/ +COPY container_files/shibboleth-sp/ /etc/shibboleth/ COPY container_files/tomcat/ /opt/tomcat/ +COPY container_files/httpd/* /etc/httpd/conf.d/ COPY container_files/tier-support/* /opt/tier-support/ COPY container_files/tls/host-key.pem /etc/pki/tls/private/ COPY container_files/tls/* /etc/pki/tls/certs/ -COPY container_files/usr-local-bin/* /usr/local/bin/ COPY container_files/var-www-html/ /var/www/html/ -COPY container_files/usr/share/ /usr/share/ +COPY container_files/usr-local-bin/* /usr/local/bin/ + +#COPY container_files/usr/share/ /usr/share/ -#RUN cp /opt/tier-support/grouper.xml /opt/tier-support/grouper-ws.xml /opt/tomcat/conf/Catalina/localhost/ \ -RUN chown -R tomcat /opt/shibboleth-idp/ \ - && chmod -R 700 /opt/shibboleth-idp/ \ - && chmod +rx /var/www/html/app/index.py \ - && ANT_OPTS="-Didp.noprompt=true -Didp.target.dir=/opt/shibboleth-idp" /opt/shibboleth-idp/bin/build.sh \ - && chmod go-w /usr/share/phpmyadmin/config.inc.php +#RUN chmod +rx /var/www/html/app/index.py \ +# && rm -f /tmp/loghttpd /tmp/logpipe /tmp/logshibd /tmp/logsuperd /tmp/logtomcat /tmp/pg_logfile -RUN chown -R tomcat:tomcat /opt/grouper/grouperWebapp -RUN chown -R tomcat:tomcat /opt/tomcat -RUN chown -R apache:apache /usr/share/phpmyadmin/tmp/ -ENV GROUPER_START_DELAY_SECONDS=10 \ +# Recovered from 4.x container +ENV GROUPER_USE_PIPES=true \ + GROUPER_LOG_TO_PIPE=true \ + GROUPER_RUN_APACHE=true \ + GROUPER_RUN_SHIB_SP=true \ + GROUPER_SHIB_LOG_USE_PIPE=true \ + GROUPER_TOMCAT_LOG_ACCESS=true \ + GROUPER_TOMCAT_AJP_PORT=8009 \ + GROUPER_TOMCAT_HTTPS_PORT=-1 \ GROUPER_WS_GROUPER_AUTH=true +# Workaround for 5.7.0 issue, GRP-5246: Tomcat rewrite valve should be opt-in or have a way to opt out +RUN touch /opt/tomcat/conf/Catalina/localhost/rewrite.config + + # note 5005 is for remote Java debugging # 1025 is MailHog SMTP server # 8025 is MailHog HTTP server -EXPOSE 389 3306 8080 5005 1025 8025 + +EXPOSE 389 636 5432 443 8080 8443 5005 1025 8025 CMD ["grouper"] + +## =========================================================== +# +#RUN false +# +#RUN dnf install -y procps-ng nano nc mariadb mariadb-server openldap-clients php php-json php-mysqlnd golang https://archive.fedoraproject.org/pub/archive/epel/8.7/Everything/x86_64/Packages/p/phpldapadmin-1.2.6.3-1.el8.noarch.rpm \ +# && dnf install -y 'dnf-command(config-manager)' \ +# && dnf config-manager --set-enabled powertools \ +# && dnf install -y openldap-servers \ +# && dnf clean all +# +#RUN mkdir -p /tmp/phpmyadmin \ +# && cd /tmp/phpmyadmin \ +# && wget https://files.phpmyadmin.net/phpMyAdmin/5.2.1/phpMyAdmin-5.2.1-all-languages.zip \ +# && unzip phpMyAdmin-*.zip \ +# && mv phpMyAdmin-*-all-languages /usr/share/phpmyadmin \ +# && mkdir -p /run/php-fpm/ /usr/share/phpmyadmin/tmp/ +# +#COPY container_files/seed-data/ /seed-data/ +# +## TODO get the my.cnf from the old server. These files are in cnf.d and don't have a lot of variables +#RUN mysql_install_db --force \ +# && chown -R mysql:mysql /var/lib/mysql/ /var/log/mariadb \ +# && sed -i 's/^\(bind-address\s.*\)/# \1/' /etc/my.cnf.d/mariadb-server.cnf \ +# && sed -i 's/^\(log_error\s.*\)/# \1/' /etc/my.cnf \ +# && sed -i 's/\[mysqld\]/\[mysqld\]\ncharacter_set_server = utf8/' /etc/my.cnf \ +# && sed -i 's/\[mysqld\]/\[mysqld\]\ncollation_server = utf8_general_ci/' /etc/my.cnf \ +# && sed -i 's/\[mysqld\]/\[mysqld\]\nport = 3306/' /etc/my.cnf \ +# && cat /etc/my.cnf \ +# && echo "/usr/bin/mysqld_safe &" > /tmp/config \ +# && echo "mysqladmin --silent --wait=30 ping || exit 1" >> /tmp/config \ +# && echo "mysql -e 'CREATE USER \"root\"@\"%\"; GRANT ALL PRIVILEGES ON *.* TO \"root\"@\"%\" WITH GRANT OPTION; FLUSH PRIVILEGES'" >> /tmp/config \ +# && echo "mysql -e 'CREATE DATABASE grouper CHARACTER SET utf8 COLLATE utf8_bin;'" >> /tmp/config \ +# && bash /tmp/config \ +# && rm -f /tmp/config +## && mysql grouper < /seed-data/sisData.sql +# +## TODO error ERROR 1133 (28000) at line 1: Can't find any matching row in the user table +# +## On Rocky Linux, slapd defaults to mdg not hdb +## use `ldapsearch -H ldapi:/// -Y EXTERNAL -b "cn=config" -LLL -Q "olcDatabase=*" dn` to config +# +## On Rocky, don't need to import module memberOf (`cat /etc/openldap/slapd.d/cn=config/cn=module{0}.ldif`) +# +#RUN cp /usr/share/openldap-servers/DB_CONFIG.example /var/lib/ldap/DB_CONFIG \ +# && mkdir -p /var/ldap/example \ +# && chown -R ldap:ldap /var/lib/ldap /etc/openldap/slapd.d /var/ldap \ +# && (/usr/sbin/slapd -h "ldap:/// ldaps:/// ldapi:///" -u ldap &) \ +# && while ! nc -z localhost 389 > /dev/null; do echo waiting for ldap to start; sleep 1; done \ +# && ldapmodify -Y EXTERNAL -H ldapi:/// -f /seed-data/domain.ldif \ +# && ldapadd -H ldapi:/// -f /etc/openldap/schema/cosine.ldif \ +# && ldapadd -H ldapi:/// -f /etc/openldap/schema/inetorgperson.ldif \ +# && ldapadd -H ldapi:/// -f /seed-data/memberOf.ldif \ +# && ldapadd -H ldapi:/// -f /seed-data/eduPerson.ldif \ +# && ldapadd -x -D cn=root,dc=internet2,dc=edu -w password -f /seed-data/users.ldif \ +# && pkill -HUP slapd \ +# && while nc -z localhost 389 > /dev/null; do echo waiting for ldap to stop; sleep 1; done +# +## install Go app for MailHog +#RUN dnf install -y golang \ +# && go install github.com/mailhog/MailHog@v1.0.1 +# +#COPY container_files/grouper/conf /opt/grouper/grouperWebapp/WEB-INF/classes/ +##COPY container_files/conf/grouperText/* /opt/grouper/grouperWebapp/WEB-INF/classes/grouperText/ +# +#RUN (/usr/sbin/slapd -h "ldap:/// ldaps:/// ldapi:///" -u ldap &) \ +# && while ! nc -z localhost 389 > /dev/null; do echo waiting for ldap to start; sleep 1; done; \ +# (mysqld_safe & ) \ +# && while ! nc -z localhost 3306 > /dev/null; do echo waiting for mysqld to start; sleep 3; done; \ +# cd /opt/grouper/grouperWebapp/WEB-INF/bin \ +# && ./gsh.sh -registry -check -runscript -noprompt \ +# && pkill -HUP slapd \ +# && while nc -z localhost 389 > /dev/null; do echo waiting for ldap to stop; sleep 1; done; \ +# pkill -u mysql mysqld \ +# && while nc -z localhost 3306 > /dev/null; do echo waiting for mysqld to stop; sleep 1; done +# +#COPY --from=idp /opt/shibboleth-idp/ /opt/shibboleth-idp/ +# +#COPY container_files/etc/ /etc/ +#COPY container_files/httpd/* /etc/httpd/conf.d/ +#COPY container_files/shibboleth-idp/ /opt/shibboleth-idp/ +#COPY container_files/shibboleth-sp/* /etc/shibboleth/ +#COPY container_files/tomcat/ /opt/tomcat/ +#COPY container_files/tier-support/* /opt/tier-support/ +#COPY container_files/tls/host-key.pem /etc/pki/tls/private/ +#COPY container_files/tls/* /etc/pki/tls/certs/ +#COPY container_files/usr-local-bin/* /usr/local/bin/ +#COPY container_files/var-www-html/ /var/www/html/ +#COPY container_files/usr/share/ /usr/share/ +# +##RUN cp /opt/tier-support/grouper.xml /opt/tier-support/grouper-ws.xml /opt/tomcat/conf/Catalina/localhost/ \ +#RUN chown -R tomcat /opt/shibboleth-idp/ \ +# && chmod -R 700 /opt/shibboleth-idp/ \ +# && chmod +rx /var/www/html/app/index.py \ +# && ANT_OPTS="-Didp.noprompt=true -Didp.target.dir=/opt/shibboleth-idp" /opt/shibboleth-idp/bin/build.sh \ +# && chmod go-w /usr/share/phpmyadmin/config.inc.php +# +# +#RUN chown -R tomcat:tomcat /opt/grouper/grouperWebapp +#RUN chown -R tomcat:tomcat /opt/tomcat +#RUN chown -R apache:apache /usr/share/phpmyadmin/tmp/ +# +#ENV GROUPER_START_DELAY_SECONDS=10 \ +# GROUPER_WS_GROUPER_AUTH=true +# +## note 5005 is for remote Java debugging +## 1025 is MailHog SMTP server +## 8025 is MailHog HTTP server +#EXPOSE 389 3306 8080 5005 1025 8025 +# +#CMD ["grouper"] diff --git a/base/container_files/etc/my.cnf.d/mariadb-server.cnf b/base/container_files/etc/my.cnf.d/mariadb-server.cnf deleted file mode 100644 index cc82204..0000000 --- a/base/container_files/etc/my.cnf.d/mariadb-server.cnf +++ /dev/null @@ -1,56 +0,0 @@ -# -# These groups are read by MariaDB server. -# Use it for options that only the server (but not clients) should see -# -# See the examples of server my.cnf files in /usr/share/mysql/ -# - -# this is read by the standalone daemon and embedded servers -[server] - -# this is only for the mysqld standalone daemon -# Settings user and group are ignored when systemd is used. -# If you need to run mysqld under a different user or group, -# customize your systemd unit file for mysqld/mariadb according to the -# instructions in http://fedoraproject.org/wiki/Systemd -[mysqld] -datadir=/var/lib/mysql -socket=/var/lib/mysql/mysql.sock -log-error=/var/log/mariadb/mariadb.log -pid-file=/run/mariadb/mariadb.pid -max_connections = 750 - - -# -# * Galera-related settings -# -[galera] -# Mandatory settings -#wsrep_on=ON -#wsrep_provider= -#wsrep_cluster_address= -#binlog_format=row -#default_storage_engine=InnoDB -#innodb_autoinc_lock_mode=2 -# -# Allow server to accept connections on all interfaces. -# -bind-address=0.0.0.0 -# -# Optional setting -#wsrep_slave_threads=1 -#innodb_flush_log_at_trx_commit=0 - -# this is only for embedded server -[embedded] - -# This group is only read by MariaDB servers, not by MySQL. -# If you use the same .cnf file for MySQL and MariaDB, -# you can put MariaDB-only options here -[mariadb] - -# This group is only read by MariaDB-10.3 servers. -# If you use the same .cnf file for MariaDB of different versions, -# use this group for options that older servers don't understand -[mariadb-10.3] - diff --git a/base/container_files/conf/grouper-loader.properties b/base/container_files/grouper/conf/grouper-loader.properties similarity index 94% rename from base/container_files/conf/grouper-loader.properties rename to base/container_files/grouper/conf/grouper-loader.properties index aa21dfe..b473ddc 100644 --- a/base/container_files/conf/grouper-loader.properties +++ b/base/container_files/grouper/conf/grouper-loader.properties @@ -85,3 +85,15 @@ ldap.demo.uiTestExpectedValue = admin loader.ldap.requireTopStemAsStemFromConfigGroup=false loader.allowStemDisplayNameChangesUnderStems=basis:hr, basis:sis + +db.hr.url = jdbc:postgresql://localhost:5432/hr +db.hr.user = hr_grouper_svc +db.hr.pass = pass +db.sis.url = jdbc:postgresql://localhost:5432/sis +db.sis.user = sis_grouper_svc +db.sis.pass = pass + + +# Way too verbose +daemon.log.logEnabled_overallLog = false +daemon.log.logEnabled_subjobLog = false diff --git a/base/container_files/conf/grouper-ui.properties b/base/container_files/grouper/conf/grouper-ui.properties similarity index 100% rename from base/container_files/conf/grouper-ui.properties rename to base/container_files/grouper/conf/grouper-ui.properties diff --git a/base/container_files/conf/grouper.hibernate.properties b/base/container_files/grouper/conf/grouper.hibernate.properties similarity index 82% rename from base/container_files/conf/grouper.hibernate.properties rename to base/container_files/grouper/conf/grouper.hibernate.properties index 88c7570..e267e4e 100644 --- a/base/container_files/conf/grouper.hibernate.properties +++ b/base/container_files/grouper/conf/grouper.hibernate.properties @@ -20,12 +20,15 @@ # e.g. hsqldb (b): jdbc:hsqldb:hsql://localhost:9001/grouper # e.g. postgres: jdbc:postgresql://localhost:5432/database # e.g. mssql: jdbc:sqlserver://localhost:3280;databaseName=grouper -hibernate.connection.url = jdbc:mysql://localhost:3306/grouper?CharSet=utf8&useUnicode=true&characterEncoding=utf8 +hibernate.connection.url = jdbc:postgresql://localhost:5432/grouper -hibernate.connection.username = root +hibernate.connection.username = grouper # If you are using an empty password, depending upon your version of # Java and Ant you may need to specify a password of "". # Note: you can keep passwords external and encrypted: https://bugs.internet2.edu/jira/browse/GRP-122 -hibernate.connection.password = +hibernate.connection.password = pass -registry.auto.ddl.upToVersion = 4.*.* +registry.auto.ddl.upToVersion = 5.*.* + +# initial loaders overwhelm postgres at default 500 +hibernate.c3p0.max_size = 100 \ No newline at end of file diff --git a/base/container_files/conf/grouper.properties b/base/container_files/grouper/conf/grouper.properties similarity index 100% rename from base/container_files/conf/grouper.properties rename to base/container_files/grouper/conf/grouper.properties diff --git a/base/container_files/conf/grouperText/grouper.text.en.us.properties b/base/container_files/grouper/conf/grouperText/grouper.text.en.us.properties similarity index 100% rename from base/container_files/conf/grouperText/grouper.text.en.us.properties rename to base/container_files/grouper/conf/grouperText/grouper.text.en.us.properties diff --git a/base/container_files/conf/log4j.grouperContainerHost.properties b/base/container_files/grouper/conf/log4j.grouperContainerHost.properties similarity index 100% rename from base/container_files/conf/log4j.grouperContainerHost.properties rename to base/container_files/grouper/conf/log4j.grouperContainerHost.properties diff --git a/base/container_files/conf/log4j2.xml b/base/container_files/grouper/conf/log4j2.xml similarity index 100% rename from base/container_files/conf/log4j2.xml rename to base/container_files/grouper/conf/log4j2.xml diff --git a/base/container_files/conf/morphString.properties b/base/container_files/grouper/conf/morphString.properties similarity index 100% rename from base/container_files/conf/morphString.properties rename to base/container_files/grouper/conf/morphString.properties diff --git a/base/container_files/conf/subject.properties b/base/container_files/grouper/conf/subject.properties similarity index 100% rename from base/container_files/conf/subject.properties rename to base/container_files/grouper/conf/subject.properties diff --git a/base/container_files/httpd/phpMyAdmin.conf b/base/container_files/httpd/phpMyAdmin.conf deleted file mode 100644 index bf257a4..0000000 --- a/base/container_files/httpd/phpMyAdmin.conf +++ /dev/null @@ -1,77 +0,0 @@ -# phpMyAdmin - Web based MySQL browser written in php -# -# Allows only localhost by default -# -# But allowing phpMyAdmin to anyone other than localhost should be considered -# dangerous unless properly secured by SSL - -Alias /phpMyAdmin /usr/share/phpmyadmin -Alias /phpmyadmin /usr/share/phpmyadmin - - - AddDefaultCharset UTF-8 - - - # Apache 2.4 - - Require all granted - Require ip 127.0.0.1 - Require ip ::1 - - - - # Apache 2.2 - Order Deny,Allow - Deny from All - Allow from 127.0.0.1 - Allow from ::1 - - - - - - # Apache 2.4 - - Require all granted - Require ip 127.0.0.1 - Require ip ::1 - - - - # Apache 2.2 - Order Deny,Allow - Deny from All - Allow from 127.0.0.1 - Allow from ::1 - - - -# These directories do not require access over HTTP - taken from the original -# phpMyAdmin upstream tarball -# - - Order Deny,Allow - Deny from All - Allow from None - - - - Order Deny,Allow - Deny from All - Allow from None - - - - Order Deny,Allow - Deny from All - Allow from None - - -# This configuration prevents mod_security at phpMyAdmin directories from -# filtering SQL etc. This may break your mod_security implementation. -# -# -# -# SecRuleInheritance Off -# -# \ No newline at end of file diff --git a/base/container_files/seed-data/domain.ldif b/base/container_files/ldap/domain.ldif similarity index 100% rename from base/container_files/seed-data/domain.ldif rename to base/container_files/ldap/domain.ldif diff --git a/base/container_files/seed-data/eduPerson.ldif b/base/container_files/ldap/eduPerson.ldif similarity index 100% rename from base/container_files/seed-data/eduPerson.ldif rename to base/container_files/ldap/eduPerson.ldif diff --git a/base/container_files/seed-data/memberOf.ldif b/base/container_files/ldap/memberOf.ldif similarity index 100% rename from base/container_files/seed-data/memberOf.ldif rename to base/container_files/ldap/memberOf.ldif diff --git a/base/container_files/seed-data/users.ldif b/base/container_files/ldap/users.ldif similarity index 100% rename from base/container_files/seed-data/users.ldif rename to base/container_files/ldap/users.ldif diff --git a/base/container_files/postgres/00-init_dbs_and_users.sql b/base/container_files/postgres/00-init_dbs_and_users.sql new file mode 100644 index 0000000..62af2d7 --- /dev/null +++ b/base/container_files/postgres/00-init_dbs_and_users.sql @@ -0,0 +1,36 @@ +CREATE DATABASE grouper; +CREATE USER grouper WITH ENCRYPTED PASSWORD 'pass'; +GRANT ALL PRIVILEGES ON DATABASE grouper TO grouper; + +CREATE DATABASE hr; +CREATE USER hr_owner WITH ENCRYPTED PASSWORD 'pass'; +GRANT ALL PRIVILEGES ON DATABASE hr TO hr_owner; + +CREATE DATABASE sis; +CREATE USER sis_owner WITH ENCRYPTED PASSWORD 'pass'; +GRANT ALL PRIVILEGES ON DATABASE sis TO sis_owner; + +CREATE USER hr_grouper_svc PASSWORD 'pass'; +CREATE USER sis_grouper_svc PASSWORD 'pass'; + +\c grouper postgres +GRANT ALL ON SCHEMA public TO grouper; + +\c hr postgres +GRANT ALL ON SCHEMA public TO hr_owner; +/*GRANT SELECT ON ALL TABLES IN SCHEMA public TO hr_grouper_svc;*/ + +\c hr hr_owner +/* not working with v15 ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT ON TABLES TO hr_grouper_svc; */ +ALTER DEFAULT PRIVILEGES FOR ROLE hr_owner IN SCHEMA public GRANT SELECT ON TABLES TO hr_grouper_svc; + +\c sis postgres +GRANT ALL ON SCHEMA public TO sis_owner; +/*GRANT SELECT ON ALL TABLES IN SCHEMA public TO sis_grouper_svc;*/ + +\c sis sis_owner +/* not working with v15 ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT ON TABLES TO sis_grouper_svc; */ +ALTER DEFAULT PRIVILEGES FOR ROLE sis_owner IN SCHEMA public GRANT SELECT ON TABLES TO sis_grouper_svc; + + +/* note - default privileges only apply for the user running the command; need to create future objects as the schema owner */ diff --git a/base/container_files/postgres/pg_hba.conf b/base/container_files/postgres/pg_hba.conf new file mode 100644 index 0000000..496b74c --- /dev/null +++ b/base/container_files/postgres/pg_hba.conf @@ -0,0 +1,7 @@ +local all all trust +host all all 127.0.0.1/32 trust +host all all ::1/128 trust +local replication all trust +host replication all 127.0.0.1/32 trust +host replication all ::1/128 trust +host all all 0.0.0.0/0 scram-sha-256 diff --git a/base/container_files/postgres/postgresql.conf b/base/container_files/postgres/postgresql.conf new file mode 100644 index 0000000..9b24470 --- /dev/null +++ b/base/container_files/postgres/postgresql.conf @@ -0,0 +1,23 @@ +#max_connections = 100 # (change requires restart) +max_connections = 350 # (change requires restart) +#shared_buffers = 128MB # min 128kB +shared_buffers = 512MB # min 128kB +dynamic_shared_memory_type = posix # the default is usually the first option +max_wal_size = 1GB +min_wal_size = 80MB +logging_collector = on # Enable capturing of stderr, jsonlog, +log_filename = 'postgresql-%a.log' # log file name pattern, +log_rotation_age = 1d # Automatic rotation of logfiles will +log_rotation_size = 0 # Automatic rotation of logfiles will +log_truncate_on_rotation = on # If on, an existing log file with the +log_timezone = 'UTC' +datestyle = 'iso, mdy' +timezone = 'UTC' +lc_messages = 'C.UTF-8' # locale for system error message +lc_monetary = 'C.UTF-8' # locale for monetary formatting +lc_numeric = 'C.UTF-8' # locale for number formatting +lc_time = 'C.UTF-8' # locale for time formatting +default_text_search_config = 'pg_catalog.english' + +#listen_addresses = 'localhost' +listen_addresses = '*' \ No newline at end of file diff --git a/base/container_files/repos/shibboleth.repo b/base/container_files/repos/shibboleth.repo new file mode 100644 index 0000000..65cdd34 --- /dev/null +++ b/base/container_files/repos/shibboleth.repo @@ -0,0 +1,10 @@ +[shibboleth] +name=Shibboleth (rockylinux8) +# Please report any problems to https://shibboleth.atlassian.net/jira +type=rpm-md +mirrorlist=https://shibboleth.net/cgi-bin/mirrorlist.cgi/rockylinux8 +gpgcheck=1 +gpgkey=https://shibboleth.net/downloads/service-provider/RPMS/repomd.xml.key + https://shibboleth.net/downloads/service-provider/RPMS/cantor.repomd.xml.key +enabled=1 + diff --git a/base/container_files/shibboleth-idp/conf/relying-party.xml b/base/container_files/shibboleth-idp/conf/relying-party.xml new file mode 100755 index 0000000..cb75e65 --- /dev/null +++ b/base/container_files/shibboleth-idp/conf/relying-party.xml @@ -0,0 +1,76 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/base/container_files/shibboleth-sp/attribute-map.xml b/base/container_files/shibboleth-sp/attribute-map.xml index dcee617..b5208f8 100644 --- a/base/container_files/shibboleth-sp/attribute-map.xml +++ b/base/container_files/shibboleth-sp/attribute-map.xml @@ -1,64 +1,66 @@ - + + + - - + + - - + + + - + + + - + - - + + - - + + - - + + - - - - - - - - - - - + + - + - - - - + + + - - - + @@ -138,4 +138,27 @@ - \ No newline at end of file + + + + diff --git a/base/container_files/shibboleth-sp/idp-metadata.xml b/base/container_files/shibboleth-sp/idp-metadata.xml index 111ea3c..0748400 100644 --- a/base/container_files/shibboleth-sp/idp-metadata.xml +++ b/base/container_files/shibboleth-sp/idp-metadata.xml @@ -10,7 +10,7 @@ - example.org + example.edu + + + + + + + + + + + + + + + + + + + + + + + - + + + + + + + + + + + - + + REMOTE_USER="uid" + metadataAttributePrefix="Meta-" + sessionHook="/Shibboleth.sso/AttrChecker" + cipherSuites="DEFAULT:!EXP:!LOW:!aNULL:!eNULL:!DES:!IDEA:!SEED:!RC4:!3DES:!kRSA:!SSLv2:!SSLv3:!TLSv1:!TLSv1.1"> - + + + - - SAML2 - - - SAML2 Local + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -61,31 +200,49 @@ + + + + + + + + + - + + + + + + + + - + + + + - - + + +