From 827d2cffb7111d49cbc1d956cae3ec502a9814f7 Mon Sep 17 00:00:00 2001 From: Slavek Licehammer Date: Thu, 19 Nov 2020 23:49:32 +0100 Subject: [PATCH] New SAML2 authN implementation SAML2 authentication is now using Shibboleth SP by default. SP embeded in midPoint si also available on a different URL. --- Dockerfile | 4 +- container_files/httpd/conf/ssl-enable.conf | 2 + container_files/supervisor/supervisord.conf | 7 + .../midpoint/httpd/00-shib.conf | 1 + .../midpoint/httpd/midpoint-shib.conf | 14 ++ .../midpoint/httpd/vhosts.conf | 1 + .../midpoint/shibboleth/attribute-map.xml | 168 ++++++++++++++++++ .../midpoint/shibboleth/shibboleth2.xml | 112 ++++++++++++ demo/shibboleth/docker-compose.yml | 16 ++ .../shibboleth-idp/conf/attribute-filter.xml | 9 + .../idp/shibboleth-idp/conf/idp.properties | 2 +- .../conf/metadata-providers.xml | 2 + .../metadata/midpoint-shib-sp.xml | 110 ++++++++++++ .../shibboleth-idp/metadata/midpoint-sp.xml | 4 +- .../securityPolicy/SecurityPolicy.xml | 29 ++- 15 files changed, 472 insertions(+), 9 deletions(-) create mode 100644 demo/shibboleth/configs-and-secrets/midpoint/httpd/00-shib.conf create mode 100644 demo/shibboleth/configs-and-secrets/midpoint/httpd/midpoint-shib.conf create mode 100644 demo/shibboleth/configs-and-secrets/midpoint/httpd/vhosts.conf create mode 100644 demo/shibboleth/configs-and-secrets/midpoint/shibboleth/attribute-map.xml create mode 100644 demo/shibboleth/configs-and-secrets/midpoint/shibboleth/shibboleth2.xml create mode 100644 demo/shibboleth/idp/shibboleth-idp/metadata/midpoint-shib-sp.xml diff --git a/Dockerfile b/Dockerfile index 03c121f..0b8a5c5 100644 --- a/Dockerfile +++ b/Dockerfile @@ -16,8 +16,7 @@ RUN yum -y install \ libcurl \ && yum clean -y all -RUN rm /etc/shibboleth/sp-signing-key.pem /etc/shibboleth/sp-signing-cert.pem /etc/shibboleth/sp-encrypt-key.pem /etc/shibboleth/sp-encrypt-cert.pem\ - && cd /etc/httpd/conf.d/ \ +RUN cd /etc/httpd/conf.d/ \ && rm -f autoindex.conf ssl.conf userdir.conf welcome.conf COPY container_files/supervisor/supervisord.conf /etc/supervisor/supervisord.conf @@ -35,6 +34,7 @@ RUN chmod 755 /opt/tier/setenv.sh \ && chmod 755 /usr/local/bin/healthcheck.sh RUN cp /dev/null /etc/httpd/conf.d/ssl.conf \ + && mkdir /etc/httpd/conf.d/vhosts \ && rm /etc/httpd/conf.d/shib.conf \ && sed -i 's/LogFormat "/LogFormat "httpd;access_log;%{ENV}e;%{USERTOKEN}e;/g' /etc/httpd/conf/httpd.conf \ && echo -e "\nErrorLogFormat \"httpd;error_log;%{ENV}e;%{USERTOKEN}e;[%{u}t] [%-m:%l] [pid %P:tid %T] %7F: %E: [client\ %a] %M% ,\ referer\ %{Referer}i\"" >> /etc/httpd/conf/httpd.conf \ diff --git a/container_files/httpd/conf/ssl-enable.conf b/container_files/httpd/conf/ssl-enable.conf index 35bf295..a756e78 100644 --- a/container_files/httpd/conf/ssl-enable.conf +++ b/container_files/httpd/conf/ssl-enable.conf @@ -25,4 +25,6 @@ Listen 443 https # HSTS (mod_headers is required) (15768000 seconds = 6 months) Header always set Strict-Transport-Security "max-age=15768000" + + IncludeOptional conf.d/vhosts/*.conf diff --git a/container_files/supervisor/supervisord.conf b/container_files/supervisor/supervisord.conf index 8619f53..a1dc9bf 100644 --- a/container_files/supervisor/supervisord.conf +++ b/container_files/supervisor/supervisord.conf @@ -18,6 +18,13 @@ stdout_logfile_maxbytes=0 redirect_stderr=true autorestart=false +[program:shibboleth] +command=/usr/sbin/shibd -f +stdout_logfile=/dev/fd/2 +stdout_logfile_maxbytes=0 +redirect_stderr=true +autorestart=false + [program:crond] command=/usr/sbin/crond -n -i -m off stdout_logfile=/tmp/logcrond diff --git a/demo/shibboleth/configs-and-secrets/midpoint/httpd/00-shib.conf b/demo/shibboleth/configs-and-secrets/midpoint/httpd/00-shib.conf new file mode 100644 index 0000000..0e5c7b2 --- /dev/null +++ b/demo/shibboleth/configs-and-secrets/midpoint/httpd/00-shib.conf @@ -0,0 +1 @@ +LoadModule mod_shib /usr/lib64/shibboleth/mod_shib_24.so diff --git a/demo/shibboleth/configs-and-secrets/midpoint/httpd/midpoint-shib.conf b/demo/shibboleth/configs-and-secrets/midpoint/httpd/midpoint-shib.conf new file mode 100644 index 0000000..a383349 --- /dev/null +++ b/demo/shibboleth/configs-and-secrets/midpoint/httpd/midpoint-shib.conf @@ -0,0 +1,14 @@ + + AuthType shibboleth + ShibRequestSetting requireSession 1 + ShibRequireSession on + ShibUseHeaders On + require shibboleth + + + + AuthType shibboleth + ShibRequestSetting requireSession false + ShibUseHeaders On + require shibboleth + diff --git a/demo/shibboleth/configs-and-secrets/midpoint/httpd/vhosts.conf b/demo/shibboleth/configs-and-secrets/midpoint/httpd/vhosts.conf new file mode 100644 index 0000000..a434bd8 --- /dev/null +++ b/demo/shibboleth/configs-and-secrets/midpoint/httpd/vhosts.conf @@ -0,0 +1 @@ +RewriteRule "^/midpoint/$" "/midpoint/auth/shib" [R] diff --git a/demo/shibboleth/configs-and-secrets/midpoint/shibboleth/attribute-map.xml b/demo/shibboleth/configs-and-secrets/midpoint/shibboleth/attribute-map.xml new file mode 100644 index 0000000..f0a5f19 --- /dev/null +++ b/demo/shibboleth/configs-and-secrets/midpoint/shibboleth/attribute-map.xml @@ -0,0 +1,168 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/demo/shibboleth/configs-and-secrets/midpoint/shibboleth/shibboleth2.xml b/demo/shibboleth/configs-and-secrets/midpoint/shibboleth/shibboleth2.xml new file mode 100644 index 0000000..9ed72c2 --- /dev/null +++ b/demo/shibboleth/configs-and-secrets/midpoint/shibboleth/shibboleth2.xml @@ -0,0 +1,112 @@ + + + + + + + + + + + + + + + SAML2 + + + + SAML2 Local + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/demo/shibboleth/docker-compose.yml b/demo/shibboleth/docker-compose.yml index decacb9..3817e6b 100644 --- a/demo/shibboleth/docker-compose.yml +++ b/demo/shibboleth/docker-compose.yml @@ -16,6 +16,7 @@ services: midpoint_server: build: ./midpoint_server/ + command: /usr/local/bin/startup.sh ports: - 8443:443 environment: @@ -48,12 +49,27 @@ services: - type: bind source: ./configs-and-secrets/midpoint/shibboleth/idp-metadata.xml target: /etc/shibboleth/idp-metadata.xml + - type: bind + source: ./configs-and-secrets/midpoint/shibboleth/shibboleth2.xml + target: /etc/shibboleth/shibboleth2.xml + - type: bind + source: ./configs-and-secrets/midpoint/shibboleth/attribute-map.xml + target: /etc/shibboleth/attribute-map.xml - type: bind source: ./configs-and-secrets/midpoint/httpd/host-cert.pem target: /etc/pki/tls/certs/host-cert.pem - type: bind source: ./configs-and-secrets/midpoint/httpd/host-cert.pem target: /etc/pki/tls/certs/cachain.pem + - type: bind + source: ./configs-and-secrets/midpoint/httpd/00-shib.conf + target: /etc/httpd/conf.modules.d/00-shib.conf + - type: bind + source: ./configs-and-secrets/midpoint/httpd/midpoint-shib.conf + target: /etc/httpd/conf.d/midpoint-shib.conf + - type: bind + source: ./configs-and-secrets/midpoint/httpd/vhosts.conf + target: /etc/httpd/conf.d/vhosts/vhosts.conf directory: build: ./directory/ diff --git a/demo/shibboleth/idp/shibboleth-idp/conf/attribute-filter.xml b/demo/shibboleth/idp/shibboleth-idp/conf/attribute-filter.xml index 2fcb257..c7a14c7 100644 --- a/demo/shibboleth/idp/shibboleth-idp/conf/attribute-filter.xml +++ b/demo/shibboleth/idp/shibboleth-idp/conf/attribute-filter.xml @@ -26,4 +26,13 @@ + + + + + + + + + diff --git a/demo/shibboleth/idp/shibboleth-idp/conf/idp.properties b/demo/shibboleth/idp/shibboleth-idp/conf/idp.properties index 6294a30..2470feb 100644 --- a/demo/shibboleth/idp/shibboleth-idp/conf/idp.properties +++ b/demo/shibboleth/idp/shibboleth-idp/conf/idp.properties @@ -56,7 +56,7 @@ idp.encryption.cert= %{idp.home}/credentials/idp-encryption.crt # If true, encryption will happen whenever a key to use can be located, but # failure to encrypt won't result in request failure. -#idp.encryption.optional = false +idp.encryption.optional = true # Configuration of client- and server-side storage plugins #idp.storage.cleanupInterval = PT10M diff --git a/demo/shibboleth/idp/shibboleth-idp/conf/metadata-providers.xml b/demo/shibboleth/idp/shibboleth-idp/conf/metadata-providers.xml index 684b387..2a44b8d 100644 --- a/demo/shibboleth/idp/shibboleth-idp/conf/metadata-providers.xml +++ b/demo/shibboleth/idp/shibboleth-idp/conf/metadata-providers.xml @@ -27,6 +27,8 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + 47abdf273ac1 + + CN=47abdf273ac1 + MIID6zCCAlOgAwIBAgIJAN3KLR1rSj7uMA0GCSqGSIb3DQEBCwUAMBcxFTATBgNV +BAMTDDQ3YWJkZjI3M2FjMTAeFw0xOTA0MjYxODAzMzRaFw0yOTA0MjMxODAzMzRa +MBcxFTATBgNVBAMTDDQ3YWJkZjI3M2FjMTCCAaIwDQYJKoZIhvcNAQEBBQADggGP +ADCCAYoCggGBAMPUEiYPVaEV2CyAdVLjj57vw71o47bkiErWqhh8Flq+JMTA6BUc +wgXVMSlM6OcB+gGdInNSuCwUGD+/LTiRoaECERPRzYAJjO9nSLmldsvBxnR/E5rw +n5c+8K3BOAoLZ/mGKHDhjLlbiClKTMl2Nx3okyb1jKdR/mTjTKzrUy9T42o688s2 +CFuEYmVulHww2zgNSIv5nUaYyH/D3jPYf9ANayv60R3JUp0sijywbRTm4VRgV3P3 +jQ4Y7AlWNnqQlqkEvqZfWt87E56Dbo+nuD0uTRSUmUY4j1DJ0ns8jIUfkHCfq4Sh +bVJQ4eLfc9sTLPE7/42uesT9mH5RGUTB6bZJD2gvKZ9pnbTZUYygOFGcJjkl/Trl +Q0rXMArffseUEqGNJeslQJQAQXDDVwbzFCpneJmMAUNKUwNRhCaazdFErDTvHytB +wmpBvcqhEbbocGxxXm6gNEOrWRK3dZD4GBf+vJA8/Z770ZrQWQfUL/DpYm4tCoDJ +m4/Rsaosv/PqsQIDAQABozowODAXBgNVHREEEDAOggw0N2FiZGYyNzNhYzEwHQYD +VR0OBBYEFLb8Mqq4XpiJZs3S0cQ/nLLfnkoTMA0GCSqGSIb3DQEBCwUAA4IBgQCc +u3AKCgPIOY73bWoXeVD1M6qG1asU9E1r5xle5+2vnXfo+fq/EfA2t+9kNsPs/yxG +O+sL9COXRrTTPhHzbjTQ3AHvd/ar3DUgTTj9rAVmpyXzmu17mFlcx6ihFldYwCFE +k1ZBXQ6hvZeQpFcTeqiPwPza+XeiJh3qgKBinm7RESTNzM5eiAlOCrEgx1tmRV5p +mLrPZYPKUIW9IY0a85lm9lw4rWDEqKaiWDF0E/BWPzF7xsx37ofLCabQm2zPc5Nk +aJD3xxa3OExsIHOa46K72UoaXY2HT8Pf3DucAGp8wBZ8UJBRBmSlbF/U6rjj4L4F +fRWMX+9yfmNOPCi6196EDQ+K4U/96kiq77WcqsqhU4HHwqR0cqvCHxvrU7Y84aXu +lfwgC6d8W/YhLAUIs8yFKTFbiufNW7KdqMs97b2QpNX2RHCFhnUBd1opDLTQGByB +WXrWfdEqrgYwoBN18u0A5migNn5wWpozl84ChRpjTaIangle4Eox8dZq5qV6mf0= + + + + + + + 47abdf273ac1 + + CN=47abdf273ac1 + MIID6zCCAlOgAwIBAgIJAJsNOvtU9eJFMA0GCSqGSIb3DQEBCwUAMBcxFTATBgNV +BAMTDDQ3YWJkZjI3M2FjMTAeFw0xOTA0MjYxODAzMzRaFw0yOTA0MjMxODAzMzRa +MBcxFTATBgNVBAMTDDQ3YWJkZjI3M2FjMTCCAaIwDQYJKoZIhvcNAQEBBQADggGP +ADCCAYoCggGBALjZmkfztDJ7HDqewumGwXfh93U8T4rjIw0wtc/Vh3PHMzNmJtie +MtoUjJaJ99I9UahrWprpdYQIgxDmjnN3mS89HvFHL/vq4r7m5srrxBXNfRuODyj2 +FJ7R6RVrISyBv/zuSzdhqvC2pBsLp/qocSE+4KPQrVT6i+w7fDYtSTJX257YDRj8 +XntvWUaXnCUMJuHbHbt7tDgKVYTsm6zP3ohaaVxFc2wzJ4SGQk/FY088ZShHWP9I +KJ/0YbSYxTXX3Htq5n54UDAIF1w8lUZvwxfbfWAhH7wTOZK/qAIm0d7RdrsFXs64 +6VyQUhEY4LOsGJKQI+mLnLGrSUELTgsfdFcoArokN7RgCOXLsFDoP2QnXZX83VVG +1aWJb0rvtr/cDT9FOGrOVXaT/gtAt3rh39hlKRBpXvXZBE0L3gegam3Uq05drdHK +RFw+CHCXyCOvj/xjTmeQjQlhNPK3HetQqlSNhAgh+sDZkZzz3Qw1jU3D2JUHTPUN +9eC3c1+XWn5cTQIDAQABozowODAXBgNVHREEEDAOggw0N2FiZGYyNzNhYzEwHQYD +VR0OBBYEFLDpZ+fBmCN5KDjZ8UyjKHMXRcv2MA0GCSqGSIb3DQEBCwUAA4IBgQCi +GWsUc75R+jBjZfwbReMUCQkbS/a2A7de3VCyWUeoFnlTka9wUOxfKnTRE6XHvjFk +Q/4HT+mE+uHXnVoiJg/NM9yVTKPl503va1bm9+kEW1b6CoxTmUF+fTPc5Pxz9Rto +vlTVTWH8M2YK6nWrWB8xUEVz8hALHBtvN1JUd22mnN6v5s80JLdVc0lwFtcmvcp/ +SnMwkYBIOkEe55uDwODVJtvpdEny0E6ZqofP5bfWfTccX4FOFuA0NqeBullDCjWg +ErIEnmT+qWYdsS2ru5K52pfSaTB1DHyeoiLnqJOnavg1LB0sIMRQK3O5t/5y59VD +9UuR9KGj6DZvpc/jN0CQ353NlG8U+a0QrK9Dkr/g/HiUs2819bNo13ZugdrZ758F +dL+Al2doe9BUzgfZTYm8p2lftfKw4Yycdj+p3DqNk4w1v6I6Oe8PbtwFjZvFFd50 +SZert/PFKIu94m11abs//JPKo0+QcOTn7/5NVD7gRNZY2OpxeERTD2xhtk5zukg= + + + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/demo/shibboleth/idp/shibboleth-idp/metadata/midpoint-sp.xml b/demo/shibboleth/idp/shibboleth-idp/metadata/midpoint-sp.xml index 5789ed8..55c61f5 100644 --- a/demo/shibboleth/idp/shibboleth-idp/metadata/midpoint-sp.xml +++ b/demo/shibboleth/idp/shibboleth-idp/metadata/midpoint-sp.xml @@ -64,8 +64,8 @@ AIW0+dXJ2IyzM+0sv2g4DOsXsnSvinGqjr82A54mXGSr7edhPdlQhILFkJfhTwLq+mjnyQSNe3s2 - - + + diff --git a/demo/shibboleth/midpoint_server/container_files/mp-home/post-initial-objects/securityPolicy/SecurityPolicy.xml b/demo/shibboleth/midpoint_server/container_files/mp-home/post-initial-objects/securityPolicy/SecurityPolicy.xml index 5cc5998..4abf399 100644 --- a/demo/shibboleth/midpoint_server/container_files/mp-home/post-initial-objects/securityPolicy/SecurityPolicy.xml +++ b/demo/shibboleth/midpoint_server/container_files/mp-home/post-initial-objects/securityPolicy/SecurityPolicy.xml @@ -63,16 +63,21 @@ + + httpHeader + https://localhost:8443/Shibboleth.sso/Logout + REMOTE_USER + - admin-gui-default + admin-gui-saml-internal - Default GUI authentication sequence. + Internal SAML2 GUI authentication sequence. http://midpoint.evolveum.com/xml/ns/public/common/channels-3#user - true - gui-default + false + saml-internal mySamlSso @@ -98,6 +103,22 @@ sufficient + + admin-gui-default + + Special GUI authentication sequence that is using Shibboleth SP + + + http://midpoint.evolveum.com/xml/ns/public/common/channels-3#user + true + shib + + + httpHeader + 30 + sufficient + + rest