From 582f64f88699590d7cd4aa10630d6ccb276d36be Mon Sep 17 00:00:00 2001 From: skublik Date: Thu, 28 Mar 2019 14:08:24 +0100 Subject: [PATCH 1/2] adaptation mP container on new version of shibboleth_sp --- Dockerfile | 8 +- container_files/usr-local-bin/start-httpd.sh | 11 +- demo/complex/after-installation.sh | 3 + .../midpoint/shibboleth/shibboleth2.xml | 7 +- .../midpoint/shibboleth/sp-cert.pem | 22 - .../midpoint/shibboleth/sp-encrypt-cert.pem | 24 + .../midpoint/shibboleth/sp-encrypt-key.pem | 40 + .../midpoint/shibboleth/sp-key.pem | 28 - .../midpoint/shibboleth/sp-signing-cert.pem | 24 + .../midpoint/shibboleth/sp-signing-key.pem | 40 + demo/complex/docker-compose.yml | 41 +- demo/complex/grouper_daemon/Dockerfile | 2 +- demo/complex/grouper_data/Dockerfile | 2 +- demo/complex/grouper_ui/Dockerfile | 2 +- demo/complex/grouper_ws/Dockerfile | 2 +- demo/complex/idp/Dockerfile | 2 +- .../metadata/midpoint-sp-new.xml | 37 + .../resources/resource-grouper.xml | 2 +- .../container_files/httpd/host-cert.pem | 22 + .../container_files/httpd/host-key.pem | 28 + .../connector-grouper-rest-0.2.jar | Bin 4758027 -> 4757273 bytes .../seed-data/persons-and-courses.sql | 5016 +---------------- demo/complex/tests/main.bats | 13 +- demo/complex/tests/resources/grouper/t260.gsh | 31 - .../midpoint/shibboleth/shibboleth2.xml | 7 +- .../midpoint/shibboleth/sp-cert.pem | 22 - .../midpoint/shibboleth/sp-encrypt-cert.pem | 24 + .../midpoint/shibboleth/sp-encrypt-key.pem | 40 + .../midpoint/shibboleth/sp-key.pem | 28 - .../midpoint/shibboleth/sp-signing-cert.pem | 24 + .../midpoint/shibboleth/sp-signing-key.pem | 40 + .../shibboleth/shibboleth2.xml | 7 +- .../shibboleth/sp-cert.pem | 20 - .../shibboleth/sp-encrypt-cert.pem | 24 + .../shibboleth/sp-encrypt-key.pem | 40 + .../configs-and-secrets/shibboleth/sp-key.pem | 28 - .../shibboleth/sp-signing-cert.pem | 24 + .../shibboleth/sp-signing-key.pem | 40 + demo/shibboleth/docker-compose-tests.yml | 22 +- demo/shibboleth/docker-compose.yml | 22 +- demo/shibboleth/idp/Dockerfile | 2 +- 41 files changed, 811 insertions(+), 5010 deletions(-) delete mode 100644 demo/complex/configs-and-secrets/midpoint/shibboleth/sp-cert.pem create mode 100644 demo/complex/configs-and-secrets/midpoint/shibboleth/sp-encrypt-cert.pem create mode 100644 demo/complex/configs-and-secrets/midpoint/shibboleth/sp-encrypt-key.pem delete mode 100644 demo/complex/configs-and-secrets/midpoint/shibboleth/sp-key.pem create mode 100644 demo/complex/configs-and-secrets/midpoint/shibboleth/sp-signing-cert.pem create mode 100644 demo/complex/configs-and-secrets/midpoint/shibboleth/sp-signing-key.pem create mode 100644 demo/complex/idp/shibboleth-idp/metadata/midpoint-sp-new.xml create mode 100644 demo/complex/midpoint_server/container_files/httpd/host-cert.pem create mode 100644 demo/complex/midpoint_server/container_files/httpd/host-key.pem delete mode 100644 demo/complex/tests/resources/grouper/t260.gsh delete mode 100644 demo/shibboleth/configs-and-secrets/midpoint/shibboleth/sp-cert.pem create mode 100644 demo/shibboleth/configs-and-secrets/midpoint/shibboleth/sp-encrypt-cert.pem create mode 100644 demo/shibboleth/configs-and-secrets/midpoint/shibboleth/sp-encrypt-key.pem delete mode 100644 demo/shibboleth/configs-and-secrets/midpoint/shibboleth/sp-key.pem create mode 100644 demo/shibboleth/configs-and-secrets/midpoint/shibboleth/sp-signing-cert.pem create mode 100644 demo/shibboleth/configs-and-secrets/midpoint/shibboleth/sp-signing-key.pem delete mode 100644 demo/shibboleth/configs-and-secrets/shibboleth/sp-cert.pem create mode 100644 demo/shibboleth/configs-and-secrets/shibboleth/sp-encrypt-cert.pem create mode 100644 demo/shibboleth/configs-and-secrets/shibboleth/sp-encrypt-key.pem delete mode 100644 demo/shibboleth/configs-and-secrets/shibboleth/sp-key.pem create mode 100644 demo/shibboleth/configs-and-secrets/shibboleth/sp-signing-cert.pem create mode 100644 demo/shibboleth/configs-and-secrets/shibboleth/sp-signing-key.pem diff --git a/Dockerfile b/Dockerfile index cb52405..94bcac4 100644 --- a/Dockerfile +++ b/Dockerfile @@ -16,7 +16,7 @@ RUN yum -y install \ libcurl \ && yum clean -y all -RUN rm /etc/shibboleth/sp-key.pem /etc/shibboleth/sp-cert.pem \ +RUN rm /etc/shibboleth/sp-signing-key.pem /etc/shibboleth/sp-signing-cert.pem /etc/shibboleth/sp-encrypt-key.pem /etc/shibboleth/sp-encrypt-cert.pem\ && cd /etc/httpd/conf.d/ \ && rm -f autoindex.conf ssl.conf userdir.conf welcome.conf @@ -38,8 +38,6 @@ RUN chmod 755 /opt/tier/setenv.sh \ RUN cp /dev/null /etc/httpd/conf.d/ssl.conf \ && mv /etc/httpd/conf.d/shib.conf /etc/httpd/conf.d/shib.conf.auth.shibboleth \ && touch /etc/httpd/conf.d/shib.conf.auth.internal \ - && mv /etc/httpd/conf.modules.d/00-shib.conf /etc/httpd/conf.modules.d/00-shib.conf.auth.shibboleth \ - && touch /etc/httpd/conf.modules.d/00-shib.conf.auth.internal \ && sed -i 's/LogFormat "/LogFormat "httpd;access_log;%{ENV}e;%{USERTOKEN}e;/g' /etc/httpd/conf/httpd.conf \ && echo -e "\nErrorLogFormat \"httpd;error_log;%{ENV}e;%{USERTOKEN}e;[%{u}t] [%-m:%l] [pid %P:tid %T] %7F: %E: [client\ %a] %M% ,\ referer\ %{Referer}i\"" >> /etc/httpd/conf/httpd.conf \ && sed -i 's/CustomLog "logs\/access_log"/CustomLog "\/tmp\/loghttpd"/g' /etc/httpd/conf/httpd.conf \ @@ -49,7 +47,7 @@ RUN cp /dev/null /etc/httpd/conf.d/ssl.conf \ # Build arguments -ARG MP_VERSION=3.9 +ARG MP_VERSION=4.0 ARG MP_DIST_FILE=midpoint-dist.tar.gz ENV MP_DIR /opt/midpoint @@ -100,7 +98,7 @@ ENV TIER_MAINTAINER tier # TIER Beacon Opt-out # Completely uncomment the following ENV line to prevent the containers from sending analytics information to Internet2. -# With the default/release configuration, it will only send product (Shibb/Grouper/COmanage/midPoint) and version (3.9, etc) +# With the default/release configuration, it will only send product (Shibb/Grouper/COmanage/midPoint) and version (4.0, etc) # once daily between midnight and 4am. There is no configuration or private information collected or sent. # This data helps with the scaling and funding of TIER. Please do not disable it if you find the TIER tools useful. # To keep it commented, keep multiple comments on the following line (to prevent other scripts from processing it). diff --git a/container_files/usr-local-bin/start-httpd.sh b/container_files/usr-local-bin/start-httpd.sh index 96ad214..7d002cd 100755 --- a/container_files/usr-local-bin/start-httpd.sh +++ b/container_files/usr-local-bin/start-httpd.sh @@ -3,8 +3,10 @@ echo "Linking secrets" for filepath in /run/secrets/*; do label_file=`basename $filepath` - if [ "$label_file" == "mp_sp-key.pem" ]; then - ln -sf /run/secrets/mp_sp-key.pem /etc/shibboleth/sp-key.pem + if [ "$label_file" == "mp_sp-signing-key.pem" ]; then + ln -sf /run/secrets/mp_sp-key.pem /etc/shibboleth/sp-signing-key.pem + elif [ "$label_file" == "mp_sp-encrypt-key.pem" ]; then + ln -sf /run/secrets/mp_sp-key.pem /etc/shibboleth/sp-encrypt-key.pem elif [ "$label_file" == "mp_host-key.pem" ]; then ln -sf /run/secrets/mp_host-key.pem /etc/pki/tls/private/host-key.pem fi @@ -13,12 +15,13 @@ done echo "Linking config files; using authentication: $AUTHENTICATION" ln -sf /etc/httpd/conf.d/midpoint.conf.auth.$AUTHENTICATION /etc/httpd/conf.d/midpoint.conf ln -sf /etc/httpd/conf.d/shib.conf.auth.$AUTHENTICATION /etc/httpd/conf.d/shib.conf -ln -sf /etc/httpd/conf.modules.d/00-shib.conf.auth.$AUTHENTICATION /etc/httpd/conf.modules.d/00-shib.conf case $AUTHENTICATION in shibboleth) echo "*** Starting httpd WITH Shibboleth support" - httpd-shib-foreground + set -e + rm -f /etc/httpd/logs/httpd.pid + (/usr/sbin/shibd) & httpd -DFOREGROUND ;; internal) echo "*** Starting httpd WITHOUT Shibboleth support" diff --git a/demo/complex/after-installation.sh b/demo/complex/after-installation.sh index 1629455..68582e3 100755 --- a/demo/complex/after-installation.sh +++ b/demo/complex/after-installation.sh @@ -12,6 +12,9 @@ $(dirname "$0")/test-resources-1.sh echo -e "${B} * Recomputing Grouper admin group and user object...${N}" $(dirname "$0")/recompute.sh +echo -e "${B} * Waiting 120 seconds for changes to propagate to Grouper...${N}" +sleep 120 + echo -e "${B} * Testing Grouper resource...${N}" $(dirname "$0")/test-resource-grouper.sh diff --git a/demo/complex/configs-and-secrets/midpoint/shibboleth/shibboleth2.xml b/demo/complex/configs-and-secrets/midpoint/shibboleth/shibboleth2.xml index a644264..ee05a97 100644 --- a/demo/complex/configs-and-secrets/midpoint/shibboleth/shibboleth2.xml +++ b/demo/complex/configs-and-secrets/midpoint/shibboleth/shibboleth2.xml @@ -110,8 +110,11 @@ - - + + + - - + + + - - + + +