From a4b0f8c1092469f2576bf5d2cac7361d24c67c65 Mon Sep 17 00:00:00 2001 From: Slavek Licehammer Date: Mon, 19 Oct 2020 16:40:33 +0200 Subject: [PATCH 1/2] Update to midPoint 4.2-SNAPSHOT --- container_files/httpd/conf/midpoint.conf | 2 +- .../httpd/conf/midpoint.conf.auth.internal | 2 +- .../httpd/conf/midpoint.conf.auth.shibboleth | 2 +- .../usr-local-bin/start-midpoint.sh | 1 + .../securityPolicy/000-security-policy.xml | 8 +- .../010-system-configuration.xml | 288 ++++++++++++++++-- download-midpoint.sh | 2 +- 7 files changed, 275 insertions(+), 30 deletions(-) diff --git a/container_files/httpd/conf/midpoint.conf b/container_files/httpd/conf/midpoint.conf index 2d63bda..656489c 100644 --- a/container_files/httpd/conf/midpoint.conf +++ b/container_files/httpd/conf/midpoint.conf @@ -3,4 +3,4 @@ Timeout 2400 ProxyTimeout 2400 ProxyBadHeader Ignore -ProxyPass /midpoint ajp://localhost:9090/midpoint timeout=2400 retry=0 +ProxyPass /midpoint ajp://localhost:9090/midpoint secret=s3cr3t timeout=2400 retry=0 diff --git a/container_files/httpd/conf/midpoint.conf.auth.internal b/container_files/httpd/conf/midpoint.conf.auth.internal index 2d63bda..57a9992 100644 --- a/container_files/httpd/conf/midpoint.conf.auth.internal +++ b/container_files/httpd/conf/midpoint.conf.auth.internal @@ -3,4 +3,4 @@ Timeout 2400 ProxyTimeout 2400 ProxyBadHeader Ignore -ProxyPass /midpoint ajp://localhost:9090/midpoint timeout=2400 retry=0 +ProxyPass /midpoint ajp://localhost:9090/midpoint secret=s3cr3t timeout=2400 retry=0 diff --git a/container_files/httpd/conf/midpoint.conf.auth.shibboleth b/container_files/httpd/conf/midpoint.conf.auth.shibboleth index ca38a30..e8fcc24 100644 --- a/container_files/httpd/conf/midpoint.conf.auth.shibboleth +++ b/container_files/httpd/conf/midpoint.conf.auth.shibboleth @@ -3,7 +3,7 @@ Timeout 2400 ProxyTimeout 2400 ProxyBadHeader Ignore -ProxyPass /midpoint ajp://localhost:9090/midpoint timeout=2400 retry=0 +ProxyPass /midpoint ajp://localhost:9090/midpoint secret=s3cr3t timeout=2400 retry=0 AuthType shibboleth diff --git a/container_files/usr-local-bin/start-midpoint.sh b/container_files/usr-local-bin/start-midpoint.sh index e729fec..4b19fb3 100755 --- a/container_files/usr-local-bin/start-midpoint.sh +++ b/container_files/usr-local-bin/start-midpoint.sh @@ -52,6 +52,7 @@ java -Xmx$MP_MEM_MAX -Xms$MP_MEM_INIT -Dfile.encoding=UTF8 \ -Dspring.profiles.active="`$MP_DIR/active-spring-profiles`" \ -Dserver.tomcat.ajp.enabled=$AJP_ENABLED \ -Dserver.tomcat.ajp.port=$AJP_PORT \ + -Dserver.tomcat.ajp.secret=s3cr3t \ -Dlogging.path=/tmp/logtomcat \ $MP_JAVA_OPTS \ -jar $MP_DIR/lib/midpoint.war &>/tmp/logmidpoint-console diff --git a/demo/grouper/midpoint_server/container_files/mp-home/post-initial-objects/securityPolicy/000-security-policy.xml b/demo/grouper/midpoint_server/container_files/mp-home/post-initial-objects/securityPolicy/000-security-policy.xml index 4b39fd3..77aa0f3 100644 --- a/demo/grouper/midpoint_server/container_files/mp-home/post-initial-objects/securityPolicy/000-security-policy.xml +++ b/demo/grouper/midpoint_server/container_files/mp-home/post-initial-objects/securityPolicy/000-security-policy.xml @@ -70,7 +70,7 @@ Default GUI authentication sequence. - http://midpoint.evolveum.com/xml/ns/public/model/channels-3#user + http://midpoint.evolveum.com/xml/ns/public/common/channels-3#user true gui-default @@ -86,7 +86,7 @@ Special GUI authentication sequence that is using just the internal user password. - http://midpoint.evolveum.com/xml/ns/public/model/channels-3#user + http://midpoint.evolveum.com/xml/ns/public/common/channels-3#user false emergency @@ -104,7 +104,7 @@ Authentication sequence for REST service. - http://midpoint.evolveum.com/xml/ns/public/model/channels-3#rest + http://midpoint.evolveum.com/xml/ns/public/common/channels-3#rest true rest-default @@ -120,7 +120,7 @@ Authentication sequence for actuator. - http://midpoint.evolveum.com/xml/ns/public/model/channels-3#actuator + http://midpoint.evolveum.com/xml/ns/public/common/channels-3#actuator true actuator-default diff --git a/demo/grouper/midpoint_server/container_files/mp-home/post-initial-objects/systemConfigurations/010-system-configuration.xml b/demo/grouper/midpoint_server/container_files/mp-home/post-initial-objects/systemConfigurations/010-system-configuration.xml index 7355929..cfe767f 100644 --- a/demo/grouper/midpoint_server/container_files/mp-home/post-initial-objects/systemConfigurations/010-system-configuration.xml +++ b/demo/grouper/midpoint_server/container_files/mp-home/post-initial-objects/systemConfigurations/010-system-configuration.xml @@ -1,51 +1,81 @@ + - - + SystemConfiguration - + + + + - + ERROR ro.isdc.wro.extensions.processor.css.Less4jProcessor - + + OFF org.hibernate.engine.jdbc.spi.SqlExceptionHelper - + + OFF org.hibernate.engine.jdbc.batch.internal.BatchingBatch - + + WARN org.hibernate.engine.jdbc.batch.internal.AbstractBatchImpl - + + OFF org.hibernate.internal.ExceptionMapperStandardImpl - + + OFF net.sf.jasperreports.engine.fill.JRFillDataset - + + WARN org.apache.wicket.resource.PropertiesFactory - + + ERROR org.springframework.context.support.ResourceBundleMessageSource - + + INFO com.evolveum.midpoint.model.impl.lens.projector.Projector - + + INFO com.evolveum.midpoint.model.impl.lens.Clockwork @@ -53,18 +83,20 @@ DEBUG com.evolveum.polygon.connector.grouper - + + %date [%X{subsystem}] [%thread] %level \(%logger\): %msg%n - MIDPOINT_LOG ${midpoint.home}/log/midpoint.log ${midpoint.home}/log/midpoint-%d{yyyy-MM-dd}.%i.log 10 100MB true - + + %date %level: %msg%n - MIDPOINT_PROFILE_LOG ${midpoint.home}/log/midpoint-profile.log ${midpoint.home}/log/midpoint-profile-%d{yyyy-MM-dd}.%i.log 10 @@ -212,7 +244,7 @@ demo/grouper - + /self/profile View/edit your profile @@ -223,7 +255,7 @@ http://midpoint.evolveum.com/xml/ns/public/security/authorization-ui-3#selfProfile http://midpoint.evolveum.com/xml/ns/public/security/authorization-ui-3#selfAll - + /self/credentials View/edit your credentials @@ -234,7 +266,7 @@ http://midpoint.evolveum.com/xml/ns/public/security/authorization-ui-3#selfCredentials http://midpoint.evolveum.com/xml/ns/public/security/authorization-ui-3#selfAll - + /admin/users @@ -243,7 +275,7 @@ red http://midpoint.evolveum.com/xml/ns/public/security/authorization-ui-3#users - + /admin/resources @@ -536,4 +568,216 @@ never never + + + + safe + + "Safe" expression profile. It is supposed to contain only operations that are "safe", + i.e. operations that have very little risk to harm the system, circumvent midPoint security + and so on. Use of those operations should be reasonably safe in all expressions. + However, there are limitations. This profile may incomplete or it may even be not completely secure. + Proper security testing of this profile was not yet conducted. It is provided here "AS IS", + without any guarantees. Use at your own risk. + + deny + + asIs + allow + + + path + allow + + + value + allow + + + const + allow + + + script + deny + + + + + script-safe + deny + + com.evolveum.midpoint.xml.ns._public.common.common_3 + MidPoint common schema - generated bean classes + allow + + + com.evolveum.prism.xml.ns._public.types_3 + Prism schema - bean classes + allow + + + java.lang.Integer + allow + + + java.lang.Object + Basic Java operations. + deny + + equals + allow + + hashCode + allow + + + + java.lang.String + String operations are generally safe. But Groovy is adding execute() method which is very dangerous. + allow + + execute + deny + + + + java.lang.CharSequence + allow + + + java.lang.Enum + allow + + + java.util.List + List operations are generally safe. But Groovy is adding execute() method which is very dangerous. + allow + + execute + deny + + + + java.util.ArrayList + List operations are generally safe. But Groovy is adding execute() method which is very dangerous. + allow + + execute + deny + + + + java.util.Map + allow + + + java.util.HashMap + allow + + + java.util.Date + allow + + + javax.xml.namespace.QName + allow + + + javax.xml.datatype.XMLGregorianCalendar + allow + + + java.lang.System + Just a few methods of System are safe enough. + deny + + currentTimeMillis + allow + + + + java.lang.IllegalStateException + Basic Java exception. Also used in test. + allow + + + java.lang.IllegalArgumentException + Basic Java exception. + allow + + + com.evolveum.midpoint.model.common.expression.functions.BasicExpressionFunctions + MidPoint basic functions library + allow + + + com.evolveum.midpoint.model.common.expression.functions.LogExpressionFunctions + MidPoint logging functions library + allow + + + com.evolveum.midpoint.report.impl.ReportFunctions + MidPoint report functions library + allow + + + org.apache.commons.lang.StringUtils + Apache Commons: Strings + allow + + + + + + + diff --git a/download-midpoint.sh b/download-midpoint.sh index c317e1b..0f808e0 100755 --- a/download-midpoint.sh +++ b/download-midpoint.sh @@ -10,7 +10,7 @@ else # But if we need to incorporate interim changes to I2 distribution during # midPoint development cycle, we can specify concrete file from "midpoint-tier" # download directory by using its name (like "latest-stable"). - MP_VERSION="4.1" + MP_VERSION="4.2-SNAPSHOT" else MP_VERSION=$tag fi From 64a6506f0df1f4ccce4bbf0a2fa7c8ae4655e95a Mon Sep 17 00:00:00 2001 From: Keith Hazelton Date: Mon, 19 Oct 2020 13:29:03 -0500 Subject: [PATCH 2/2] Update Dockerfile --- demo/grouper/midpoint_server/Dockerfile | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/demo/grouper/midpoint_server/Dockerfile b/demo/grouper/midpoint_server/Dockerfile index 34ce0cd..982407b 100644 --- a/demo/grouper/midpoint_server/Dockerfile +++ b/demo/grouper/midpoint_server/Dockerfile @@ -1,4 +1,6 @@ -FROM tier/midpoint:latest +# FROM tier/midpoint:latest + +FROM docker/midpoint:latest MAINTAINER info@evolveum.com