From 33742b16c5e1eeaf9702f99e3007c8b9248a1f3d Mon Sep 17 00:00:00 2001 From: Paul Caskey Date: Tue, 11 Apr 2017 08:57:03 -0500 Subject: [PATCH] sync release and test configs --- .gitignore | 1 - README.md | 13 +- conf/access-control.xml | 2 +- conf/attribute-filter.xml | 47 +++- conf/attribute-resolver.xml | 10 +- conf/authn/krb5-authn-config.xml | 4 +- conf/authn/password-authn-config.xml | 4 +- conf/idp.properties | 6 +- conf/intercept/profile-intercept.xml | 18 +- conf/ldap.properties | 8 +- conf/metadata-providers.xml | 4 - conf/relying-party.xml | 10 +- credentials/http.keytab | Bin 834 -> 0 bytes credentials/idp-backchannel.crt | 21 -- credentials/idp-backchannel.p12 | Bin 2660 -> 0 bytes credentials/idp-encryption.crt | 21 -- credentials/idp-encryption.key | 27 --- credentials/idp-signing.crt | 21 -- credentials/idp-signing.key | 27 --- credentials/sealer.jks | Bin 500 -> 0 bytes credentials/sealer.kver | 3 +- edit-webapp/css/logout.css | 24 +- edit-webapp/css/main.css | 326 +++++++++++++-------------- 23 files changed, 266 insertions(+), 331 deletions(-) delete mode 100644 .gitignore delete mode 100644 credentials/http.keytab delete mode 100644 credentials/idp-backchannel.crt delete mode 100644 credentials/idp-backchannel.p12 delete mode 100644 credentials/idp-encryption.crt delete mode 100644 credentials/idp-encryption.key delete mode 100644 credentials/idp-signing.crt delete mode 100644 credentials/idp-signing.key delete mode 100644 credentials/sealer.jks diff --git a/.gitignore b/.gitignore deleted file mode 100644 index 47e48bc..0000000 --- a/.gitignore +++ /dev/null @@ -1 +0,0 @@ -shib-idp-conftree.tar* diff --git a/README.md b/README.md index 43cdf5e..f26284c 100644 --- a/README.md +++ b/README.md @@ -1,3 +1,14 @@ # shib-idp-conftree -`tar cvf shib-idp-conftree.tar --exclude .git .` +## Purpose + +This project contains the configuration tree (structure) for Shibboleth IDP. The are various usage scenarios throughout the build, test, deploy cycle that warrant this abstraction +of the configuration tree. There is a separate repository for the Docker Image which is responsible for building the runtime environment and pulling the configuration trees housed here +to complete a deployment. + +### Configuration Trees + + * `test` branch + * Internal Testing - (TEST) branch/repo that uses the "test bed" which is something that I2 provides (LDAP) and an element to make all integrations. Appropriate for Jenkins and testing environments + * `release` branch + * External Testing - (RELEASE) branch/repo (ultimately will live in Subversion?) for end users diff --git a/conf/access-control.xml b/conf/access-control.xml index a9184e6..21af6c3 100644 --- a/conf/access-control.xml +++ b/conf/access-control.xml @@ -30,7 +30,7 @@ + p:allowedRanges="#{ {'127.0.0.1/32', '::1/128', '172.18.0.0/24'} }" /> + - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + - - - - - - diff --git a/conf/attribute-resolver.xml b/conf/attribute-resolver.xml index b23a80c..e111728 100644 --- a/conf/attribute-resolver.xml +++ b/conf/attribute-resolver.xml @@ -31,7 +31,7 @@ long term implications. --> - + @@ -60,6 +60,12 @@ + + + + + @@ -84,7 +90,7 @@ %{idp.attribute.resolver.LDAP.searchFilter} ]]> - givenName sn displayName mail uid + givenName sn displayName mail uid diff --git a/conf/authn/krb5-authn-config.xml b/conf/authn/krb5-authn-config.xml index 3230134..7dc59ba 100644 --- a/conf/authn/krb5-authn-config.xml +++ b/conf/authn/krb5-authn-config.xml @@ -21,10 +21,10 @@ The keytab bean must be an absolute file pathname and not a reference to a classpath resource, so if idp.home is not a path, don't use it in the value. --> - + diff --git a/conf/authn/password-authn-config.xml b/conf/authn/password-authn-config.xml index 48b2c3d..08886b2 100644 --- a/conf/authn/password-authn-config.xml +++ b/conf/authn/password-authn-config.xml @@ -14,8 +14,8 @@ - - + + diff --git a/conf/idp.properties b/conf/idp.properties index 1f32c81..d7cfea7 100644 --- a/conf/idp.properties +++ b/conf/idp.properties @@ -2,10 +2,10 @@ idp.additionalProperties= /conf/ldap.properties, /conf/saml-nameid.properties, /conf/services.properties, /conf/authn/duo.properties # Set the entityID of the IdP -idp.entityID= https://idp.testbed.tier.internet2.edu/idp/shibboleth +idp.entityID= https://example.org/idp/shibboleth # Set the scope used in the attribute resolver for scoped attributes -idp.scope= testbed.tier.internet2.edu +idp.scope= example.org # General cookie properties (maxAge only applies to persistent cookies) #idp.cookie.secure = false @@ -161,7 +161,7 @@ idp.authn.flows= Password #idp.replayCache.StorageService = shibboleth.StorageService # Toggles whether to allow outbound messages via SAML artifact -#idp.artifact.enabled = true +idp.artifact.enabled = false # Suppresses typical signing/encryption when artifact binding used #idp.artifact.secureChannel = true # May differ to direct SAML 2 artifact lookups to specific server nodes diff --git a/conf/intercept/profile-intercept.xml b/conf/intercept/profile-intercept.xml index 4040a10..bb3d3a7 100644 --- a/conf/intercept/profile-intercept.xml +++ b/conf/intercept/profile-intercept.xml @@ -30,9 +30,25 @@ - + + + + + + + + true + TRUE + YES + yes + + + + + + diff --git a/conf/ldap.properties b/conf/ldap.properties index 1aafb7c..e045c8e 100644 --- a/conf/ldap.properties +++ b/conf/ldap.properties @@ -5,7 +5,7 @@ #idp.authn.LDAP.authenticator = anonSearchAuthenticator ## Connection properties ## -idp.authn.LDAP.ldapURL = ldap://testbed.tier.internet2.edu +idp.authn.LDAP.ldapURL = ldap://localhost:10389 idp.authn.LDAP.useStartTLS = false idp.authn.LDAP.useSSL = false # Time in milliseconds that connects will block @@ -27,13 +27,13 @@ idp.authn.LDAP.returnAttributes = passwordExpirationTime,loginGr # Search DN resolution, used by anonSearchAuthenticator, bindSearchAuthenticator # for AD: CN=Users,DC=example,DC=org -idp.authn.LDAP.baseDN = ou=People,dc=testbed,dc=tier,dc=internet2,dc=edu +idp.authn.LDAP.baseDN = ou=people,dc=example,dc=org #idp.authn.LDAP.subtreeSearch = false idp.authn.LDAP.userFilter = (uid={user}) # bind search configuration # for AD: idp.authn.LDAP.bindDN=adminuser@domain.com -idp.authn.LDAP.bindDN = -idp.authn.LDAP.bindDNCredential = +idp.authn.LDAP.bindDN = uid=myservice,ou=system +idp.authn.LDAP.bindDNCredential = myServicePassword # Format DN resolution, used by directAuthenticator, adAuthenticator # for AD use idp.authn.LDAP.dnFormat=%s@domain.com diff --git a/conf/metadata-providers.xml b/conf/metadata-providers.xml index 778989c..d22b15b 100644 --- a/conf/metadata-providers.xml +++ b/conf/metadata-providers.xml @@ -80,9 +80,5 @@ - - - - diff --git a/conf/relying-party.xml b/conf/relying-party.xml index 28c9193..1f48cff 100644 --- a/conf/relying-party.xml +++ b/conf/relying-party.xml @@ -34,14 +34,16 @@ - + + - - + + diff --git a/credentials/http.keytab b/credentials/http.keytab deleted file mode 100644 index f057e3672460b8240b797cb2911ed651dbd904d5..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 834 zcmZQ&Vqjn>WME>D3ULh%adLIh3-NRf()08SaSifw4KdPlbqQr)@dybCV35m9DbOoP zEiOq)P0=gKOfAyO%qvMP%1bRV(o0P#1)9Sc&O7%2BZClwLb}|KgOztX98|M!ZWee` z`*nL;y`i!~+Od~?1umSt(f5Ih6RB&dAcMgCn1o!ZIbYr?6^ARSTsXi9v?P}g>j5o^q;6bsFmT-BXn2|Q$`cf9R5qNMfg}3w@jS!(N4fw(83iH$ diff --git a/credentials/idp-backchannel.crt b/credentials/idp-backchannel.crt deleted file mode 100644 index 78b0409..0000000 --- a/credentials/idp-backchannel.crt +++ /dev/null @@ -1,21 +0,0 @@ ------BEGIN CERTIFICATE----- -MIIDZjCCAk6gAwIBAgIVAOFETpFi27881c/E8q+EMl9Q0x3eMA0GCSqGSIb3DQEB -CwUAMCkxJzAlBgNVBAMMHmlkcC50ZXN0YmVkLnRpZXIuaW50ZXJuZXQyLmVkdTAe -Fw0xNjA0MDEwMTU0MTZaFw0zNjA0MDEwMTU0MTZaMCkxJzAlBgNVBAMMHmlkcC50 -ZXN0YmVkLnRpZXIuaW50ZXJuZXQyLmVkdTCCASIwDQYJKoZIhvcNAQEBBQADggEP -ADCCAQoCggEBAJHEgwTuY6udWkTkKrIAjy/0NFdqlSQ0KlUesN9806aSTB44kF4z -x3dqLNZ0sXYb42vVkhJs9ClD7+nU/PhYErMdsHFkeEiC/oaNA4KJxraPtQwdcXv7 -qutoiNcGPXAAqNC80OkcqneeWWEo83BYMPA/YB+Oko+qZkaAqaQq6fPUhUZzKxp1 -jkAWFknZXt676MRbqqXMSdLQScJ9DHC1t8m4+R29In8wybMofvmLZ1DzKjQPlRzD -XtEx66USOAoDZLXzmSkYPOx8Rq3HoEsIWnjUOXIA7zurKqyv3qe9Dwy6XYdBpvpw -JYtpfL9I7P5ftAqgDAd0nUuro7m133EHTXsCAwEAAaOBhDCBgTAdBgNVHQ4EFgQU -x7OgBHgTB2AYpVTo5OaIMlLOVgEwYAYDVR0RBFkwV4IeaWRwLnRlc3RiZWQudGll -ci5pbnRlcm5ldDIuZWR1hjVodHRwczovL2lkcC50ZXN0YmVkLnRpZXIuaW50ZXJu -ZXQyLmVkdS9pZHAvc2hpYmJvbGV0aDANBgkqhkiG9w0BAQsFAAOCAQEAdt2uTZVH -DflxXQ4MkPrPIP99xeTZfYc9Y9bwCMjt21+cDfnu92MzlbYzQ9txLQcw30iFc0Zj -i7gys2m+/dp8zRjB++RfXirbNyZUSo/KQIr1GrWeoIJ8CMVafRRw+46RJA/3GsSN -/0zX1sFJHz0q8WrKZMh2c4P7ejwuVp1JSh0vWZxXhyhHuSklygSvG6XXUPlBwB8p -QbZEuxKgalDTQSaa5vza0d+0ocgaaybMnex6N7MD1Lvsh/qEy+Yxc1/4ruay7nmk -2mXmsTUWN3majWZjsCJCMNrugom03rhC3BhnuLA/tYAHOiSt8W4zdfqf2/ShWRjJ -4HpJj1hbzraYTw== ------END CERTIFICATE----- diff --git a/credentials/idp-backchannel.p12 b/credentials/idp-backchannel.p12 deleted file mode 100644 index 91a22fc6446391d5c94ef0c82689c6e4ca4eb525..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 2660 zcmY+Ec{~&TAIG=Zh7HXSxpLn$GR)n#5<+g4Icm+7b8T;X3j3eUSuPG1 z#!JsouXbKORxjA9c`nNT`VnitTo4Eh0F%JaWO++1NV8BkpT%AlZQSnrk9%*l0|&+4 zk10vIO`q^Zb&XR1t1cJ!G;GFI3Xm_Vl3Gi+d#&%i-8Vfo)E-p}9!_8H=odqyhlY33 z+a@Mc+usQh#w3nsVJTCX>Ye4(F(0o8ypZ6_A0I+85D!b*?(-JGEstyo$tBcGXTx6Z zJM=4;omrYb-2yL~O6v0kZ>d2e* zb~*6T1BBXB(w9fNR}54gW~!bP?w!T-swQ=}mySu-Bn!%jB`IvG>0B3nm}1aLmqj9H z?zE&|8n0C^Qn3k}P8jBbojEtckCte?3@uO)x5g!0ayNIU{^A?ll^k!5wLK;P(JUWI zet+$mrLVF{JnZV*eVSeLiyu9h)t7Ro5xI6|X2!?GVKppb?@`-#C>1h|o_E1QR=qhl z+fGvSHZB*LX63r70P}Q9CR`3q*vSLh-iT^yQBB}8Lv-NQPu*Zq4dZj^splUE&Zw+E zf4-f)8S-b_naTT8(Z*jB_nq~I`!*n^qOn_$%m5O5adu7PPo58Ogquvy>GBhMc32&& zbg^jv+BAooK|_TjW*T+N-NCU3T^=uVDJFY~e*6ii^Nw|{do;KIs*;OEf3;yJdsQF| zsUC_9DnC3V01D~>bE`{EV(isI@@i*o;dVx0HduC|8IF;Td%)Z) zEQ-Vnzy^K>|MIkc5lP!u6XdE=3;Bgj1vL&#T=qKvO@{rdNbN0e4TP>v?w%e3D%@RK=SeU2uRf(!3-s z>rtLbi973*&%wLGuWAlX|A=4S?H7D7GjAPTnaeAuSl2&BS!we;(52gKtbWvG?rHu& zq2s|&8!p)bvf)gj#&AU%R$fY_()0!TZu+B>JFUraCHUm?PRAqv@-VOzs4>XGPbFFy z1`?OP@xwn(@!hg}O}%>pHd{42urhck0I4`-BKvV2{q$Ypw(5e(C+`wZw)AaQE8Y@8 z8eUaSzQSq(mWHIhJyy7zu{ju;uxKcHz+al0c9a(`sCz>RbJe`XsPgrdzr3zt!OjPo zTYQcfzFImgxsSE`$du1UmY}%K(i1O5M}9D(S8K)QTUb61o@j^K3Pr(SGl-hdQImL) z;)v>c)WhQ!TlGR8L9S*~c2n%%ccLs-dW@v>P2ux5M*D^aoe|ZeZ$4us^(_aRSjc2R_=-Mtk@9ca+sb5> z=Z(22X@{Xs|3gY%VQo`sV?Y4l0w4^a1-Jwt03tZ=c}~6X_dkH6h#VCF2>ClDaw>tN zbU5Dco=BAJzsp3lg~3SYfM9}*wk{f@tB=;>9Bq9LYw`ayaYH%yb>>+1ARvHKto}`a z{|98~Zy;}4^ABJ46f2Y$8EYKX&pYbBu9i@cu){cfM2ds5B(mS%0VI*Hqpyc#2cLjL$&^&8VQ+I?nS7Heu!1 z;oXw?(JVZxqQb zI1yRmaUPSHt*om2ay)fg&i9$s9X-D2^GCs6CQKed7-r(6UH$ye7)RAxJt)#1yXhy_ zEJ$Nkd%wH@j1LG8Daw~~=Ld^0nlzmfZ5<#5OInx+>3f|(?nJp|iH$BotSvL!?CN4{ z&NV5)J$T5uCxBJg)-Lr(p38aXi~vm;O7_G$jOI-v78_E!MtMjQ^w?q!@uJrfjx-SZbzq9XIa=X7S8q?im_OXuv zU&^<_GodE3{3)Vn=C{nss78P)^L_P7^>tChw{t(t#(hFM+1FE(<@ys{fn1Y*{JE<| z@6k^3^UuY~&Q1aDYZ}=o;qm*dcMm{^UlvtxIYQbi$*c+J#n7*_$M!Y9&t#Z|wwlX3 zl&IqB_77a7)@!)(RnL|UPQT7gwNf%TT~KGk8q-y(0=%a!rQ6?q&OIzf)$UkPP*SYf zBKGAx;W3<(6X+46jONrV$MWs7Gm9pd_LhM}yIPkcr9rAG*5(sVapz2ps%=LF!@o7$ zs?TcOKx8_-ei;O7-wk}dV|OCY>AVa7i$BCl%exsKL}t-cqMzv#Zr?BDtB&%RHLs%Q ztZ&i~;J#Tv`ydog#jWO+43`olWOl*)RT7Qd9hsvQm>v-13XOQ!4|C@=Ji6{Gzkrry`#l><$JRUQxs# znUz?USOL?Itj*5McG=ryDXA#|iA9OI#U%_((N56}0zg5Ky{ReA z`FSO&c_oDmbqq{C44egERgO97B@9A7APe+!67$magG-7s^U|$-K)y-L0ZN0^GglOp z7J&6Lx%@b5iDN+=O=v z^D9$-YleRC`=i9JST^nx*aYpE^Z(3^ypzvLU&?*|;I?!U+r-^9OVxXKlo!vvcE{RiQVOT;Gyg)Vu!vc* zKi|$Us!-&d=@a