From 60832668bd56ee72794ed606f6332583e8dce4b5 Mon Sep 17 00:00:00 2001 From: Paul Caskey Date: Wed, 25 Aug 2021 17:02:51 +0000 Subject: [PATCH 1/5] fix for IdPUI and bypass basic auth for grouper WS --- Workbench/idp_ui/container_files/idp_ui/application.yml | 4 ++-- Workbench/webproxy/container_files/httpd/ssl.conf | 6 ++++++ 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/Workbench/idp_ui/container_files/idp_ui/application.yml b/Workbench/idp_ui/container_files/idp_ui/application.yml index a7c17b7..cf04975 100644 --- a/Workbench/idp_ui/container_files/idp_ui/application.yml +++ b/Workbench/idp_ui/container_files/idp_ui/application.yml @@ -28,7 +28,7 @@ shibui: forceServiceProviderMetadataGeneration: false callbackUrl: "https://__CSPHOSTNAME__/idpui/callback" maximumAuthenticationLifetime: 3600000 - saml2ProfileMapping: + simpleProfileMapping: username: urn:oid:0.9.2342.19200300.100.1.1 firstname: urn:oid:2.5.4.42 lastname: urn:oid:2.5.4.4 @@ -45,4 +45,4 @@ spring: hibernate: ddl-auto: update - \ No newline at end of file + diff --git a/Workbench/webproxy/container_files/httpd/ssl.conf b/Workbench/webproxy/container_files/httpd/ssl.conf index fbc437a..a0f150a 100644 --- a/Workbench/webproxy/container_files/httpd/ssl.conf +++ b/Workbench/webproxy/container_files/httpd/ssl.conf @@ -152,6 +152,12 @@ SSLCertificateChainFile /etc/pki/tls/certs/server-chain.crt Satisfy any + + Order deny,allow + Allow from all + Satisfy any + + AuthType Basic AuthName "Restricted CSP content" From d7752dd9d6b76b1d359610b16a8d7c72307e8dd6 Mon Sep 17 00:00:00 2001 From: Paul Caskey Date: Tue, 31 Aug 2021 17:12:13 +0000 Subject: [PATCH 2/5] bump midpoint to 4.3.2 --- Workbench/idp/Dockerfile | 3 + Workbench/midpoint_server/Dockerfile | 3 +- .../resources/100-grouper.xml | 2 +- .../010-system-configuration.xml | 361 ++++++++++++++++-- .../webproxy/container_files/httpd/index.html | 2 +- 5 files changed, 335 insertions(+), 36 deletions(-) diff --git a/Workbench/idp/Dockerfile b/Workbench/idp/Dockerfile index 2ab14b2..4309126 100644 --- a/Workbench/idp/Dockerfile +++ b/Workbench/idp/Dockerfile @@ -6,6 +6,9 @@ ARG CSPHOSTNAME=localhost ENV CSPHOSTNAME=$CSPHOSTNAME COPY shibboleth-idp/ /opt/shibboleth-idp/ +#rather than copying metadata files included in above folder and including in config, instead upload these files to the IdP UI +# API info here: https://documenter.getpostman.com/view/446764/TzzHmCkn + RUN mkdir -p /opt/shibboleth-idp/metadata/generated && mkdir -p /opt/shibboleth-idp/conf/generated diff --git a/Workbench/midpoint_server/Dockerfile b/Workbench/midpoint_server/Dockerfile index a9464b9..82f1cef 100644 --- a/Workbench/midpoint_server/Dockerfile +++ b/Workbench/midpoint_server/Dockerfile @@ -1,4 +1,5 @@ -FROM tier/midpoint:latest +FROM tier/midpoint:4.3.2-SNAPSHOT +#FROM tier/midpoint:latest MAINTAINER info@evolveum.com diff --git a/Workbench/midpoint_server/container_files/mp-home/post-initial-objects/resources/100-grouper.xml b/Workbench/midpoint_server/container_files/mp-home/post-initial-objects/resources/100-grouper.xml index 9b5b20e..92ab570 100644 --- a/Workbench/midpoint_server/container_files/mp-home/post-initial-objects/resources/100-grouper.xml +++ b/Workbench/midpoint_server/container_files/mp-home/post-initial-objects/resources/100-grouper.xml @@ -14,7 +14,7 @@ xmlns:ri="http://midpoint.evolveum.com/xml/ns/public/resource/instance-3" xmlns:icfc="http://midpoint.evolveum.com/xml/ns/public/connector/icf-1/connector-schema-3" xmlns:rest="http://midpoint.evolveum.com/xml/ns/public/connector/icf-1/bundle/com.evolveum.polygon.connector-grouper-rest/com.evolveum.polygon.connector.grouper.rest.GrouperConnector" - xmlns:conf="http://midpoint.evolveum.com/xml/ns/public/connector/builtin-1/bundle/com.evolveum.midpoint.provisioning.ucf.impl.builtin.async/AsyncUpdateConnector" + xmlns:conf="http://midpoint.evolveum.com/xml/ns/public/connector/builtin-1/bundle/com.evolveum.midpoint.provisioning.ucf.impl.builtin.async.update/AsyncUpdateConnector" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"> diff --git a/Workbench/midpoint_server/container_files/mp-home/post-initial-objects/systemConfigurations/010-system-configuration.xml b/Workbench/midpoint_server/container_files/mp-home/post-initial-objects/systemConfigurations/010-system-configuration.xml index 7355929..73b6c7f 100644 --- a/Workbench/midpoint_server/container_files/mp-home/post-initial-objects/systemConfigurations/010-system-configuration.xml +++ b/Workbench/midpoint_server/container_files/mp-home/post-initial-objects/systemConfigurations/010-system-configuration.xml @@ -1,51 +1,87 @@ + - - + SystemConfiguration - + + + + - + ERROR ro.isdc.wro.extensions.processor.css.Less4jProcessor - + + + OFF + org.springframework.security.web.DefaultSecurityFilterChain + + + OFF org.hibernate.engine.jdbc.spi.SqlExceptionHelper - + + OFF org.hibernate.engine.jdbc.batch.internal.BatchingBatch - + + WARN org.hibernate.engine.jdbc.batch.internal.AbstractBatchImpl - + + OFF org.hibernate.internal.ExceptionMapperStandardImpl - + + OFF net.sf.jasperreports.engine.fill.JRFillDataset - + + WARN org.apache.wicket.resource.PropertiesFactory - + + ERROR org.springframework.context.support.ResourceBundleMessageSource - + + INFO com.evolveum.midpoint.model.impl.lens.projector.Projector - + + INFO com.evolveum.midpoint.model.impl.lens.Clockwork @@ -53,18 +89,20 @@ DEBUG com.evolveum.polygon.connector.grouper - + + %date [%X{subsystem}] [%thread] %level \(%logger\): %msg%n - MIDPOINT_LOG ${midpoint.home}/log/midpoint.log ${midpoint.home}/log/midpoint-%d{yyyy-MM-dd}.%i.log 10 100MB true - + + %date %level: %msg%n - MIDPOINT_PROFILE_LOG ${midpoint.home}/log/midpoint-profile.log ${midpoint.home}/log/midpoint-profile-%d{yyyy-MM-dd}.%i.log 10 @@ -209,13 +247,13 @@ - demo/grouper + CSP-Workbench - + /self/profile - - View/edit your profile + + PageSelfDashboard.profile.description fa fa-user @@ -223,10 +261,10 @@ http://midpoint.evolveum.com/xml/ns/public/security/authorization-ui-3#selfProfile http://midpoint.evolveum.com/xml/ns/public/security/authorization-ui-3#selfAll - + /self/credentials - - View/edit your credentials + + PageSelfDashboard.credentials.description fa fa-shield @@ -234,18 +272,18 @@ http://midpoint.evolveum.com/xml/ns/public/security/authorization-ui-3#selfCredentials http://midpoint.evolveum.com/xml/ns/public/security/authorization-ui-3#selfAll - + /admin/users - + fa fa-users red http://midpoint.evolveum.com/xml/ns/public/security/authorization-ui-3#users - + /admin/resources - + fa fa-database @@ -258,7 +296,12 @@ - My cases + + My cases + + MyCases.title + + My case fe fe-case-object @@ -276,7 +319,12 @@ - All manual cases + + All manual cases + + AllManualCases.title + + Manual case Manual provisioning cases @@ -292,7 +340,12 @@ - All requests + + All requests + + AllRequests.title + + Request Operation requests @@ -308,7 +361,12 @@ - All approvals + + All approvals + + AllApprovals.title + + Approval Approval cases @@ -423,6 +481,20 @@ + + dashboard-reports-view + ReportType + + + + + + collection-reports-view + ReportType + + + + @@ -453,6 +525,9 @@ executionStatus + + schedulingState + node @@ -486,6 +561,9 @@ stateBeforeSuspend + + schedulingStateBeforeSuspend + category @@ -531,9 +609,226 @@ true + + admin-dashboard + + never never + + + + safe + + "Safe" expression profile. It is supposed to contain only operations that are "safe", + i.e. operations that have very little risk to harm the system, circumvent midPoint security + and so on. Use of those operations should be reasonably safe in all expressions. + However, there are limitations. This profile may incomplete or it may even be not completely secure. + Proper security testing of this profile was not yet conducted. It is provided here "AS IS", + without any guarantees. Use at your own risk. + + deny + + asIs + allow + + + path + allow + + + value + allow + + + const + allow + + + script + deny + + + + + script-safe + deny + + com.evolveum.midpoint.xml.ns._public.common.common_3 + MidPoint common schema - generated bean classes + allow + + + com.evolveum.prism.xml.ns._public.types_3 + Prism schema - bean classes + allow + + + java.lang.Integer + allow + + + java.lang.Object + Basic Java operations. + deny + + equals + allow + + hashCode + allow + + + + java.lang.String + String operations are generally safe. But Groovy is adding execute() method which is very dangerous. + allow + + execute + deny + + + + java.lang.CharSequence + allow + + + java.lang.Enum + allow + + + java.util.List + List operations are generally safe. But Groovy is adding execute() method which is very dangerous. + allow + + execute + deny + + + + java.util.ArrayList + List operations are generally safe. But Groovy is adding execute() method which is very dangerous. + allow + + execute + deny + + + + java.util.Map + allow + + + java.util.HashMap + allow + + + java.util.Date + allow + + + javax.xml.namespace.QName + allow + + + javax.xml.datatype.XMLGregorianCalendar + allow + + + java.lang.System + Just a few methods of System are safe enough. + deny + + currentTimeMillis + allow + + + + java.lang.IllegalStateException + Basic Java exception. Also used in test. + allow + + + java.lang.IllegalArgumentException + Basic Java exception. + allow + + + com.evolveum.midpoint.model.common.expression.functions.BasicExpressionFunctions + MidPoint basic functions library + allow + + + com.evolveum.midpoint.model.common.expression.functions.LogExpressionFunctions + MidPoint logging functions library + allow + + + com.evolveum.midpoint.report.impl.ReportFunctions + MidPoint report functions library + allow + + + org.apache.commons.lang.StringUtils + Apache Commons: Strings + allow + + + + + + + + diff --git a/Workbench/webproxy/container_files/httpd/index.html b/Workbench/webproxy/container_files/httpd/index.html index 99be771..32773f7 100644 --- a/Workbench/webproxy/container_files/httpd/index.html +++ b/Workbench/webproxy/container_files/httpd/index.html @@ -9,7 +9,7 @@

Welcome to the InCommon TAP Workbench!

The system contains the following TAP components (click the links to access each component in its own tab): From a4ca90bb6e0aceec8e25376e37ee4f076693b37e Mon Sep 17 00:00:00 2001 From: Paul Caskey Date: Fri, 3 Sep 2021 20:11:02 +0000 Subject: [PATCH 3/5] IdP UI update --- Workbench/comanage_cron/Dockerfile | 2 +- Workbench/idp_ui/Dockerfile | 2 +- Workbench/webproxy/container_files/httpd/index.html | 2 +- Workbench/webproxy/container_files/httpd/ssl.conf | 6 ++++++ 4 files changed, 9 insertions(+), 3 deletions(-) diff --git a/Workbench/comanage_cron/Dockerfile b/Workbench/comanage_cron/Dockerfile index e819b2c..597e2c6 100644 --- a/Workbench/comanage_cron/Dockerfile +++ b/Workbench/comanage_cron/Dockerfile @@ -21,7 +21,7 @@ ENV COMANAGE_REGISTRY_EMAIL_HOST=smtp.example.edu #ENV SHIBBOLETH_SP_METADATA_PROVIDER_XML=sdf #ENV SHIBBOLETH_SP_SAMLDS_URL=thing -RUN apt-get update +RUN apt-get update --allow-releaseinfo-change && apt-get update ARG maintainer=my ARG imagename=comanage diff --git a/Workbench/idp_ui/Dockerfile b/Workbench/idp_ui/Dockerfile index b00be05..f5452b4 100644 --- a/Workbench/idp_ui/Dockerfile +++ b/Workbench/idp_ui/Dockerfile @@ -1,4 +1,4 @@ -FROM i2incommon/shib-idp-ui:1.8.0 +FROM i2incommon/shib-idp-ui:1.9.0 ARG CSPHOSTNAME=localhost ENV CSPHOSTNAME=$CSPHOSTNAME diff --git a/Workbench/webproxy/container_files/httpd/index.html b/Workbench/webproxy/container_files/httpd/index.html index 32773f7..5c8ab3b 100644 --- a/Workbench/webproxy/container_files/httpd/index.html +++ b/Workbench/webproxy/container_files/httpd/index.html @@ -11,7 +11,7 @@

Welcome to the InCommon TAP Workbench!

  • Grouper (2.5.37.1)
  • midPoint (4.3.2)
  • COmanage Registry (3.3.2)
    • -
  • Shibboleth IdP UI (1.8.0)
    • +
  • Shibboleth IdP UI (1.9.0)

    • The system also contains the following downstream/target applications: diff --git a/Workbench/webproxy/container_files/httpd/ssl.conf b/Workbench/webproxy/container_files/httpd/ssl.conf index a0f150a..a5b9877 100644 --- a/Workbench/webproxy/container_files/httpd/ssl.conf +++ b/Workbench/webproxy/container_files/httpd/ssl.conf @@ -158,6 +158,12 @@ SSLCertificateChainFile /etc/pki/tls/certs/server-chain.crt Satisfy any     + + Order deny,allow + Allow from all + Satisfy any + + AuthType Basic AuthName "Restricted CSP content" From abf6efc568f8b110ac805fc5d8ad0810b2e52e22 Mon Sep 17 00:00:00 2001 From: Ethan Kromhout Date: Wed, 8 Sep 2021 02:48:44 -0400 Subject: [PATCH 4/5] Graphviz dot support for graphics --- Workbench/midpoint_server/Dockerfile | 1 + 1 file changed, 1 insertion(+) diff --git a/Workbench/midpoint_server/Dockerfile b/Workbench/midpoint_server/Dockerfile index 82f1cef..876daca 100644 --- a/Workbench/midpoint_server/Dockerfile +++ b/Workbench/midpoint_server/Dockerfile @@ -24,6 +24,7 @@ COPY container_files/system/setservername.sh /usr/local/bin/ RUN chmod 755 /usr/local/bin/setservername.sh #set hostname RUN /usr/local/bin/setservername.sh +RUN yum install -y graphviz #COPY container_files/supervisor/supervisord.conf /etc/supervisor/ From 46aba78fb529bcb6e9f73515ef9ab33e052e4845 Mon Sep 17 00:00:00 2001 From: Paul Caskey Date: Thu, 9 Sep 2021 20:26:18 +0000 Subject: [PATCH 5/5] bump mP postgres to ver 12 --- Workbench/docker-compose.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Workbench/docker-compose.yml b/Workbench/docker-compose.yml index c14d4d5..75f0300 100644 --- a/Workbench/docker-compose.yml +++ b/Workbench/docker-compose.yml @@ -223,7 +223,7 @@ services: - CREATE_NEW_DATABASE=if_needed midpoint_data: - image: postgres:11 + image: postgres:12 environment: - POSTGRES_PASSWORD_FILE=/run/secrets/mp_database_password.txt - POSTGRES_USER=midpoint