add COmanage Match

internet2 · Dec 19, 2024 · 1ea3abf · 1ea3abf
1 parent ff772be
commit 1ea3abf
Show file tree

Hide file tree

Showing 19 changed files with 884 additions and 2 deletions.
diff --git a/Workbench/comanage_match/Dockerfile b/Workbench/comanage_match/Dockerfile
@@ -0,0 +1,40 @@
+FROM comanageproject/comanage-match:1.2.0-shibboleth-sp-supervisor-6
+
+ARG CSPHOSTNAME=localhost
+ENV CSPHOSTNAME=$CSPHOSTNAME
+
+# match settings (env vars from https://spaces.at.internet2.edu/display/COmanage/Configuring+Match+Container+Images)
+ENV COMANAGE_MATCH_ADMIN_USERNAME=banderson@example.org
+ENV COMANAGE_MATCH_SECURITY_SALT=kd67NSQ93VcXPioYT6083620jfutBHGKSNND23hvGG09m10S
+ENV COMANAGE_MATCH_VIRTUAL_HOST_FQDN=$CSPHOSTNAME
+ENV COMANAGE_MATCH_VIRTUAL_HOST_SCHEME=https
+#from database.php
+ENV COMANAGE_MATCH_DATABASE=match
+ENV COMANAGE_MATCH_DATABASE_HOST=comanage-match-data
+ENV COMANAGE_MATCH_DATABASE_USER=match_user
+ENV COMANAGE_MATCH_DATABASE_USER_PASSWORD=Password1
+#from email.php
+ENV COMANAGE_MATCH_EMAIL_FROM_EMAIL=noreply@workbench.incommon.org
+ENV COMANAGE_MATCH_EMAIL_FROM_NAME="Do Not Reply"
+ENV COMANAGE_MATCH_EMAIL_TRANSPORT=Smtp
+ENV COMANAGE_MATCH_EMAIL_HOST=tls://email-smtp.us-west-2.amazonaws.com
+ENV COMANAGE_MATCH_EMAIL_ACCOUNT=AKIAZDWJANQRZKPFVK6J
+ENV COMANAGE_MATCH_EMAIL_ACCOUNT_PASSWORD=BNAp6WlvsI4iXK3ush8pwPD2QKHDYQ09ti+Z3r/mb2Nx
+ENV COMANAGE_MATCH_EMAIL_PORT=465
+# for httpd
+ENV COMANAGE_MATCH_HTTP_NO=true
+ENV COMANAGE_MATCH_HTTPS_LISTEN_PORT=443
+ENV HTTPS_CERT_FILE=/etc/pki/tls/certs/match-ssl.crt
+ENV HTTPS_PRIVKEY_FILE=/etc/pki/tls/private/match-ssl.key
+
+COPY container_files/httpd/match-ssl.crt /etc/pki/tls/certs/
+COPY container_files/httpd/match-ssl.key /etc/pki/tls/private/
+RUN chmod 600 /etc/pki/tls/certs/match-ssl.crt && chmod 600 /etc/pki/tls/private/match-ssl.key
+
+COPY container_files/shibboleth/ /etc/shibboleth/
+
+#dynamically set hostname
+COPY container_files/system/setservername.sh /usr/local/bin/
+RUN chmod 755 /usr/local/bin/setservername.sh && /usr/local/bin/setservername.sh
+
+
diff --git a/Workbench/comanage_match/container_files/httpd/match-ssl.crt b/Workbench/comanage_match/container_files/httpd/match-ssl.crt
@@ -0,0 +1,22 @@
+-----BEGIN CERTIFICATE-----
+MIIDqTCCApGgAwIBAgIJALFLXI21jEHrMA0GCSqGSIb3DQEBCwUAMGsxCzAJBgNV
+BAYTAlVTMREwDwYDVQQIDAhNaWNoaWdhbjESMBAGA1UEBwwJQW5uIEFyYm9yMRIw
+EAYDVQQKDAlJbnRlcm5ldDIxITAfBgNVBAMMGGNvbWFuYWdlLW1hdGNoLndvcmti
+ZW5jaDAeFw0yNDEyMTkxNDI3NDhaFw0zNDEyMTcxNDI3NDhaMGsxCzAJBgNVBAYT
+AlVTMREwDwYDVQQIDAhNaWNoaWdhbjESMBAGA1UEBwwJQW5uIEFyYm9yMRIwEAYD
+VQQKDAlJbnRlcm5ldDIxITAfBgNVBAMMGGNvbWFuYWdlLW1hdGNoLndvcmtiZW5j
+aDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALKgirFsUBMGr8+H5QtY
+e/w8HB5spFUJUX7+Ako1v9yY95WYolbs5s8/TO8iVdRw38yn7mVOavPpquhEfuBg
+oUI4iGftowEv+cT7C1ALZHfHr7cpYGOYS0sHOXWVaUx6ggPR57Vs+gb/3sLA9AUR
+F+AUG+Fkd49yWF+MwnV8ieA88qdx828RdfmWqeO3VAjNXxsWN7/hX9RKBmBSS0n0
+6xaSIqA/5vTD+8kA+D0Rvvv2xBmpBJo+FbLhA9qz2NJM7iVy7xxC/HQojBrXt7qd
+63EkPv7H6o6sBzZQ4oxyT3on8E6tUPfa/jrRhHuJt9JmDVEZyvhOkidDyvZef+Qr
+bckCAwEAAaNQME4wHQYDVR0OBBYEFPXB9x9X7k3gk3Jwm1BS4/HFldPVMB8GA1Ud
+IwQYMBaAFPXB9x9X7k3gk3Jwm1BS4/HFldPVMAwGA1UdEwQFMAMBAf8wDQYJKoZI
+hvcNAQELBQADggEBACXerk/2Q4+Hw6laPj/IkreUgrHe9oCt3EjbMSTjUERp6j/c
+Trmy/QefGVICpGPnBNV5XcDmPMoAG5UJ5wxG3lXu2VFuf1qhs4yuTzYuskZGijEv
+xGIxhMuhPuRZrccfrqMXMGS0HV0kPKVJcTD21wzoJNzvBxZG1YGshehBUComsjFt
+YHaqHD4tgMCA+TElILi9GJk9hiqc4+X6V/XXPDitXXx+eKC4fNrXfdJ+tb5eE/A7
+a6204TeVdOX+iChjJOOcSJY3uLto/Ez0dVxrMIEbppZWMlrl7tlJVS9Y4lKkw3FC
+XDWW3UplClTk3tCtfhfF1zLm2gk40ep38o8O8NY=
+-----END CERTIFICATE-----
diff --git a/Workbench/comanage_match/container_files/httpd/match-ssl.key b/Workbench/comanage_match/container_files/httpd/match-ssl.key
@@ -0,0 +1,27 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIEowIBAAKCAQEAsqCKsWxQEwavz4flC1h7/DwcHmykVQlRfv4CSjW/3Jj3lZii
+Vuzmzz9M7yJV1HDfzKfuZU5q8+mq6ER+4GChQjiIZ+2jAS/5xPsLUAtkd8evtylg
+Y5hLSwc5dZVpTHqCA9HntWz6Bv/ewsD0BREX4BQb4WR3j3JYX4zCdXyJ4Dzyp3Hz
+bxF1+Zap47dUCM1fGxY3v+Ff1EoGYFJLSfTrFpIioD/m9MP7yQD4PRG++/bEGakE
+mj4VsuED2rPY0kzuJXLvHEL8dCiMGte3up3rcSQ+/sfqjqwHNlDijHJPeifwTq1Q
+99r+OtGEe4m30mYNURnK+E6SJ0PK9l5/5CttyQIDAQABAoIBAFZBC3fNE4V8bxzJ
+RCKMYaJU7EcMsvWVAFNQGI75EWJWQwdroshSsMlWibHXZJamwoqydH1atm59YNez
+a4ixYGz3m3aD23hRUEx75OSL+8GTHRhW1IKDIahjHq3WrfgOGAX8L+T9cGY827Yz
+MiHYNS0wyJ23w7vyvRW2hJfywSkTtW1l2yXHrU8/AYcq0in07GPeIdSnmrRuov+b
+kPAkiLkJBXrMmPkKX0qQ9jCU2hdZVHtlaoMSr2/6klNn2ynNLST08W9Hd5qQTbpw
+eDmKQZYUH2W/dEnmii4MzA9FiW0s6sPV5NSMQAZoWpSk2bt1rAFZp5UjWGuXX5gz
+xGRahFkCgYEA7fNDS/+O/lPTjaAdoZ9triYrKHdRTlNwfenkinghMj/yKLFmCu6/
+C+6sGvJELJaJqQc1rYSwNhd3VeI+lpqqTmPrtid16ZD9InQbA2Zywa5XI1okCWtH
+TQccSRE9B4Ow4NUfjIyFeI6u1xq3P+2sM5EXWMLl7g2nMKKCejoFQC8CgYEAwC1J
+pwBvLFfTUMNxoILpXx31xcrKvRCfGWRWB8hyj2x14/7qhpGueUkjqHSRl0fW6urk
+zdmiPRmb2R68bOZ2alkbvgrxWyicSoRWyaLsipbk0H4o3tBOxZHTGqdY/6czlBJX
+vYHc1qi3+Ak/+xYXxh3d13uNpVq72d2pNx9we4cCgYEAlGAWXLN01P4scqmfEIM7
+f1ZpnwgX+QFqqflI+1dBS/Y36EwGV1bcZnJje0IKZMtR98Z5IEQXJQOo9DLp2DuF
+avA/sQwWKJiyX+OKXKprcH5n87Fnuz/b7Bo89wr6xU7G4svCqn+NUsmWGKeeEQ0B
+Tf5xUnXlrnVxBZCwT8sSLx0CgYBxcYp74f6+n22nzGfkB8N5mbb+tpJtf0Vb+OXs
+HEC8N5t0JoQNQixLfohlJcLYGdldvaGpfqKODPL5/XHfm0Al0UpWKiGF3Xg9aNfO
+mbWmriKOjRrVRQRrDoUew9D+wZXp/9X5kZJqyRgofFVfhBAurGzLiiz4gpJHrtj4
+KD//OwKBgAkrQfT4pvsiUi+c8oCEiHd/rR3e+Q3mhJrx3/lRWff7X7lb90JeVa9y
+xwfe9V/mWhihXCVPJMyyMKrfonDBlsXW7EiruJxIOa11hNXD07UsOYwKk0WAhmXU
+iv7FsRK9JStKTKw/sI9P8H+Xfi/2zyc+8vJJprXdZtJBnTM4/fEr
+-----END RSA PRIVATE KEY-----
diff --git a/Workbench/comanage_match/container_files/shibboleth/attribute-map.xml b/Workbench/comanage_match/container_files/shibboleth/attribute-map.xml
@@ -0,0 +1,169 @@
+<Attributes xmlns="urn:mace:shibboleth:2.0:attribute-map" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
+
+    <!--
+    The mappings are a mix of SAML 1.1 and SAML 2.0 attribute names agreed to within the Shibboleth
+    community. The non-OID URNs are SAML 1.1 names and most of the OIDs are SAML 2.0 names, with a
+    few exceptions for newer attributes where the name is the same for both versions. You will
+    usually want to uncomment or map the names for both SAML versions as a unit.
+    -->
+
+    <!-- New standard identifier attributes for SAML. -->
+
+    <Attribute name="urn:oasis:names:tc:SAML:attribute:subject-id" id="subject-id">
+        <AttributeDecoder xsi:type="ScopedAttributeDecoder" caseSensitive="false"/>
+    </Attribute>
+
+    <Attribute name="urn:oasis:names:tc:SAML:attribute:pairwise-id" id="pairwise-id">
+        <AttributeDecoder xsi:type="ScopedAttributeDecoder" caseSensitive="false"/>
+    </Attribute>
+
+    <!-- The most typical eduPerson attributes. -->
+
+    <Attribute name="urn:oid:1.3.6.1.4.1.5923.1.1.1.6" id="eppn">
+        <AttributeDecoder xsi:type="ScopedAttributeDecoder" caseSensitive="false"/>
+    </Attribute>
+    <Attribute name="urn:mace:dir:attribute-def:eduPersonPrincipalName" id="eppn">
+        <AttributeDecoder xsi:type="ScopedAttributeDecoder" caseSensitive="false"/>
+    </Attribute>
+
+    <Attribute name="urn:oid:1.3.6.1.4.1.5923.1.1.1.9" id="affiliation">
+        <AttributeDecoder xsi:type="ScopedAttributeDecoder" caseSensitive="false"/>
+    </Attribute>
+    <Attribute name="urn:mace:dir:attribute-def:eduPersonScopedAffiliation" id="affiliation">
+        <AttributeDecoder xsi:type="ScopedAttributeDecoder" caseSensitive="false"/>
+    </Attribute>
+
+    <Attribute name="urn:oid:1.3.6.1.4.1.5923.1.1.1.7" id="entitlement"/>
+    <Attribute name="urn:mace:dir:attribute-def:eduPersonEntitlement" id="entitlement"/>
+
+    <!--
+    Legacy pairwise identifier attribute / NameID format, intended to be replaced by the
+    simpler pairwise-id attribute (see top of file).
+    -->
+
+    <!-- The eduPerson attribute version (note the OID-style name): -->
+    <Attribute name="urn:oid:1.3.6.1.4.1.5923.1.1.1.10" id="persistent-id">
+        <AttributeDecoder xsi:type="NameIDAttributeDecoder" formatter="$NameQualifier!$SPNameQualifier!$Name" defaultQualifiers="true"/>
+    </Attribute>
+
+    <!-- The SAML 2.0 NameID Format: -->
+    <Attribute name="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent" id="persistent-id">
+        <AttributeDecoder xsi:type="NameIDAttributeDecoder" formatter="$NameQualifier!$SPNameQualifier!$Name" defaultQualifiers="true"/>
+    </Attribute>
+
+    <!-- Other eduPerson attributes (SAML 2 names followed by SAML 1 names)... -->
+    <!--
+    <Attribute name="urn:oid:1.3.6.1.4.1.5923.1.1.1.11" id="assurance"/>    
+    <Attribute name="urn:oid:1.3.6.1.4.1.5923.1.5.1.1" id="member"/>
+    <Attribute name="urn:oid:1.3.6.1.4.1.5923.1.6.1.1" id="eduCourseOffering"/>
+    <Attribute name="urn:oid:1.3.6.1.4.1.5923.1.6.1.2" id="eduCourseMember"/>
+
+    <Attribute name="urn:oid:1.3.6.1.4.1.5923.1.1.1.1" id="unscoped-affiliation">
+        <AttributeDecoder xsi:type="StringAttributeDecoder" caseSensitive="false"/>
+    </Attribute>
+    <Attribute name="urn:oid:1.3.6.1.4.1.5923.1.1.1.5" id="primary-affiliation">
+        <AttributeDecoder xsi:type="StringAttributeDecoder" caseSensitive="false"/>
+    </Attribute>
+    <Attribute name="urn:oid:1.3.6.1.4.1.5923.1.1.1.2" id="nickname"/>
+    <Attribute name="urn:oid:1.3.6.1.4.1.5923.1.1.1.8" id="primary-orgunit-dn"/>
+    <Attribute name="urn:oid:1.3.6.1.4.1.5923.1.1.1.4" id="orgunit-dn"/>
+    <Attribute name="urn:oid:1.3.6.1.4.1.5923.1.1.1.3" id="org-dn"/>
+
+    <Attribute name="urn:mace:dir:attribute-def:eduPersonAffiliation" id="unscoped-affiliation">
+        <AttributeDecoder xsi:type="StringAttributeDecoder" caseSensitive="false"/>
+    </Attribute>
+    <Attribute name="urn:mace:dir:attribute-def:eduPersonPrimaryAffiliation" id="primary-affiliation">
+        <AttributeDecoder xsi:type="StringAttributeDecoder" caseSensitive="false"/>
+    </Attribute>
+    <Attribute name="urn:mace:dir:attribute-def:eduPersonNickname" id="nickname"/>
+    <Attribute name="urn:mace:dir:attribute-def:eduPersonPrimaryOrgUnitDN" id="primary-orgunit-dn"/>
+    <Attribute name="urn:mace:dir:attribute-def:eduPersonOrgUnitDN" id="orgunit-dn"/>
+    <Attribute name="urn:mace:dir:attribute-def:eduPersonOrgDN" id="org-dn"/>
+    -->
+
+    <!-- Older LDAP-defined attributes (SAML 2.0 names followed by SAML 1 names)... -->
+    <!--
+    <Attribute name="urn:oid:2.5.4.3" id="cn"/>
+    <Attribute name="urn:oid:2.5.4.4" id="sn"/>
+    <Attribute name="urn:oid:2.5.4.42" id="givenName"/>
+    <Attribute name="urn:oid:2.16.840.1.113730.3.1.241" id="displayName"/>
+    -->
+    <Attribute name="urn:oid:0.9.2342.19200300.100.1.1" id="uid"/>
+    <!--
+    <Attribute name="urn:oid:0.9.2342.19200300.100.1.3" id="mail"/>
+    <Attribute name="urn:oid:2.5.4.20" id="telephoneNumber"/>
+    <Attribute name="urn:oid:2.5.4.12" id="title"/>
+    <Attribute name="urn:oid:2.5.4.43" id="initials"/>
+    <Attribute name="urn:oid:2.5.4.13" id="description"/>
+    <Attribute name="urn:oid:2.16.840.1.113730.3.1.1" id="carLicense"/>
+    <Attribute name="urn:oid:2.16.840.1.113730.3.1.2" id="departmentNumber"/>
+    <Attribute name="urn:oid:2.16.840.1.113730.3.1.3" id="employeeNumber"/>
+    <Attribute name="urn:oid:2.16.840.1.113730.3.1.4" id="employeeType"/>
+    <Attribute name="urn:oid:2.16.840.1.113730.3.1.39" id="preferredLanguage"/>
+    <Attribute name="urn:oid:0.9.2342.19200300.100.1.10" id="manager"/>
+    <Attribute name="urn:oid:2.5.4.34" id="seeAlso"/>
+    <Attribute name="urn:oid:2.5.4.23" id="facsimileTelephoneNumber"/>
+    <Attribute name="urn:oid:2.5.4.9" id="street"/>
+    <Attribute name="urn:oid:2.5.4.18" id="postOfficeBox"/>
+    <Attribute name="urn:oid:2.5.4.17" id="postalCode"/>
+    <Attribute name="urn:oid:2.5.4.8" id="st"/>
+    <Attribute name="urn:oid:2.5.4.7" id="l"/>
+    <Attribute name="urn:oid:2.5.4.10" id="o"/>
+    <Attribute name="urn:oid:2.5.4.11" id="ou"/>
+    <Attribute name="urn:oid:2.5.4.15" id="businessCategory"/>
+    <Attribute name="urn:oid:2.5.4.19" id="physicalDeliveryOfficeName"/>
+
+    <Attribute name="urn:mace:dir:attribute-def:cn" id="cn"/>
+    <Attribute name="urn:mace:dir:attribute-def:sn" id="sn"/>
+    <Attribute name="urn:mace:dir:attribute-def:givenName" id="givenName"/>
+    <Attribute name="urn:mace:dir:attribute-def:displayName" id="displayName"/>
+    <Attribute name="urn:mace:dir:attribute-def:uid" id="uid"/>
+    <Attribute name="urn:mace:dir:attribute-def:mail" id="mail"/>
+    <Attribute name="urn:mace:dir:attribute-def:telephoneNumber" id="telephoneNumber"/>
+    <Attribute name="urn:mace:dir:attribute-def:title" id="title"/>
+    <Attribute name="urn:mace:dir:attribute-def:initials" id="initials"/>
+    <Attribute name="urn:mace:dir:attribute-def:description" id="description"/>
+    <Attribute name="urn:mace:dir:attribute-def:carLicense" id="carLicense"/>
+    <Attribute name="urn:mace:dir:attribute-def:departmentNumber" id="departmentNumber"/>
+    <Attribute name="urn:mace:dir:attribute-def:employeeNumber" id="employeeNumber"/>
+    <Attribute name="urn:mace:dir:attribute-def:employeeType" id="employeeType"/>
+    <Attribute name="urn:mace:dir:attribute-def:preferredLanguage" id="preferredLanguage"/>
+    <Attribute name="urn:mace:dir:attribute-def:manager" id="manager"/>
+    <Attribute name="urn:mace:dir:attribute-def:seeAlso" id="seeAlso"/>
+    <Attribute name="urn:mace:dir:attribute-def:facsimileTelephoneNumber" id="facsimileTelephoneNumber"/>
+    <Attribute name="urn:mace:dir:attribute-def:street" id="street"/>
+    <Attribute name="urn:mace:dir:attribute-def:postOfficeBox" id="postOfficeBox"/>
+    <Attribute name="urn:mace:dir:attribute-def:postalCode" id="postalCode"/>
+    <Attribute name="urn:mace:dir:attribute-def:st" id="st"/>
+    <Attribute name="urn:mace:dir:attribute-def:l" id="l"/>
+    <Attribute name="urn:mace:dir:attribute-def:o" id="o"/>
+    <Attribute name="urn:mace:dir:attribute-def:ou" id="ou"/>
+    <Attribute name="urn:mace:dir:attribute-def:businessCategory" id="businessCategory"/>
+    <Attribute name="urn:mace:dir:attribute-def:physicalDeliveryOfficeName" id="physicalDeliveryOfficeName"/>
+    -->
+
+    <!-- SCHAC attributes... -->
+    <!--
+    <Attribute name="urn:oid:1.3.6.1.4.1.25178.1.2.9" id="schacHomeOrganization">
+        <AttributeDecoder xsi:type="StringAttributeDecoder" caseSensitive="false"/>
+    </Attribute>
+    <Attribute name="urn:oid:1.3.6.1.4.1.25178.1.2.10" id="schacHomeOrganizationType">
+        <AttributeDecoder xsi:type="StringAttributeDecoder" caseSensitive="false"/>
+    </Attribute>
+    <Attribute name="urn:oid:1.3.6.1.4.1.25178.1.2.14" id="schacPersonalUniqueCode">
+        <AttributeDecoder xsi:type="StringAttributeDecoder" caseSensitive="false"/>
+    </Attribute>
+    <Attribute name="urn:oid:1.3.6.1.4.1.25178.1.2.15" id="schacPersonalUniqueID"/>
+    <Attribute name="urn:oid:1.3.6.1.4.1.25178.1.2.19" id="schacUserStatus">
+        <AttributeDecoder xsi:type="StringAttributeDecoder" caseSensitive="false"/>
+    </Attribute>
+    <Attribute name="urn:oid:1.3.6.1.4.1.25178.1.2.20" id="schacProjectMembership">
+        <AttributeDecoder xsi:type="StringAttributeDecoder" caseSensitive="false"/>
+    </Attribute>
+    <Attribute name="urn:oid:1.3.6.1.4.1.25178.1.2.21" id="schacProjectSpecificRole">
+        <AttributeDecoder xsi:type="StringAttributeDecoder" caseSensitive="false"/>
+    </Attribute>
+    -->
+
+</Attributes>
+