From 73fe39109614c1be3893b960302c7acbe5127c62 Mon Sep 17 00:00:00 2001 From: Paul Caskey Date: Sat, 26 Aug 2023 00:22:01 +0000 Subject: [PATCH] bump Grouper to 4.5.4 --- Workbench/grouper_daemon/Dockerfile | 2 +- Workbench/grouper_data/Dockerfile | 2 +- Workbench/grouper_ui/Dockerfile | 2 +- Workbench/grouper_ws/Dockerfile | 2 +- .../securityPolicy/000-security-policy.xml | 28 +- .../010-system-configuration.xml | 1903 ++++++++++++----- .../webproxy/container_files/httpd/index.html | 2 +- 7 files changed, 1440 insertions(+), 501 deletions(-) diff --git a/Workbench/grouper_daemon/Dockerfile b/Workbench/grouper_daemon/Dockerfile index 79fb8cf..58ade03 100644 --- a/Workbench/grouper_daemon/Dockerfile +++ b/Workbench/grouper_daemon/Dockerfile @@ -1,4 +1,4 @@ -FROM i2incommon/grouper:4.5.2 +FROM i2incommon/grouper:4.5.4 LABEL author="tier-packaging@internet2.edu " diff --git a/Workbench/grouper_data/Dockerfile b/Workbench/grouper_data/Dockerfile index 08bedad..97fcd03 100644 --- a/Workbench/grouper_data/Dockerfile +++ b/Workbench/grouper_data/Dockerfile @@ -1,4 +1,4 @@ -FROM i2incommon/grouper:4.5.2 +FROM i2incommon/grouper:4.5.4 LABEL author="tier-packaging@internet2.edu " diff --git a/Workbench/grouper_ui/Dockerfile b/Workbench/grouper_ui/Dockerfile index 2e8d2a5..3e14a3c 100644 --- a/Workbench/grouper_ui/Dockerfile +++ b/Workbench/grouper_ui/Dockerfile @@ -1,4 +1,4 @@ -FROM i2incommon/grouper:4.5.2 +FROM i2incommon/grouper:4.5.4 LABEL author="tier-packaging@internet2.edu " diff --git a/Workbench/grouper_ws/Dockerfile b/Workbench/grouper_ws/Dockerfile index 09b2663..5727b12 100644 --- a/Workbench/grouper_ws/Dockerfile +++ b/Workbench/grouper_ws/Dockerfile @@ -1,4 +1,4 @@ -FROM i2incommon/grouper:4.5.2 +FROM i2incommon/grouper:4.5.4 LABEL author="tier-packaging@internet2.edu " diff --git a/Workbench/midpoint_server/container_files/mp-home/post-initial-objects/securityPolicy/000-security-policy.xml b/Workbench/midpoint_server/container_files/mp-home/post-initial-objects/securityPolicy/000-security-policy.xml index 601e34d..ffd8450 100644 --- a/Workbench/midpoint_server/container_files/mp-home/post-initial-objects/securityPolicy/000-security-policy.xml +++ b/Workbench/midpoint_server/container_files/mp-home/post-initial-objects/securityPolicy/000-security-policy.xml @@ -7,15 +7,15 @@ - internalLoginForm + internalLoginForm Internal username/password authentication, default user password, login form - internalBasic + internalBasic Internal username/password authentication, using HTTP basic auth - mySamlSso + mySamlSso My internal enterprise SAML-based SSO system. midpointdemo-shibboleth @@ -44,13 +44,13 @@ - httpHeader + httpHeader https://__CSPHOSTNAME__/MPSSO/Shibboleth.sso/Logout REMOTE_USER - admin-gui-saml-internal + admin-gui-saml-internal Internal SAML2 GUI authentication sequence. @@ -60,13 +60,13 @@ saml-internal - mySamlSso + mySamlSso 30 sufficient - admin-gui-emergency + admin-gui-emergency Special GUI authentication sequence that is using just the internal user password. @@ -78,13 +78,13 @@ - internalLoginForm + internalLoginForm 30 sufficient - admin-gui-default + admin-gui-default Special GUI authentication sequence that is using Shibboleth SP @@ -94,13 +94,13 @@ shib - httpHeader + httpHeader 30 sufficient - rest + rest Authentication sequence for REST service. @@ -110,13 +110,13 @@ rest-default - internalBasic + internalBasic 10 sufficient - actuator + actuator Authentication sequence for actuator. @@ -126,7 +126,7 @@ actuator-default - internalBasic + internalBasic 10 sufficient diff --git a/Workbench/midpoint_server/container_files/mp-home/post-initial-objects/systemConfigurations/010-system-configuration.xml b/Workbench/midpoint_server/container_files/mp-home/post-initial-objects/systemConfigurations/010-system-configuration.xml index 5ac96fb..7205bba 100644 --- a/Workbench/midpoint_server/container_files/mp-home/post-initial-objects/systemConfigurations/010-system-configuration.xml +++ b/Workbench/midpoint_server/container_files/mp-home/post-initial-objects/systemConfigurations/010-system-configuration.xml @@ -22,101 +22,89 @@ - - - ERROR - ro.isdc.wro.extensions.processor.css.Less4jProcessor - - - - OFF - org.springframework.security.web.DefaultSecurityFilterChain - - - - OFF - org.hibernate.engine.jdbc.spi.SqlExceptionHelper - - - - OFF - org.hibernate.engine.jdbc.batch.internal.BatchingBatch - - - - WARN - org.hibernate.engine.jdbc.batch.internal.AbstractBatchImpl - - - - OFF - org.hibernate.internal.ExceptionMapperStandardImpl - - - - OFF - net.sf.jasperreports.engine.fill.JRFillDataset - - - - WARN - org.apache.wicket.resource.PropertiesFactory - - - - ERROR - org.springframework.context.support.ResourceBundleMessageSource - - - - INFO - com.evolveum.midpoint.model.impl.lens.projector.Projector - - - - INFO - com.evolveum.midpoint.model.impl.lens.Clockwork - - - DEBUG - com.evolveum.polygon.connector.grouper - - - %date [%X{subsystem}] [%thread] %level \(%logger\): %msg%n - ${midpoint.home}/log/midpoint.log - ${midpoint.home}/log/midpoint-%d{yyyy-MM-dd}.%i.log - 10 - 100MB - true - - - - %date %level: %msg%n - ${midpoint.home}/log/midpoint-profile.log - ${midpoint.home}/log/midpoint-profile-%d{yyyy-MM-dd}.%i.log - 10 - 100MB - true - - MIDPOINT_LOG - INFO - - false -
false
- + + + + + OFF + org.springframework.security.web.DefaultSecurityFilterChain + + + + OFF + org.hibernate.engine.jdbc.spi.SqlExceptionHelper + + + + OFF + org.hibernate.engine.jdbc.batch.internal.BatchingBatch + + + + WARN + org.hibernate.engine.jdbc.batch.internal.AbstractBatchImpl + + + + OFF + org.hibernate.internal.ExceptionMapperStandardImpl + + + + WARN + org.apache.wicket.resource.PropertiesFactory + + + + ERROR + org.springframework.context.support.ResourceBundleMessageSource + + + + INFO + com.evolveum.midpoint.model.impl.lens.projector.Projector + + + + INFO + com.evolveum.midpoint.model.impl.lens.Clockwork + + + %date [%X{subsystem}] [%thread] %level \(%logger\): %msg%n + /tmp/logmidpoint + ${midpoint.home}/log/midpoint-%d{yyyy-MM-dd}.%i.log + 0 + 2000MB + true + + + %date %level: %msg%n + ${midpoint.home}/log/midpoint-profile.log + ${midpoint.home}/log/midpoint-profile-%d{yyyy-MM-dd}.%i.log + 10 + 100MB + true + + MIDPOINT_LOG + INFO + + false +
false
+ + + UserType @@ -289,371 +277,1322 @@ CSP-Workbench + - - /self/profile - - PageSelfDashboard.profile.description - - fa fa-user - - green - http://midpoint.evolveum.com/xml/ns/public/security/authorization-ui-3#selfProfile - http://midpoint.evolveum.com/xml/ns/public/security/authorization-ui-3#selfAll - - - /self/credentials - - PageSelfDashboard.credentials.description - - fa fa-shield - - blue - http://midpoint.evolveum.com/xml/ns/public/security/authorization-ui-3#selfCredentials - http://midpoint.evolveum.com/xml/ns/public/security/authorization-ui-3#selfAll - - - /admin/users - - - fa fa-users - - red - http://midpoint.evolveum.com/xml/ns/public/security/authorization-ui-3#users - - - /admin/resources - - - fa fa-database - - purple - http://midpoint.evolveum.com/xml/ns/public/security/authorization-ui-3#resources - - - - my-cases - - - - - My cases - - MyCases.title - - - My case - - fe fe-case-object - - - 1000 - CaseType - - - - - - - manual-case-view - - - - - All manual cases - - AllManualCases.title - - - Manual case - Manual provisioning cases - - 1010 - CaseType - - - - - - - operation-request-case-view - - - - - All requests - - AllRequests.title - - - Request - Operation requests - - 1020 - CaseType - - - - - - - approval-case-view - - - - - All approvals - - AllApprovals.title - - - Approval - Approval cases - - 1030 - CaseType - - - - - - - reconciliation-tasks-view - 30 - TaskType - - - - - - recomputation-tasks-view - 30 - TaskType - - - - - - import-tasks-view - 30 - TaskType - - - - - - live-sync-tasks-view - 30 - TaskType - - - - - - async-update-tasks-view - 30 - TaskType - - - - - - cleanup-tasks-view - 30 - TaskType - - - - - - report-tasks-view - 30 - TaskType - - - - - - single-bulk-action-tasks-view - 30 - TaskType - - - - - - iterative-bulk-action-tasks-view - 30 - TaskType - - - - - - certification-tasks-view - 30 - TaskType - - - - - - approval-tasks-view - 30 - TaskType - - - - - - utility-tasks-view - 30 - TaskType - - - - - - system-tasks-view - 30 - TaskType - - - - - - dashboard-reports-view - ReportType - - - - - - collection-reports-view - ReportType - - - - - - - - c:TaskType - - 150 + + UserType + + myAccesses - + + col-12 col-xxl-6 + + fe fe-assignment + - - cleanupAfterCompletion - - - threadStopAction - - - binding - - - dependent - - - - 900 + 10 + + viewAll + + + + fa fa-search + + + + /self/profile/user + allAssignments + + + + requestAccess + + + + fas fa-plus-circle + + + + /self/requestAccess + + + allAssignments + 5 + + + myRequests - + + col-12 col-xxl-6 + + fe fe-case + - - executionStatus - - - schedulingState - - - node - - - nodeAsObserved - - - resultStatus - - - result - - - nextRunStartTimestamp - - - nextRetryTimestamp - - - unpauseAction - - - taskIdentifier - - - parent - - - waitingReason - - - stateBeforeSuspend - - - schedulingStateBeforeSuspend - - - category - - - otherHandlersUriStack - - - channel - - - subtaskRef - - - dependentTaskRef - - - lastRunStartTimestamp - - - lastRunFinishTimestamp - - - completionTimestamp - - - - 910 - hidden + 20 + + viewAll + + + + fa fa-search + + + + /admin/casesAll + my-cases + + + myRequests + 5 + + + myWorkItems - + + col-12 col-xxl-6 + + fa fa-inbox + - - progress - - - expectedTotal - - - stalledSince - - - - - - true - - admin-dashboard - - - + 40 + + viewAll + + + + fa fa-search + + + + /admin/myWorkItems + + + myWorkItems + 5 + + + myAccounts + + + col-12 col-xxl-6 + + fa fa-male + + + 30 + + viewAll + + + + fa fa-search + + + + /self/profile/user + projections + + + projections + 5 + + + profileWidget + + + PageSelfDashboard.profile.description + col-md-3 + + bg-green fa fa-user + + + linkWidget + + profile-widget-action + + /self/profile/user + + + + + credentialsWidget + + + PageSelfDashboard.credentials.description + col-md-3 + + bg-blue fa fa-shield-alt + + + linkWidget + + credentials-widget-action + + /self/credentials + + + + + listResourcesWidget + + + col-md-3 + + bg-purple fa fa-database + + + linkWidget + + list-resources-widget-action + + /admin/resources + + + + + listUsersWidget + + + col-md-3 + + bg-red fa fa-user + + + linkWidget + + list-resources-widget-action + + /admin/users + + + + + + + my-cases + + + + + My cases + + MyCases.title + + + My case + + fe fe-case-object + + + 1000 + CaseType + + + + + + + manual-case-view + + + + + All manual cases + + AllManualCases.title + + + Manual case + Manual provisioning cases + + 1010 + CaseType + + + + + + + operation-request-case-view + + + + + All requests + + AllRequests.title + + + Request + Operation requests + + 1020 + CaseType + + + + + + + approval-case-view + + + + + All approvals + + AllApprovals.title + + + Approval + Approval cases + + 1030 + CaseType + + + + + + + correlation-case-view + + + + + All correlations + + AllCorrelations.title + + + Correlation + Correlation cases + + 1040 + CaseType + + + + + + reconciliation-tasks-view + 30 + TaskType + + + + + + recomputation-tasks-view + 30 + TaskType + + + + + + import-tasks-view + 30 + TaskType + + + + + + live-sync-tasks-view + 30 + TaskType + + + + + + async-update-tasks-view + 30 + TaskType + + + + + + cleanup-tasks-view + 30 + TaskType + + + + + + report-tasks-view + + + + Report tasks + report tasks + + ReportTasks.title + + + + fa fa-chart-pie + green + + + 30 + TaskType + + + + + + non-iterative-bulk-tasks-view + 30 + TaskType + + + + + + iterative-bulk-tasks-view + 30 + TaskType + + + + + + report-import-task-view + 30 + add + TaskType + + + + + + export-report-tasks-view + add + 30 + TaskType + + + + + + + + export-report-distributed-tasks-view + add + 30 + TaskType + + + + + + + + shadow-integrity-check-task-view + 30 + add + TaskType + + + + + + shadows-refresh-task-view + 30 + add + TaskType + + + + + + objects-delete-task-view + 30 + add + TaskType + + + + + + shadows-delete-long-time-not-updated-task-view + 30 + add + TaskType + + + + + + execute-change-task-view + 30 + add + TaskType + + + + + + execute-deltas-task-view + 30 + add + TaskType + + + + + + reindex-repository-task-view + 30 + add + TaskType + + + + + + object-integrity-check-task-view + 30 + add + TaskType + + + + + + validity-task-view + 30 + add + TaskType + + + + + + trigger-task-view + 30 + add + TaskType + + + + + + propagation-task-view + 30 + add + TaskType + + + + + + multi-propagation-task-view + 30 + add + TaskType + + + + + + certification-tasks-view + 30 + TaskType + + + + + + approval-tasks-view + 30 + TaskType + + + + + + utility-tasks-view + 30 + TaskType + + + + + + system-tasks-view + 30 + TaskType + + + + + + dashboard-reports-view + ReportType + + + + + + collection-reports-view + ReportType + + + + + + application-role + add + RoleType + + + + + + business-role + add + RoleType + + + + + + application + + + + ServiceType + + + + + + event-mark + c:MarkType + + + + + + + + object-mark + c:MarkType + + + + + + + + + + c:TaskType + + advanced-options-panel + + + + formPanel + + advanced-options + 150 + + + + + cleanupAfterCompletion + + + threadStopAction + + + binding + + + dependent + + + + + operational-attributes-panel + + + + formPanel + + operational-attributes + 900 + + + + + executionState + + + schedulingState + + + node + + + nodeAsObserved + + + resultStatus + + + result + + + nextRunStartTimestamp + + + nextRetryTimestamp + + + unpauseAction + + + taskIdentifier + + + parent + + + waitingReason + + + stateBeforeSuspend + + + schedulingStateBeforeSuspend + + + category + + + otherHandlersUriStack + + + channel + + + subtaskRef + + + dependentTaskRef + + + lastRunStartTimestamp + + + lastRunFinishTimestamp + + + completionTimestamp + + + + 910 + hidden + operation-attributes-progress + + + + + progress + + + expectedTotal + + + stalledSince + + + + + + c:UserType + + applications + + + + roleMemberships + + applications + c:ServiceType + + + + + + hidden + ServiceType + ServiceType + + + + + + + + rw-type-basic + + basic + + + + + schemaHandling/objectType/displayName + visible + + + schemaHandling/objectType/description + visible + + + schemaHandling/objectType/kind + visible + + + schemaHandling/objectType/intent + visible + + + schemaHandling/objectType/securityPolicyRef + visible + + + schemaHandling/objectType/default + visible + + + + hidden + schemaHandling/objectType + + rw-type-basic + + + rw-type-delineation + + delineation + + + + + schemaHandling/objectType/delineation/objectClass + visible + + + schemaHandling/objectType/delineation/auxiliaryObjectClass + visible + + + schemaHandling/objectType/delineation/searchHierarchyScope + visible + + + schemaHandling/objectType/delineation/filter + visible + + + schemaHandling/objectType/delineation/classificationCondition + visible + + + + hidden + schemaHandling/objectType/delineation + + rw-type-delineation + + + rw-attribute-limitations + + limitationsMapping + + + + + schemaHandling/objectType/attribute/limitations/access/read + visible + + + schemaHandling/objectType/attribute/limitations/access/add + visible + + + schemaHandling/objectType/attribute/limitations/access/modify + visible + + + schemaHandling/objectType/attribute/limitations/minOccurs + visible + + + schemaHandling/objectType/attribute/limitations/maxOccurs + visible + + + schemaHandling/objectType/attribute/limitations/processing + visible + + + + hidden + schemaHandling/objectType/attribute/limitations + + rw-attribute-limitations + + + rw-synchronization-reaction-main + + reactionMainSetting + + + + + schemaHandling/objectType/synchronization/reaction/name + visible + + + schemaHandling/objectType/synchronization/reaction/description + visible + + + schemaHandling/objectType/synchronization/reaction/situation + visible + + + + hidden + schemaHandling/objectType/synchronization/reaction + + rw-synchronization-reaction-main + + + rw-synchronization-reaction-optional + + reactionOptionalSetting + + + + + schemaHandling/objectType/synchronization/reaction/condition + visible + + + schemaHandling/objectType/synchronization/reaction/channel + visible + + + schemaHandling/objectType/synchronization/reaction/order + visible + + + + hidden + schemaHandling/objectType/synchronization/reaction + + rw-synchronization-reaction-optional + + + rw-attribute + + mainConfigurationAttribute + + + + + schemaHandling/objectType/attribute/ref + visible + + + schemaHandling/objectType/attribute/displayName + visible + + + schemaHandling/objectType/attribute/help + visible + + + schemaHandling/objectType/attribute/description + visible + + + schemaHandling/objectType/attribute/tolerant + visible + + + schemaHandling/objectType/attribute/exclusiveStrong + visible + + + schemaHandling/objectType/attribute/readReplaceMode + visible + + + schemaHandling/objectType/attribute/fetchStrategy + visible + + + schemaHandling/objectType/attribute/matchingRule + visible + + + + hidden + schemaHandling/objectType/attribute + + rw-attribute + + + rw-association + + association + + + + + schemaHandling/objectType/association/ref + visible + + + schemaHandling/objectType/association/displayName + visible + + + schemaHandling/objectType/association/description + visible + + + schemaHandling/objectType/association/auxiliaryObjectClass + visible + + + schemaHandling/objectType/association/kind + visible + + + schemaHandling/objectType/association/intent + visible + + + schemaHandling/objectType/association/direction + visible + + + schemaHandling/objectType/association/associationAttribute + visible + + + schemaHandling/objectType/association/shortcutAssociationAttribute + visible + + + schemaHandling/objectType/association/valueAttribute + visible + + + schemaHandling/objectType/association/shortcutValueAttribute + visible + + + schemaHandling/objectType/association/explicitReferentialIntegrity + visible + + + + hidden + schemaHandling/objectType/association + + rw-association + + + + + rw-connectorConfiguration-partial + + required + + + + + connectorConfiguration/configurationProperties/jdbcUrlTemplate + + + connectorConfiguration/configurationProperties/jdbcDriver + + + connectorConfiguration/configurationProperties/password + + + connectorConfiguration/configurationProperties/user + + + connectorConfiguration/configurationProperties/port + + + connectorConfiguration/configurationProperties/host + + + connectorConfiguration/configurationProperties/database + + + + hidden + connectorConfiguration/configurationProperties + + rw-connectorConfiguration-partial + + + run + + + + connectorType + org.identityconnectors.databasetable.DatabaseTableConnector + + + available + true + + + + + + + + rw-connectorConfiguration-partial + + required + + + + + connectorConfiguration/configurationProperties/host + + + connectorConfiguration/configurationProperties/port + + + connectorConfiguration/configurationProperties/connectionSecurity + + + connectorConfiguration/configurationProperties/bindDn + visible + + + connectorConfiguration/configurationProperties/bindPassword + visible + + + + hidden + connectorConfiguration/configurationProperties + + rw-connectorConfiguration-partial + + + run + + + + connectorType + com.evolveum.polygon.connector.ldap.LdapConnector + + + available + true + + + + + + + + rw-connectorConfiguration-partial + + required + + + + + connectorConfiguration/configurationProperties/host + + + connectorConfiguration/configurationProperties/port + + + connectorConfiguration/configurationProperties/connectionSecurity + + + connectorConfiguration/configurationProperties/bindDn + visible + + + connectorConfiguration/configurationProperties/bindPassword + visible + + + + hidden + connectorConfiguration/configurationProperties + + rw-connectorConfiguration-partial + + + run + + + + connectorType + com.evolveum.polygon.connector.ldap.ad.AdLdapConnector + + + available + true + + + + + + + + admin-dashboard + + + + + + allRoles + true + allRoles + + + allOrgs + allOrgs + + + allServices + allServices + + + + + /self/profile + + View/edit your profile + + fa fa-user + + green + http://midpoint.evolveum.com/xml/ns/public/security/authorization-ui-3#selfProfile + http://midpoint.evolveum.com/xml/ns/public/security/authorization-ui-3#selfAll + + + /self/credentials + + View/edit your credentials + + fa fa-shield + + blue + http://midpoint.evolveum.com/xml/ns/public/security/authorization-ui-3#selfCredentials + http://midpoint.evolveum.com/xml/ns/public/security/authorization-ui-3#selfAll + + + /admin/users + + + fa fa-users + + red + http://midpoint.evolveum.com/xml/ns/public/security/authorization-ui-3#users + + + /admin/resources + + + fa fa-database + + purple + http://midpoint.evolveum.com/xml/ns/public/security/authorization-ui-3#resources + + never never @@ -717,50 +1656,51 @@ java.lang.Object - Basic Java operations. - deny - - equals - allow - - hashCode - allow - + Basic Java operations. + deny + + equals + allow + + + hashCode + allow + java.lang.String - String operations are generally safe. But Groovy is adding execute() method which is very dangerous. - allow - - execute - deny - + String operations are generally safe. But Groovy is adding execute() method which is very dangerous. + allow + + execute + deny + java.lang.CharSequence - allow + allow java.lang.Enum - allow + allow java.util.List - List operations are generally safe. But Groovy is adding execute() method which is very dangerous. - allow - - execute - deny - + List operations are generally safe. But Groovy is adding execute() method which is very dangerous. + allow + + execute + deny + java.util.ArrayList - List operations are generally safe. But Groovy is adding execute() method which is very dangerous. - allow - - execute - deny - + List operations are generally safe. But Groovy is adding execute() method which is very dangerous. + allow + + execute + deny + java.util.Map @@ -817,7 +1757,7 @@ allow - org.apache.commons.lang.StringUtils + org.apache.commons.lang3.StringUtils Apache Commons: Strings allow @@ -869,6 +1809,5 @@ --> - diff --git a/Workbench/webproxy/container_files/httpd/index.html b/Workbench/webproxy/container_files/httpd/index.html index ce9d316..74d1463 100644 --- a/Workbench/webproxy/container_files/httpd/index.html +++ b/Workbench/webproxy/container_files/httpd/index.html @@ -9,7 +9,7 @@

Welcome to the InCommon TAP Workbench!

The system contains the following TAP components (click the links to access each component in its own tab):