Skip to content

Commit

Permalink
add COmanage Match
Browse files Browse the repository at this point in the history
  • Loading branch information
pcaskey committed Dec 19, 2024
1 parent ff772be commit 1ea3abf
Show file tree
Hide file tree
Showing 19 changed files with 884 additions and 2 deletions.
40 changes: 40 additions & 0 deletions Workbench/comanage_match/Dockerfile
Original file line number Diff line number Diff line change
@@ -0,0 +1,40 @@
FROM comanageproject/comanage-match:1.2.0-shibboleth-sp-supervisor-6

ARG CSPHOSTNAME=localhost
ENV CSPHOSTNAME=$CSPHOSTNAME

# match settings (env vars from https://spaces.at.internet2.edu/display/COmanage/Configuring+Match+Container+Images)
ENV COMANAGE_MATCH_ADMIN_USERNAME=banderson@example.org
ENV COMANAGE_MATCH_SECURITY_SALT=kd67NSQ93VcXPioYT6083620jfutBHGKSNND23hvGG09m10S
ENV COMANAGE_MATCH_VIRTUAL_HOST_FQDN=$CSPHOSTNAME
ENV COMANAGE_MATCH_VIRTUAL_HOST_SCHEME=https
#from database.php
ENV COMANAGE_MATCH_DATABASE=match
ENV COMANAGE_MATCH_DATABASE_HOST=comanage-match-data
ENV COMANAGE_MATCH_DATABASE_USER=match_user
ENV COMANAGE_MATCH_DATABASE_USER_PASSWORD=Password1
#from email.php
ENV COMANAGE_MATCH_EMAIL_FROM_EMAIL=noreply@workbench.incommon.org
ENV COMANAGE_MATCH_EMAIL_FROM_NAME="Do Not Reply"
ENV COMANAGE_MATCH_EMAIL_TRANSPORT=Smtp
ENV COMANAGE_MATCH_EMAIL_HOST=tls://email-smtp.us-west-2.amazonaws.com
ENV COMANAGE_MATCH_EMAIL_ACCOUNT=AKIAZDWJANQRZKPFVK6J
ENV COMANAGE_MATCH_EMAIL_ACCOUNT_PASSWORD=BNAp6WlvsI4iXK3ush8pwPD2QKHDYQ09ti+Z3r/mb2Nx
ENV COMANAGE_MATCH_EMAIL_PORT=465
# for httpd
ENV COMANAGE_MATCH_HTTP_NO=true
ENV COMANAGE_MATCH_HTTPS_LISTEN_PORT=443
ENV HTTPS_CERT_FILE=/etc/pki/tls/certs/match-ssl.crt
ENV HTTPS_PRIVKEY_FILE=/etc/pki/tls/private/match-ssl.key

COPY container_files/httpd/match-ssl.crt /etc/pki/tls/certs/
COPY container_files/httpd/match-ssl.key /etc/pki/tls/private/
RUN chmod 600 /etc/pki/tls/certs/match-ssl.crt && chmod 600 /etc/pki/tls/private/match-ssl.key

COPY container_files/shibboleth/ /etc/shibboleth/

#dynamically set hostname
COPY container_files/system/setservername.sh /usr/local/bin/
RUN chmod 755 /usr/local/bin/setservername.sh && /usr/local/bin/setservername.sh


22 changes: 22 additions & 0 deletions Workbench/comanage_match/container_files/httpd/match-ssl.crt
Original file line number Diff line number Diff line change
@@ -0,0 +1,22 @@
-----BEGIN CERTIFICATE-----
MIIDqTCCApGgAwIBAgIJALFLXI21jEHrMA0GCSqGSIb3DQEBCwUAMGsxCzAJBgNV
BAYTAlVTMREwDwYDVQQIDAhNaWNoaWdhbjESMBAGA1UEBwwJQW5uIEFyYm9yMRIw
EAYDVQQKDAlJbnRlcm5ldDIxITAfBgNVBAMMGGNvbWFuYWdlLW1hdGNoLndvcmti
ZW5jaDAeFw0yNDEyMTkxNDI3NDhaFw0zNDEyMTcxNDI3NDhaMGsxCzAJBgNVBAYT
AlVTMREwDwYDVQQIDAhNaWNoaWdhbjESMBAGA1UEBwwJQW5uIEFyYm9yMRIwEAYD
VQQKDAlJbnRlcm5ldDIxITAfBgNVBAMMGGNvbWFuYWdlLW1hdGNoLndvcmtiZW5j
aDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALKgirFsUBMGr8+H5QtY
e/w8HB5spFUJUX7+Ako1v9yY95WYolbs5s8/TO8iVdRw38yn7mVOavPpquhEfuBg
oUI4iGftowEv+cT7C1ALZHfHr7cpYGOYS0sHOXWVaUx6ggPR57Vs+gb/3sLA9AUR
F+AUG+Fkd49yWF+MwnV8ieA88qdx828RdfmWqeO3VAjNXxsWN7/hX9RKBmBSS0n0
6xaSIqA/5vTD+8kA+D0Rvvv2xBmpBJo+FbLhA9qz2NJM7iVy7xxC/HQojBrXt7qd
63EkPv7H6o6sBzZQ4oxyT3on8E6tUPfa/jrRhHuJt9JmDVEZyvhOkidDyvZef+Qr
bckCAwEAAaNQME4wHQYDVR0OBBYEFPXB9x9X7k3gk3Jwm1BS4/HFldPVMB8GA1Ud
IwQYMBaAFPXB9x9X7k3gk3Jwm1BS4/HFldPVMAwGA1UdEwQFMAMBAf8wDQYJKoZI
hvcNAQELBQADggEBACXerk/2Q4+Hw6laPj/IkreUgrHe9oCt3EjbMSTjUERp6j/c
Trmy/QefGVICpGPnBNV5XcDmPMoAG5UJ5wxG3lXu2VFuf1qhs4yuTzYuskZGijEv
xGIxhMuhPuRZrccfrqMXMGS0HV0kPKVJcTD21wzoJNzvBxZG1YGshehBUComsjFt
YHaqHD4tgMCA+TElILi9GJk9hiqc4+X6V/XXPDitXXx+eKC4fNrXfdJ+tb5eE/A7
a6204TeVdOX+iChjJOOcSJY3uLto/Ez0dVxrMIEbppZWMlrl7tlJVS9Y4lKkw3FC
XDWW3UplClTk3tCtfhfF1zLm2gk40ep38o8O8NY=
-----END CERTIFICATE-----
27 changes: 27 additions & 0 deletions Workbench/comanage_match/container_files/httpd/match-ssl.key
Original file line number Diff line number Diff line change
@@ -0,0 +1,27 @@
-----BEGIN RSA PRIVATE KEY-----
MIIEowIBAAKCAQEAsqCKsWxQEwavz4flC1h7/DwcHmykVQlRfv4CSjW/3Jj3lZii
Vuzmzz9M7yJV1HDfzKfuZU5q8+mq6ER+4GChQjiIZ+2jAS/5xPsLUAtkd8evtylg
Y5hLSwc5dZVpTHqCA9HntWz6Bv/ewsD0BREX4BQb4WR3j3JYX4zCdXyJ4Dzyp3Hz
bxF1+Zap47dUCM1fGxY3v+Ff1EoGYFJLSfTrFpIioD/m9MP7yQD4PRG++/bEGakE
mj4VsuED2rPY0kzuJXLvHEL8dCiMGte3up3rcSQ+/sfqjqwHNlDijHJPeifwTq1Q
99r+OtGEe4m30mYNURnK+E6SJ0PK9l5/5CttyQIDAQABAoIBAFZBC3fNE4V8bxzJ
RCKMYaJU7EcMsvWVAFNQGI75EWJWQwdroshSsMlWibHXZJamwoqydH1atm59YNez
a4ixYGz3m3aD23hRUEx75OSL+8GTHRhW1IKDIahjHq3WrfgOGAX8L+T9cGY827Yz
MiHYNS0wyJ23w7vyvRW2hJfywSkTtW1l2yXHrU8/AYcq0in07GPeIdSnmrRuov+b
kPAkiLkJBXrMmPkKX0qQ9jCU2hdZVHtlaoMSr2/6klNn2ynNLST08W9Hd5qQTbpw
eDmKQZYUH2W/dEnmii4MzA9FiW0s6sPV5NSMQAZoWpSk2bt1rAFZp5UjWGuXX5gz
xGRahFkCgYEA7fNDS/+O/lPTjaAdoZ9triYrKHdRTlNwfenkinghMj/yKLFmCu6/
C+6sGvJELJaJqQc1rYSwNhd3VeI+lpqqTmPrtid16ZD9InQbA2Zywa5XI1okCWtH
TQccSRE9B4Ow4NUfjIyFeI6u1xq3P+2sM5EXWMLl7g2nMKKCejoFQC8CgYEAwC1J
pwBvLFfTUMNxoILpXx31xcrKvRCfGWRWB8hyj2x14/7qhpGueUkjqHSRl0fW6urk
zdmiPRmb2R68bOZ2alkbvgrxWyicSoRWyaLsipbk0H4o3tBOxZHTGqdY/6czlBJX
vYHc1qi3+Ak/+xYXxh3d13uNpVq72d2pNx9we4cCgYEAlGAWXLN01P4scqmfEIM7
f1ZpnwgX+QFqqflI+1dBS/Y36EwGV1bcZnJje0IKZMtR98Z5IEQXJQOo9DLp2DuF
avA/sQwWKJiyX+OKXKprcH5n87Fnuz/b7Bo89wr6xU7G4svCqn+NUsmWGKeeEQ0B
Tf5xUnXlrnVxBZCwT8sSLx0CgYBxcYp74f6+n22nzGfkB8N5mbb+tpJtf0Vb+OXs
HEC8N5t0JoQNQixLfohlJcLYGdldvaGpfqKODPL5/XHfm0Al0UpWKiGF3Xg9aNfO
mbWmriKOjRrVRQRrDoUew9D+wZXp/9X5kZJqyRgofFVfhBAurGzLiiz4gpJHrtj4
KD//OwKBgAkrQfT4pvsiUi+c8oCEiHd/rR3e+Q3mhJrx3/lRWff7X7lb90JeVa9y
xwfe9V/mWhihXCVPJMyyMKrfonDBlsXW7EiruJxIOa11hNXD07UsOYwKk0WAhmXU
iv7FsRK9JStKTKw/sI9P8H+Xfi/2zyc+8vJJprXdZtJBnTM4/fEr
-----END RSA PRIVATE KEY-----
169 changes: 169 additions & 0 deletions Workbench/comanage_match/container_files/shibboleth/attribute-map.xml
Original file line number Diff line number Diff line change
@@ -0,0 +1,169 @@
<Attributes xmlns="urn:mace:shibboleth:2.0:attribute-map" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">

<!--
The mappings are a mix of SAML 1.1 and SAML 2.0 attribute names agreed to within the Shibboleth
community. The non-OID URNs are SAML 1.1 names and most of the OIDs are SAML 2.0 names, with a
few exceptions for newer attributes where the name is the same for both versions. You will
usually want to uncomment or map the names for both SAML versions as a unit.
-->

<!-- New standard identifier attributes for SAML. -->

<Attribute name="urn:oasis:names:tc:SAML:attribute:subject-id" id="subject-id">
<AttributeDecoder xsi:type="ScopedAttributeDecoder" caseSensitive="false"/>
</Attribute>

<Attribute name="urn:oasis:names:tc:SAML:attribute:pairwise-id" id="pairwise-id">
<AttributeDecoder xsi:type="ScopedAttributeDecoder" caseSensitive="false"/>
</Attribute>

<!-- The most typical eduPerson attributes. -->

<Attribute name="urn:oid:1.3.6.1.4.1.5923.1.1.1.6" id="eppn">
<AttributeDecoder xsi:type="ScopedAttributeDecoder" caseSensitive="false"/>
</Attribute>
<Attribute name="urn:mace:dir:attribute-def:eduPersonPrincipalName" id="eppn">
<AttributeDecoder xsi:type="ScopedAttributeDecoder" caseSensitive="false"/>
</Attribute>

<Attribute name="urn:oid:1.3.6.1.4.1.5923.1.1.1.9" id="affiliation">
<AttributeDecoder xsi:type="ScopedAttributeDecoder" caseSensitive="false"/>
</Attribute>
<Attribute name="urn:mace:dir:attribute-def:eduPersonScopedAffiliation" id="affiliation">
<AttributeDecoder xsi:type="ScopedAttributeDecoder" caseSensitive="false"/>
</Attribute>

<Attribute name="urn:oid:1.3.6.1.4.1.5923.1.1.1.7" id="entitlement"/>
<Attribute name="urn:mace:dir:attribute-def:eduPersonEntitlement" id="entitlement"/>

<!--
Legacy pairwise identifier attribute / NameID format, intended to be replaced by the
simpler pairwise-id attribute (see top of file).
-->

<!-- The eduPerson attribute version (note the OID-style name): -->
<Attribute name="urn:oid:1.3.6.1.4.1.5923.1.1.1.10" id="persistent-id">
<AttributeDecoder xsi:type="NameIDAttributeDecoder" formatter="$NameQualifier!$SPNameQualifier!$Name" defaultQualifiers="true"/>
</Attribute>

<!-- The SAML 2.0 NameID Format: -->
<Attribute name="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent" id="persistent-id">
<AttributeDecoder xsi:type="NameIDAttributeDecoder" formatter="$NameQualifier!$SPNameQualifier!$Name" defaultQualifiers="true"/>
</Attribute>

<!-- Other eduPerson attributes (SAML 2 names followed by SAML 1 names)... -->
<!--
<Attribute name="urn:oid:1.3.6.1.4.1.5923.1.1.1.11" id="assurance"/>
<Attribute name="urn:oid:1.3.6.1.4.1.5923.1.5.1.1" id="member"/>
<Attribute name="urn:oid:1.3.6.1.4.1.5923.1.6.1.1" id="eduCourseOffering"/>
<Attribute name="urn:oid:1.3.6.1.4.1.5923.1.6.1.2" id="eduCourseMember"/>
<Attribute name="urn:oid:1.3.6.1.4.1.5923.1.1.1.1" id="unscoped-affiliation">
<AttributeDecoder xsi:type="StringAttributeDecoder" caseSensitive="false"/>
</Attribute>
<Attribute name="urn:oid:1.3.6.1.4.1.5923.1.1.1.5" id="primary-affiliation">
<AttributeDecoder xsi:type="StringAttributeDecoder" caseSensitive="false"/>
</Attribute>
<Attribute name="urn:oid:1.3.6.1.4.1.5923.1.1.1.2" id="nickname"/>
<Attribute name="urn:oid:1.3.6.1.4.1.5923.1.1.1.8" id="primary-orgunit-dn"/>
<Attribute name="urn:oid:1.3.6.1.4.1.5923.1.1.1.4" id="orgunit-dn"/>
<Attribute name="urn:oid:1.3.6.1.4.1.5923.1.1.1.3" id="org-dn"/>
<Attribute name="urn:mace:dir:attribute-def:eduPersonAffiliation" id="unscoped-affiliation">
<AttributeDecoder xsi:type="StringAttributeDecoder" caseSensitive="false"/>
</Attribute>
<Attribute name="urn:mace:dir:attribute-def:eduPersonPrimaryAffiliation" id="primary-affiliation">
<AttributeDecoder xsi:type="StringAttributeDecoder" caseSensitive="false"/>
</Attribute>
<Attribute name="urn:mace:dir:attribute-def:eduPersonNickname" id="nickname"/>
<Attribute name="urn:mace:dir:attribute-def:eduPersonPrimaryOrgUnitDN" id="primary-orgunit-dn"/>
<Attribute name="urn:mace:dir:attribute-def:eduPersonOrgUnitDN" id="orgunit-dn"/>
<Attribute name="urn:mace:dir:attribute-def:eduPersonOrgDN" id="org-dn"/>
-->

<!-- Older LDAP-defined attributes (SAML 2.0 names followed by SAML 1 names)... -->
<!--
<Attribute name="urn:oid:2.5.4.3" id="cn"/>
<Attribute name="urn:oid:2.5.4.4" id="sn"/>
<Attribute name="urn:oid:2.5.4.42" id="givenName"/>
<Attribute name="urn:oid:2.16.840.1.113730.3.1.241" id="displayName"/>
-->
<Attribute name="urn:oid:0.9.2342.19200300.100.1.1" id="uid"/>
<!--
<Attribute name="urn:oid:0.9.2342.19200300.100.1.3" id="mail"/>
<Attribute name="urn:oid:2.5.4.20" id="telephoneNumber"/>
<Attribute name="urn:oid:2.5.4.12" id="title"/>
<Attribute name="urn:oid:2.5.4.43" id="initials"/>
<Attribute name="urn:oid:2.5.4.13" id="description"/>
<Attribute name="urn:oid:2.16.840.1.113730.3.1.1" id="carLicense"/>
<Attribute name="urn:oid:2.16.840.1.113730.3.1.2" id="departmentNumber"/>
<Attribute name="urn:oid:2.16.840.1.113730.3.1.3" id="employeeNumber"/>
<Attribute name="urn:oid:2.16.840.1.113730.3.1.4" id="employeeType"/>
<Attribute name="urn:oid:2.16.840.1.113730.3.1.39" id="preferredLanguage"/>
<Attribute name="urn:oid:0.9.2342.19200300.100.1.10" id="manager"/>
<Attribute name="urn:oid:2.5.4.34" id="seeAlso"/>
<Attribute name="urn:oid:2.5.4.23" id="facsimileTelephoneNumber"/>
<Attribute name="urn:oid:2.5.4.9" id="street"/>
<Attribute name="urn:oid:2.5.4.18" id="postOfficeBox"/>
<Attribute name="urn:oid:2.5.4.17" id="postalCode"/>
<Attribute name="urn:oid:2.5.4.8" id="st"/>
<Attribute name="urn:oid:2.5.4.7" id="l"/>
<Attribute name="urn:oid:2.5.4.10" id="o"/>
<Attribute name="urn:oid:2.5.4.11" id="ou"/>
<Attribute name="urn:oid:2.5.4.15" id="businessCategory"/>
<Attribute name="urn:oid:2.5.4.19" id="physicalDeliveryOfficeName"/>
<Attribute name="urn:mace:dir:attribute-def:cn" id="cn"/>
<Attribute name="urn:mace:dir:attribute-def:sn" id="sn"/>
<Attribute name="urn:mace:dir:attribute-def:givenName" id="givenName"/>
<Attribute name="urn:mace:dir:attribute-def:displayName" id="displayName"/>
<Attribute name="urn:mace:dir:attribute-def:uid" id="uid"/>
<Attribute name="urn:mace:dir:attribute-def:mail" id="mail"/>
<Attribute name="urn:mace:dir:attribute-def:telephoneNumber" id="telephoneNumber"/>
<Attribute name="urn:mace:dir:attribute-def:title" id="title"/>
<Attribute name="urn:mace:dir:attribute-def:initials" id="initials"/>
<Attribute name="urn:mace:dir:attribute-def:description" id="description"/>
<Attribute name="urn:mace:dir:attribute-def:carLicense" id="carLicense"/>
<Attribute name="urn:mace:dir:attribute-def:departmentNumber" id="departmentNumber"/>
<Attribute name="urn:mace:dir:attribute-def:employeeNumber" id="employeeNumber"/>
<Attribute name="urn:mace:dir:attribute-def:employeeType" id="employeeType"/>
<Attribute name="urn:mace:dir:attribute-def:preferredLanguage" id="preferredLanguage"/>
<Attribute name="urn:mace:dir:attribute-def:manager" id="manager"/>
<Attribute name="urn:mace:dir:attribute-def:seeAlso" id="seeAlso"/>
<Attribute name="urn:mace:dir:attribute-def:facsimileTelephoneNumber" id="facsimileTelephoneNumber"/>
<Attribute name="urn:mace:dir:attribute-def:street" id="street"/>
<Attribute name="urn:mace:dir:attribute-def:postOfficeBox" id="postOfficeBox"/>
<Attribute name="urn:mace:dir:attribute-def:postalCode" id="postalCode"/>
<Attribute name="urn:mace:dir:attribute-def:st" id="st"/>
<Attribute name="urn:mace:dir:attribute-def:l" id="l"/>
<Attribute name="urn:mace:dir:attribute-def:o" id="o"/>
<Attribute name="urn:mace:dir:attribute-def:ou" id="ou"/>
<Attribute name="urn:mace:dir:attribute-def:businessCategory" id="businessCategory"/>
<Attribute name="urn:mace:dir:attribute-def:physicalDeliveryOfficeName" id="physicalDeliveryOfficeName"/>
-->

<!-- SCHAC attributes... -->
<!--
<Attribute name="urn:oid:1.3.6.1.4.1.25178.1.2.9" id="schacHomeOrganization">
<AttributeDecoder xsi:type="StringAttributeDecoder" caseSensitive="false"/>
</Attribute>
<Attribute name="urn:oid:1.3.6.1.4.1.25178.1.2.10" id="schacHomeOrganizationType">
<AttributeDecoder xsi:type="StringAttributeDecoder" caseSensitive="false"/>
</Attribute>
<Attribute name="urn:oid:1.3.6.1.4.1.25178.1.2.14" id="schacPersonalUniqueCode">
<AttributeDecoder xsi:type="StringAttributeDecoder" caseSensitive="false"/>
</Attribute>
<Attribute name="urn:oid:1.3.6.1.4.1.25178.1.2.15" id="schacPersonalUniqueID"/>
<Attribute name="urn:oid:1.3.6.1.4.1.25178.1.2.19" id="schacUserStatus">
<AttributeDecoder xsi:type="StringAttributeDecoder" caseSensitive="false"/>
</Attribute>
<Attribute name="urn:oid:1.3.6.1.4.1.25178.1.2.20" id="schacProjectMembership">
<AttributeDecoder xsi:type="StringAttributeDecoder" caseSensitive="false"/>
</Attribute>
<Attribute name="urn:oid:1.3.6.1.4.1.25178.1.2.21" id="schacProjectSpecificRole">
<AttributeDecoder xsi:type="StringAttributeDecoder" caseSensitive="false"/>
</Attribute>
-->

</Attributes>

Loading

0 comments on commit 1ea3abf

Please sign in to comment.