forked from docker/grouper
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Browse files
Browse the repository at this point in the history
Merge pull request docker#57 from docker/2.4.0-a31-u14-w3-p3-20190304
2.4.0 a31 u14 w3 p3 20190304
Showing
13 changed files
with
325 additions
and
187 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,203 +1,89 @@ | ||
<?xml version="1.0" encoding="UTF-8"?> | ||
<web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:j2ee="http://java.sun.com/xml/ns/j2ee" version="2.4" xsi:schemaLocation="http://java.sun.com/xml/ns/j2ee http://java.s | ||
un.com/xml/ns/j2ee/web-app_2_4.xsd"> | ||
<!--DO NOT EDIT THIS FILE. IT WILL BE OVERWRITTEN. CHANGE YOUR FILE specified by the build.properties value [additional.web.xml]. The contents of that file are merged into ${grouper-ui}/w | ||
ebapp/WEB-INF/web.core.xml--> | ||
<!--In webapp--> | ||
<!--Processing context-param--> | ||
<!--Processing filter--> | ||
<!--Inserting tag from merge file--> | ||
<filter> | ||
<web-app xmlns:j2ee="http://java.sun.com/xml/ns/j2ee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" | ||
xsi:schemaLocation="http://java.sun.com/xml/ns/j2ee http://java.sun.com/xml/ns/j2ee/web-app_2_4.xsd" | ||
version="2.4"> | ||
<filter> | ||
<filter-name>GrouperUi</filter-name> | ||
<filter-class>edu.internet2.middleware.grouper.ui.GrouperUiFilter</filter-class> | ||
</filter> | ||
<!--Inserting tag from merge file--> | ||
<filter> | ||
<filter-name>Error Catcher</filter-name> | ||
<filter-class>edu.internet2.middleware.grouper.ui.ErrorFilter</filter-class> | ||
</filter> | ||
<!--Inserting tag from base file. Merge file was file:/opt/grouper.ui-2.3.0/temp/99.web.core-filters.xml--> | ||
<filter> | ||
<filter-name>Login check</filter-name> | ||
<filter-class>edu.internet2.middleware.grouper.ui.LoginCheckFilter</filter-class> | ||
<init-param> | ||
<param-name>failureUrl</param-name> | ||
<param-value>/index.jsp</param-value> | ||
</init-param> | ||
<init-param> | ||
<param-name>ignore</param-name> | ||
<param-value>:/populateIndex.do:/callLogin.do:/error.do:/logout.do:/status:</param-value> | ||
</init-param> | ||
<init-param> | ||
<param-name>grouperRole</param-name> | ||
<param-value>*</param-value> | ||
</init-param> | ||
</filter> | ||
<!--Inserting tag from base file. Merge file was file:/opt/grouper.ui-2.3.0/temp/99.web.core-filters.xml--> | ||
<filter> | ||
<filter-name>Caller page</filter-name> | ||
<filter-class>edu.internet2.middleware.grouper.ui.CallerPageFilter</filter-class> | ||
</filter> | ||
<!--Inserting tag from base file. Merge file was file:/opt/grouper.ui-2.3.0/temp/99.web.core-filters.xml--> | ||
<filter> | ||
<filter> | ||
<filter-name>CSRFGuard</filter-name> | ||
<filter-class>org.owasp.csrfguard.CsrfGuardFilter</filter-class> | ||
</filter> | ||
<!--Processing filter-mapping--> | ||
<!--Inserting tag from merge file--> | ||
<filter-mapping> | ||
<filter-name>GrouperUi</filter-name> | ||
<url-pattern>*.do</url-pattern> | ||
</filter-mapping> | ||
<!--Inserting tag from merge file--> | ||
<filter-mapping> | ||
<filter-mapping> | ||
<filter-name>GrouperUi</filter-name> | ||
<url-pattern>*.jsp</url-pattern> | ||
</filter-mapping> | ||
<!--Inserting tag from merge file--> | ||
<filter-mapping> | ||
<filter-name>Error Catcher</filter-name> | ||
<url-pattern>*.do</url-pattern> | ||
</filter-mapping> | ||
<!--Inserting tag from merge file--> | ||
<filter-mapping> | ||
<filter-name>Error Catcher</filter-name> | ||
<url-pattern>/gotoCallerPage</url-pattern> | ||
</filter-mapping> | ||
<!--Inserting tag from base file. Merge file was file:/opt/grouper.ui-2.3.0/temp/99.web.core-filters.xml--> | ||
<filter-mapping> | ||
<filter-mapping> | ||
<filter-name>GrouperUi</filter-name> | ||
<url-pattern>/grouperUi/app/*</url-pattern> | ||
</filter-mapping> | ||
<!--Inserting tag from base file. Merge file was file:/opt/grouper.ui-2.3.0/temp/99.web.core-filters.xml--> | ||
<filter-mapping> | ||
<filter-mapping> | ||
<filter-name>GrouperUi</filter-name> | ||
<url-pattern>/grouperUi/appHtml/*</url-pattern> | ||
</filter-mapping> | ||
<!--Inserting tag from base file. Merge file was file:/opt/grouper.ui-2.3.0/temp/99.web.core-filters.xml--> | ||
<filter-mapping> | ||
<filter-mapping> | ||
<filter-name>GrouperUi</filter-name> | ||
<url-pattern>/grouperExternal/app/*</url-pattern> | ||
</filter-mapping> | ||
<!--Inserting tag from base file. Merge file was file:/opt/grouper.ui-2.3.0/temp/99.web.core-filters.xml--> | ||
<filter-mapping> | ||
<filter-name>GrouperUi</filter-name> | ||
<url-pattern>/grouperExternal/appHtml/*</url-pattern> | ||
</filter-mapping> | ||
<!--Inserting tag from base file. Merge file was file:/opt/grouper.ui-2.3.0/temp/99.web.core-filters.xml--> | ||
<filter-mapping> | ||
<filter-mapping> | ||
<filter-name>GrouperUi</filter-name> | ||
<url-pattern>/grouperExternal/public/UiV2Public.index</url-pattern> | ||
</filter-mapping> | ||
<!--Inserting tag from base file. Merge file was file:/opt/grouper.ui-2.3.0/temp/99.web.core-filters.xml--> | ||
<filter-mapping> | ||
<filter-mapping> | ||
<filter-name>GrouperUi</filter-name> | ||
<url-pattern>/grouperExternal/public/UiV2Public.postIndex</url-pattern> | ||
</filter-mapping> | ||
<!--Inserting tag from base file. Merge file was file:/opt/grouper.ui-2.3.0/temp/99.web.core-filters.xml--> | ||
<filter-mapping> | ||
<filter-name>Caller page</filter-name> | ||
<url-pattern>/gotoCallerPage</url-pattern> | ||
</filter-mapping> | ||
<!--Inserting tag from base file. Merge file was file:/opt/grouper.ui-2.3.0/temp/99.web.core-filters.xml--> | ||
<filter-mapping> | ||
<filter-name>Login check</filter-name> | ||
<url-pattern>*.do</url-pattern> | ||
</filter-mapping> | ||
<!--Inserting tag from base file. Merge file was file:/opt/grouper.ui-2.3.0/temp/99.web.core-filters.xml--> | ||
<filter-mapping> | ||
<filter-mapping> | ||
<filter-name>CSRFGuard</filter-name> | ||
<url-pattern>/*</url-pattern> | ||
</filter-mapping> | ||
<!--Processing listener--> | ||
<!--Inserting tag from base file. Merge file was file:/opt/grouper.ui-2.3.0/temp/99.web.core-filters.xml--> | ||
<listener> | ||
<listener-class>edu.internet2.middleware.grouper.ui.GrouperSessionAttributeListener</listener-class> | ||
</listener> | ||
<!--Inserting tag from base file. Merge file was file:/opt/grouper.ui-2.3.0/temp/99.web.core-filters.xml--> | ||
<listener> | ||
<listener> | ||
<listener-class>edu.internet2.middleware.grouper.ui.GrouperSessionAttributeListener</listener-class> | ||
</listener> | ||
<listener> | ||
<listener-class>org.owasp.csrfguard.CsrfGuardServletContextListener</listener-class> | ||
</listener> | ||
<!--Inserting tag from base file. Merge file was file:/opt/grouper.ui-2.3.0/temp/99.web.core-filters.xml--> | ||
<listener> | ||
<listener> | ||
<listener-class>org.owasp.csrfguard.CsrfGuardHttpSessionListener</listener-class> | ||
</listener> | ||
<!--Processing servlet--> | ||
<!--Inserting tag from base file. Merge file was file:/opt/grouper.ui-2.3.0/temp/99.web.core-filters.xml--> | ||
<servlet> | ||
<servlet> | ||
<servlet-name>StatusServlet</servlet-name> | ||
<display-name>Status Servlet</display-name> | ||
<servlet-class>edu.internet2.middleware.grouper.j2ee.status.GrouperStatusServlet</servlet-class> | ||
<load-on-startup>1</load-on-startup> | ||
</servlet> | ||
<!--Inserting tag from base file. Merge file was file:/opt/grouper.ui-2.3.0/temp/99.web.core-filters.xml--> | ||
<servlet> | ||
<!-- Map the filter to a Servlet or URL --> | ||
|
||
<servlet> | ||
<servlet-name>UiServlet</servlet-name> | ||
<servlet-class>edu.internet2.middleware.grouper.j2ee.GrouperUiRestServlet</servlet-class> | ||
<load-on-startup>1</load-on-startup> | ||
</servlet> | ||
<!--Inserting tag from base file. Merge file was file:/opt/grouper.ui-2.3.0/temp/99.web.core-filters.xml--> | ||
<servlet> | ||
<servlet-name>OwaspJavaScriptServlet</servlet-name> | ||
<servlet-class>org.owasp.csrfguard.servlet.JavaScriptServlet</servlet-class> | ||
</servlet> | ||
<!--Inserting tag from base file. Merge file was file:/opt/grouper.ui-2.3.0/temp/99.web.core-filters.xml--> | ||
<servlet> | ||
<servlet-name>action</servlet-name> | ||
<servlet-class>org.apache.struts.action.ActionServlet</servlet-class> | ||
<init-param> | ||
<param-name>config</param-name> | ||
<param-value>/WEB-INF/struts-config.xml</param-value> | ||
</init-param> | ||
<load-on-startup>2</load-on-startup> | ||
<servlet> | ||
<servlet-name>OwaspJavaScriptServlet</servlet-name> | ||
<servlet-class>org.owasp.csrfguard.servlet.JavaScriptServlet</servlet-class> | ||
</servlet> | ||
<!--Processing servlet-mapping--> | ||
<!--Inserting tag from base file. Merge file was file:/opt/grouper.ui-2.3.0/temp/99.web.core-filters.xml--> | ||
<servlet-mapping> | ||
<servlet-mapping> | ||
<servlet-name>StatusServlet</servlet-name> | ||
<url-pattern>/status</url-pattern> | ||
</servlet-mapping> | ||
<!--Inserting tag from base file. Merge file was file:/opt/grouper.ui-2.3.0/temp/99.web.core-filters.xml--> | ||
<servlet-mapping> | ||
<servlet-mapping> | ||
<servlet-name>UiServlet</servlet-name> | ||
<url-pattern>/grouperUi/app/*</url-pattern> | ||
</servlet-mapping> | ||
<!--Inserting tag from base file. Merge file was file:/opt/grouper.ui-2.3.0/temp/99.web.core-filters.xml--> | ||
<servlet-mapping> | ||
<servlet-mapping> | ||
<servlet-name>UiServlet</servlet-name> | ||
<url-pattern>/grouperExternal/app/*</url-pattern> | ||
</servlet-mapping> | ||
<!--Inserting tag from base file. Merge file was file:/opt/grouper.ui-2.3.0/temp/99.web.core-filters.xml--> | ||
<servlet-mapping> | ||
<servlet-mapping> | ||
<servlet-name>UiServlet</servlet-name> | ||
<url-pattern>/grouperExternal/public/UiV2Public.index</url-pattern> | ||
</servlet-mapping> | ||
<!--Inserting tag from base file. Merge file was file:/opt/grouper.ui-2.3.0/temp/99.web.core-filters.xml--> | ||
<servlet-mapping> | ||
<servlet-mapping> | ||
<servlet-name>UiServlet</servlet-name> | ||
<url-pattern>/grouperExternal/public/UiV2Public.postIndex</url-pattern> | ||
</servlet-mapping> | ||
<!--Inserting tag from base file. Merge file was file:/opt/grouper.ui-2.3.0/temp/99.web.core-filters.xml--> | ||
<servlet-mapping> | ||
<servlet-name>OwaspJavaScriptServlet</servlet-name> | ||
<url-pattern>/grouperExternal/public/OwaspJavaScriptServlet</url-pattern> | ||
</servlet-mapping> | ||
<!--Inserting tag from base file. Merge file was file:/opt/grouper.ui-2.3.0/temp/99.web.core-filters.xml--> | ||
<servlet-mapping> | ||
<servlet-name>action</servlet-name> | ||
<url-pattern>*.do</url-pattern> | ||
<servlet-mapping> | ||
<servlet-name>OwaspJavaScriptServlet</servlet-name> | ||
<url-pattern>/grouperExternal/public/OwaspJavaScriptServlet</url-pattern> | ||
</servlet-mapping> | ||
<!--Processing mime-mapping--> | ||
<!--Processing error-page--> | ||
<!--Processing error-page--> | ||
<!--Processing taglib--> | ||
<!--Processing resource-env-ref--> | ||
<!--Processing resource-ref--> | ||
<!--Processing security-constraint--> | ||
<!--Inserting tag from base file. Merge file was file:/opt/grouper.ui-2.3.0/temp/99.web.core-filters.xml--> | ||
<!--Processing env-entry--> | ||
<!--Processing ejb-ref--> | ||
<!--Processing ejb-local-ref--> | ||
</web-app> |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
64 changes: 64 additions & 0 deletions
64
test-compose/data/container_files/conf/grouper-loader.properties
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,64 @@ | ||
################################# | ||
## LDAP connections | ||
################################# | ||
# specify the ldap connection with user, pass, url | ||
# the string after "ldap." is the ID of the connection, and it should not have | ||
# spaces or other special chars in it. In this case is it "personLdap" | ||
|
||
#note the URL should start with ldap: or ldaps: if it is SSL. | ||
#It should contain the server and port (optional if not default), and baseDn, | ||
#e.g. ldaps://ldapserver.school.edu:636/dc=school,dc=edu | ||
ldap.demo.url = ldap://localhost:389/dc=internet2,dc=edu | ||
|
||
#optional, if authenticated | ||
ldap.demo.user = cn=admin,dc=internet2,dc=edu | ||
#ldap.demo.user = cn=admin | ||
|
||
#optional, if authenticated note the password can be stored encrypted in an external file | ||
#ldap.demo.pass = ${java.lang.System.getenv().get('SUBJECT_SOURCE_LDAP_PASSWORD_FILE') != null ? org.apache.commons.io.FileUtils.readFileToString(java.lang.System.getenv().get('SUBJECT_SOURCE_LDAP_PASSWORD_FILE'), "utf-8") : java.lang.System.getenv().get('SUBJECT_SOURCE_LDAP_PASSWORD')} | ||
ldap.demo.pass = password | ||
|
||
#optional, if you are using tls, set this to true. Generally you will not be using an SSL URL to use TLS... | ||
ldap.demo.tls = false | ||
|
||
#optional, if using sasl | ||
#ldap.personLdap.saslAuthorizationId = | ||
#ldap.personLdap.saslRealm = | ||
|
||
#optional (note, time limit is for search operations, timeout is for connection timeouts), | ||
#most of these default to vt-ldap defaults. times are in millis | ||
#validateOnCheckout defaults to true if all other validate methods are false | ||
#ldap.personLdap.batchSize = | ||
#ldap.personLdap.countLimit = | ||
#ldap.personLdap.timeLimit = | ||
#ldap.personLdap.timeout = | ||
#ldap.personLdap.minPoolSize = | ||
#ldap.personLdap.maxPoolSize = | ||
#ldap.personLdap.validateOnCheckIn = | ||
#ldap.personLdap.validateOnCheckOut = | ||
#ldap.personLdap.validatePeriodically = | ||
#ldap.personLdap.validateTimerPeriod = | ||
#ldap.personLdap.pruneTimerPeriod = | ||
#if connections expire after a certain amount of time, this is it, in millis, defaults to 300000 (5 minutes) | ||
#ldap.personLdap.expirationTime = | ||
|
||
#make the paths fully qualified and not relative to the loader group. | ||
loader.ldap.requireTopStemAsStemFromConfigGroup=false | ||
|
||
##################################### | ||
## Messaging integration with change log | ||
##################################### | ||
changeLog.consumer.rabbitMqMessagingSample.quartzCron = 0 * * * * ? | ||
|
||
# note, change "messagingSample" in key to be the name of the consumer. e.g. changeLog.consumer.someNameAnyName.class | ||
changeLog.consumer.rabbitMqMessagingSample.class = edu.internet2.middleware.grouper.changeLog.esb.consumer.EsbConsumer | ||
|
||
changeLog.consumer.rabbitMqMessagingSample.publisher.class = edu.internet2.middleware.grouper.changeLog.esb.consumer.EsbMessagingPublisher | ||
changeLog.consumer.rabbitMqMessagingSample.publisher.messagingSystemName = rabbitmq | ||
# note, routingKey property is valid only for rabbitmq. For other messaging systems, it is ignored. | ||
changeLog.consumer.rabbitMqMessagingSample.publisher.routingKey = | ||
## queue or topic | ||
changeLog.consumer.rabbitMqMessagingSample.publisher.messageQueueType = queue | ||
changeLog.consumer.rabbitMqMessagingSample.publisher.queueOrTopicName = sampleQueue | ||
## this is optional if not using "id" for subjectId, need to be a subject attribute in the sources.xml | ||
#changeLog.consumer.rabbitMqMessagingSample.publisher.addSubjectAttributes = email |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,3 +1,10 @@ | ||
gs = GrouperSession.startRootSession() | ||
|
||
addStem("","app", "app") | ||
addStem("","basis", "basis") | ||
addStem("","bundle", "bundle") | ||
addStem("","org", "org") | ||
addStem("","ref", "ref") | ||
addStem("","test", "test") | ||
|
||
addMember("etc:sysadmingroup","banderson"); |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,72 @@ | ||
#!/bin/bash | ||
|
||
startsecs=$(date +'%s') | ||
starttime=$(date +%H:%M:%S) | ||
|
||
echo 'starting:' ${starttime} | ||
|
||
#ensure clair-scanner | ||
if [ ! -s ./clair-scanner ]; then | ||
echo 'downloading curl-scanner...' | ||
curl -s -L -o ./clair-scanner https://github.com/arminc/clair-scanner/releases/download/v8/clair-scanner_linux_amd64 | ||
chmod 755 clair-scanner | ||
else | ||
echo 'using existing clair-scanner...' | ||
fi | ||
|
||
#ensure DB container | ||
echo 'ensuring a fresh clair-db container...' | ||
docker ps | grep clair-db &>/dev/null | ||
if [ $? == "0" ]; then | ||
echo 'removing existing clair-db container...' | ||
docker kill db &>/dev/null | ||
docker rm db &>/dev/null | ||
docker run -p 5432:5432 -d --name db arminc/clair-db:latest &>/dev/null | ||
else | ||
docker run -p 5432:5432 -d --name db arminc/clair-db:latest &>/dev/null | ||
fi | ||
sleep 30 | ||
|
||
#ensure clair-scan container | ||
echo 'ensuring a fresh clair-scan container...' | ||
docker ps | grep clair-local-scan &>/dev/null | ||
if [ $? == "0" ]; then | ||
echo 'removing existing clair-scan container...' | ||
docker kill clair &>/dev/null | ||
docker rm clair &>/dev/null | ||
docker run -p 6060:6060 --link db:postgres -d --name clair arminc/clair-local-scan:v2.0.5 &>/dev/null | ||
else | ||
docker run -p 6060:6060 --link db:postgres -d --name clair arminc/clair-local-scan:v2.0.5 &>/dev/null | ||
fi | ||
sleep 30 | ||
|
||
#get ip where clair-scanner will listen | ||
clairip=$(/sbin/ifconfig docker0 | grep 'inet ' | sed 's/^[[:space:]]*//g' | cut -f 2 -d ' ' | sed 's/^[[:space:]]*//g') | ||
echo 'sending ip addr' ${clairip} 'to clair-scan server...' | ||
|
||
#run scan | ||
echo 'running scan...' | ||
./clair-scanner --ip ${clairip} $1 | ||
retcode=$? | ||
|
||
#eval results | ||
if [ $retcode == '0' ]; then | ||
echo 'scan found nothing.' | ||
else | ||
echo 'scan found issues.' | ||
fi | ||
|
||
#cleanup | ||
echo 'removing temporary containers...' | ||
docker kill clair &>/dev/null | ||
docker rm clair &>/dev/null | ||
docker kill db &>/dev/null | ||
docker rm db &>/dev/null | ||
|
||
endsecs=$(date +'%s') | ||
endtime=$(date +%H:%M:%S) | ||
echo 'finished:' $endtime ' ('$((endsecs - startsecs)) 'seconds)' | ||
echo "" | ||
|
||
#pass along return code from scan | ||
exit $retcode |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,16 @@ | ||
#!/usr/bin/env bats | ||
|
||
load ../common | ||
|
||
@test "010 Image is present and healthy" { | ||
docker image inspect ${maintainer}/${imagename} | ||
} | ||
|
||
@test "030 Test Compose the environment" { | ||
cd test-compose && ./compose.sh && docker-compose down | ||
} | ||
|
||
|
||
@test "070 There are no known security vulnerabilities" { | ||
./tests/clairscan.sh ${maintainer}/${imagename}:latest | ||
} |