From 463b203ff5a06e5898b91811fb5b70c0b5c7ce8f Mon Sep 17 00:00:00 2001 From: Pavol Mederly Date: Wed, 19 Sep 2018 23:30:07 +0200 Subject: [PATCH 1/3] Migrate midpoint container to shibboleth Also fix treatment of environment variables. --- midpoint/.env | 13 ++ midpoint/README.md | 55 +---- .../{ => application}/database_password.txt | 0 .../{ => application}/keystore_password.txt | 0 .../midpoint/httpd/host-cert.pem | 22 ++ .../midpoint/httpd/host-key.pem | 28 +++ .../midpoint/shibboleth/idp-metadata.xml | 207 ++++++++++++++++++ .../midpoint/shibboleth/shibboleth2.xml | 136 ++++++++++++ .../midpoint/shibboleth/sp-cert.pem | 22 ++ .../midpoint/shibboleth/sp-key.pem | 28 +++ midpoint/docker-compose.yml | 68 ++++-- midpoint/midpoint-data/Dockerfile | 4 - midpoint/midpoint-server/Dockerfile | 58 ++--- .../httpd/conf/midpoint.conf.auth.internal | 6 + .../httpd/conf/midpoint.conf.auth.shibboleth | 15 ++ .../httpd/conf/ssl-enable.conf | 28 +++ .../container_files/log-prefix | 7 - .../mp-dir/active-spring-profiles | 13 ++ .../{ => mp-dir}/repository-url | 0 .../shibboleth/attribute-map.xml | 153 +++++++++++++ .../container_files/shibboleth/native.logger | 39 ++++ .../container_files/shibboleth/shibd.logger | 59 +++++ .../usr-local-bin/entrypoint.sh | 38 ++++ 23 files changed, 884 insertions(+), 115 deletions(-) create mode 100644 midpoint/.env rename midpoint/configs-and-secrets/midpoint/{ => application}/database_password.txt (100%) rename midpoint/configs-and-secrets/midpoint/{ => application}/keystore_password.txt (100%) create mode 100644 midpoint/configs-and-secrets/midpoint/httpd/host-cert.pem create mode 100644 midpoint/configs-and-secrets/midpoint/httpd/host-key.pem create mode 100644 midpoint/configs-and-secrets/midpoint/shibboleth/idp-metadata.xml create mode 100644 midpoint/configs-and-secrets/midpoint/shibboleth/shibboleth2.xml create mode 100644 midpoint/configs-and-secrets/midpoint/shibboleth/sp-cert.pem create mode 100644 midpoint/configs-and-secrets/midpoint/shibboleth/sp-key.pem create mode 100644 midpoint/midpoint-server/container_files/httpd/conf/midpoint.conf.auth.internal create mode 100644 midpoint/midpoint-server/container_files/httpd/conf/midpoint.conf.auth.shibboleth create mode 100644 midpoint/midpoint-server/container_files/httpd/conf/ssl-enable.conf delete mode 100755 midpoint/midpoint-server/container_files/log-prefix create mode 100755 midpoint/midpoint-server/container_files/mp-dir/active-spring-profiles rename midpoint/midpoint-server/container_files/{ => mp-dir}/repository-url (100%) create mode 100644 midpoint/midpoint-server/container_files/shibboleth/attribute-map.xml create mode 100644 midpoint/midpoint-server/container_files/shibboleth/native.logger create mode 100644 midpoint/midpoint-server/container_files/shibboleth/shibd.logger create mode 100755 midpoint/midpoint-server/container_files/usr-local-bin/entrypoint.sh diff --git a/midpoint/.env b/midpoint/.env new file mode 100644 index 0000000..9b1bf15 --- /dev/null +++ b/midpoint/.env @@ -0,0 +1,13 @@ +AUTHENTICATION=internal +ENV=demo +USERTOKEN=3.9-SNAPSHOT +REPO_DATABASE_TYPE=mariadb +REPO_JDBC_URL=default +REPO_HOST=midpoint-data +REPO_PORT=3306 +REPO_DATABASE=midpoint +REPO_USER=root +REPO_PASSWORD_FILE=/run/secrets/m_database_password.txt +KEYSTORE_PASSWORD_FILE=/run/secrets/m_keystore_password.txt +MEM=2048m +LOGOUT_URL=https://localhost:8443/Shibboleth.sso/Logout diff --git a/midpoint/README.md b/midpoint/README.md index 35e9c3a..c796407 100644 --- a/midpoint/README.md +++ b/midpoint/README.md @@ -1,56 +1,5 @@ # Overview -This is a preliminary version of midPoint dockerization for TIER environment. +This is a midPoint dockerization for TIER environment. It is a work in progress. -There are two containers there: - -- `midpoint-server`: provides the midPoint application -- `midpoint-data`: provides the default midPoint repository; note that the repository can be implemented in any other way - by another container (perhaps hosting a different database) or by providing it externally: on premises or in cloud. - -# Building and starting -## Downloading midPoint - -Before building, please build or download current `midpoint-3.9-SNAPSHOT-dist.tar.gz` file and put it into `midpoint-server` directory. There are the following options: -1. Build midPoint from sources as described [here](https://wiki.evolveum.com/display/midPoint/Building+MidPoint+From+Source+Code) - *but use `tmp/tier` branch instead of `master`*. It should contain a bit more stable code in comparison with the master branch. -2. Use `download-midpoint` script. -3. Download midPoint manually from [Evolveum web site](https://evolveum.com/downloads/midpoint-tier/midpoint-3.9-SNAPSHOT-dist.tar.gz). - -Showing e.g. the second option: - -``` -$ ./download-midpoint -Downloading midPoint 3.9-SNAPSHOT ------------------------------------------ - % Total % Received % Xferd Average Speed Time Time Time Current - Dload Upload Total Spent Left Speed -100 157M 100 157M 0 0 867k 0 0:03:05 0:03:05 --:--:-- 954k ------------------------------------------ -Checking the download... -OK -``` - -## Creating Docker composition - -After midPoint archive is correctly placed into `midpoint-server` directory, please execute the following commands: - -``` -$ docker-compose up --build -``` - -This will take a while. - -Finally, you will see notices like these: - -``` -Starting midpoint_midpoint-data_1 ... -Starting midpoint_midpoint-data_1 ... done -Recreating midpoint_midpoint-server_1 ... -Recreating midpoint_midpoint-server_1 ... done -Attaching to midpoint_midpoint-data_1, midpoint_midpoint-server_1 -``` - -followed by startup messages from individual Docker containers. - -## After installation - -After Docker containers are up, check that you can log into midPoint at `http://localhost:8080/midpoint` using `administrator/5ecr3t`. +Please see a detailed description, including installation instructions [here](https://spaces.at.internet2.edu/display/MID/Dockerized+midPoint). diff --git a/midpoint/configs-and-secrets/midpoint/database_password.txt b/midpoint/configs-and-secrets/midpoint/application/database_password.txt similarity index 100% rename from midpoint/configs-and-secrets/midpoint/database_password.txt rename to midpoint/configs-and-secrets/midpoint/application/database_password.txt diff --git a/midpoint/configs-and-secrets/midpoint/keystore_password.txt b/midpoint/configs-and-secrets/midpoint/application/keystore_password.txt similarity index 100% rename from midpoint/configs-and-secrets/midpoint/keystore_password.txt rename to midpoint/configs-and-secrets/midpoint/application/keystore_password.txt diff --git a/midpoint/configs-and-secrets/midpoint/httpd/host-cert.pem b/midpoint/configs-and-secrets/midpoint/httpd/host-cert.pem new file mode 100644 index 0000000..9b1021b --- /dev/null +++ b/midpoint/configs-and-secrets/midpoint/httpd/host-cert.pem @@ -0,0 +1,22 @@ +-----BEGIN CERTIFICATE----- +MIIDqDCCApCgAwIBAgIJAMOSkn4oS2aAMA0GCSqGSIb3DQEBCwUAMGkxCzAJBgNV +BAYTAlVTMQswCQYDVQQIDAJNSTESMBAGA1UEBwwJQW5uIEFyYm9yMRcwFQYDVQQK +DA5JbnRlcm5ldDIvVElFUjEgMB4GA1UEAwwXbWlkcG9pbnQuc3AuZXhhbXBsZS5v +cmcwHhcNMTgwOTE0MDU1OTQ1WhcNMTkwOTE0MDU1OTQ1WjBpMQswCQYDVQQGEwJV +UzELMAkGA1UECAwCTUkxEjAQBgNVBAcMCUFubiBBcmJvcjEXMBUGA1UECgwOSW50 +ZXJuZXQyL1RJRVIxIDAeBgNVBAMMF21pZHBvaW50LnNwLmV4YW1wbGUub3JnMIIB +IjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEApj/b7MEUSfu3oXMfNgRwTse7 +a5UV7Jswf1M/ZN/ZZkAkIxNBevZgozjesvLPWrmsTgONi7XigJUJvCjdjmlW9eDM +lri/rkD8HuOR1DQCVKL9nvoS2c3D7sq5Emda3V8Tlj82VqfEmePd3sajx7mcTfbH +8jwAL9NhkC+WMib5IpjLGpG0FEAC0ha7Lxb+7jIiqHVJaqLXJGCyGN4mh6c1Q9S1 +f8RVTiW2a8x22G+9wnZYbkiA2Kxls177imHlhSz8EdvV4IpGw1amrEWhhuDEum7B +vZ1xQDLatgRqh4qAKLIVYeRnJ8H1FelMa90qB4G08MIPifmTsQwqJyBYaEdgWQID +AQABo1MwUTAdBgNVHQ4EFgQUqb9BteODF6wv5R57aEON/wGXMiowHwYDVR0jBBgw +FoAUqb9BteODF6wv5R57aEON/wGXMiowDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG +9w0BAQsFAAOCAQEAAcKhxI+tSItrXmqC0PSmgWyAYpqbkz6W/cefTutXqhIgY09f +h0LSv7ogTahoGpyiZk9vy6u3OE9bYwxapEfa4KBjO6HxBMIVBBb3RegVjoPzjElN +BDwAx0VGFcZTXwMxDWycWdG8ql7rCZBvS50w04uTaIgnGmqXAdWWmBgfJ9cRbxW+ +JwO/mOl1QM1lR/5142NpvuUVWlmZSKEGydE5A1qPz2wpDbBR1ym1BQNS4NEqw6Kp +GSB8jKyCS1Ve0v2wVze2038Wukz02dq9uKPTIO3T+B+ibZmxn6Op/kFCc1/kK5NS +Q6JdO1B6KquGAYdGmKAcQ19mv+jqGktqWEEf0g== +-----END CERTIFICATE----- diff --git a/midpoint/configs-and-secrets/midpoint/httpd/host-key.pem b/midpoint/configs-and-secrets/midpoint/httpd/host-key.pem new file mode 100644 index 0000000..5746e59 --- /dev/null +++ b/midpoint/configs-and-secrets/midpoint/httpd/host-key.pem @@ -0,0 +1,28 @@ +-----BEGIN PRIVATE KEY----- +MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQCmP9vswRRJ+7eh +cx82BHBOx7trlRXsmzB/Uz9k39lmQCQjE0F69mCjON6y8s9auaxOA42LteKAlQm8 +KN2OaVb14MyWuL+uQPwe45HUNAJUov2e+hLZzcPuyrkSZ1rdXxOWPzZWp8SZ493e +xqPHuZxN9sfyPAAv02GQL5YyJvkimMsakbQUQALSFrsvFv7uMiKodUlqotckYLIY +3iaHpzVD1LV/xFVOJbZrzHbYb73CdlhuSIDYrGWzXvuKYeWFLPwR29XgikbDVqas +RaGG4MS6bsG9nXFAMtq2BGqHioAoshVh5GcnwfUV6Uxr3SoHgbTwwg+J+ZOxDCon +IFhoR2BZAgMBAAECggEAEIRBpjjceiku6jRUwnoYaks/nIWYQwR8AfpUTwJKR/VR +Yca097Fokm7A+UhUP3A45RtHQb0VPq8P44iv0kk24YCu8r5yFK7SHYOAZnOwU5ZJ +2jSAEPF3aM7tKh3okhuzB3dKP7u1NZDE5zAW723KUJiW7sL1RcsbY0bHBj6G+9/H +NplmsjuGt684vRBB0qOBfKF7EiG7mT69tHuNj4gRza9SMY31UtKbZdt2fNY6mp5V +HscMba7egZP+Ke0pVX4+go9j7K8GG8hYaQDLjrzlPqrxZ2c5X9cC+CRDI/CHuL/s +V/2yGZJ6n6UabwZoH83RdFrbQ94rU8Hkli6EvxXvMQKBgQDRpheNW5jDG5TfeJKh +yfKTDQqH2Tk3BsBYYBN7Hf3m7vbkzlxnAKJAoSLmtRMuoeXvI5MrhzaHGsNIUS76 +LDIZnvB7DLUxhFUZsCPkpAA1QHuTWY96oR3PHnPjpk8lSUvtbOPwDLdzVApeFJgZ +VqMNArZ7AHsK3Kkyi+f4WVQjbQKBgQDLAWiGb5dx6fAM2W6B6HjNmzjBWOuVEXa2 +76to9jzupBZmETfZgxtWUaWUDuNS+f7dtVUTE+p6v/w8clrHEhEZYkqunIOLo/UA +LFPiuoTfEsWb1rh+nsCjCgy4uimixj/bSkf7NC6NyKTvCygA1mGnVVJUEPegYlDy +LXCkaKWxHQKBgQCmyHSKL2lrJkEcOwakEU2acNCE3Gno/cT9SYmV83kvQ8JEqmrW +QqnRsp9aXIljGscapPmKsmnNt5vNp1AxFAHTYh88NRLczsMIyZj0ZwgHVUI6KhC7 +5Psa78YQQBlMt2/g9TSsnuE+rYgF6mpKFiNm0Vasqeg47uzn2mdzqlUGTQKBgE04 +JutkTUY+h1pL5vYxWKpVDfy19z7H2tFxT1FowPrBneeLSyRI88Ac5I/yLdRlVeY9 +0LOmEr5Igwj3MsKgg7KVKfVLgdo/LrW3Jt2Kt3onKNXDkoBPoNUjwH0QC0Boiue+ +VK0gR0kVdm+bXccbxR+im+NwZNE0NLg6Qqu3RredAoGBALuVoqbPPmTCZXYG328H +bzOs2aiR7BzPSVByV+qG6jW7w03RAnFPJZp7HMU+ViI5VY0wabUscMSvz5163+gM +4KwY3v9ZjZzZGukIfLuudkdqtaiVOx/KeAC0n+nG21YU+wpZww8gkfHh1/sa2CME +CWYCgOnmiTHcj83UaTqEXtmv +-----END PRIVATE KEY----- diff --git a/midpoint/configs-and-secrets/midpoint/shibboleth/idp-metadata.xml b/midpoint/configs-and-secrets/midpoint/shibboleth/idp-metadata.xml new file mode 100644 index 0000000..35914b7 --- /dev/null +++ b/midpoint/configs-and-secrets/midpoint/shibboleth/idp-metadata.xml @@ -0,0 +1,207 @@ + + + + + + + + example.org + + + + + + + +MIIDEzCCAfugAwIBAgIUS9SuTXwsFVVG+LjOEAbLqqT/el0wDQYJKoZIhvcNAQEL +BQAwFTETMBEGA1UEAwwKaWRwdGVzdGJlZDAeFw0xNTEyMTEwMjIwMjZaFw0zNTEy +MTEwMjIwMjZaMBUxEzARBgNVBAMMCmlkcHRlc3RiZWQwggEiMA0GCSqGSIb3DQEB +AQUAA4IBDwAwggEKAoIBAQCMAoDHx8xCIfv/6QKqt9mcHYmEJ8y2dKprUbpdcOjH +YvNPIl/lHPsUyrb+Nc+q2CDeiWjVk1mWYq0UpIwpBMuw1H6+oOqr4VQRi65pin0M +SfE0MWIaFo5FPvpvoptkHD4gvREbm4swyXGMczcMRfqgalFXhUD2wz8W3XAM5Cq2 +03XeJbj6TwjvKatG5XPdeUe2FBGuOO2q54L1hcIGnLMCQrg7D31lR13PJbjnJ0No +5C3k8TPuny6vJsBC03GNLNKfmrKVTdzr3VKp1uay1G3DL9314fgmbl8HA5iRQmy+ +XInUU6/8NXZSF59p3ITAOvZQeZsbJjg5gGDip5OZo9YlAgMBAAGjWzBZMB0GA1Ud +DgQWBBRPlM4VkKZ0U4ec9GrIhFQl0hNbLDA4BgNVHREEMTAvggppZHB0ZXN0YmVk +hiFodHRwczovL2lkcHRlc3RiZWQvaWRwL3NoaWJib2xldGgwDQYJKoZIhvcNAQEL +BQADggEBAIZ0a1ov3my3ljJG588I/PHx+TxAWONWmpKbO9c/qI3Drxk4oRIffiac +ANxdvtabgIzrlk5gMMisD7oyqHJiWgKv5Bgctd8w3IS3lLl7wHX65mTKQRXniG98 +NIjkvfrhe2eeJxecOqnDI8GOhIGCIqZUn8ShdM/yHjhQ2Mh0Hj3U0LlKvnmfGSQl +j0viGwbFCaNaIP3zc5UmCrdE5h8sWL3Fu7ILKM9RyFa2ILHrJScV9t623IcHffHP +IeaY/WtuapsrqRFxuQL9QFWN0FsRIdLmjTq+00+B/XnnKRKFBuWfjhHLF/uu8f+E +t6Lf23Kb8yD6ZR7dihMZAGHnYQ/hlhM= + + + + + + + + + +MIIDFDCCAfygAwIBAgIVAN3vv+b7KN5Se9m1RZsCllp/B/hdMA0GCSqGSIb3DQEB +CwUAMBUxEzARBgNVBAMMCmlkcHRlc3RiZWQwHhcNMTUxMjExMDIyMDE0WhcNMzUx +MjExMDIyMDE0WjAVMRMwEQYDVQQDDAppZHB0ZXN0YmVkMIIBIjANBgkqhkiG9w0B +AQEFAAOCAQ8AMIIBCgKCAQEAh91caeY0Q85uhaUyqFwP2bMjwMFxMzRlAoqBHd7g +u6eo4duaeLz1BaoR2XTBpNNvFR5oHH+TkKahVDGeH5+kcnIpxI8JPdsZml1srvf2 +Z6dzJsulJZUdpqnngycTkGtZgEoC1vmYVky2BSAIIifmdh6s0epbHnMGLsHzMKfJ +Cb/Q6dYzRWTCPtzE2VMuQqqWgeyMr7u14x/Vqr9RPEFsgY8GIu5jzB6AyUIwrLg+ +MNkv6aIdcHwxYTGL7ijfy6rSWrgBflQoYRYNEnseK0ZHgJahz4ovCag6wZAoPpBs +uYlY7lEr89Ucb6NHx3uqGMsXlDFdE4QwfDLLhCYHPvJ0uwIDAQABo1swWTAdBgNV +HQ4EFgQUAkOgED3iYdmvQEOMm6u/JmD/UTQwOAYDVR0RBDEwL4IKaWRwdGVzdGJl +ZIYhaHR0cHM6Ly9pZHB0ZXN0YmVkL2lkcC9zaGliYm9sZXRoMA0GCSqGSIb3DQEB +CwUAA4IBAQBIdd4YWlnvJjql8+zKKgmWgIY7U8DA8e6QcbAf8f8cdE33RSnjI63X +sv/y9GfmbAVAD6RIAXPFFeRYJ08GOxGI9axfNaKdlsklJ9bk4ducHqgCSWYVer3s +RQBjxyOfSTvk9YCJvdJVQRJLcCvxwKakFCsOSnV3t9OvN86Ak+fKPVB5j2fM/0fZ +Kqjn3iqgdNPTLXPsuJLJO5lITRiBa4onmVelAiCstI9PQiaEck+oAHnMTnC9JE/B +DHv3e4rwq3LznlqPw0GSd7xqNTdMDwNOWjkuOr3sGpWS8ms/ZHHXV1Vd22uPe70i +s00xrv14zLifcc8oj5DYzOhYRifRXgHX + + + + + + + + + +MIIDEzCCAfugAwIBAgIUG6Nn1rlERS1vsi88tcdzSYX0oqAwDQYJKoZIhvcNAQEL +BQAwFTETMBEGA1UEAwwKaWRwdGVzdGJlZDAeFw0xNTEyMTEwMjIwMTRaFw0zNTEy +MTEwMjIwMTRaMBUxEzARBgNVBAMMCmlkcHRlc3RiZWQwggEiMA0GCSqGSIb3DQEB +AQUAA4IBDwAwggEKAoIBAQCBXv0o3fmT8iluyLjJ4lBAVCW+ZRVyEXPYQuRi7vfD +cO4a6d1kxiJLsaK0W88VNxjFQRr8PgDkWr28vwoH1rgk4pLsszLD48DBzD942peJ +l/S6FnsIJjmaHcBh4pbNhU4yowu63iKkvttrcZAEbpEro6Z8CziWEx8sywoaYEQG +ifPkr9ORV6Cn3txq+9gMBePG41GrtZrUGIu+xrndL0Shh4Pq0eq/9MAsVlIIXEa8 +9WfH8J2kFcTOfoWtIc70b7TLZQsx4YnNcnrGLSUEcstFyPLX+Xtv5SNZF89OOIxX +VNjNvgE5DbJb9hMM4UAFqI+1bo9QqtxwThjc/sOvIxzNAgMBAAGjWzBZMB0GA1Ud +DgQWBBStTyogRPuAVG6q7yPyav1uvE+7pTA4BgNVHREEMTAvggppZHB0ZXN0YmVk +hiFodHRwczovL2lkcHRlc3RiZWQvaWRwL3NoaWJib2xldGgwDQYJKoZIhvcNAQEL +BQADggEBAFMfoOv+oISGjvamq7+Y4G7ep5vxlAPeK3RATYPYvAmyH946qZXh98ni +QXyuqZW5P5eEt86toY45IwDU5r09SKwHughEe99iiEkxh0mb2qo84qX9/qcg+kyN +jeLd/OSyolpUCEFNwOFcog7pj7Eer+6AHbwTn1Mjb5TBsKwtDMJsaxPvdj0u7M5r +xL/wHkFhn1rCo2QiojzjSlV3yLTh49iTyhE3cG+RxaNKDCxhp0jSSLX1BW/ZoPA8 ++PMJEA+Q0QbyRD8aJOHN5O8jGxCa/ZzcOnYVL6AsEXoDiY3vAUYh1FUonOWw0m9H +p+tGUbGS2l873J5PrsbpeKEVR/IIoKo= + + + + + + + urn:mace:shibboleth:1.0:nameIdentifier + urn:oasis:names:tc:SAML:2.0:nameid-format:transient + + + + + + + + + + + + + localhost + + + + + + +MIIDEzCCAfugAwIBAgIUS9SuTXwsFVVG+LjOEAbLqqT/el0wDQYJKoZIhvcNAQEL +BQAwFTETMBEGA1UEAwwKaWRwdGVzdGJlZDAeFw0xNTEyMTEwMjIwMjZaFw0zNTEy +MTEwMjIwMjZaMBUxEzARBgNVBAMMCmlkcHRlc3RiZWQwggEiMA0GCSqGSIb3DQEB +AQUAA4IBDwAwggEKAoIBAQCMAoDHx8xCIfv/6QKqt9mcHYmEJ8y2dKprUbpdcOjH +YvNPIl/lHPsUyrb+Nc+q2CDeiWjVk1mWYq0UpIwpBMuw1H6+oOqr4VQRi65pin0M +SfE0MWIaFo5FPvpvoptkHD4gvREbm4swyXGMczcMRfqgalFXhUD2wz8W3XAM5Cq2 +03XeJbj6TwjvKatG5XPdeUe2FBGuOO2q54L1hcIGnLMCQrg7D31lR13PJbjnJ0No +5C3k8TPuny6vJsBC03GNLNKfmrKVTdzr3VKp1uay1G3DL9314fgmbl8HA5iRQmy+ +XInUU6/8NXZSF59p3ITAOvZQeZsbJjg5gGDip5OZo9YlAgMBAAGjWzBZMB0GA1Ud +DgQWBBRPlM4VkKZ0U4ec9GrIhFQl0hNbLDA4BgNVHREEMTAvggppZHB0ZXN0YmVk +hiFodHRwczovL2lkcHRlc3RiZWQvaWRwL3NoaWJib2xldGgwDQYJKoZIhvcNAQEL +BQADggEBAIZ0a1ov3my3ljJG588I/PHx+TxAWONWmpKbO9c/qI3Drxk4oRIffiac +ANxdvtabgIzrlk5gMMisD7oyqHJiWgKv5Bgctd8w3IS3lLl7wHX65mTKQRXniG98 +NIjkvfrhe2eeJxecOqnDI8GOhIGCIqZUn8ShdM/yHjhQ2Mh0Hj3U0LlKvnmfGSQl +j0viGwbFCaNaIP3zc5UmCrdE5h8sWL3Fu7ILKM9RyFa2ILHrJScV9t623IcHffHP +IeaY/WtuapsrqRFxuQL9QFWN0FsRIdLmjTq+00+B/XnnKRKFBuWfjhHLF/uu8f+E +t6Lf23Kb8yD6ZR7dihMZAGHnYQ/hlhM= + + + + + + + + + +MIIDFDCCAfygAwIBAgIVAN3vv+b7KN5Se9m1RZsCllp/B/hdMA0GCSqGSIb3DQEB +CwUAMBUxEzARBgNVBAMMCmlkcHRlc3RiZWQwHhcNMTUxMjExMDIyMDE0WhcNMzUx +MjExMDIyMDE0WjAVMRMwEQYDVQQDDAppZHB0ZXN0YmVkMIIBIjANBgkqhkiG9w0B +AQEFAAOCAQ8AMIIBCgKCAQEAh91caeY0Q85uhaUyqFwP2bMjwMFxMzRlAoqBHd7g +u6eo4duaeLz1BaoR2XTBpNNvFR5oHH+TkKahVDGeH5+kcnIpxI8JPdsZml1srvf2 +Z6dzJsulJZUdpqnngycTkGtZgEoC1vmYVky2BSAIIifmdh6s0epbHnMGLsHzMKfJ +Cb/Q6dYzRWTCPtzE2VMuQqqWgeyMr7u14x/Vqr9RPEFsgY8GIu5jzB6AyUIwrLg+ +MNkv6aIdcHwxYTGL7ijfy6rSWrgBflQoYRYNEnseK0ZHgJahz4ovCag6wZAoPpBs +uYlY7lEr89Ucb6NHx3uqGMsXlDFdE4QwfDLLhCYHPvJ0uwIDAQABo1swWTAdBgNV +HQ4EFgQUAkOgED3iYdmvQEOMm6u/JmD/UTQwOAYDVR0RBDEwL4IKaWRwdGVzdGJl +ZIYhaHR0cHM6Ly9pZHB0ZXN0YmVkL2lkcC9zaGliYm9sZXRoMA0GCSqGSIb3DQEB +CwUAA4IBAQBIdd4YWlnvJjql8+zKKgmWgIY7U8DA8e6QcbAf8f8cdE33RSnjI63X +sv/y9GfmbAVAD6RIAXPFFeRYJ08GOxGI9axfNaKdlsklJ9bk4ducHqgCSWYVer3s +RQBjxyOfSTvk9YCJvdJVQRJLcCvxwKakFCsOSnV3t9OvN86Ak+fKPVB5j2fM/0fZ +Kqjn3iqgdNPTLXPsuJLJO5lITRiBa4onmVelAiCstI9PQiaEck+oAHnMTnC9JE/B +DHv3e4rwq3LznlqPw0GSd7xqNTdMDwNOWjkuOr3sGpWS8ms/ZHHXV1Vd22uPe70i +s00xrv14zLifcc8oj5DYzOhYRifRXgHX + + + + + + + + + +MIIDEzCCAfugAwIBAgIUG6Nn1rlERS1vsi88tcdzSYX0oqAwDQYJKoZIhvcNAQEL +BQAwFTETMBEGA1UEAwwKaWRwdGVzdGJlZDAeFw0xNTEyMTEwMjIwMTRaFw0zNTEy +MTEwMjIwMTRaMBUxEzARBgNVBAMMCmlkcHRlc3RiZWQwggEiMA0GCSqGSIb3DQEB +AQUAA4IBDwAwggEKAoIBAQCBXv0o3fmT8iluyLjJ4lBAVCW+ZRVyEXPYQuRi7vfD +cO4a6d1kxiJLsaK0W88VNxjFQRr8PgDkWr28vwoH1rgk4pLsszLD48DBzD942peJ +l/S6FnsIJjmaHcBh4pbNhU4yowu63iKkvttrcZAEbpEro6Z8CziWEx8sywoaYEQG +ifPkr9ORV6Cn3txq+9gMBePG41GrtZrUGIu+xrndL0Shh4Pq0eq/9MAsVlIIXEa8 +9WfH8J2kFcTOfoWtIc70b7TLZQsx4YnNcnrGLSUEcstFyPLX+Xtv5SNZF89OOIxX +VNjNvgE5DbJb9hMM4UAFqI+1bo9QqtxwThjc/sOvIxzNAgMBAAGjWzBZMB0GA1Ud +DgQWBBStTyogRPuAVG6q7yPyav1uvE+7pTA4BgNVHREEMTAvggppZHB0ZXN0YmVk +hiFodHRwczovL2lkcHRlc3RiZWQvaWRwL3NoaWJib2xldGgwDQYJKoZIhvcNAQEL +BQADggEBAFMfoOv+oISGjvamq7+Y4G7ep5vxlAPeK3RATYPYvAmyH946qZXh98ni +QXyuqZW5P5eEt86toY45IwDU5r09SKwHughEe99iiEkxh0mb2qo84qX9/qcg+kyN +jeLd/OSyolpUCEFNwOFcog7pj7Eer+6AHbwTn1Mjb5TBsKwtDMJsaxPvdj0u7M5r +xL/wHkFhn1rCo2QiojzjSlV3yLTh49iTyhE3cG+RxaNKDCxhp0jSSLX1BW/ZoPA8 ++PMJEA+Q0QbyRD8aJOHN5O8jGxCa/ZzcOnYVL6AsEXoDiY3vAUYh1FUonOWw0m9H +p+tGUbGS2l873J5PrsbpeKEVR/IIoKo= + + + + + + + + + + + + + + diff --git a/midpoint/configs-and-secrets/midpoint/shibboleth/shibboleth2.xml b/midpoint/configs-and-secrets/midpoint/shibboleth/shibboleth2.xml new file mode 100644 index 0000000..a644264 --- /dev/null +++ b/midpoint/configs-and-secrets/midpoint/shibboleth/shibboleth2.xml @@ -0,0 +1,136 @@ + + + + + + + + + + + + + + + + + SAML2 + + + + SAML2 Local + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/midpoint/configs-and-secrets/midpoint/shibboleth/sp-cert.pem b/midpoint/configs-and-secrets/midpoint/shibboleth/sp-cert.pem new file mode 100644 index 0000000..0f5474e --- /dev/null +++ b/midpoint/configs-and-secrets/midpoint/shibboleth/sp-cert.pem @@ -0,0 +1,22 @@ +-----BEGIN CERTIFICATE----- +MIIDqDCCApCgAwIBAgIJAKUZrfriIt9cMA0GCSqGSIb3DQEBCwUAMGkxCzAJBgNV +BAYTAlVTMQswCQYDVQQIDAJNSTESMBAGA1UEBwwJQW5uIEFyYm9yMRcwFQYDVQQK +DA5JbnRlcm5ldDIvVElFUjEgMB4GA1UEAwwXZXZvbHZldW0uc3AuZXhhbXBsZS5v +cmcwHhcNMTgwOTE0MDU0NjU3WhcNMTkwOTE0MDU0NjU3WjBpMQswCQYDVQQGEwJV +UzELMAkGA1UECAwCTUkxEjAQBgNVBAcMCUFubiBBcmJvcjEXMBUGA1UECgwOSW50 +ZXJuZXQyL1RJRVIxIDAeBgNVBAMMF2V2b2x2ZXVtLnNwLmV4YW1wbGUub3JnMIIB +IjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAw5v1zxlM94yaBssgNNbIUJwW +XxbGxgSs2AWBeg2aEi/VQd2UE5ivZakNJlqWSJyHo2xE4kxeSyBBxinjSyhmpNao +xIcqQsgW0gxo4SEHo3kUXWPo+of/pj6CslutsSJZWGTRV0dHITvaWX+NM8eXMfgu +mJFwy3RMdLaWQhY1Dyi2jNoO+DZnfNgPyPeEZcmORaoeEID9QdZfHtcgTf2QfSHq ++xsTwHB6Ro5t7YD2ma8Krb/XcDTfsq3qJemd7LhPj5lGmhYSMgDbgwEkZgZ1kBOP +lfsP2BvX5nipv7Vd1C5YXmv+NDR8V3yAWBC7ZAenxGmrnkaSVXnpUplUsGGm1QID +AQABo1MwUTAdBgNVHQ4EFgQUuxSZwW6V1P/b0tsTM32OU/v/n+UwHwYDVR0jBBgw +FoAUuxSZwW6V1P/b0tsTM32OU/v/n+UwDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG +9w0BAQsFAAOCAQEAJWLXEfZkPeUyiGvsIUjczzdF3ptqXoP9aETS2pOV9sTri19R +TsQZW6XQRHGtuEOsqEGH8yiTdGR5hbGC+ynH/xTJnK+tBn/R3KrgxLKyMvoUzAPl +mhVq1dh+ZEtbsRpQRRubP6nm9kXNma0cXrkJSzuWM0W+l/xSOOYiSRRk3XWJfVjn +9jQlcJRh5SOkKN08oZHrCYKxToEuOfV8PtRj3T80DhsBTv2SHqhg4cBhzQPb0Kjm +9m4IkYOz8c5ZtuHDGnqMHw60Nyt+jyik4mMFP2frcOVP0W0sgwcfHllYzHoA/Khq +Yk3TBVs1BjPuNDJWHct8Eo68YP2/ZvzqfVM87Q== +-----END CERTIFICATE----- diff --git a/midpoint/configs-and-secrets/midpoint/shibboleth/sp-key.pem b/midpoint/configs-and-secrets/midpoint/shibboleth/sp-key.pem new file mode 100644 index 0000000..b4c7a68 --- /dev/null +++ b/midpoint/configs-and-secrets/midpoint/shibboleth/sp-key.pem @@ -0,0 +1,28 @@ +-----BEGIN PRIVATE KEY----- +MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDDm/XPGUz3jJoG +yyA01shQnBZfFsbGBKzYBYF6DZoSL9VB3ZQTmK9lqQ0mWpZInIejbETiTF5LIEHG +KeNLKGak1qjEhypCyBbSDGjhIQejeRRdY+j6h/+mPoKyW62xIllYZNFXR0chO9pZ +f40zx5cx+C6YkXDLdEx0tpZCFjUPKLaM2g74Nmd82A/I94RlyY5Fqh4QgP1B1l8e +1yBN/ZB9Ier7GxPAcHpGjm3tgPaZrwqtv9dwNN+yreol6Z3suE+PmUaaFhIyANuD +ASRmBnWQE4+V+w/YG9fmeKm/tV3ULlhea/40NHxXfIBYELtkB6fEaaueRpJVeelS +mVSwYabVAgMBAAECggEAeQxOdTaG9ro/puyUpZ40oA23mmiR4YCLJbNiiJFaQt7u +7a+dLvNRt2uCA7YTQiP7nBooFpKD16HCkkrhqWT7AA8GqXero2AHHz0mugqim3sW +KyTkzATVI5+TaaRqPC+xco4RLh2h2uMbID9atixRWE7pJuj6EC2MEr3bBlKPyyyj +gYEi7PLZC5oEMHCZSteVik0yXI3kJJEneuVgFHTc+mwuz/qzqJP7f93i77c/FcRd +pWCo1fg0Xuxh3M17Y/0e0ZzSBowbRVv7VkJDKZmdAYE+DaODdaIR8rrQVqkIEX4A +4m/ufAS5j2Rck0MEY9mu5STQByo1EGiAsxTp8pVCkQKBgQD905GZiMIZ+yBM1aXa +ZJj/BF2a/s/wf3N6YLtfobWGDAGXDIe07lr+jSK1+vYRcqHW/a6/H0JsVg+gD9Gs +10p0ry8AVWqR+5GRRDUKBMBXVDxMFZybXvMzRnR67SJA6TVEirMHYeawtzEjzha0 +csIo0kCe3Ke22mR8aebFSFDonwKBgQDFSMTvC/y18k8n9NQ3Rsu2Z4itH3nZ3fM3 +e7+gFxQyCXJHR/kTaAPVb2HAsuA+lAemnEHJUhOjao0QiUilWkE44wSfx7LwFPWP +XO89oOWGKhOclkzs2nvxOcC/pEjWm83cgOz/IPWqkw0/wefmh6RDcPz1JgwO2Jij +P14FGG9YCwKBgQDPdmOlODBeB/Iomt+Kl3qtxaW0j9zp12JNfk7oJUY3IA0Uprss +2T0qnbTnRQ5myGkbThHMSQKDhfwTeZqJSRakNKOYBDisxQ//yd4IKEYFmuYF0gxE +ueDR4h5GcxfyMirFsRAPUqe5fKH/f+zy5HFp6B/FONkkDXDgd7aVPTxURQKBgF8q +sUUXJTqnvqNpqQ1ZK1+8JeRNcLw2IuM64L9bIrTYdbYI9A/2dxL4fdE0+JN3WRF4 +AwwYeby044N8lfydwySr7kkdTiYeFi6oCAhUmyPTHE7G+iivZGaDE4Xeu/w6gF3E +G48e2SMFeLiu0y0TdZvK31tqlRp8RXVKVhJjLSLtAoGBAP01ZMUJu5AU19c7xRTy +kfVzE6PI+E8ZZ6qEWMs2Xt3NQL4Bffh94QQCmQYX3AY7xVD1gAQgbLXx4lEDQdzu +i/kV4t+oeYwXSn1UEgOQj504qwR3gi4JZdfa0LbiMzhp9qyxofyk7Lre7Tc3Xmu1 +jyigTF7oAYoPBWk/mAthK1wO +-----END PRIVATE KEY----- diff --git a/midpoint/docker-compose.yml b/midpoint/docker-compose.yml index 88d6af0..d0b435d 100644 --- a/midpoint/docker-compose.yml +++ b/midpoint/docker-compose.yml @@ -24,40 +24,62 @@ services: depends_on: - midpoint-data expose: - - 8080 + - 443 ports: - - 8080:8080 - volumes: - - midpoint_home:/opt/midpoint/var + - 8443:443 + environment: + - AUTHENTICATION + - ENV + - USERTOKEN + - REPO_DATABASE_TYPE + - REPO_JDBC_URL + - REPO_HOST + - REPO_PORT + - REPO_DATABASE + - REPO_USER + - REPO_PASSWORD_FILE + - KEYSTORE_PASSWORD_FILE + - MEM networks: - - back + - back secrets: - - m_database_password.txt - - m_keystore_password.txt -# the following is just to demonstrate required normalization of logging parameters -# environment: -# - LOGFILE=midpoint.log -# - COMPONENT=midpoint;tier -# - "USERTOKEN=user token " -# - ENV=demo only -# -# repository configuration examples -# - REPO_DATABASE_TYPE=mariadb -# - REPO_HOST=xyz -# - REPO_PORT=10000 -# the following overrides default URL construction -# - REPO_JDBC_URL=jdbc:mariadb://midpoint-data:3306/midpoint + - m_database_password.txt + - m_keystore_password.txt + - source: m_sp-key.pem + target: shib_sp-key.pem + - source: m_host-key.pem + target: host-key.pem + volumes: + - midpoint_home:/opt/midpoint/var + - type: bind + source: ./configs-and-secrets/midpoint/shibboleth/sp-cert.pem + target: /etc/shibboleth/sp-cert.pem + - type: bind + source: ./configs-and-secrets/midpoint/shibboleth/shibboleth2.xml + target: /etc/shibboleth/shibboleth2.xml + - type: bind + source: ./configs-and-secrets/midpoint/shibboleth/idp-metadata.xml + target: /etc/shibboleth/idp-metadata.xml + - type: bind + source: ./configs-and-secrets/midpoint/httpd/host-cert.pem + target: /etc/pki/tls/certs/host-cert.pem + - type: bind + source: ./configs-and-secrets/midpoint/httpd/host-cert.pem + target: /etc/pki/tls/certs/cachain.pem networks: back: driver: bridge - secrets: + m_host-key.pem: + file: ./configs-and-secrets/midpoint/httpd/host-key.pem + m_sp-key.pem: + file: ./configs-and-secrets/midpoint/shibboleth/sp-key.pem m_database_password.txt: - file: ./configs-and-secrets/midpoint/database_password.txt + file: ./configs-and-secrets/midpoint/application/database_password.txt m_keystore_password.txt: - file: ./configs-and-secrets/midpoint/keystore_password.txt + file: ./configs-and-secrets/midpoint/application/keystore_password.txt volumes: midpoint_mysql: diff --git a/midpoint/midpoint-data/Dockerfile b/midpoint/midpoint-data/Dockerfile index fcaa4e0..3249b23 100644 --- a/midpoint/midpoint-data/Dockerfile +++ b/midpoint/midpoint-data/Dockerfile @@ -23,13 +23,9 @@ RUN mysql_install_db \ && echo "/usr/bin/mysqld_safe &" > /tmp/config \ && echo "mysqladmin --silent --wait=30 ping || exit 1" >> /tmp/config \ && echo "mysql -e \"CREATE USER 'root'@'%' IDENTIFIED BY '`cat /tmp/database_password.txt`';\"" >> /tmp/config \ - && echo "echo ok0" >> /tmp/config \ && echo "mysql -e 'GRANT ALL PRIVILEGES ON *.* TO \"root\"@\"%\" WITH GRANT OPTION;'" >> /tmp/config \ - && echo "echo ok1" >> /tmp/config \ && echo "mysql -e 'CREATE DATABASE midpoint CHARACTER SET utf8 COLLATE utf8_bin;'" >> /tmp/config \ - && echo "echo ok2" >> /tmp/config \ && echo "mysql -e \"SET PASSWORD FOR 'root'@'localhost' = PASSWORD('`cat /tmp/database_password.txt`');\"" >> /tmp/config \ - && echo "echo ok3" >> /tmp/config \ && cat /tmp/config \ && bash /tmp/config \ && rm -f /tmp/config /tmp/database_password.txt diff --git a/midpoint/midpoint-server/Dockerfile b/midpoint/midpoint-server/Dockerfile index 4e58c39..c2e274a 100644 --- a/midpoint/midpoint-server/Dockerfile +++ b/midpoint/midpoint-server/Dockerfile @@ -6,22 +6,34 @@ FROM tier/shibboleth_sp MAINTAINER info@evolveum.com -# TODO switch to other appropriate Java implementation - RUN yum -y install java-1.8.0-openjdk +RUN rm /etc/shibboleth/sp-key.pem /etc/shibboleth/sp-cert.pem + +COPY container_files/httpd/conf/* /etc/httpd/conf.d/ +COPY container_files/shibboleth/* /etc/shibboleth/ +COPY container_files/usr-local-bin/* /usr/local/bin/ + +RUN cp /dev/null /etc/httpd/conf.d/ssl.conf \ + && sed -i 's/LogFormat "/LogFormat "httpd;access_log;%{ENV}e;%{USERTOKEN}e;/g' /etc/httpd/conf/httpd.conf \ + && echo -e "\nErrorLogFormat \"httpd;error_log;%{ENV}e;%{USERTOKEN}e;[%{u}t] [%-m:%l] [pid %P:tid %T] %7F: %E: [client\ %a] %M% ,\ referer\ %{Referer}i\"" >> /etc/httpd/conf/httpd.conf \ + && sed -i 's/CustomLog "logs\/access_log"/CustomLog "\/tmp\/logpipe"/g' /etc/httpd/conf/httpd.conf \ + && sed -i 's/ErrorLog "logs\/error_log"/ErrorLog "\/tmp\/logpipe"/g' /etc/httpd/conf/httpd.conf \ + && echo -e "\nPassEnv ENV" >> /etc/httpd/conf/httpd.conf \ + && echo -e "\nPassEnv USERTOKEN" >> /etc/httpd/conf/httpd.conf + # Build arguments ARG MP_VERSION=3.9-SNAPSHOT ARG MP_DIST_FILE=midpoint-${MP_VERSION}-dist.tar.gz -ENV MP_DIR=/opt/midpoint - -# Copying files +ENV MP_DIR /opt/midpoint RUN mkdir -p ${MP_DIR}/var + COPY ${MP_DIST_FILE} ${MP_DIR} -COPY container_files/ ${MP_DIR}/ +COPY container_files/mp-dir/ ${MP_DIR}/ + RUN echo 'Extracting midPoint archive...' \ && tar xzf ${MP_DIR}/midpoint-${MP_VERSION}-dist.tar.gz -C ${MP_DIR} --strip-components=1 @@ -37,32 +49,22 @@ ENV REPO_JDBC_URL default ENV REPO_PASSWORD_FILE /run/secrets/m_database_password.txt ENV REPO_DATABASE_TYPE mariadb -ENV KEYSTORE_PASSWORD_FILE /run/secrets/m_keystore_password.txt - # Logging parameters -ENV COMPONENT midpoint -ENV LOGFILE midpoint.log ENV ENV demo ENV USERTOKEN $MP_VERSION +# Authentication/web + +ENV AUTHENTICATION internal +ENV SSO_HEADER uid +ENV AJP_ENABLED true +ENV AJP_PORT 9090 +ENV LOGOUT_URL https://localhost:8443/Shibboleth.sso/Logout + # Other parameters -ENV MEM 2048M - -# Execution - -CMD java -Xmx$MEM -Xms2048M -Dfile.encoding=UTF8 \ - -Dmidpoint.home=$MP_DIR/var \ - -Dmidpoint.repository.database=$REPO_DATABASE_TYPE \ - -Dmidpoint.repository.jdbcUsername=$REPO_USER \ - -Dmidpoint.repository.jdbcPassword_FILE=$REPO_PASSWORD_FILE \ - -Dmidpoint.repository.jdbcUrl="`$MP_DIR/repository-url`" \ - -Dmidpoint.repository.hibernateHbm2ddl=none \ - -Dmidpoint.repository.missingSchemaAction=create \ - -Dmidpoint.repository.initializationFailTimeout=60000 \ - -Dmidpoint.keystore.keyStorePassword_FILE=$KEYSTORE_PASSWORD_FILE \ - -Dmidpoint.logging.console.enabled=true \ - -Dmidpoint.logging.console.prefix="`$MP_DIR/log-prefix`" \ - -Dmidpoint.logging.console.timezone=UTC \ - -jar $MP_DIR/lib/midpoint.war +ENV KEYSTORE_PASSWORD_FILE /run/secrets/m_keystore_password.txt +ENV MEM 2048m + +ENTRYPOINT ["/usr/local/bin/entrypoint.sh"] diff --git a/midpoint/midpoint-server/container_files/httpd/conf/midpoint.conf.auth.internal b/midpoint/midpoint-server/container_files/httpd/conf/midpoint.conf.auth.internal new file mode 100644 index 0000000..690a4cd --- /dev/null +++ b/midpoint/midpoint-server/container_files/httpd/conf/midpoint.conf.auth.internal @@ -0,0 +1,6 @@ + +Timeout 2400 +ProxyTimeout 2400 +ProxyBadHeader Ignore + +ProxyPass /midpoint ajp://localhost:9090/midpoint timeout=2400 \ No newline at end of file diff --git a/midpoint/midpoint-server/container_files/httpd/conf/midpoint.conf.auth.shibboleth b/midpoint/midpoint-server/container_files/httpd/conf/midpoint.conf.auth.shibboleth new file mode 100644 index 0000000..e827b9f --- /dev/null +++ b/midpoint/midpoint-server/container_files/httpd/conf/midpoint.conf.auth.shibboleth @@ -0,0 +1,15 @@ + +Timeout 2400 +ProxyTimeout 2400 +ProxyBadHeader Ignore + +ProxyPass /midpoint ajp://localhost:9090/midpoint timeout=2400 + + + + AuthType shibboleth + ShibRequestSetting requireSession 1 + ShibRequireSession on + ShibUseHeaders On + require shibboleth + diff --git a/midpoint/midpoint-server/container_files/httpd/conf/ssl-enable.conf b/midpoint/midpoint-server/container_files/httpd/conf/ssl-enable.conf new file mode 100644 index 0000000..35bf295 --- /dev/null +++ b/midpoint/midpoint-server/container_files/httpd/conf/ssl-enable.conf @@ -0,0 +1,28 @@ +# modern configuration, tweak to your needs +SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1 +SSLCipherSuite ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256 +SSLHonorCipherOrder on +SSLCompression off + +# OCSP Stapling, only in httpd 2.3.3 and later +SSLUseStapling on +SSLStaplingResponderTimeout 5 +SSLStaplingReturnResponderErrors off +SSLStaplingCache shmcb:/var/run/ocsp(128000) + +Listen 443 https + + RewriteEngine on + RewriteRule "^/$" "/midpoint/" [R] + + + SSLEngine on + SSLCertificateChainFile /etc/pki/tls/certs/cachain.pem + + SSLCertificateFile /etc/pki/tls/certs/host-cert.pem + + SSLCertificateKeyFile /etc/pki/tls/private/host-key.pem + + # HSTS (mod_headers is required) (15768000 seconds = 6 months) + Header always set Strict-Transport-Security "max-age=15768000" + diff --git a/midpoint/midpoint-server/container_files/log-prefix b/midpoint/midpoint-server/container_files/log-prefix deleted file mode 100755 index fb7c278..0000000 --- a/midpoint/midpoint-server/container_files/log-prefix +++ /dev/null @@ -1,7 +0,0 @@ -#!/bin/bash - -C=${COMPONENT//[;]/_} -L=${LOGFILE//[;]/_} -E=${ENV//[; ]/_} -U=${USERTOKEN//[; ]/_} -echo $C\;$L\;$E\;$U\; diff --git a/midpoint/midpoint-server/container_files/mp-dir/active-spring-profiles b/midpoint/midpoint-server/container_files/mp-dir/active-spring-profiles new file mode 100755 index 0000000..40058e6 --- /dev/null +++ b/midpoint/midpoint-server/container_files/mp-dir/active-spring-profiles @@ -0,0 +1,13 @@ +#!/bin/bash + +case $AUTHENTICATION in + shibboleth) + echo "default,sso" + ;; + internal) + echo "default" + ;; + *) + echo "default" +esac + diff --git a/midpoint/midpoint-server/container_files/repository-url b/midpoint/midpoint-server/container_files/mp-dir/repository-url similarity index 100% rename from midpoint/midpoint-server/container_files/repository-url rename to midpoint/midpoint-server/container_files/mp-dir/repository-url diff --git a/midpoint/midpoint-server/container_files/shibboleth/attribute-map.xml b/midpoint/midpoint-server/container_files/shibboleth/attribute-map.xml new file mode 100644 index 0000000..a6725f3 --- /dev/null +++ b/midpoint/midpoint-server/container_files/shibboleth/attribute-map.xml @@ -0,0 +1,153 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/midpoint/midpoint-server/container_files/shibboleth/native.logger b/midpoint/midpoint-server/container_files/shibboleth/native.logger new file mode 100644 index 0000000..0b01f32 --- /dev/null +++ b/midpoint/midpoint-server/container_files/shibboleth/native.logger @@ -0,0 +1,39 @@ +# set overall behavior +log4j.rootCategory=INFO, native_log, warn_log + +# fairly verbose for DEBUG, so generally leave at INFO +log4j.category.XMLTooling.XMLObject=INFO +log4j.category.XMLTooling.KeyInfoResolver=INFO +log4j.category.Shibboleth.IPRange=INFO +log4j.category.Shibboleth.PropertySet=INFO + +# raise for low-level tracing of SOAP client HTTP/SSL behavior +log4j.category.XMLTooling.libcurl=INFO + +# useful categories to tune independently: +# +# tracing of SAML messages and security policies +#log4j.category.OpenSAML.MessageDecoder=DEBUG +#log4j.category.OpenSAML.MessageEncoder=DEBUG +#log4j.category.OpenSAML.SecurityPolicyRule=DEBUG +# interprocess message remoting +#log4j.category.Shibboleth.Listener=DEBUG +# mapping of requests to applicationId +#log4j.category.Shibboleth.RequestMapper=DEBUG +# high level session cache operations +#log4j.category.Shibboleth.SessionCache=DEBUG +# persistent storage and caching +#log4j.category.XMLTooling.StorageService=DEBUG + +# define the appender + +log4j.appender.native_log=org.apache.log4j.FileAppender +log4j.appender.native_log.fileName=/tmp/logpipe +log4j.appender.native_log.layout=org.apache.log4j.PatternLayout +log4j.appender.native_log.layout.ConversionPattern=shibd;native.log;${ENV};${USERTOKEN};%d{%Y-%m-%d %H:%M:%S} %p %c %x: %m%n + +log4j.appender.warn_log=org.apache.log4j.FileAppender +log4j.appender.warn_log.fileName=/tmp/logpipe +log4j.appender.warn_log.layout=org.apache.log4j.PatternLayout +log4j.appender.warn_log.layout.ConversionPattern=shibd;native_warn.log;${ENV};${USERTOKEN};%d{%Y-%m-%d %H:%M:%S} %p %c %x: %m%n +log4j.appender.warn_log.threshold=WARN diff --git a/midpoint/midpoint-server/container_files/shibboleth/shibd.logger b/midpoint/midpoint-server/container_files/shibboleth/shibd.logger new file mode 100644 index 0000000..c5685b2 --- /dev/null +++ b/midpoint/midpoint-server/container_files/shibboleth/shibd.logger @@ -0,0 +1,59 @@ +# set overall behavior +log4j.rootCategory=INFO, shibd_log + +# fairly verbose for DEBUG, so generally leave at INFO +log4j.category.XMLTooling.XMLObject=INFO +log4j.category.XMLTooling.KeyInfoResolver=INFO +log4j.category.Shibboleth.IPRange=INFO +log4j.category.Shibboleth.PropertySet=INFO + +# raise for low-level tracing of SOAP client HTTP/SSL behavior +log4j.category.XMLTooling.libcurl=INFO + +# useful categories to tune independently: +# +# tracing of SAML messages and security policies +#log4j.category.OpenSAML.MessageDecoder=DEBUG +#log4j.category.OpenSAML.MessageEncoder=DEBUG +#log4j.category.OpenSAML.SecurityPolicyRule=DEBUG +#log4j.category.XMLTooling.SOAPClient=DEBUG +# interprocess message remoting +#log4j.category.Shibboleth.Listener=DEBUG +# mapping of requests to applicationId +#log4j.category.Shibboleth.RequestMapper=DEBUG +# high level session cache operations +#log4j.category.Shibboleth.SessionCache=DEBUG +# persistent storage and caching +#log4j.category.XMLTooling.StorageService=DEBUG + +# logs XML being signed or verified if set to DEBUG +log4j.category.XMLTooling.Signature.Debugger=INFO, sig_log +log4j.additivity.XMLTooling.Signature.Debugger=false + +# the tran log blocks the "default" appender(s) at runtime +# Level should be left at INFO for this category +log4j.category.Shibboleth-TRANSACTION=INFO, tran_log +log4j.additivity.Shibboleth-TRANSACTION=false +# uncomment to suppress particular event types +#log4j.category.Shibboleth-TRANSACTION.AuthnRequest=WARN +#log4j.category.Shibboleth-TRANSACTION.Login=WARN +#log4j.category.Shibboleth-TRANSACTION.Logout=WARN + +# define the appenders + +log4j.appender.shibd_log=org.apache.log4j.FileAppender +log4j.appender.shibd_log.fileName=/tmp/logpipe +log4j.appender.shibd_log.maxFileSize=0 +log4j.appender.shibd_log.layout=org.apache.log4j.PatternLayout +log4j.appender.shibd_log.layout.ConversionPattern=shibd;shibd.log;${ENV};${USERTOKEN};%d{%Y-%m-%d %H:%M:%S} %p %c %x: %m%n + +log4j.appender.tran_log=org.apache.log4j.FileAppender +log4j.appender.tran_log.fileName=/tmp/logpipe +log4j.appender.tran_log.maxFileSize=0 +log4j.appender.tran_log.layout=org.apache.log4j.PatternLayout +log4j.appender.tran_log.layout.ConversionPattern=shibd;transaction.log;${ENV};${USERTOKEN};%d{%Y-%m-%d %H:%M:%S} %p %c %x: %m%n + +log4j.appender.sig_log=org.apache.log4j.FileAppender +log4j.appender.sig_log.fileName=/tmp/logpipe +log4j.appender.sig_log.layout=org.apache.log4j.PatternLayout +log4j.appender.sig_log.layout.ConversionPattern=shibd;signature.log;${ENV};${USERTOKEN};%m diff --git a/midpoint/midpoint-server/container_files/usr-local-bin/entrypoint.sh b/midpoint/midpoint-server/container_files/usr-local-bin/entrypoint.sh new file mode 100755 index 0000000..a275bd2 --- /dev/null +++ b/midpoint/midpoint-server/container_files/usr-local-bin/entrypoint.sh @@ -0,0 +1,38 @@ +#!/bin/bash + +# normalizing logging variables as required by TIER +export ENV=${ENV//[; ]/_} +export USERTOKEN=${USERTOKEN//[; ]/_} + +echo "Linking secrets and config files; using authentication: $AUTHENTICATION" +ln -sf /run/secrets/shib_sp-key.pem /etc/shibboleth/sp-key.pem +ln -sf /run/secrets/host-key.pem /etc/pki/tls/private/host-key.pem +ln -sf /etc/httpd/conf.d/midpoint.conf.auth.$AUTHENTICATION /etc/httpd/conf.d/midpoint.conf + +httpd-shib-foreground & + +if [ "$AUTHENTICATION" = "shibboleth" ]; then + LOGOUT_URL_DIRECTIVE="-Dauth.logout.url=$LOGOUT_URL" +else + LOGOUT_URL_DIRECTIVE= +fi + +java -Xmx$MEM -Xms2048m -Dfile.encoding=UTF8 \ + -Dmidpoint.home=$MP_DIR/var \ + -Dmidpoint.repository.database=$REPO_DATABASE_TYPE \ + -Dmidpoint.repository.jdbcUsername=$REPO_USER \ + -Dmidpoint.repository.jdbcPassword_FILE=$REPO_PASSWORD_FILE \ + -Dmidpoint.repository.jdbcUrl="`$MP_DIR/repository-url`" \ + -Dmidpoint.repository.hibernateHbm2ddl=none \ + -Dmidpoint.repository.missingSchemaAction=create \ + -Dmidpoint.repository.initializationFailTimeout=60000 \ + -Dmidpoint.keystore.keyStorePassword_FILE=$KEYSTORE_PASSWORD_FILE \ + -Dmidpoint.logging.console.enabled=true \ + -Dmidpoint.logging.console.prefix="midpoint;midpoint.log;$ENV;$USERTOKEN;" \ + -Dmidpoint.logging.console.timezone=UTC \ + -Dspring.profiles.active="`$MP_DIR/active-spring-profiles`" \ + -Dauth.sso.header=$SSO_HEADER \ + $LOGOUT_URL_DIRECTIVE \ + -Dserver.tomcat.ajp.enabled=$AJP_ENABLED \ + -Dserver.tomcat.ajp.port=$AJP_PORT \ + -jar $MP_DIR/lib/midpoint.war From 238724047712ab245b8af29edb54b626df1a526e Mon Sep 17 00:00:00 2001 From: Pavol Mederly Date: Wed, 19 Sep 2018 23:31:29 +0200 Subject: [PATCH 2/3] Add demo Shibboleth containers These containers are used to demonstrate Shibboleth-based SSO capabilities of TIER midPoint Docker container. They are NOT to be used in "midPoint-Grouper" demo. --- .../shibboleth/idp-metadata.xml | 207 +++++++++++++ .../shibboleth/shibboleth2.xml | 136 ++++++++ .../shibboleth/sp-cert.pem | 20 ++ .../configs-and-secrets/shibboleth/sp-key.pem | 28 ++ demo/shibboleth/directory/Dockerfile | 30 ++ .../container_files/seed-data/ds-setup.inf | 28 ++ .../container_files/seed-data/users.ldif | 24 ++ demo/shibboleth/docker-compose.yml | 37 +++ demo/shibboleth/idp/Dockerfile | 5 + .../shibboleth-idp/conf/attribute-filter.xml | 29 ++ .../conf/attribute-resolver.xml | 293 ++++++++++++++++++ .../idp/shibboleth-idp/conf/idp.properties | 195 ++++++++++++ .../idp/shibboleth-idp/conf/ldap.properties | 58 ++++ .../conf/metadata-providers.xml | 80 +++++ .../credentials/idp-backchannel.crt | 19 ++ .../credentials/idp-backchannel.p12 | Bin 0 -> 2500 bytes .../credentials/idp-browser.p12 | Bin 0 -> 2470 bytes .../credentials/idp-encryption.crt | 19 ++ .../credentials/idp-encryption.key | 27 ++ .../credentials/idp-signing.crt | 19 ++ .../credentials/idp-signing.key | 27 ++ .../idp/shibboleth-idp/credentials/sealer.jks | Bin 0 -> 500 bytes .../shibboleth-idp/credentials/sealer.kver | 2 + .../shibboleth-idp/metadata/idp-metadata.xml | 207 +++++++++++++ .../shibboleth-idp/metadata/midpoint-sp.xml | 80 +++++ 25 files changed, 1570 insertions(+) create mode 100644 demo/shibboleth/configs-and-secrets/shibboleth/idp-metadata.xml create mode 100644 demo/shibboleth/configs-and-secrets/shibboleth/shibboleth2.xml create mode 100644 demo/shibboleth/configs-and-secrets/shibboleth/sp-cert.pem create mode 100644 demo/shibboleth/configs-and-secrets/shibboleth/sp-key.pem create mode 100644 demo/shibboleth/directory/Dockerfile create mode 100644 demo/shibboleth/directory/container_files/seed-data/ds-setup.inf create mode 100644 demo/shibboleth/directory/container_files/seed-data/users.ldif create mode 100644 demo/shibboleth/docker-compose.yml create mode 100644 demo/shibboleth/idp/Dockerfile create mode 100644 demo/shibboleth/idp/shibboleth-idp/conf/attribute-filter.xml create mode 100644 demo/shibboleth/idp/shibboleth-idp/conf/attribute-resolver.xml create mode 100644 demo/shibboleth/idp/shibboleth-idp/conf/idp.properties create mode 100644 demo/shibboleth/idp/shibboleth-idp/conf/ldap.properties create mode 100644 demo/shibboleth/idp/shibboleth-idp/conf/metadata-providers.xml create mode 100644 demo/shibboleth/idp/shibboleth-idp/credentials/idp-backchannel.crt create mode 100644 demo/shibboleth/idp/shibboleth-idp/credentials/idp-backchannel.p12 create mode 100644 demo/shibboleth/idp/shibboleth-idp/credentials/idp-browser.p12 create mode 100644 demo/shibboleth/idp/shibboleth-idp/credentials/idp-encryption.crt create mode 100644 demo/shibboleth/idp/shibboleth-idp/credentials/idp-encryption.key create mode 100644 demo/shibboleth/idp/shibboleth-idp/credentials/idp-signing.crt create mode 100644 demo/shibboleth/idp/shibboleth-idp/credentials/idp-signing.key create mode 100644 demo/shibboleth/idp/shibboleth-idp/credentials/sealer.jks create mode 100644 demo/shibboleth/idp/shibboleth-idp/credentials/sealer.kver create mode 100644 demo/shibboleth/idp/shibboleth-idp/metadata/idp-metadata.xml create mode 100644 demo/shibboleth/idp/shibboleth-idp/metadata/midpoint-sp.xml diff --git a/demo/shibboleth/configs-and-secrets/shibboleth/idp-metadata.xml b/demo/shibboleth/configs-and-secrets/shibboleth/idp-metadata.xml new file mode 100644 index 0000000..35914b7 --- /dev/null +++ b/demo/shibboleth/configs-and-secrets/shibboleth/idp-metadata.xml @@ -0,0 +1,207 @@ + + + + + + + + example.org + + + + + + + +MIIDEzCCAfugAwIBAgIUS9SuTXwsFVVG+LjOEAbLqqT/el0wDQYJKoZIhvcNAQEL +BQAwFTETMBEGA1UEAwwKaWRwdGVzdGJlZDAeFw0xNTEyMTEwMjIwMjZaFw0zNTEy +MTEwMjIwMjZaMBUxEzARBgNVBAMMCmlkcHRlc3RiZWQwggEiMA0GCSqGSIb3DQEB +AQUAA4IBDwAwggEKAoIBAQCMAoDHx8xCIfv/6QKqt9mcHYmEJ8y2dKprUbpdcOjH +YvNPIl/lHPsUyrb+Nc+q2CDeiWjVk1mWYq0UpIwpBMuw1H6+oOqr4VQRi65pin0M +SfE0MWIaFo5FPvpvoptkHD4gvREbm4swyXGMczcMRfqgalFXhUD2wz8W3XAM5Cq2 +03XeJbj6TwjvKatG5XPdeUe2FBGuOO2q54L1hcIGnLMCQrg7D31lR13PJbjnJ0No +5C3k8TPuny6vJsBC03GNLNKfmrKVTdzr3VKp1uay1G3DL9314fgmbl8HA5iRQmy+ +XInUU6/8NXZSF59p3ITAOvZQeZsbJjg5gGDip5OZo9YlAgMBAAGjWzBZMB0GA1Ud +DgQWBBRPlM4VkKZ0U4ec9GrIhFQl0hNbLDA4BgNVHREEMTAvggppZHB0ZXN0YmVk +hiFodHRwczovL2lkcHRlc3RiZWQvaWRwL3NoaWJib2xldGgwDQYJKoZIhvcNAQEL +BQADggEBAIZ0a1ov3my3ljJG588I/PHx+TxAWONWmpKbO9c/qI3Drxk4oRIffiac +ANxdvtabgIzrlk5gMMisD7oyqHJiWgKv5Bgctd8w3IS3lLl7wHX65mTKQRXniG98 +NIjkvfrhe2eeJxecOqnDI8GOhIGCIqZUn8ShdM/yHjhQ2Mh0Hj3U0LlKvnmfGSQl +j0viGwbFCaNaIP3zc5UmCrdE5h8sWL3Fu7ILKM9RyFa2ILHrJScV9t623IcHffHP +IeaY/WtuapsrqRFxuQL9QFWN0FsRIdLmjTq+00+B/XnnKRKFBuWfjhHLF/uu8f+E +t6Lf23Kb8yD6ZR7dihMZAGHnYQ/hlhM= + + + + + + + + + +MIIDFDCCAfygAwIBAgIVAN3vv+b7KN5Se9m1RZsCllp/B/hdMA0GCSqGSIb3DQEB +CwUAMBUxEzARBgNVBAMMCmlkcHRlc3RiZWQwHhcNMTUxMjExMDIyMDE0WhcNMzUx +MjExMDIyMDE0WjAVMRMwEQYDVQQDDAppZHB0ZXN0YmVkMIIBIjANBgkqhkiG9w0B +AQEFAAOCAQ8AMIIBCgKCAQEAh91caeY0Q85uhaUyqFwP2bMjwMFxMzRlAoqBHd7g +u6eo4duaeLz1BaoR2XTBpNNvFR5oHH+TkKahVDGeH5+kcnIpxI8JPdsZml1srvf2 +Z6dzJsulJZUdpqnngycTkGtZgEoC1vmYVky2BSAIIifmdh6s0epbHnMGLsHzMKfJ +Cb/Q6dYzRWTCPtzE2VMuQqqWgeyMr7u14x/Vqr9RPEFsgY8GIu5jzB6AyUIwrLg+ +MNkv6aIdcHwxYTGL7ijfy6rSWrgBflQoYRYNEnseK0ZHgJahz4ovCag6wZAoPpBs +uYlY7lEr89Ucb6NHx3uqGMsXlDFdE4QwfDLLhCYHPvJ0uwIDAQABo1swWTAdBgNV +HQ4EFgQUAkOgED3iYdmvQEOMm6u/JmD/UTQwOAYDVR0RBDEwL4IKaWRwdGVzdGJl +ZIYhaHR0cHM6Ly9pZHB0ZXN0YmVkL2lkcC9zaGliYm9sZXRoMA0GCSqGSIb3DQEB +CwUAA4IBAQBIdd4YWlnvJjql8+zKKgmWgIY7U8DA8e6QcbAf8f8cdE33RSnjI63X +sv/y9GfmbAVAD6RIAXPFFeRYJ08GOxGI9axfNaKdlsklJ9bk4ducHqgCSWYVer3s +RQBjxyOfSTvk9YCJvdJVQRJLcCvxwKakFCsOSnV3t9OvN86Ak+fKPVB5j2fM/0fZ +Kqjn3iqgdNPTLXPsuJLJO5lITRiBa4onmVelAiCstI9PQiaEck+oAHnMTnC9JE/B +DHv3e4rwq3LznlqPw0GSd7xqNTdMDwNOWjkuOr3sGpWS8ms/ZHHXV1Vd22uPe70i +s00xrv14zLifcc8oj5DYzOhYRifRXgHX + + + + + + + + + +MIIDEzCCAfugAwIBAgIUG6Nn1rlERS1vsi88tcdzSYX0oqAwDQYJKoZIhvcNAQEL +BQAwFTETMBEGA1UEAwwKaWRwdGVzdGJlZDAeFw0xNTEyMTEwMjIwMTRaFw0zNTEy +MTEwMjIwMTRaMBUxEzARBgNVBAMMCmlkcHRlc3RiZWQwggEiMA0GCSqGSIb3DQEB +AQUAA4IBDwAwggEKAoIBAQCBXv0o3fmT8iluyLjJ4lBAVCW+ZRVyEXPYQuRi7vfD +cO4a6d1kxiJLsaK0W88VNxjFQRr8PgDkWr28vwoH1rgk4pLsszLD48DBzD942peJ +l/S6FnsIJjmaHcBh4pbNhU4yowu63iKkvttrcZAEbpEro6Z8CziWEx8sywoaYEQG +ifPkr9ORV6Cn3txq+9gMBePG41GrtZrUGIu+xrndL0Shh4Pq0eq/9MAsVlIIXEa8 +9WfH8J2kFcTOfoWtIc70b7TLZQsx4YnNcnrGLSUEcstFyPLX+Xtv5SNZF89OOIxX +VNjNvgE5DbJb9hMM4UAFqI+1bo9QqtxwThjc/sOvIxzNAgMBAAGjWzBZMB0GA1Ud +DgQWBBStTyogRPuAVG6q7yPyav1uvE+7pTA4BgNVHREEMTAvggppZHB0ZXN0YmVk +hiFodHRwczovL2lkcHRlc3RiZWQvaWRwL3NoaWJib2xldGgwDQYJKoZIhvcNAQEL +BQADggEBAFMfoOv+oISGjvamq7+Y4G7ep5vxlAPeK3RATYPYvAmyH946qZXh98ni +QXyuqZW5P5eEt86toY45IwDU5r09SKwHughEe99iiEkxh0mb2qo84qX9/qcg+kyN +jeLd/OSyolpUCEFNwOFcog7pj7Eer+6AHbwTn1Mjb5TBsKwtDMJsaxPvdj0u7M5r +xL/wHkFhn1rCo2QiojzjSlV3yLTh49iTyhE3cG+RxaNKDCxhp0jSSLX1BW/ZoPA8 ++PMJEA+Q0QbyRD8aJOHN5O8jGxCa/ZzcOnYVL6AsEXoDiY3vAUYh1FUonOWw0m9H +p+tGUbGS2l873J5PrsbpeKEVR/IIoKo= + + + + + + + urn:mace:shibboleth:1.0:nameIdentifier + urn:oasis:names:tc:SAML:2.0:nameid-format:transient + + + + + + + + + + + + + localhost + + + + + + +MIIDEzCCAfugAwIBAgIUS9SuTXwsFVVG+LjOEAbLqqT/el0wDQYJKoZIhvcNAQEL +BQAwFTETMBEGA1UEAwwKaWRwdGVzdGJlZDAeFw0xNTEyMTEwMjIwMjZaFw0zNTEy +MTEwMjIwMjZaMBUxEzARBgNVBAMMCmlkcHRlc3RiZWQwggEiMA0GCSqGSIb3DQEB +AQUAA4IBDwAwggEKAoIBAQCMAoDHx8xCIfv/6QKqt9mcHYmEJ8y2dKprUbpdcOjH +YvNPIl/lHPsUyrb+Nc+q2CDeiWjVk1mWYq0UpIwpBMuw1H6+oOqr4VQRi65pin0M +SfE0MWIaFo5FPvpvoptkHD4gvREbm4swyXGMczcMRfqgalFXhUD2wz8W3XAM5Cq2 +03XeJbj6TwjvKatG5XPdeUe2FBGuOO2q54L1hcIGnLMCQrg7D31lR13PJbjnJ0No +5C3k8TPuny6vJsBC03GNLNKfmrKVTdzr3VKp1uay1G3DL9314fgmbl8HA5iRQmy+ +XInUU6/8NXZSF59p3ITAOvZQeZsbJjg5gGDip5OZo9YlAgMBAAGjWzBZMB0GA1Ud +DgQWBBRPlM4VkKZ0U4ec9GrIhFQl0hNbLDA4BgNVHREEMTAvggppZHB0ZXN0YmVk +hiFodHRwczovL2lkcHRlc3RiZWQvaWRwL3NoaWJib2xldGgwDQYJKoZIhvcNAQEL +BQADggEBAIZ0a1ov3my3ljJG588I/PHx+TxAWONWmpKbO9c/qI3Drxk4oRIffiac +ANxdvtabgIzrlk5gMMisD7oyqHJiWgKv5Bgctd8w3IS3lLl7wHX65mTKQRXniG98 +NIjkvfrhe2eeJxecOqnDI8GOhIGCIqZUn8ShdM/yHjhQ2Mh0Hj3U0LlKvnmfGSQl +j0viGwbFCaNaIP3zc5UmCrdE5h8sWL3Fu7ILKM9RyFa2ILHrJScV9t623IcHffHP +IeaY/WtuapsrqRFxuQL9QFWN0FsRIdLmjTq+00+B/XnnKRKFBuWfjhHLF/uu8f+E +t6Lf23Kb8yD6ZR7dihMZAGHnYQ/hlhM= + + + + + + + + + +MIIDFDCCAfygAwIBAgIVAN3vv+b7KN5Se9m1RZsCllp/B/hdMA0GCSqGSIb3DQEB +CwUAMBUxEzARBgNVBAMMCmlkcHRlc3RiZWQwHhcNMTUxMjExMDIyMDE0WhcNMzUx +MjExMDIyMDE0WjAVMRMwEQYDVQQDDAppZHB0ZXN0YmVkMIIBIjANBgkqhkiG9w0B +AQEFAAOCAQ8AMIIBCgKCAQEAh91caeY0Q85uhaUyqFwP2bMjwMFxMzRlAoqBHd7g +u6eo4duaeLz1BaoR2XTBpNNvFR5oHH+TkKahVDGeH5+kcnIpxI8JPdsZml1srvf2 +Z6dzJsulJZUdpqnngycTkGtZgEoC1vmYVky2BSAIIifmdh6s0epbHnMGLsHzMKfJ +Cb/Q6dYzRWTCPtzE2VMuQqqWgeyMr7u14x/Vqr9RPEFsgY8GIu5jzB6AyUIwrLg+ +MNkv6aIdcHwxYTGL7ijfy6rSWrgBflQoYRYNEnseK0ZHgJahz4ovCag6wZAoPpBs +uYlY7lEr89Ucb6NHx3uqGMsXlDFdE4QwfDLLhCYHPvJ0uwIDAQABo1swWTAdBgNV +HQ4EFgQUAkOgED3iYdmvQEOMm6u/JmD/UTQwOAYDVR0RBDEwL4IKaWRwdGVzdGJl +ZIYhaHR0cHM6Ly9pZHB0ZXN0YmVkL2lkcC9zaGliYm9sZXRoMA0GCSqGSIb3DQEB +CwUAA4IBAQBIdd4YWlnvJjql8+zKKgmWgIY7U8DA8e6QcbAf8f8cdE33RSnjI63X +sv/y9GfmbAVAD6RIAXPFFeRYJ08GOxGI9axfNaKdlsklJ9bk4ducHqgCSWYVer3s +RQBjxyOfSTvk9YCJvdJVQRJLcCvxwKakFCsOSnV3t9OvN86Ak+fKPVB5j2fM/0fZ +Kqjn3iqgdNPTLXPsuJLJO5lITRiBa4onmVelAiCstI9PQiaEck+oAHnMTnC9JE/B +DHv3e4rwq3LznlqPw0GSd7xqNTdMDwNOWjkuOr3sGpWS8ms/ZHHXV1Vd22uPe70i +s00xrv14zLifcc8oj5DYzOhYRifRXgHX + + + + + + + + + +MIIDEzCCAfugAwIBAgIUG6Nn1rlERS1vsi88tcdzSYX0oqAwDQYJKoZIhvcNAQEL +BQAwFTETMBEGA1UEAwwKaWRwdGVzdGJlZDAeFw0xNTEyMTEwMjIwMTRaFw0zNTEy +MTEwMjIwMTRaMBUxEzARBgNVBAMMCmlkcHRlc3RiZWQwggEiMA0GCSqGSIb3DQEB +AQUAA4IBDwAwggEKAoIBAQCBXv0o3fmT8iluyLjJ4lBAVCW+ZRVyEXPYQuRi7vfD +cO4a6d1kxiJLsaK0W88VNxjFQRr8PgDkWr28vwoH1rgk4pLsszLD48DBzD942peJ +l/S6FnsIJjmaHcBh4pbNhU4yowu63iKkvttrcZAEbpEro6Z8CziWEx8sywoaYEQG +ifPkr9ORV6Cn3txq+9gMBePG41GrtZrUGIu+xrndL0Shh4Pq0eq/9MAsVlIIXEa8 +9WfH8J2kFcTOfoWtIc70b7TLZQsx4YnNcnrGLSUEcstFyPLX+Xtv5SNZF89OOIxX +VNjNvgE5DbJb9hMM4UAFqI+1bo9QqtxwThjc/sOvIxzNAgMBAAGjWzBZMB0GA1Ud +DgQWBBStTyogRPuAVG6q7yPyav1uvE+7pTA4BgNVHREEMTAvggppZHB0ZXN0YmVk +hiFodHRwczovL2lkcHRlc3RiZWQvaWRwL3NoaWJib2xldGgwDQYJKoZIhvcNAQEL +BQADggEBAFMfoOv+oISGjvamq7+Y4G7ep5vxlAPeK3RATYPYvAmyH946qZXh98ni +QXyuqZW5P5eEt86toY45IwDU5r09SKwHughEe99iiEkxh0mb2qo84qX9/qcg+kyN +jeLd/OSyolpUCEFNwOFcog7pj7Eer+6AHbwTn1Mjb5TBsKwtDMJsaxPvdj0u7M5r +xL/wHkFhn1rCo2QiojzjSlV3yLTh49iTyhE3cG+RxaNKDCxhp0jSSLX1BW/ZoPA8 ++PMJEA+Q0QbyRD8aJOHN5O8jGxCa/ZzcOnYVL6AsEXoDiY3vAUYh1FUonOWw0m9H +p+tGUbGS2l873J5PrsbpeKEVR/IIoKo= + + + + + + + + + + + + + + diff --git a/demo/shibboleth/configs-and-secrets/shibboleth/shibboleth2.xml b/demo/shibboleth/configs-and-secrets/shibboleth/shibboleth2.xml new file mode 100644 index 0000000..a644264 --- /dev/null +++ b/demo/shibboleth/configs-and-secrets/shibboleth/shibboleth2.xml @@ -0,0 +1,136 @@ + + + + + + + + + + + + + + + + + SAML2 + + + + SAML2 Local + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/demo/shibboleth/configs-and-secrets/shibboleth/sp-cert.pem b/demo/shibboleth/configs-and-secrets/shibboleth/sp-cert.pem new file mode 100644 index 0000000..9cc228a --- /dev/null +++ b/demo/shibboleth/configs-and-secrets/shibboleth/sp-cert.pem @@ -0,0 +1,20 @@ +-----BEGIN CERTIFICATE----- +MIIDPDCCAiQCCQDNZe8r0hVtuTANBgkqhkiG9w0BAQUFADBgMQswCQYDVQQGEwJV +UzELMAkGA1UECAwCTUkxEjAQBgNVBAcMCUFubiBBcmJvcjEXMBUGA1UECgwOSW50 +ZXJuZXQyL1RJRVIxFzAVBgNVBAMMDnNwLmV4YW1wbGUub3JnMB4XDTE3MDkyMjE5 +NTAzNVoXDTI3MDkyMDE5NTAzNVowYDELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAk1J +MRIwEAYDVQQHDAlBbm4gQXJib3IxFzAVBgNVBAoMDkludGVybmV0Mi9USUVSMRcw +FQYDVQQDDA5zcC5leGFtcGxlLm9yZzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC +AQoCggEBAMTNJmsNpTpR4NrDJwOgK/o3UYlNdi1c6xBflt+liLAsQc160QReV4dS +SGK8LZvN58a/BTIsH8dLhQlUQ8qQUY2AfolVrNxb7Waumeh/POzYUTRylnoGpU3W +bGMEPxE/AdgP5U/adYvyu4XI5epv7wjZJOTqcVag15SalY+aso+ZC/5l+UzRxmWB +ZxKTsSL1y7PFehY4/Zl3Y3oGVsVl/zspt5lteoZQeeVxUX29S3Af11yHY4xpEp+7 +rvAzY/nlsTiHAsUoCFK/NFQ2evvSRx52B9Fk1cWP1MDVDm2QjQqD9xBGYSnX6bhQ +ejVx7JUJHlblu2Q5p5XdW0BihgFluoECAwEAATANBgkqhkiG9w0BAQUFAAOCAQEA +n/qhYnIviPs4tglCdrw+M7gbqKNWadDC3F9HDYzlJMFeS/ae2turhEUgQPbYPDQQ +eO3oOILtvCXNFUPM58jf8V5YFRrOqrTgx44kexQDaHO5YYNft5tF5TdvBYE2gOVr +GdYrH2iSP8WX+Yy7JH5uqkfwWzEntWHJdey39rCWKAUCCB35+/2b4N53Qmlv2+ug +CpNJYFtXInd4YMmM5HjXLyoWXtjnKiwDqYUCeYPSwAajnCqRqRXUX0gYTFDRiwRP +HbmO9We0nqoc/71nikmGGoSRMO/zWVMFjwmAx1fGiWdU61sjGX8sHifzmVyJVEBI +Z75p+JrWYZJYrx/vpWxL8g== +-----END CERTIFICATE----- diff --git a/demo/shibboleth/configs-and-secrets/shibboleth/sp-key.pem b/demo/shibboleth/configs-and-secrets/shibboleth/sp-key.pem new file mode 100644 index 0000000..1b0b579 --- /dev/null +++ b/demo/shibboleth/configs-and-secrets/shibboleth/sp-key.pem @@ -0,0 +1,28 @@ +-----BEGIN PRIVATE KEY----- +MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDEzSZrDaU6UeDa +wycDoCv6N1GJTXYtXOsQX5bfpYiwLEHNetEEXleHUkhivC2bzefGvwUyLB/HS4UJ +VEPKkFGNgH6JVazcW+1mrpnofzzs2FE0cpZ6BqVN1mxjBD8RPwHYD+VP2nWL8ruF +yOXqb+8I2STk6nFWoNeUmpWPmrKPmQv+ZflM0cZlgWcSk7Ei9cuzxXoWOP2Zd2N6 +BlbFZf87KbeZbXqGUHnlcVF9vUtwH9dch2OMaRKfu67wM2P55bE4hwLFKAhSvzRU +Nnr70kcedgfRZNXFj9TA1Q5tkI0Kg/cQRmEp1+m4UHo1ceyVCR5W5btkOaeV3VtA +YoYBZbqBAgMBAAECggEAA/5t0ypZug9DUu0283niqpdIzlKGHXGPS6vE8hD37ytW +wobFiyMm/5YJ5gcPnePV2lCyGEyQ8Ih10LSnE4tOPGLpLnxQn8A11ymf8fnzEJNr +Qnc42o0b+bJqTLAfX4g5z1qzOqWiUQ7CA3sKP3G6FiHh/8tKNYnaFif09Q8cpJFb +YDDkvm48NJgsrIoCgmaFIQIn+yDzGQKWwTNMIks+RByWpc67j1x1kiyQM1RfrEev +Yyq/ZkP66IYZzmZKpFCWGs5qbRZdxyXNpq85DjwA99lAH7vxtMJHQM4z1h1eDH4L +Ma5hEnmmHu4D5lF2GDQYflvuFdDGH5tThO6MV0IrSQKBgQD+kvEtNxJCMxLOVFyV +NWF3pk/i2nkD+53t/VPXjMPtW7IesouEGzU82I/fT2wUTkNwFdkVpv37qoLypKZm +npJFxr6abQNjiDh2Fsh8/iuJfvdZUFJbCEY6NS58qgjix8XCQKRD06EugK7uekIZ +zJnttF3qVBBD8Z8Uwxz8i+jF1wKBgQDF51y/5XB6Bz47cdxw7P8NsfnTz2V3H0HU +OnlEBANbhmBadjU8dqbM54Nxbn7VOdooXPuSnAKJ9vPDg1n5Y/GO+lgldNzfyK6g +HnbldSu0zBvAaGvmAjLjetEtOkBqYkrHJlT6JAems/Kc/YX5uooAz9/jNJFXP9++ +KbjH3CzHZwKBgQC6ppxEDZPKi83nD/2NvMTIyFzcNFj0LaEepFW7vc7NkiSn0zrt +0lEXWqUqEv5oaPWTEcHH2VdxFRTLuSL0LKGMnWqUqQcKDA9xrcSzuFvNhRTwHC81 +5XwwI1wBNV4sgFKj2WdW/6y2/szDt0oNxnC50zvkmlwOpPKBc4kmNaKmowKBgBmC +uXIDIXyZcmw3QTNNWZNqXcnv8iRo4xN4dilOWyBxMfp3QmWI5feD4G2+0Jqr2nNZ +iRRdB/bA3qtVQ0PinkDQBIzPg6lVNS1uv+TUNc4YgXtL+pyrq+Om8U/jMmqEQR9q +0YltG49houSZyatnYGK6aSHgpNuaYD0jI66fsyYBAoGAMefyD0I/ncArjuf58hVQ +zSjxfcvlja9okrC8ZgqsVluezcm4rQNcSjBnESGTCjJC7O29AofGLHkvnsBQDiGk +hE38IRisd+okXdApr41ifWDhmtASud5q6wlhOpMmQxg+OALf1rTvFYhbnFEXV/KY +e5A4iXLRIbxbmXZDa35Rebw= +-----END PRIVATE KEY----- diff --git a/demo/shibboleth/directory/Dockerfile b/demo/shibboleth/directory/Dockerfile new file mode 100644 index 0000000..6e87782 --- /dev/null +++ b/demo/shibboleth/directory/Dockerfile @@ -0,0 +1,30 @@ +FROM centos:centos7 + +LABEL author="tier-packaging@internet2.edu " + +RUN yum install -y epel-release \ + && yum update -y \ + && yum install -y 389-ds-base 389-admin 389-adminutil \ + && yum clean all \ + && rm -rf /var/cache/yum + +COPY container_files/seed-data/ /seed-data/ + +RUN useradd ldapadmin \ + && rm -fr /var/lock /usr/lib/systemd/system \ + # The 389-ds setup will fail because the hostname can't reliable be determined, so we'll bypass it and then install. \ + && sed -i 's/checkHostname {/checkHostname {\nreturn();/g' /usr/lib64/dirsrv/perl/DSUtil.pm \ + # Not doing SELinux \ + && sed -i 's/updateSelinuxPolicy($inf);//g' /usr/lib64/dirsrv/perl/* \ + # Do not restart at the end \ + && sed -i '/if (@errs = startServer($inf))/,/}/d' /usr/lib64/dirsrv/perl/* \ + && setup-ds.pl --silent --file /seed-data/ds-setup.inf \ + && /usr/sbin/ns-slapd -D /etc/dirsrv/slapd-dir \ + && while ! curl -s ldap://localhost:389 > /dev/null; do echo waiting for ldap to start; sleep 1; done; \ + ldapadd -H ldap:/// -f /seed-data/users.ldif -x -D "cn=Directory Manager" -w password + +EXPOSE 389 + +# temporary! + +CMD rm -rf /var/lock/dirsrv/slapd-dir/server/* && /usr/sbin/ns-slapd -D /etc/dirsrv/slapd-dir && sleep 100000000 diff --git a/demo/shibboleth/directory/container_files/seed-data/ds-setup.inf b/demo/shibboleth/directory/container_files/seed-data/ds-setup.inf new file mode 100644 index 0000000..96c29a1 --- /dev/null +++ b/demo/shibboleth/directory/container_files/seed-data/ds-setup.inf @@ -0,0 +1,28 @@ +[General] +AdminDomain = internet2.edu +ConfigDirectoryAdminID = admin +ConfigDirectoryAdminPwd = admin +ConfigDirectoryLdapURL = ldap://localhost:389/o=NetscapeRoot +FullMachineName = localhost +ServerRoot = /usr/lib64/dirsrv +SuiteSpotGroup = nobody +SuiteSpotUserID = nobody + +[admin] +Port = 9830 +ServerAdminID = admin +ServerAdminPwd = admin +ServerIpAddress = 0.0.0.0 +SysUser = nobody + +[slapd] +AddOrgEntries = No +AddSampleEntries = No +InstallLdifFile = suggest +RootDN = cn=Directory Manager +RootDNPwd = password +ServerIdentifier = dir +ServerPort = 389 +SlapdConfigForMC = yes +Suffix = dc=internet2,dc=edu +UseExistingMC = No diff --git a/demo/shibboleth/directory/container_files/seed-data/users.ldif b/demo/shibboleth/directory/container_files/seed-data/users.ldif new file mode 100644 index 0000000..1d57238 --- /dev/null +++ b/demo/shibboleth/directory/container_files/seed-data/users.ldif @@ -0,0 +1,24 @@ +dn: cn=admin,dc=internet2,dc=edu +objectClass: simpleSecurityObject +objectClass: organizationalRole +cn: admin +userPassword: password +description: LDAP administrator + +dn: cn=users,ou=Groups,dc=internet2,dc=edu +objectClass: groupOfUniqueNames +objectClass: top +uniqueMember: uid=banderson,ou=People,dc=internet2,dc=edu +uniqueMember: uid=jsmith,ou=People,dc=internet2,dc=edu +cn: users + +dn: uid=administrator,ou=People,dc=internet2,dc=edu +objectClass: organizationalPerson +objectClass: person +objectClass: top +objectClass: inetOrgPerson +givenName: Administrator +uid: administrator +sn: Administrator +cn: Administrator +userPassword: password diff --git a/demo/shibboleth/docker-compose.yml b/demo/shibboleth/docker-compose.yml new file mode 100644 index 0000000..4b931ac --- /dev/null +++ b/demo/shibboleth/docker-compose.yml @@ -0,0 +1,37 @@ +version: "3.3" + +services: + directory: + build: ./directory/ + expose: + - "389" + ports: + - "389:389" + networks: + - back + volumes: + - ldap:/var/lib/dirsrv + + idp: + build: ./idp/ + depends_on: + - directory + environment: + - JETTY_MAX_HEAP=64m + - JETTY_BROWSER_SSL_KEYSTORE_PASSWORD=password + - JETTY_BACKCHANNEL_SSL_KEYSTORE_PASSWORD=password + networks: + - front + - back + ports: + - "4443:4443" + +networks: + front: + driver: bridge + back: + driver: bridge + + +volumes: + ldap: diff --git a/demo/shibboleth/idp/Dockerfile b/demo/shibboleth/idp/Dockerfile new file mode 100644 index 0000000..7d0b512 --- /dev/null +++ b/demo/shibboleth/idp/Dockerfile @@ -0,0 +1,5 @@ +FROM unicon/shibboleth-idp:latest + +LABEL author="tier-packaging@internet2.edu " + +COPY shibboleth-idp/ /opt/shibboleth-idp/ diff --git a/demo/shibboleth/idp/shibboleth-idp/conf/attribute-filter.xml b/demo/shibboleth/idp/shibboleth-idp/conf/attribute-filter.xml new file mode 100644 index 0000000..facaa6d --- /dev/null +++ b/demo/shibboleth/idp/shibboleth-idp/conf/attribute-filter.xml @@ -0,0 +1,29 @@ + + + + + + + + + + + + + + diff --git a/demo/shibboleth/idp/shibboleth-idp/conf/attribute-resolver.xml b/demo/shibboleth/idp/shibboleth-idp/conf/attribute-resolver.xml new file mode 100644 index 0000000..ee9519f --- /dev/null +++ b/demo/shibboleth/idp/shibboleth-idp/conf/attribute-resolver.xml @@ -0,0 +1,293 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/demo/shibboleth/idp/shibboleth-idp/conf/idp.properties b/demo/shibboleth/idp/shibboleth-idp/conf/idp.properties new file mode 100644 index 0000000..4396f49 --- /dev/null +++ b/demo/shibboleth/idp/shibboleth-idp/conf/idp.properties @@ -0,0 +1,195 @@ +# Load any additional property resources from a comma-delimited list +idp.additionalProperties= /conf/ldap.properties, /conf/saml-nameid.properties, /conf/services.properties + +# Set the entityID of the IdP +idp.entityID= https://idptestbed/idp/shibboleth + +# Set the scope used in the attribute resolver for scoped attributes +idp.scope= example.org + +# General cookie properties (maxAge only applies to persistent cookies) +#idp.cookie.secure = false +#idp.cookie.httpOnly = true +#idp.cookie.domain = +#idp.cookie.path = +#idp.cookie.maxAge = 31536000 + +# Set the location of user-supplied web flow definitions +#idp.webflows = %{idp.home}/flows + +# Set the location of Velocity view templates +#idp.views = %{idp.home}/views + +# Settings for internal AES encryption key +#idp.sealer.storeType = JCEKS +#idp.sealer.updateInterval = PT15M +#idp.sealer.aliasBase = secret +idp.sealer.storeResource= %{idp.home}/credentials/sealer.jks +idp.sealer.versionResource= %{idp.home}/credentials/sealer.kver +idp.sealer.storePassword= password +idp.sealer.keyPassword= password + +# Settings for public/private signing and encryption key(s) +# During decryption key rollover, point the ".2" properties at a second +# keypair, uncomment in credentials.xml, then publish it in your metadata. +idp.signing.key= %{idp.home}/credentials/idp-signing.key +idp.signing.cert= %{idp.home}/credentials/idp-signing.crt +idp.encryption.key= %{idp.home}/credentials/idp-encryption.key +idp.encryption.cert= %{idp.home}/credentials/idp-encryption.crt +#idp.encryption.key.2 = %{idp.home}/credentials/idp-encryption-old.key +#idp.encryption.cert.2 = %{idp.home}/credentials/idp-encryption-old.crt + +# Sets the bean ID to use as a default security configuration set +#idp.security.config = shibboleth.DefaultSecurityConfiguration + +# To default to SHA-1, set to shibboleth.SigningConfiguration.SHA1 +#idp.signing.config = shibboleth.SigningConfiguration.SHA256 + +# Configures trust evaluation of keys used by services at runtime +# Defaults to supporting both explicit key and PKIX using SAML metadata. +#idp.trust.signatures = shibboleth.ChainingSignatureTrustEngine +# To pick only one set to one of: +# shibboleth.ExplicitKeySignatureTrustEngine, shibboleth.PKIXSignatureTrustEngine +#idp.trust.certificates = shibboleth.ChainingX509TrustEngine +# To pick only one set to one of: +# shibboleth.ExplicitKeyX509TrustEngine, shibboleth.PKIXX509TrustEngine + +# If true, encryption will happen whenever a key to use can be located, but +# failure to encrypt won't result in request failure. +#idp.encryption.optional = false + +# Configuration of client- and server-side storage plugins +#idp.storage.cleanupInterval = PT10M +#idp.storage.htmlLocalStorage = false + +# Set to true to expose more detailed errors in responses to SPs +#idp.errors.detailed = false +# Set to false to skip signing of SAML response messages that signal errors +#idp.errors.signed = true +# Name of bean containing a list of Java exception classes to ignore +#idp.errors.excludedExceptions = ExceptionClassListBean +# Name of bean containing a property set mapping exception names to views +#idp.errors.exceptionMappings = ExceptionToViewPropertyBean +# Set if a different default view name for events and exceptions is needed +#idp.errors.defaultView = error + +# Set to false to disable the IdP session layer +#idp.session.enabled = true + +# Set to "shibboleth.StorageService" for server-side storage of user sessions +#idp.session.StorageService = shibboleth.ClientSessionStorageService +idp.session.StorageService = shibboleth.StorageService + +# Size of session IDs +#idp.session.idSize = 32 +# Bind sessions to IP addresses +#idp.session.consistentAddress = true +# Inactivity timeout +#idp.session.timeout = PT60M +# Extra time to store sessions for logout +#idp.session.slop = PT0S +# Tolerate storage-related errors +#idp.session.maskStorageFailure = false +# Track information about SPs logged into +#idp.session.trackSPSessions = false +# Support lookup by SP for SAML logout +#idp.session.secondaryServiceIndex = false +# Length of time to track SP sessions +#idp.session.defaultSPlifetime = PT2H + +# Regular expression matching login flows to enable, e.g. IPAddress|Password +idp.authn.flows= Password + +# Regular expression of forced "initial" methods when no session exists, +# usually in conjunction with the idp.authn.resolveAttribute property below. +#idp.authn.flows.initial = Password + +# Set to an attribute ID to resolve prior to selecting authentication flows; +# its values are used to filter the flows to allow. +#idp.authn.resolveAttribute = eduPersonAssurance + +# Default lifetime and timeout of various authentication methods +#idp.authn.defaultLifetime = PT60M +#idp.authn.defaultTimeout = PT30M + +# Whether to prioritize "active" results when an SP requests more than +# one possible matching login method (V2 behavior was to favor them) +#idp.authn.favorSSO = true + +# Whether to fail requests when a user identity after authentication +# doesn't match the identity in a pre-existing session. +#idp.authn.identitySwitchIsError = false + +# Set to "shibboleth.StorageService" or custom bean for alternate storage of consent +#idp.consent.StorageService = shibboleth.ClientPersistentStorageService + +# Set to "shibboleth.consent.AttributeConsentStorageKey" to use an attribute +# to key user consent storage records (and set the attribute name) +#idp.consent.userStorageKey = shibboleth.consent.PrincipalConsentStorageKey +#idp.consent.userStorageKeyAttribute = uid + +# Flags controlling how built-in attribute consent feature operates +#idp.consent.allowDoNotRemember = true +#idp.consent.allowGlobal = true +#idp.consent.allowPerAttribute = false + +# Whether attribute values and terms of use text are compared +#idp.consent.compareValues = false +# Maximum number of consent records for space-limited storage (e.g. cookies) +#idp.consent.maxStoredRecords = 10 +# Maximum number of consent records for larger/server-side storage (0 = no limit) +#idp.consent.expandedMaxStoredRecords = 0 + +# Time in milliseconds to expire consent storage records. +#idp.consent.storageRecordLifetime = P1Y + +# Whether to lookup metadata, etc. for every SP involved in a logout +# for use by user interface logic; adds overhead so off by default. +#idp.logout.elaboration = false + +# Whether to require logout requests be signed/authenticated. +#idp.logout.authenticated = true + +# Message freshness and replay cache tuning +#idp.policy.messageLifetime = PT3M +#idp.policy.clockSkew = PT3M + +# Set to custom bean for alternate storage of replay cache +#idp.replayCache.StorageService = shibboleth.StorageService + +# Toggles whether to allow outbound messages via SAML artifact +#idp.artifact.enabled = true +# Suppresses typical signing/encryption when artifact binding used +#idp.artifact.secureChannel = true +# May differ to direct SAML 2 artifact lookups to specific server nodes +#idp.artifact.endpointIndex = 2 +# Set to custom bean for alternate storage of artifact map state +#idp.artifact.StorageService = shibboleth.StorageService + +# Name of access control policy for various admin flows +idp.status.accessPolicy= AccessByIPAddress +idp.resolvertest.accessPolicy= AccessByIPAddress +idp.reload.accessPolicy= AccessByIPAddress + +# Comma-delimited languages to use if not match can be found with the +# browser-supported languages, defaults to an empty list. +idp.ui.fallbackLanguages= en,fr,de + +# Storage service used by CAS protocol +# Defaults to shibboleth.StorageService (in-memory) +# MUST be server-side storage (e.g. in-memory, memcached, database) +# NOTE that idp.session.StorageService requires server-side storage +# when CAS protocol is enabled +idp.cas.StorageService=shibboleth.StorageService + +# CAS service registry implementation class +#idp.cas.serviceRegistryClass=net.shibboleth.idp.cas.service.PatternServiceRegistry + +# Profile flows in which the ProfileRequestContext should be exposed +# in servlet request under the key "opensamlProfileRequestContext" +#idp.profile.exposeProfileRequestContextInServletRequest = SAML2/POST/SSO,SAML2/Redirect/SSO + +# F-TICKS auditing - set salt to include hashed username +#idp.fticks.federation=MyFederation +#idp.fticks.algorithm=SHA-256 +#idp.fticks.salt=somethingsecret diff --git a/demo/shibboleth/idp/shibboleth-idp/conf/ldap.properties b/demo/shibboleth/idp/shibboleth-idp/conf/ldap.properties new file mode 100644 index 0000000..726f145 --- /dev/null +++ b/demo/shibboleth/idp/shibboleth-idp/conf/ldap.properties @@ -0,0 +1,58 @@ +# LDAP authentication configuration, see authn/ldap-authn-config.xml + +## Authenticator strategy, either anonSearchAuthenticator, bindSearchAuthenticator, directAuthenticator, adAuthenticator +#idp.authn.LDAP.authenticator = anonSearchAuthenticator + +## Connection properties ## +idp.authn.LDAP.ldapURL = ldap://directory:389 +idp.authn.LDAP.useStartTLS = false +idp.authn.LDAP.useSSL = false +#idp.authn.LDAP.connectTimeout = 3000 + +## SSL configuration, either jvmTrust, certificateTrust, or keyStoreTrust +#idp.authn.LDAP.sslConfig = certificateTrust +## If using certificateTrust above, set to the trusted certificate's path +idp.authn.LDAP.trustCertificates = %{idp.home}/credentials/ldap-server.crt +## If using keyStoreTrust above, set to the truststore path +idp.authn.LDAP.trustStore = %{idp.home}/credentials/ldap-server.truststore + +## Return attributes during authentication +## NOTE: this is not used during attribute resolution; configure that directly in the +## attribute-resolver.xml configuration via a DataConnector's element +idp.authn.LDAP.returnAttributes = cn,businessCategory,mail + +## DN resolution properties ## + +# Search DN resolution, used by anonSearchAuthenticator, bindSearchAuthenticator +# for AD: CN=Users,DC=example,DC=org +idp.authn.LDAP.baseDN = ou=people,dc=internet2,dc=edu +#idp.authn.LDAP.subtreeSearch = false +idp.authn.LDAP.userFilter = (uid={user}) +# bind search configuration +# for AD: idp.authn.LDAP.bindDN=adminuser@domain.com +idp.authn.LDAP.bindDN = cn=admin,dc=internet2,dc=edu +idp.authn.LDAP.bindDNCredential = password + +# Format DN resolution, used by directAuthenticator, adAuthenticator +# for AD use idp.authn.LDAP.dnFormat=%s@domain.com +idp.authn.LDAP.dnFormat = uid=%s,ou=people,dc=internet2,dc=edu + +# LDAP attribute configuration, see attribute-resolver.xml +idp.attribute.resolver.LDAP.ldapURL = %{idp.authn.LDAP.ldapURL} +idp.attribute.resolver.LDAP.baseDN = %{idp.authn.LDAP.baseDN} +idp.attribute.resolver.LDAP.bindDN = %{idp.authn.LDAP.bindDN} +idp.attribute.resolver.LDAP.bindDNCredential = %{idp.authn.LDAP.bindDNCredential} +idp.attribute.resolver.LDAP.useStartTLS = %{idp.authn.LDAP.useStartTLS:true} +idp.attribute.resolver.LDAP.trustCertificates = %{idp.authn.LDAP.trustCertificates} +idp.attribute.resolver.LDAP.searchFilter = (uid=$requestContext.principalName) + +# LDAP pool configuration, used for both authn and DN resolution +#idp.pool.LDAP.minSize = 3 +#idp.pool.LDAP.maxSize = 10 +#idp.pool.LDAP.validateOnCheckout = false +#idp.pool.LDAP.validatePeriodically = true +#idp.pool.LDAP.validatePeriod = 300 +#idp.pool.LDAP.prunePeriod = 300 +#idp.pool.LDAP.idleTime = 600 +#idp.pool.LDAP.blockWaitTime = 3000 +#idp.pool.LDAP.failFastInitialize = false diff --git a/demo/shibboleth/idp/shibboleth-idp/conf/metadata-providers.xml b/demo/shibboleth/idp/shibboleth-idp/conf/metadata-providers.xml new file mode 100644 index 0000000..684b387 --- /dev/null +++ b/demo/shibboleth/idp/shibboleth-idp/conf/metadata-providers.xml @@ -0,0 +1,80 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/demo/shibboleth/idp/shibboleth-idp/credentials/idp-backchannel.crt b/demo/shibboleth/idp/shibboleth-idp/credentials/idp-backchannel.crt new file mode 100644 index 0000000..c1f8fab --- /dev/null +++ b/demo/shibboleth/idp/shibboleth-idp/credentials/idp-backchannel.crt @@ -0,0 +1,19 @@ +-----BEGIN CERTIFICATE----- +MIIDEzCCAfugAwIBAgIUS9SuTXwsFVVG+LjOEAbLqqT/el0wDQYJKoZIhvcNAQEL +BQAwFTETMBEGA1UEAwwKaWRwdGVzdGJlZDAeFw0xNTEyMTEwMjIwMjZaFw0zNTEy +MTEwMjIwMjZaMBUxEzARBgNVBAMMCmlkcHRlc3RiZWQwggEiMA0GCSqGSIb3DQEB +AQUAA4IBDwAwggEKAoIBAQCMAoDHx8xCIfv/6QKqt9mcHYmEJ8y2dKprUbpdcOjH +YvNPIl/lHPsUyrb+Nc+q2CDeiWjVk1mWYq0UpIwpBMuw1H6+oOqr4VQRi65pin0M +SfE0MWIaFo5FPvpvoptkHD4gvREbm4swyXGMczcMRfqgalFXhUD2wz8W3XAM5Cq2 +03XeJbj6TwjvKatG5XPdeUe2FBGuOO2q54L1hcIGnLMCQrg7D31lR13PJbjnJ0No +5C3k8TPuny6vJsBC03GNLNKfmrKVTdzr3VKp1uay1G3DL9314fgmbl8HA5iRQmy+ +XInUU6/8NXZSF59p3ITAOvZQeZsbJjg5gGDip5OZo9YlAgMBAAGjWzBZMB0GA1Ud +DgQWBBRPlM4VkKZ0U4ec9GrIhFQl0hNbLDA4BgNVHREEMTAvggppZHB0ZXN0YmVk +hiFodHRwczovL2lkcHRlc3RiZWQvaWRwL3NoaWJib2xldGgwDQYJKoZIhvcNAQEL +BQADggEBAIZ0a1ov3my3ljJG588I/PHx+TxAWONWmpKbO9c/qI3Drxk4oRIffiac +ANxdvtabgIzrlk5gMMisD7oyqHJiWgKv5Bgctd8w3IS3lLl7wHX65mTKQRXniG98 +NIjkvfrhe2eeJxecOqnDI8GOhIGCIqZUn8ShdM/yHjhQ2Mh0Hj3U0LlKvnmfGSQl +j0viGwbFCaNaIP3zc5UmCrdE5h8sWL3Fu7ILKM9RyFa2ILHrJScV9t623IcHffHP +IeaY/WtuapsrqRFxuQL9QFWN0FsRIdLmjTq+00+B/XnnKRKFBuWfjhHLF/uu8f+E +t6Lf23Kb8yD6ZR7dihMZAGHnYQ/hlhM= +-----END CERTIFICATE----- diff --git a/demo/shibboleth/idp/shibboleth-idp/credentials/idp-backchannel.p12 b/demo/shibboleth/idp/shibboleth-idp/credentials/idp-backchannel.p12 new file mode 100644 index 0000000000000000000000000000000000000000..112540ac0718da62464ec2f31d7916a923e3c531 GIT binary patch literal 2500 zcmY+EcQ_k}8^q@CpG?EY_)M{|{s#&Y{$Z3_Dts;c<>{_WRK~+^7Vz1O_ zkveMArfSooW~{1l?swvVvt33=;M^na(kh za9}J52lhF`9ta#u;D00*HxQ1+`3yUpl?^N8e_I^vOh6J2bcn!#_7Im?+5eBvjthhM zf`i2O1kg{;Aui6V`ccN;VM=bu0f8U@2nV9+>W~WD-|yXF--O>tM;YF#+BBLz46_ze zy|dqjcQHP$n_@P7dCSC2b2pZzXh~`GkGy7yOQc>8l{dP`*uAl6jlGNx+NXwJ^&t~R zJn9~hxq6OdR2k0WZcscb=}Tx)?x5_bO*r!dS4% z`@6K|Dc<0lgwcYD3A9q)1XfMp7jCg!hRJ&G$S0Fn>*m2HC#wtX(nZwHM#({i{-Ps* zM7p%O#Z~dW;C1Vwo!0!@=xBZvBp{dKpQk*gR<{9{jR-IjhE|W7;$a)s4)^23TU&6( zDgyAG-?~Jkv9038q)SC0T5f8FAmGQn3}v0-LHFT5V5KWCGP}n_M@vKRJ%rKV1cZ~0>dVPW4m%Pp!}^pz#&|O5Pm%jZr#Rc=q!1^r zogM)kaQD^{oPFPbI$=OU93sR!jJ9jabsdP9 z#f+1ifg_Zb6N~F`(eCL#k@yqq?LnAdp3sr11r`TkmFy4f4nD=uXc8DEcTYVi+ ztvEYTr1{HC+kOPZjk7jZD!xC&Ap0Tyx@`}Dbh>jPr+P$ZXg_y(7V7lL8>#5J^c>*g zu|XE0My)RG%OALQ`eNv4@}J!A60A+xbh>p=4`f@%goVHw^4E&hR-M0^c1kC9pVWBF zLJ#X5+zWQ!Xqb!ADAKT4V%271wJ(MnFMYnLZ%AmDDx;V~O1^SRn6vRAcnHaD*VOWC zPG252y?^LY7K$+B&PUZ=ZQ`%P%Y&+a4ilTTR5Q|EU>+R1+r9>K^X9R?*E}Y&MtlRL zwMzOSrN2kSyo&TJ$CFh`yjrk0X#QGuTi+C<)om50=4j0bD~q<1>hZxS?I@L7JO=#jU^ zJYCtx-ft|G`YV`U;A6+nX=zglW^!c-Sz13emhi6k7H@sn9m>F*x?BtLd6}i=EhqB) zWp+bWdN-Eb@|rNoS5g+&B=z|Yqidj!B|I2ObRLCBwMKAKdy2Dtd*+oQJw#dXBHsyR zcF;uwm(f5UIvisrL6sTV@>}TfiGKR+CQu8Djfgx#Yq@8~)GQ569{Dg)>!Bs|zG_<8 zUP8`f9Vgr)9QEd6f?u0DSwznWGd^i5Jj2lrCk0ax=sp{?U`-pff?>&j;`Wcme_ecK}|1;Ir<2Ha!s+{x$I<`9QqZegR(MNE8aKia?+glvNN& z1de(2AJaKj5{`ND41EAH0nWzIzY5cTf|m8~pyf%eZJLI@9oufWYtqcAIm#`(Quue! z#^9KV$2zAh?|irpx1`EZud%TE5A67p0dC`Zu!o+rSrtJ~H>F^SHZtJ2F>=Wwh+Y(% z7f-5yD=o0vFxE@VF*mHa^KfwZssUU*P0C@-v1oCV`byV+8sxH@p>Gn(0|}=bjMRor zX*NWmi72(o(o6;>ZUI-#R-eSEjVw6BjB$PMzns3ViC)nd7blo4LN0tj5-x zpA}4i^=+lS-H}g!BxHDD-HNX2b)grSKcvuKL(ptOg<>x&Qz8wCuI<0w&m4eou;=|I zmPRWcF82= zAKC~EAnn7x>^x(#)2wuZnCoapt!>g?FACxkX9IDHe}zs=L9OMw)VNgIP!_jswitl1 z7~$j!!8Sz&ym9^c(FTffbYCyD;>F2orJ9rWt-R)na4$>xFsr@)ja24sWJbh8u?NXr z3n}dPmr-_I9X8VNzFHBIc8!;atV1ItJA6<~x|#Xn$W6=y=aN25_9yHkQ~*j`&qk%L z@Hob6Nku!wF5%;p@9mW*=?Ax`fC+4Fj$Bn@79?AaB!x*1h=A9606#|o^uTO;li2-2 ztN6Mp>){~rwN?4Zq3joP=iq0D!uO#8wPd?883R{H{2mcXYm)1NDrrWf;ts7PrPLbcoPETtI+XS>(8wfx;{R z5Fblv5Mk^lI~isyDd8d)McEl)?7L*& zxt3(FY!yO^46l36d+)yY$9KMSe!p|R|9&5m2zfyVq(>4Vcm{|p*?|0=703w8BSLP2 zh!ERf*a}Ic-}y%|wZd|zCj73f_=3(9MqnC;LCXd=Gww>y`E(SIv zhYega;J7k_>#)<2l+6T!mEmL0GOf#)J@aJ|0-p9b!-0Nm94#F9P0*i7!f8D0X_F+~ zN^N(o-BNXgL}IL5aZgijy3dzBcXSVpI_;8DvP;S^J0Aah&7!nfkhW#$wSr_G@49QkM7-3 zwdca~kJ`Dc^SymMZQO*9Kx;=SlariIaxMPlg&A&@PUww;szxtx{2rAY**3+fhB_6s zm&{UQ?QUuFBKSP^7Twe@om1A(wJ&uGJBt^n0%B#KJCYZEse_TPypWH-%n85YV>`b9h&aeyZWV z^D``1s%MD)p$Iz|Rq1GwW}4@%n$t@LqN{};$DypcOs)NShEz0*5iw@2$k970h*zZQ zJ;8*pe}R-yvo1*P*-{?6_?2FRpz4`7s;Iv%>i7m@OnGgJ9X``U6`Ut8?%9n<0a1ZlCBUa4fW4H};_ zq0}=!?%masJU2|a!{+9&Se2c_HshP&ldZcYh-7Kmh={cf`77h<-GPv^sG&zA^Bv7% zi3vViR1S$}1<1rS@5tz(676t)P~@$Q;d2VVyk}yC#ae=KpV3Rz44V=;8~fTGPDjmh zv6_e}*=MUC6g!um=Qv!=Xt+1#S(q)KmzHg?-|7|JjpCVdVAjHm>Mxh7GTR$}o4~Cu zYxp*I_3eyN8D|NhLoKY_Sifio$wL1|+#Pl0IQM}=k4*Gd!6Zc42<0Bvl47@b5#@>e z#&*at@y%1>$%;<1ZT@WBT(npEyT^4wmKEn-bJ^VlO$=pi*o9X&2A7+o!hJH6{-|Nw z7)b;>{!iC=M6el%2>u%z{2B}c^gop|1L^XJpf5-wXzTytr~f;CU{iUHVs)F+ulPYk zP(PnlM(;Jb_oph$Soflp{P;s5Gke98N zde&JHbw`cCEodvMRx-hWTWl|4Tu0l8K<4NjalraA1u$Pxa1}5JAqX^D#XM%u>rAOA zxo+#r9`h}EaBDxLT@~Ym>v z_+J!k!#BW#`B6%@rnEvSa<^Q^CisG@4MT;;O`2#HItQysMzgQKjF>BYe92kd?Q;ol zRWZipa|CwYF=oY--B6I*(#>*(OanN_iqYE5qtZ(;Ql8&sxJIqm%ebaZg~}=I;T=o+ zeUqj3yv0vH`#P%D*RGrb1E)*iT62`mK?$=%y7#w_E5z?!nj(4l4BvL((a64Rp#4_7 zz~sR!i$lL9jN3o!ok+mT*2Y)l3XEE?nsEM1X(epybKrqg16K}%_EbCdzIx{oyQ5^+ zW<2~!7yH>^+z8As5-f{NjlKM8yiG50U{@wsJ$PGo9DysME#&&(&&ShmCRKw6PoZuq zIdUl^bEwq|fsZRncxw-7qRF@Y@eQhjsqxxzQP$%M3y(223Wsa4PNOf$oK{rj2&Z@@ zeI0MA?Kmm)Z9G?(77V$@LK9b+M9KKg1VQsS7H_Dl69ykB-H2jVR)6odDqcwzs??W> zUivQJkt7eRnfQ(0YB(w@=z=)zN8>|;rB^NRqR=Qgas)XqDLGdLnvbLE~<*WdCi2j`lPDJidl3_eeD>6Xs5C%iYa zPF;a1#CzeP`Mnf1C`FL>p|#P6Q;gO!iQYJ!jE(mzKjAtafqs6s%fgZ-s+7{ z!Ryv()w_j4QnyPRv|?+L0y3O7G&rFhA76vfp38yc-Btjm^+VVvxSv8uQ<)Q2l4`8%#Z2B zOnDvidVT>jTF`z^pOm1r&Jqo;yP65no$q1J)Ab!UC)3#!v~I+g1w9-h-LS%Nx!m)J zFcEJeWOY{oIz6zT@w|LllsVKqDTZ%6bWGf%dyeZ!NC9!&xDF1i?<>| bRz*ME-RT7Qd9hsvQm>v-13XOQ!4|C@=Ji6{Gzkrry`#l><$JRUQxs# znUz?USOL?Itj*5McG=ryDXA#|iA9OI#U%_((N56}0zg5Ky{ReA z`FSO&c_oDmbqq{C44egERgO97B@9A7APe+!67$magG-7s^U|$-K)y-L0ZN0^GglOp z7J~nExqXSGq6qaT3RRODoIzr5dghn(HMT`3qXw-&ZnR=U{rWeaBa0 zj@Rc?n{AELzUY0^+HBA@e{IKY>ABk{>|UEPm*v!h|8}L0B@AK#POjmZB^kahrjB_j kAw`)5IjJtL!8j!vrkMFnww+t>abHZ&wUZ^vTC!nU0KJL18UO$Q literal 0 HcmV?d00001 diff --git a/demo/shibboleth/idp/shibboleth-idp/credentials/sealer.kver b/demo/shibboleth/idp/shibboleth-idp/credentials/sealer.kver new file mode 100644 index 0000000..d64b0e4 --- /dev/null +++ b/demo/shibboleth/idp/shibboleth-idp/credentials/sealer.kver @@ -0,0 +1,2 @@ +#Fri Dec 11 02:20:32 UTC 2015 +CurrentVersion=1 diff --git a/demo/shibboleth/idp/shibboleth-idp/metadata/idp-metadata.xml b/demo/shibboleth/idp/shibboleth-idp/metadata/idp-metadata.xml new file mode 100644 index 0000000..35914b7 --- /dev/null +++ b/demo/shibboleth/idp/shibboleth-idp/metadata/idp-metadata.xml @@ -0,0 +1,207 @@ + + + + + + + + example.org + + + + + + + +MIIDEzCCAfugAwIBAgIUS9SuTXwsFVVG+LjOEAbLqqT/el0wDQYJKoZIhvcNAQEL +BQAwFTETMBEGA1UEAwwKaWRwdGVzdGJlZDAeFw0xNTEyMTEwMjIwMjZaFw0zNTEy +MTEwMjIwMjZaMBUxEzARBgNVBAMMCmlkcHRlc3RiZWQwggEiMA0GCSqGSIb3DQEB +AQUAA4IBDwAwggEKAoIBAQCMAoDHx8xCIfv/6QKqt9mcHYmEJ8y2dKprUbpdcOjH +YvNPIl/lHPsUyrb+Nc+q2CDeiWjVk1mWYq0UpIwpBMuw1H6+oOqr4VQRi65pin0M +SfE0MWIaFo5FPvpvoptkHD4gvREbm4swyXGMczcMRfqgalFXhUD2wz8W3XAM5Cq2 +03XeJbj6TwjvKatG5XPdeUe2FBGuOO2q54L1hcIGnLMCQrg7D31lR13PJbjnJ0No +5C3k8TPuny6vJsBC03GNLNKfmrKVTdzr3VKp1uay1G3DL9314fgmbl8HA5iRQmy+ +XInUU6/8NXZSF59p3ITAOvZQeZsbJjg5gGDip5OZo9YlAgMBAAGjWzBZMB0GA1Ud +DgQWBBRPlM4VkKZ0U4ec9GrIhFQl0hNbLDA4BgNVHREEMTAvggppZHB0ZXN0YmVk +hiFodHRwczovL2lkcHRlc3RiZWQvaWRwL3NoaWJib2xldGgwDQYJKoZIhvcNAQEL +BQADggEBAIZ0a1ov3my3ljJG588I/PHx+TxAWONWmpKbO9c/qI3Drxk4oRIffiac +ANxdvtabgIzrlk5gMMisD7oyqHJiWgKv5Bgctd8w3IS3lLl7wHX65mTKQRXniG98 +NIjkvfrhe2eeJxecOqnDI8GOhIGCIqZUn8ShdM/yHjhQ2Mh0Hj3U0LlKvnmfGSQl +j0viGwbFCaNaIP3zc5UmCrdE5h8sWL3Fu7ILKM9RyFa2ILHrJScV9t623IcHffHP +IeaY/WtuapsrqRFxuQL9QFWN0FsRIdLmjTq+00+B/XnnKRKFBuWfjhHLF/uu8f+E +t6Lf23Kb8yD6ZR7dihMZAGHnYQ/hlhM= + + + + + + + + + +MIIDFDCCAfygAwIBAgIVAN3vv+b7KN5Se9m1RZsCllp/B/hdMA0GCSqGSIb3DQEB +CwUAMBUxEzARBgNVBAMMCmlkcHRlc3RiZWQwHhcNMTUxMjExMDIyMDE0WhcNMzUx +MjExMDIyMDE0WjAVMRMwEQYDVQQDDAppZHB0ZXN0YmVkMIIBIjANBgkqhkiG9w0B +AQEFAAOCAQ8AMIIBCgKCAQEAh91caeY0Q85uhaUyqFwP2bMjwMFxMzRlAoqBHd7g +u6eo4duaeLz1BaoR2XTBpNNvFR5oHH+TkKahVDGeH5+kcnIpxI8JPdsZml1srvf2 +Z6dzJsulJZUdpqnngycTkGtZgEoC1vmYVky2BSAIIifmdh6s0epbHnMGLsHzMKfJ +Cb/Q6dYzRWTCPtzE2VMuQqqWgeyMr7u14x/Vqr9RPEFsgY8GIu5jzB6AyUIwrLg+ +MNkv6aIdcHwxYTGL7ijfy6rSWrgBflQoYRYNEnseK0ZHgJahz4ovCag6wZAoPpBs +uYlY7lEr89Ucb6NHx3uqGMsXlDFdE4QwfDLLhCYHPvJ0uwIDAQABo1swWTAdBgNV +HQ4EFgQUAkOgED3iYdmvQEOMm6u/JmD/UTQwOAYDVR0RBDEwL4IKaWRwdGVzdGJl +ZIYhaHR0cHM6Ly9pZHB0ZXN0YmVkL2lkcC9zaGliYm9sZXRoMA0GCSqGSIb3DQEB +CwUAA4IBAQBIdd4YWlnvJjql8+zKKgmWgIY7U8DA8e6QcbAf8f8cdE33RSnjI63X +sv/y9GfmbAVAD6RIAXPFFeRYJ08GOxGI9axfNaKdlsklJ9bk4ducHqgCSWYVer3s +RQBjxyOfSTvk9YCJvdJVQRJLcCvxwKakFCsOSnV3t9OvN86Ak+fKPVB5j2fM/0fZ +Kqjn3iqgdNPTLXPsuJLJO5lITRiBa4onmVelAiCstI9PQiaEck+oAHnMTnC9JE/B +DHv3e4rwq3LznlqPw0GSd7xqNTdMDwNOWjkuOr3sGpWS8ms/ZHHXV1Vd22uPe70i +s00xrv14zLifcc8oj5DYzOhYRifRXgHX + + + + + + + + + +MIIDEzCCAfugAwIBAgIUG6Nn1rlERS1vsi88tcdzSYX0oqAwDQYJKoZIhvcNAQEL +BQAwFTETMBEGA1UEAwwKaWRwdGVzdGJlZDAeFw0xNTEyMTEwMjIwMTRaFw0zNTEy +MTEwMjIwMTRaMBUxEzARBgNVBAMMCmlkcHRlc3RiZWQwggEiMA0GCSqGSIb3DQEB +AQUAA4IBDwAwggEKAoIBAQCBXv0o3fmT8iluyLjJ4lBAVCW+ZRVyEXPYQuRi7vfD +cO4a6d1kxiJLsaK0W88VNxjFQRr8PgDkWr28vwoH1rgk4pLsszLD48DBzD942peJ +l/S6FnsIJjmaHcBh4pbNhU4yowu63iKkvttrcZAEbpEro6Z8CziWEx8sywoaYEQG +ifPkr9ORV6Cn3txq+9gMBePG41GrtZrUGIu+xrndL0Shh4Pq0eq/9MAsVlIIXEa8 +9WfH8J2kFcTOfoWtIc70b7TLZQsx4YnNcnrGLSUEcstFyPLX+Xtv5SNZF89OOIxX +VNjNvgE5DbJb9hMM4UAFqI+1bo9QqtxwThjc/sOvIxzNAgMBAAGjWzBZMB0GA1Ud +DgQWBBStTyogRPuAVG6q7yPyav1uvE+7pTA4BgNVHREEMTAvggppZHB0ZXN0YmVk +hiFodHRwczovL2lkcHRlc3RiZWQvaWRwL3NoaWJib2xldGgwDQYJKoZIhvcNAQEL +BQADggEBAFMfoOv+oISGjvamq7+Y4G7ep5vxlAPeK3RATYPYvAmyH946qZXh98ni +QXyuqZW5P5eEt86toY45IwDU5r09SKwHughEe99iiEkxh0mb2qo84qX9/qcg+kyN +jeLd/OSyolpUCEFNwOFcog7pj7Eer+6AHbwTn1Mjb5TBsKwtDMJsaxPvdj0u7M5r +xL/wHkFhn1rCo2QiojzjSlV3yLTh49iTyhE3cG+RxaNKDCxhp0jSSLX1BW/ZoPA8 ++PMJEA+Q0QbyRD8aJOHN5O8jGxCa/ZzcOnYVL6AsEXoDiY3vAUYh1FUonOWw0m9H +p+tGUbGS2l873J5PrsbpeKEVR/IIoKo= + + + + + + + urn:mace:shibboleth:1.0:nameIdentifier + urn:oasis:names:tc:SAML:2.0:nameid-format:transient + + + + + + + + + + + + + localhost + + + + + + +MIIDEzCCAfugAwIBAgIUS9SuTXwsFVVG+LjOEAbLqqT/el0wDQYJKoZIhvcNAQEL +BQAwFTETMBEGA1UEAwwKaWRwdGVzdGJlZDAeFw0xNTEyMTEwMjIwMjZaFw0zNTEy +MTEwMjIwMjZaMBUxEzARBgNVBAMMCmlkcHRlc3RiZWQwggEiMA0GCSqGSIb3DQEB +AQUAA4IBDwAwggEKAoIBAQCMAoDHx8xCIfv/6QKqt9mcHYmEJ8y2dKprUbpdcOjH +YvNPIl/lHPsUyrb+Nc+q2CDeiWjVk1mWYq0UpIwpBMuw1H6+oOqr4VQRi65pin0M +SfE0MWIaFo5FPvpvoptkHD4gvREbm4swyXGMczcMRfqgalFXhUD2wz8W3XAM5Cq2 +03XeJbj6TwjvKatG5XPdeUe2FBGuOO2q54L1hcIGnLMCQrg7D31lR13PJbjnJ0No +5C3k8TPuny6vJsBC03GNLNKfmrKVTdzr3VKp1uay1G3DL9314fgmbl8HA5iRQmy+ +XInUU6/8NXZSF59p3ITAOvZQeZsbJjg5gGDip5OZo9YlAgMBAAGjWzBZMB0GA1Ud +DgQWBBRPlM4VkKZ0U4ec9GrIhFQl0hNbLDA4BgNVHREEMTAvggppZHB0ZXN0YmVk +hiFodHRwczovL2lkcHRlc3RiZWQvaWRwL3NoaWJib2xldGgwDQYJKoZIhvcNAQEL +BQADggEBAIZ0a1ov3my3ljJG588I/PHx+TxAWONWmpKbO9c/qI3Drxk4oRIffiac +ANxdvtabgIzrlk5gMMisD7oyqHJiWgKv5Bgctd8w3IS3lLl7wHX65mTKQRXniG98 +NIjkvfrhe2eeJxecOqnDI8GOhIGCIqZUn8ShdM/yHjhQ2Mh0Hj3U0LlKvnmfGSQl +j0viGwbFCaNaIP3zc5UmCrdE5h8sWL3Fu7ILKM9RyFa2ILHrJScV9t623IcHffHP +IeaY/WtuapsrqRFxuQL9QFWN0FsRIdLmjTq+00+B/XnnKRKFBuWfjhHLF/uu8f+E +t6Lf23Kb8yD6ZR7dihMZAGHnYQ/hlhM= + + + + + + + + + +MIIDFDCCAfygAwIBAgIVAN3vv+b7KN5Se9m1RZsCllp/B/hdMA0GCSqGSIb3DQEB +CwUAMBUxEzARBgNVBAMMCmlkcHRlc3RiZWQwHhcNMTUxMjExMDIyMDE0WhcNMzUx +MjExMDIyMDE0WjAVMRMwEQYDVQQDDAppZHB0ZXN0YmVkMIIBIjANBgkqhkiG9w0B +AQEFAAOCAQ8AMIIBCgKCAQEAh91caeY0Q85uhaUyqFwP2bMjwMFxMzRlAoqBHd7g +u6eo4duaeLz1BaoR2XTBpNNvFR5oHH+TkKahVDGeH5+kcnIpxI8JPdsZml1srvf2 +Z6dzJsulJZUdpqnngycTkGtZgEoC1vmYVky2BSAIIifmdh6s0epbHnMGLsHzMKfJ +Cb/Q6dYzRWTCPtzE2VMuQqqWgeyMr7u14x/Vqr9RPEFsgY8GIu5jzB6AyUIwrLg+ +MNkv6aIdcHwxYTGL7ijfy6rSWrgBflQoYRYNEnseK0ZHgJahz4ovCag6wZAoPpBs +uYlY7lEr89Ucb6NHx3uqGMsXlDFdE4QwfDLLhCYHPvJ0uwIDAQABo1swWTAdBgNV +HQ4EFgQUAkOgED3iYdmvQEOMm6u/JmD/UTQwOAYDVR0RBDEwL4IKaWRwdGVzdGJl +ZIYhaHR0cHM6Ly9pZHB0ZXN0YmVkL2lkcC9zaGliYm9sZXRoMA0GCSqGSIb3DQEB +CwUAA4IBAQBIdd4YWlnvJjql8+zKKgmWgIY7U8DA8e6QcbAf8f8cdE33RSnjI63X +sv/y9GfmbAVAD6RIAXPFFeRYJ08GOxGI9axfNaKdlsklJ9bk4ducHqgCSWYVer3s +RQBjxyOfSTvk9YCJvdJVQRJLcCvxwKakFCsOSnV3t9OvN86Ak+fKPVB5j2fM/0fZ +Kqjn3iqgdNPTLXPsuJLJO5lITRiBa4onmVelAiCstI9PQiaEck+oAHnMTnC9JE/B +DHv3e4rwq3LznlqPw0GSd7xqNTdMDwNOWjkuOr3sGpWS8ms/ZHHXV1Vd22uPe70i +s00xrv14zLifcc8oj5DYzOhYRifRXgHX + + + + + + + + + +MIIDEzCCAfugAwIBAgIUG6Nn1rlERS1vsi88tcdzSYX0oqAwDQYJKoZIhvcNAQEL +BQAwFTETMBEGA1UEAwwKaWRwdGVzdGJlZDAeFw0xNTEyMTEwMjIwMTRaFw0zNTEy +MTEwMjIwMTRaMBUxEzARBgNVBAMMCmlkcHRlc3RiZWQwggEiMA0GCSqGSIb3DQEB +AQUAA4IBDwAwggEKAoIBAQCBXv0o3fmT8iluyLjJ4lBAVCW+ZRVyEXPYQuRi7vfD +cO4a6d1kxiJLsaK0W88VNxjFQRr8PgDkWr28vwoH1rgk4pLsszLD48DBzD942peJ +l/S6FnsIJjmaHcBh4pbNhU4yowu63iKkvttrcZAEbpEro6Z8CziWEx8sywoaYEQG +ifPkr9ORV6Cn3txq+9gMBePG41GrtZrUGIu+xrndL0Shh4Pq0eq/9MAsVlIIXEa8 +9WfH8J2kFcTOfoWtIc70b7TLZQsx4YnNcnrGLSUEcstFyPLX+Xtv5SNZF89OOIxX +VNjNvgE5DbJb9hMM4UAFqI+1bo9QqtxwThjc/sOvIxzNAgMBAAGjWzBZMB0GA1Ud +DgQWBBStTyogRPuAVG6q7yPyav1uvE+7pTA4BgNVHREEMTAvggppZHB0ZXN0YmVk +hiFodHRwczovL2lkcHRlc3RiZWQvaWRwL3NoaWJib2xldGgwDQYJKoZIhvcNAQEL +BQADggEBAFMfoOv+oISGjvamq7+Y4G7ep5vxlAPeK3RATYPYvAmyH946qZXh98ni +QXyuqZW5P5eEt86toY45IwDU5r09SKwHughEe99iiEkxh0mb2qo84qX9/qcg+kyN +jeLd/OSyolpUCEFNwOFcog7pj7Eer+6AHbwTn1Mjb5TBsKwtDMJsaxPvdj0u7M5r +xL/wHkFhn1rCo2QiojzjSlV3yLTh49iTyhE3cG+RxaNKDCxhp0jSSLX1BW/ZoPA8 ++PMJEA+Q0QbyRD8aJOHN5O8jGxCa/ZzcOnYVL6AsEXoDiY3vAUYh1FUonOWw0m9H +p+tGUbGS2l873J5PrsbpeKEVR/IIoKo= + + + + + + + + + + + + + + diff --git a/demo/shibboleth/idp/shibboleth-idp/metadata/midpoint-sp.xml b/demo/shibboleth/idp/shibboleth-idp/metadata/midpoint-sp.xml new file mode 100644 index 0000000..54f0577 --- /dev/null +++ b/demo/shibboleth/idp/shibboleth-idp/metadata/midpoint-sp.xml @@ -0,0 +1,80 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + midpoint.sp.example.org + + CN=midpoint.sp.example.org,O=Internet2/TIER,L=Ann Arbor,ST=MI,C=US + MIIDqDCCApCgAwIBAgIJAKUZrfriIt9cMA0GCSqGSIb3DQEBCwUAMGkxCzAJBgNV +BAYTAlVTMQswCQYDVQQIDAJNSTESMBAGA1UEBwwJQW5uIEFyYm9yMRcwFQYDVQQK +DA5JbnRlcm5ldDIvVElFUjEgMB4GA1UEAwwXZXZvbHZldW0uc3AuZXhhbXBsZS5v +cmcwHhcNMTgwOTE0MDU0NjU3WhcNMTkwOTE0MDU0NjU3WjBpMQswCQYDVQQGEwJV +UzELMAkGA1UECAwCTUkxEjAQBgNVBAcMCUFubiBBcmJvcjEXMBUGA1UECgwOSW50 +ZXJuZXQyL1RJRVIxIDAeBgNVBAMMF2V2b2x2ZXVtLnNwLmV4YW1wbGUub3JnMIIB +IjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAw5v1zxlM94yaBssgNNbIUJwW +XxbGxgSs2AWBeg2aEi/VQd2UE5ivZakNJlqWSJyHo2xE4kxeSyBBxinjSyhmpNao +xIcqQsgW0gxo4SEHo3kUXWPo+of/pj6CslutsSJZWGTRV0dHITvaWX+NM8eXMfgu +mJFwy3RMdLaWQhY1Dyi2jNoO+DZnfNgPyPeEZcmORaoeEID9QdZfHtcgTf2QfSHq ++xsTwHB6Ro5t7YD2ma8Krb/XcDTfsq3qJemd7LhPj5lGmhYSMgDbgwEkZgZ1kBOP +lfsP2BvX5nipv7Vd1C5YXmv+NDR8V3yAWBC7ZAenxGmrnkaSVXnpUplUsGGm1QID +AQABo1MwUTAdBgNVHQ4EFgQUuxSZwW6V1P/b0tsTM32OU/v/n+UwHwYDVR0jBBgw +FoAUuxSZwW6V1P/b0tsTM32OU/v/n+UwDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG +9w0BAQsFAAOCAQEAJWLXEfZkPeUyiGvsIUjczzdF3ptqXoP9aETS2pOV9sTri19R +TsQZW6XQRHGtuEOsqEGH8yiTdGR5hbGC+ynH/xTJnK+tBn/R3KrgxLKyMvoUzAPl +mhVq1dh+ZEtbsRpQRRubP6nm9kXNma0cXrkJSzuWM0W+l/xSOOYiSRRk3XWJfVjn +9jQlcJRh5SOkKN08oZHrCYKxToEuOfV8PtRj3T80DhsBTv2SHqhg4cBhzQPb0Kjm +9m4IkYOz8c5ZtuHDGnqMHw60Nyt+jyik4mMFP2frcOVP0W0sgwcfHllYzHoA/Khq +Yk3TBVs1BjPuNDJWHct8Eo68YP2/ZvzqfVM87Q== + + + + + + + + + + + + + + + + + + + + + + + + + From 5fa66bd1357c4a8f0d489e8f9fbc2acd80753b8b Mon Sep 17 00:00:00 2001 From: Pavol Mederly Date: Thu, 20 Sep 2018 00:14:35 +0200 Subject: [PATCH 3/3] Minor naming fixes in midPoint dockerization --- midpoint/docker-compose.yml | 16 +++++++--------- .../container_files/usr-local-bin/entrypoint.sh | 4 ++-- 2 files changed, 9 insertions(+), 11 deletions(-) diff --git a/midpoint/docker-compose.yml b/midpoint/docker-compose.yml index d0b435d..1a6d7e7 100644 --- a/midpoint/docker-compose.yml +++ b/midpoint/docker-compose.yml @@ -17,7 +17,7 @@ services: networks: - back volumes: - - midpoint_mysql:/var/lib/mysql + - midpoint_data:/var/lib/mysql midpoint-server: build: ./midpoint-server/ @@ -45,21 +45,19 @@ services: secrets: - m_database_password.txt - m_keystore_password.txt - - source: m_sp-key.pem - target: shib_sp-key.pem - - source: m_host-key.pem - target: host-key.pem + - m_sp-key.pem + - m_host-key.pem volumes: - midpoint_home:/opt/midpoint/var - - type: bind - source: ./configs-and-secrets/midpoint/shibboleth/sp-cert.pem - target: /etc/shibboleth/sp-cert.pem - type: bind source: ./configs-and-secrets/midpoint/shibboleth/shibboleth2.xml target: /etc/shibboleth/shibboleth2.xml - type: bind source: ./configs-and-secrets/midpoint/shibboleth/idp-metadata.xml target: /etc/shibboleth/idp-metadata.xml + - type: bind + source: ./configs-and-secrets/midpoint/shibboleth/sp-cert.pem + target: /etc/shibboleth/sp-cert.pem - type: bind source: ./configs-and-secrets/midpoint/httpd/host-cert.pem target: /etc/pki/tls/certs/host-cert.pem @@ -82,5 +80,5 @@ secrets: file: ./configs-and-secrets/midpoint/application/keystore_password.txt volumes: - midpoint_mysql: + midpoint_data: midpoint_home: diff --git a/midpoint/midpoint-server/container_files/usr-local-bin/entrypoint.sh b/midpoint/midpoint-server/container_files/usr-local-bin/entrypoint.sh index a275bd2..446fc2a 100755 --- a/midpoint/midpoint-server/container_files/usr-local-bin/entrypoint.sh +++ b/midpoint/midpoint-server/container_files/usr-local-bin/entrypoint.sh @@ -5,8 +5,8 @@ export ENV=${ENV//[; ]/_} export USERTOKEN=${USERTOKEN//[; ]/_} echo "Linking secrets and config files; using authentication: $AUTHENTICATION" -ln -sf /run/secrets/shib_sp-key.pem /etc/shibboleth/sp-key.pem -ln -sf /run/secrets/host-key.pem /etc/pki/tls/private/host-key.pem +ln -sf /run/secrets/m_sp-key.pem /etc/shibboleth/sp-key.pem +ln -sf /run/secrets/m_host-key.pem /etc/pki/tls/private/host-key.pem ln -sf /etc/httpd/conf.d/midpoint.conf.auth.$AUTHENTICATION /etc/httpd/conf.d/midpoint.conf httpd-shib-foreground &