From 4f85857c506729174013742149d69eca736fe2de Mon Sep 17 00:00:00 2001 From: Henrik Lund Kramshoej Date: Mon, 10 Jul 2017 12:27:27 +0200 Subject: Messing up the thing --- Dockerfile | 9 +- README.md | 122 +++++++++ conf-from-container/conf/README.md | 5 + conf-from-container/conf/access-control.xml | 68 +++++ conf-from-container/conf/admin/general-admin.xml | 53 ++++ conf-from-container/conf/admin/metrics.xml | 129 +++++++++ conf-from-container/conf/attribute-filter.xml | 45 ++++ .../conf/attribute-resolver-full.xml | 292 +++++++++++++++++++++ .../conf/attribute-resolver-ldap.xml | 94 +++++++ conf-from-container/conf/attribute-resolver.xml | 108 ++++++++ conf-from-container/conf/audit.xml | 32 +++ .../conf/authn/authn-comparison.xml | 77 ++++++ .../conf/authn/authn-events-flow.xml | 18 ++ .../conf/authn/duo-authn-config.xml | 25 ++ conf-from-container/conf/authn/duo.properties | 9 + .../conf/authn/external-authn-config.xml | 70 +++++ conf-from-container/conf/authn/general-authn.xml | 156 +++++++++++ .../conf/authn/ipaddress-authn-config.xml | 37 +++ .../conf/authn/jaas-authn-config.xml | 27 ++ conf-from-container/conf/authn/jaas.config | 11 + .../conf/authn/krb5-authn-config.xml | 31 +++ .../conf/authn/ldap-authn-config.xml | 135 ++++++++++ .../conf/authn/mfa-authn-config.xml | 94 +++++++ .../conf/authn/password-authn-config.xml | 121 +++++++++ .../conf/authn/remoteuser-authn-config.xml | 75 ++++++ .../authn/remoteuser-internal-authn-config.xml | 63 +++++ .../conf/authn/spnego-authn-config.xml | 74 ++++++ .../conf/authn/x509-authn-config.xml | 44 ++++ .../conf/authn/x509-internal-authn-config.xml | 21 ++ .../c14n/attribute-sourced-subject-c14n-config.xml | 44 ++++ .../conf/c14n/simple-subject-c14n-config.xml | 27 ++ .../conf/c14n/subject-c14n-events-flow.xml | 18 ++ conf-from-container/conf/c14n/subject-c14n.xml | 109 ++++++++ .../conf/c14n/x500-subject-c14n-config.xml | 37 +++ conf-from-container/conf/cas-protocol.xml | 84 ++++++ conf-from-container/conf/credentials.xml | 65 +++++ conf-from-container/conf/errors.xml | 120 +++++++++ conf-from-container/conf/global.xml | 53 ++++ conf-from-container/conf/idp.properties | 195 ++++++++++++++ .../conf/intercept/consent-intercept-config.xml | 136 ++++++++++ .../intercept/context-check-intercept-config.xml | 42 +++ .../expiring-password-intercept-config.xml | 37 +++ .../conf/intercept/intercept-events-flow.xml | 18 ++ .../conf/intercept/profile-intercept.xml | 38 +++ conf-from-container/conf/ldap.properties | 74 ++++++ conf-from-container/conf/logback.xml | 186 +++++++++++++ conf-from-container/conf/metadata-providers.xml | 67 +++++ conf-from-container/conf/mvc-beans.xml | 23 ++ conf-from-container/conf/relying-party.xml | 70 +++++ conf-from-container/conf/saml-nameid.properties | 35 +++ conf-from-container/conf/saml-nameid.xml | 62 +++++ conf-from-container/conf/services.properties | 65 +++++ conf-from-container/conf/services.xml | 144 ++++++++++ conf-from-container/conf/session-manager.xml | 45 ++++ conf-from-container/run.sh | 1 + conf-from-container/shell.sh | 1 + install.properties | 33 +++ nordu-ldap.properties | 10 + shibboleth-identity-provider-3.3.0.tar.gz | Bin 0 -> 41527189 bytes template-config/README.md | 5 + template-config/attribute-resolver.xml | 108 ++++++++ 61 files changed, 3994 insertions(+), 3 deletions(-) create mode 100755 README.md create mode 100644 conf-from-container/conf/README.md create mode 100644 conf-from-container/conf/access-control.xml create mode 100644 conf-from-container/conf/admin/general-admin.xml create mode 100644 conf-from-container/conf/admin/metrics.xml create mode 100644 conf-from-container/conf/attribute-filter.xml create mode 100644 conf-from-container/conf/attribute-resolver-full.xml create mode 100644 conf-from-container/conf/attribute-resolver-ldap.xml create mode 100644 conf-from-container/conf/attribute-resolver.xml create mode 100644 conf-from-container/conf/audit.xml create mode 100644 conf-from-container/conf/authn/authn-comparison.xml create mode 100644 conf-from-container/conf/authn/authn-events-flow.xml create mode 100644 conf-from-container/conf/authn/duo-authn-config.xml create mode 100644 conf-from-container/conf/authn/duo.properties create mode 100644 conf-from-container/conf/authn/external-authn-config.xml create mode 100644 conf-from-container/conf/authn/general-authn.xml create mode 100644 conf-from-container/conf/authn/ipaddress-authn-config.xml create mode 100644 conf-from-container/conf/authn/jaas-authn-config.xml create mode 100644 conf-from-container/conf/authn/jaas.config create mode 100644 conf-from-container/conf/authn/krb5-authn-config.xml create mode 100644 conf-from-container/conf/authn/ldap-authn-config.xml create mode 100644 conf-from-container/conf/authn/mfa-authn-config.xml create mode 100644 conf-from-container/conf/authn/password-authn-config.xml create mode 100644 conf-from-container/conf/authn/remoteuser-authn-config.xml create mode 100644 conf-from-container/conf/authn/remoteuser-internal-authn-config.xml create mode 100644 conf-from-container/conf/authn/spnego-authn-config.xml create mode 100644 conf-from-container/conf/authn/x509-authn-config.xml create mode 100644 conf-from-container/conf/authn/x509-internal-authn-config.xml create mode 100644 conf-from-container/conf/c14n/attribute-sourced-subject-c14n-config.xml create mode 100644 conf-from-container/conf/c14n/simple-subject-c14n-config.xml create mode 100644 conf-from-container/conf/c14n/subject-c14n-events-flow.xml create mode 100644 conf-from-container/conf/c14n/subject-c14n.xml create mode 100644 conf-from-container/conf/c14n/x500-subject-c14n-config.xml create mode 100644 conf-from-container/conf/cas-protocol.xml create mode 100644 conf-from-container/conf/credentials.xml create mode 100644 conf-from-container/conf/errors.xml create mode 100644 conf-from-container/conf/global.xml create mode 100644 conf-from-container/conf/idp.properties create mode 100644 conf-from-container/conf/intercept/consent-intercept-config.xml create mode 100644 conf-from-container/conf/intercept/context-check-intercept-config.xml create mode 100644 conf-from-container/conf/intercept/expiring-password-intercept-config.xml create mode 100644 conf-from-container/conf/intercept/intercept-events-flow.xml create mode 100644 conf-from-container/conf/intercept/profile-intercept.xml create mode 100644 conf-from-container/conf/ldap.properties create mode 100644 conf-from-container/conf/logback.xml create mode 100644 conf-from-container/conf/metadata-providers.xml create mode 100644 conf-from-container/conf/mvc-beans.xml create mode 100644 conf-from-container/conf/relying-party.xml create mode 100644 conf-from-container/conf/saml-nameid.properties create mode 100644 conf-from-container/conf/saml-nameid.xml create mode 100644 conf-from-container/conf/services.properties create mode 100644 conf-from-container/conf/services.xml create mode 100644 conf-from-container/conf/session-manager.xml create mode 100644 conf-from-container/run.sh create mode 100644 conf-from-container/shell.sh create mode 100644 nordu-ldap.properties create mode 100644 shibboleth-identity-provider-3.3.0.tar.gz create mode 100644 template-config/README.md create mode 100644 template-config/attribute-resolver.xml diff --git a/Dockerfile b/Dockerfile index c8ec340..6c0571c 100644 --- a/Dockerfile +++ b/Dockerfile @@ -4,17 +4,21 @@ MAINTAINER Jesper B. Rosenkilde ENV IDP_VERSION 3.3.0 COPY install.properties /opt/ +COPY nordu-ldap.properties /opt/ COPY shibboleth-identity-provider-${IDP_VERSION}.tar.gz.sha256 /opt/ +COPY shibboleth-identity-provider-${IDP_VERSION}.tar.gz /opt/ +COPY template-config/ /opt/template-config COPY shibboleth.db.ddl /tmp/ WORKDIR /opt RUN apk --no-cache add bash apache-ant sqlite curl && \ - curl -O https://shibboleth.net/downloads/identity-provider/${IDP_VERSION}/shibboleth-identity-provider-${IDP_VERSION}.tar.gz && \ + #curl -O https://shibboleth.net/downloads/identity-provider/${IDP_VERSION}/shibboleth-identity-provider-${IDP_VERSION}.tar.gz && \ sha256sum -c shibboleth-identity-provider-$IDP_VERSION.tar.gz.sha256 && \ tar xf shibboleth-identity-provider-$IDP_VERSION.tar.gz && \ mv shibboleth-identity-provider-$IDP_VERSION shibboleth-identity-provider && \ ./shibboleth-identity-provider/bin/install.sh -propertyfile install.properties && \ apk --no-cache del apache-ant && \ - rm -rf shibboleth-identity-provider* install.properties + cp /opt/template-config/*.xml /opt/shibboleth-idp/conf && \ + rm -rf shibboleth-identity-provider* install.properties nordu-ldap.properties RUN chown -R jetty:jetty /opt/shibboleth-idp @@ -23,4 +27,3 @@ RUN chown -R jetty:jetty /opt/shibboleth-idp COPY jetty_base /var/lib/jetty WORKDIR $JETTY_BASE - diff --git a/README.md b/README.md new file mode 100755 index 0000000..7f0ea74 --- /dev/null +++ b/README.md @@ -0,0 +1,122 @@ +# Shibboleth IDP version 3 project + +# RTFM + +From +https://wiki.shibboleth.net/confluence/display/IDP30/Configuration + +To configure a new IdP from scratch, you will need to address these areas first: +* Metadata +* Authentication +* Attribute Resolver +* Attribute Filter + +If you need to dig into more advanced SAML configuration needs, or need to interoperate with commercial cloud services, you will usually need to tackle these areas: +* SAML NameID Generation +* Profiles and Per-RelyingParty Behavior +* Unsolicited (IdP-initiated) SAML + +and more + +File installer.properties +Properties written out by the installer and used during upgrades. Scripts may create this ahead of time and feed it in to the installer in order to have a silent install. Deployers are not expected to modify this directly. + + + + +# Resources +Links from Jesper Rosenkilde + +https://shibboleth.net/products/identity-provider.html +https://github.com/UNINETT/mod_auth_mellon + + +# Running a docker + +## Build +``` +docker build -t $(basename $(pwd)) . +``` + +## Run +``` +docker run -p80:80 -p 443:443 --rm -ti $(basename $(pwd)) +``` + +## Interactive shell +``` +hlk@bujin:shibboleth-docker$ docker ps +CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES +b2b93c309396 shibboleth-docker "/docker-entrypoin..." 8 minutes ago Up 8 minutes 0.0.0.0:80->80/tcp, 0.0.0.0:443->443/tcp, 8080/tcp eager_borg +``` + +## Getting shell + +``` +hlk@bujin:shibboleth-docker$ docker exec -ti b2b93c309396 bash +bash-4.3# id +uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel),11(floppy),20(dialout),26(tape),27(video) +bash-4.3# hostname +b2b93c309396 +``` + +## Copy files out from container + + +docker cp `docker ps | cut -f 1 -d ' ' | grep -v "CONTAINER"`:/opt/shibboleth-idp/conf /Users/hlk/projects/shibboleth-docker/conf-from-container + +``` +docker cp c172ac9afb1b:/opt/shibboleth-idp/conf /Users/hlk/projects/shibboleth-docker/conf-from-container +``` + + + +# Changes in v2 to v3 + +Summary of changes +https://wiki.shibboleth.net/confluence/display/IDP30/ConfigurationFileSummary + +# Less changes + +Attribute resolver +https://wiki.shibboleth.net/confluence/display/IDP30/AttributeResolverConfiguration +V2 Compatibility +The overall content and structure is identical to V2. Sematically, the V3 IdP is nearly 100% compatible with V2 attribute configuration. All regressions should be reported via our issue tracker. +Some key exceptions are noted below. + + + + +# Changes to be made + +https://wiki.shibboleth.net/confluence/display/IDP30/AuthenticationConfiguration + +If the V2 UsernamePassword login handler was used, the V3 equivalent is the Password flow with the JAAS back-end; a similar JAAS configuration can typically be used, but the most common case (LDAP) is an exception because the underlying LDAP library has changed. By convention this configuration is placed in authn/jaas.config and the legacy-matching "ShibUserPassAuth" login configuration name is used (though this can be changed). The UI for password-based login is no longer strictly JSP-based as in V2, but is now a Web Flow view: this can use Velocity, JSP, or potentially other view technologies. The default login.vm view provided uses Velocity. Using an older login.jsp file will require some changes, although the V2 JSP taglibs for metadata-driven UI information should still work. We recommend modernizing to the use of Velocity, as this is much simpler in most cases. +... +So in short, activate flows with the idp.authn.flows property, transfer JAAS or web.xml and container configuration over, and you should have basic compatibility working, apart from the actual login UI for JAAS-based authentication. + +This is used in Nordunet config handler.xml + + + + +Source: https://wiki.shibboleth.net/confluence/display/IDP30/MetadataConfiguration + +During the V2 to V3 upgrade process, the original V2 relying-party.xml file is copied to metadata-providers.xml, to serve as the metadata configuration for the new version. It's strongly advisable after upgrading to update that file by stripping it of the older content and promote the element in it to the root of the file. In the interim all other content in the file except for elements (and any referenced elements) is ignored. +The following non-relevant trust engine types often found in a legacy relying-party.xml file are ignored if seen and cannot be used for metadata verification: +Chaining +MetadataExplicitKey +MetadataPKIXX509Credential +MetadataExplicitKeySignature +MetadataPKIXSignature +StaticPKIXX509Credential + + +# Other Links + +https://wiki.shibboleth.net/confluence/display/IDP30/Installation+Directory+and+Configuration+Files +describes the Installation Directory and Configuration Files + + +https://github.com/malavolti/HOWTO-Install-and-Configure-Shibboleth-Identity-Provider/blob/master/HOWTO%20Install%20and%20Configure%20a%20Shibboleth%20v3.2.1%20on%20Ubuntu%20Linux%20LTS%2014.04%20with%20Tomcat%208%20only.md +a sample config - steps to configure 3.2 diff --git a/conf-from-container/conf/README.md b/conf-from-container/conf/README.md new file mode 100644 index 0000000..6002238 --- /dev/null +++ b/conf-from-container/conf/README.md @@ -0,0 +1,5 @@ +# IDP config templates + +This directory contains the files which are being replaced after running install. + +Dockerfile should install these after running install. diff --git a/conf-from-container/conf/access-control.xml b/conf-from-container/conf/access-control.xml new file mode 100644 index 0000000..a9184e6 --- /dev/null +++ b/conf-from-container/conf/access-control.xml @@ -0,0 +1,68 @@ + + + + + + + + + + + + + + + + + + + + diff --git a/conf-from-container/conf/admin/general-admin.xml b/conf-from-container/conf/admin/general-admin.xml new file mode 100644 index 0000000..6e9fc19 --- /dev/null +++ b/conf-from-container/conf/admin/general-admin.xml @@ -0,0 +1,53 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/conf-from-container/conf/admin/metrics.xml b/conf-from-container/conf/admin/metrics.xml new file mode 100644 index 0000000..f9b5c16 --- /dev/null +++ b/conf-from-container/conf/admin/metrics.xml @@ -0,0 +1,129 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/conf-from-container/conf/attribute-filter.xml b/conf-from-container/conf/attribute-filter.xml new file mode 100644 index 0000000..f8c41ba --- /dev/null +++ b/conf-from-container/conf/attribute-filter.xml @@ -0,0 +1,45 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/conf-from-container/conf/attribute-resolver-full.xml b/conf-from-container/conf/attribute-resolver-full.xml new file mode 100644 index 0000000..4681b64 --- /dev/null +++ b/conf-from-container/conf/attribute-resolver-full.xml @@ -0,0 +1,292 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/conf-from-container/conf/attribute-resolver-ldap.xml b/conf-from-container/conf/attribute-resolver-ldap.xml new file mode 100644 index 0000000..ec79de9 --- /dev/null +++ b/conf-from-container/conf/attribute-resolver-ldap.xml @@ -0,0 +1,94 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/conf-from-container/conf/attribute-resolver.xml b/conf-from-container/conf/attribute-resolver.xml new file mode 100644 index 0000000..35f3b35 --- /dev/null +++ b/conf-from-container/conf/attribute-resolver.xml @@ -0,0 +1,108 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/conf-from-container/conf/audit.xml b/conf-from-container/conf/audit.xml new file mode 100644 index 0000000..22949fd --- /dev/null +++ b/conf-from-container/conf/audit.xml @@ -0,0 +1,32 @@ + + + + + + + + + + + + + + http://shibboleth.net/ns/profiles/status + + + diff --git a/conf-from-container/conf/authn/authn-comparison.xml b/conf-from-container/conf/authn/authn-comparison.xml new file mode 100644 index 0000000..f167b7a --- /dev/null +++ b/conf-from-container/conf/authn/authn-comparison.xml @@ -0,0 +1,77 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified + + + diff --git a/conf-from-container/conf/authn/authn-events-flow.xml b/conf-from-container/conf/authn/authn-events-flow.xml new file mode 100644 index 0000000..244e1db --- /dev/null +++ b/conf-from-container/conf/authn/authn-events-flow.xml @@ -0,0 +1,18 @@ + + + + + + + + + + diff --git a/conf-from-container/conf/authn/duo-authn-config.xml b/conf-from-container/conf/authn/duo-authn-config.xml new file mode 100644 index 0000000..0a48152 --- /dev/null +++ b/conf-from-container/conf/authn/duo-authn-config.xml @@ -0,0 +1,25 @@ + + + + + + diff --git a/conf-from-container/conf/authn/duo.properties b/conf-from-container/conf/authn/duo.properties new file mode 100644 index 0000000..2ca71ee --- /dev/null +++ b/conf-from-container/conf/authn/duo.properties @@ -0,0 +1,9 @@ +# Duo integration settings + +# Note: If upgrading from pre-3.3 IdP versions, you will need to manually add a pointer +# to this property file to idp.properties. + +idp.duo.apiHost = hostname +idp.duo.applicationKey = key +idp.duo.integrationKey = key +idp.duo.secretKey = key diff --git a/conf-from-container/conf/authn/external-authn-config.xml b/conf-from-container/conf/authn/external-authn-config.xml new file mode 100644 index 0000000..8b3a159 --- /dev/null +++ b/conf-from-container/conf/authn/external-authn-config.xml @@ -0,0 +1,70 @@ + + + + + + + + + + + + + + + + + + UnknownUsername + + + + + InvalidPassword + + + + + ExpiredPassword + + + + + ExpiringPassword + + + + + diff --git a/conf-from-container/conf/authn/general-authn.xml b/conf-from-container/conf/authn/general-authn.xml new file mode 100644 index 0000000..ac55bbb --- /dev/null +++ b/conf-from-container/conf/authn/general-authn.xml @@ -0,0 +1,156 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + 1 + + + + diff --git a/conf-from-container/conf/authn/ipaddress-authn-config.xml b/conf-from-container/conf/authn/ipaddress-authn-config.xml new file mode 100644 index 0000000..a3ee096 --- /dev/null +++ b/conf-from-container/conf/authn/ipaddress-authn-config.xml @@ -0,0 +1,37 @@ + + + + + + + + + + + + + + + diff --git a/conf-from-container/conf/authn/jaas-authn-config.xml b/conf-from-container/conf/authn/jaas-authn-config.xml new file mode 100644 index 0000000..daef4d2 --- /dev/null +++ b/conf-from-container/conf/authn/jaas-authn-config.xml @@ -0,0 +1,27 @@ + + + + + + + + + + + ShibUserPassAuth + + + + + diff --git a/conf-from-container/conf/authn/jaas.config b/conf-from-container/conf/authn/jaas.config new file mode 100644 index 0000000..232e93d --- /dev/null +++ b/conf-from-container/conf/authn/jaas.config @@ -0,0 +1,11 @@ +ShibUserPassAuth { + /* + com.sun.security.auth.module.Krb5LoginModule required; + */ + + org.ldaptive.jaas.LdapLoginModule required + ldapUrl="ldap://localhost:10389" + baseDn="ou=people,dc=example,dc=org" + userFilter="uid={user}"; + +}; \ No newline at end of file diff --git a/conf-from-container/conf/authn/krb5-authn-config.xml b/conf-from-container/conf/authn/krb5-authn-config.xml new file mode 100644 index 0000000..d3590a2 --- /dev/null +++ b/conf-from-container/conf/authn/krb5-authn-config.xml @@ -0,0 +1,31 @@ + + + + + + + + + + + + + diff --git a/conf-from-container/conf/authn/ldap-authn-config.xml b/conf-from-container/conf/authn/ldap-authn-config.xml new file mode 100644 index 0000000..56d1bc7 --- /dev/null +++ b/conf-from-container/conf/authn/ldap-authn-config.xml @@ -0,0 +1,135 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/conf-from-container/conf/authn/mfa-authn-config.xml b/conf-from-container/conf/authn/mfa-authn-config.xml new file mode 100644 index 0000000..c47c901 --- /dev/null +++ b/conf-from-container/conf/authn/mfa-authn-config.xml @@ -0,0 +1,94 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/conf-from-container/conf/authn/password-authn-config.xml b/conf-from-container/conf/authn/password-authn-config.xml new file mode 100644 index 0000000..f27051b --- /dev/null +++ b/conf-from-container/conf/authn/password-authn-config.xml @@ -0,0 +1,121 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + NoCredentials + CLIENT_NOT_FOUND + Client not found + DN_RESOLUTION_FAILURE + + + + + InvalidCredentials + PREAUTH_FAILED + INVALID_CREDENTIALS + Checksum failed + + + + + AccountLocked + Clients credentials have been revoked + + + + + PASSWORD_EXPIRED + + + + + ACCOUNT_WARNING + + + + + + + + diff --git a/conf-from-container/conf/authn/remoteuser-authn-config.xml b/conf-from-container/conf/authn/remoteuser-authn-config.xml new file mode 100644 index 0000000..4b7e722 --- /dev/null +++ b/conf-from-container/conf/authn/remoteuser-authn-config.xml @@ -0,0 +1,75 @@ + + + + + + + + + + + + + + + + + + NoCredentials + + + + + UnknownUsername + + + + + InvalidPassword + + + + + ExpiredPassword + + + + + ExpiringPassword + + + + + diff --git a/conf-from-container/conf/authn/remoteuser-internal-authn-config.xml b/conf-from-container/conf/authn/remoteuser-internal-authn-config.xml new file mode 100644 index 0000000..9e68c85 --- /dev/null +++ b/conf-from-container/conf/authn/remoteuser-internal-authn-config.xml @@ -0,0 +1,63 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/conf-from-container/conf/authn/spnego-authn-config.xml b/conf-from-container/conf/authn/spnego-authn-config.xml new file mode 100644 index 0000000..07563b9 --- /dev/null +++ b/conf-from-container/conf/authn/spnego-authn-config.xml @@ -0,0 +1,74 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + SPNEGONotAvailable + + + + + NTLMUnsupported + + + + + diff --git a/conf-from-container/conf/authn/x509-authn-config.xml b/conf-from-container/conf/authn/x509-authn-config.xml new file mode 100644 index 0000000..18b015a --- /dev/null +++ b/conf-from-container/conf/authn/x509-authn-config.xml @@ -0,0 +1,44 @@ + + + + + + + + + + + + + NoCredentials + InvalidCredentials + + + + + diff --git a/conf-from-container/conf/authn/x509-internal-authn-config.xml b/conf-from-container/conf/authn/x509-internal-authn-config.xml new file mode 100644 index 0000000..bad3029 --- /dev/null +++ b/conf-from-container/conf/authn/x509-internal-authn-config.xml @@ -0,0 +1,21 @@ + + + + + + diff --git a/conf-from-container/conf/c14n/attribute-sourced-subject-c14n-config.xml b/conf-from-container/conf/c14n/attribute-sourced-subject-c14n-config.xml new file mode 100644 index 0000000..938b30f --- /dev/null +++ b/conf-from-container/conf/c14n/attribute-sourced-subject-c14n-config.xml @@ -0,0 +1,44 @@ + + + + + + altuid + + + + + altuid + + + + + + + + + + + + + diff --git a/conf-from-container/conf/c14n/simple-subject-c14n-config.xml b/conf-from-container/conf/c14n/simple-subject-c14n-config.xml new file mode 100644 index 0000000..3cddfa6 --- /dev/null +++ b/conf-from-container/conf/c14n/simple-subject-c14n-config.xml @@ -0,0 +1,27 @@ + + + + + + + + + + + + + + diff --git a/conf-from-container/conf/c14n/subject-c14n-events-flow.xml b/conf-from-container/conf/c14n/subject-c14n-events-flow.xml new file mode 100644 index 0000000..d7458cd --- /dev/null +++ b/conf-from-container/conf/c14n/subject-c14n-events-flow.xml @@ -0,0 +1,18 @@ + + + + + + + + + + diff --git a/conf-from-container/conf/c14n/subject-c14n.xml b/conf-from-container/conf/c14n/subject-c14n.xml new file mode 100644 index 0000000..16fc6f1 --- /dev/null +++ b/conf-from-container/conf/c14n/subject-c14n.xml @@ -0,0 +1,109 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified + urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress + urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName + urn:oasis:names:tc:SAML:1.1:nameid-format:WindowsDomainQualifiedName + urn:oasis:names:tc:SAML:2.0:nameid-format:kerberos + + + + + + + + + + + + + + + + + diff --git a/conf-from-container/conf/c14n/x500-subject-c14n-config.xml b/conf-from-container/conf/c14n/x500-subject-c14n-config.xml new file mode 100644 index 0000000..1ae25e4 --- /dev/null +++ b/conf-from-container/conf/c14n/x500-subject-c14n-config.xml @@ -0,0 +1,37 @@ + + + + + + + + + + + 2.5.4.3 + + + + + + + + + + + + + diff --git a/conf-from-container/conf/cas-protocol.xml b/conf-from-container/conf/cas-protocol.xml new file mode 100644 index 0000000..d0b3d55 --- /dev/null +++ b/conf-from-container/conf/cas-protocol.xml @@ -0,0 +1,84 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/conf-from-container/conf/credentials.xml b/conf-from-container/conf/credentials.xml new file mode 100644 index 0000000..7462879 --- /dev/null +++ b/conf-from-container/conf/credentials.xml @@ -0,0 +1,65 @@ + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/conf-from-container/conf/errors.xml b/conf-from-container/conf/errors.xml new file mode 100644 index 0000000..5de522f --- /dev/null +++ b/conf-from-container/conf/errors.xml @@ -0,0 +1,120 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/conf-from-container/conf/global.xml b/conf-from-container/conf/global.xml new file mode 100644 index 0000000..60562e3 --- /dev/null +++ b/conf-from-container/conf/global.xml @@ -0,0 +1,53 @@ + + + + + + + + + + + + + + + diff --git a/conf-from-container/conf/idp.properties b/conf-from-container/conf/idp.properties new file mode 100644 index 0000000..80f23b8 --- /dev/null +++ b/conf-from-container/conf/idp.properties @@ -0,0 +1,195 @@ +# Load any additional property resources from a comma-delimited list +idp.additionalProperties= /conf/ldap.properties, /conf/saml-nameid.properties, /conf/services.properties, /conf/authn/duo.properties + +# Set the entityID of the IdP +idp.entityID= https://idp.nordu.dev/idp/shibboleth + +# Set the scope used in the attribute resolver for scoped attributes +idp.scope= nordu.dev + +# General cookie properties (maxAge only applies to persistent cookies) +#idp.cookie.secure = false +#idp.cookie.httpOnly = true +#idp.cookie.domain = +#idp.cookie.path = +#idp.cookie.maxAge = 31536000 + +# Set the location of user-supplied web flow definitions +#idp.webflows = %{idp.home}/flows + +# Set the location of Velocity view templates +#idp.views = %{idp.home}/views + +# Settings for internal AES encryption key +#idp.sealer.storeType = JCEKS +#idp.sealer.updateInterval = PT15M +#idp.sealer.aliasBase = secret +idp.sealer.storeResource= %{idp.home}/credentials/sealer.jks +idp.sealer.versionResource= %{idp.home}/credentials/sealer.kver +idp.sealer.storePassword= password +idp.sealer.keyPassword= password + +# Settings for public/private signing and encryption key(s) +# During decryption key rollover, point the ".2" properties at a second +# keypair, uncomment in credentials.xml, then publish it in your metadata. +idp.signing.key= %{idp.home}/credentials/idp-signing.key +idp.signing.cert= %{idp.home}/credentials/idp-signing.crt +idp.encryption.key= %{idp.home}/credentials/idp-encryption.key +idp.encryption.cert= %{idp.home}/credentials/idp-encryption.crt +#idp.encryption.key.2 = %{idp.home}/credentials/idp-encryption-old.key +#idp.encryption.cert.2 = %{idp.home}/credentials/idp-encryption-old.crt + +# Sets the bean ID to use as a default security configuration set +#idp.security.config = shibboleth.DefaultSecurityConfiguration + +# To default to SHA-1, set to shibboleth.SigningConfiguration.SHA1 +#idp.signing.config = shibboleth.SigningConfiguration.SHA256 + +# Configures trust evaluation of keys used by services at runtime +# Defaults to supporting both explicit key and PKIX using SAML metadata. +#idp.trust.signatures = shibboleth.ChainingSignatureTrustEngine +# To pick only one set to one of: +# shibboleth.ExplicitKeySignatureTrustEngine, shibboleth.PKIXSignatureTrustEngine +#idp.trust.certificates = shibboleth.ChainingX509TrustEngine +# To pick only one set to one of: +# shibboleth.ExplicitKeyX509TrustEngine, shibboleth.PKIXX509TrustEngine + +# If true, encryption will happen whenever a key to use can be located, but +# failure to encrypt won't result in request failure. +#idp.encryption.optional = false + +# Configuration of client- and server-side storage plugins +#idp.storage.cleanupInterval = PT10M +#idp.storage.htmlLocalStorage = false + +# Set to true to expose more detailed errors in responses to SPs +#idp.errors.detailed = false +# Set to false to skip signing of SAML response messages that signal errors +#idp.errors.signed = true +# Name of bean containing a list of Java exception classes to ignore +#idp.errors.excludedExceptions = ExceptionClassListBean +# Name of bean containing a property set mapping exception names to views +#idp.errors.exceptionMappings = ExceptionToViewPropertyBean +# Set if a different default view name for events and exceptions is needed +#idp.errors.defaultView = error + +# Set to false to disable the IdP session layer +#idp.session.enabled = true + +# Set to "shibboleth.StorageService" for server-side storage of user sessions +#idp.session.StorageService = shibboleth.ClientSessionStorageService + +# Size of session IDs +#idp.session.idSize = 32 +# Bind sessions to IP addresses +#idp.session.consistentAddress = true +# Inactivity timeout +#idp.session.timeout = PT60M +# Extra time to store sessions for logout +#idp.session.slop = PT0S +# Tolerate storage-related errors +#idp.session.maskStorageFailure = false +# Track information about SPs logged into +#idp.session.trackSPSessions = false +# Support lookup by SP for SAML logout +#idp.session.secondaryServiceIndex = false +# Length of time to track SP sessions +#idp.session.defaultSPlifetime = PT2H + +# Regular expression matching login flows to enable, e.g. IPAddress|Password +idp.authn.flows= Password + +# Regular expression of forced "initial" methods when no session exists, +# usually in conjunction with the idp.authn.resolveAttribute property below. +#idp.authn.flows.initial = Password + +# Set to an attribute ID to resolve prior to selecting authentication flows; +# its values are used to filter the flows to allow. +#idp.authn.resolveAttribute = eduPersonAssurance + +# Default lifetime and timeout of various authentication methods +#idp.authn.defaultLifetime = PT60M +#idp.authn.defaultTimeout = PT30M + +# Whether to populate relying party user interface information for display +# during authentication, consent, terms-of-use. +#idp.authn.rpui = true + +# Whether to prioritize "active" results when an SP requests more than +# one possible matching login method (V2 behavior was to favor them) +#idp.authn.favorSSO = false + +# Whether to fail requests when a user identity after authentication +# doesn't match the identity in a pre-existing session. +#idp.authn.identitySwitchIsError = false + +# Set to "shibboleth.StorageService" or custom bean for alternate storage of consent +#idp.consent.StorageService = shibboleth.ClientPersistentStorageService + +# Set to "shibboleth.consent.AttributeConsentStorageKey" to use an attribute +# to key user consent storage records (and set the attribute name) +#idp.consent.userStorageKey = shibboleth.consent.PrincipalConsentStorageKey +#idp.consent.userStorageKeyAttribute = uid + +# Flags controlling how built-in attribute consent feature operates +#idp.consent.allowDoNotRemember = true +#idp.consent.allowGlobal = true +#idp.consent.allowPerAttribute = false + +# Whether attribute values and terms of use text are compared +#idp.consent.compareValues = false +# Maximum number of consent records for space-limited storage (e.g. cookies) +#idp.consent.maxStoredRecords = 10 +# Maximum number of consent records for larger/server-side storage (0 = no limit) +#idp.consent.expandedMaxStoredRecords = 0 + +# Time in milliseconds to expire consent storage records. +#idp.consent.storageRecordLifetime = P1Y + +# Whether to lookup metadata, etc. for every SP involved in a logout +# for use by user interface logic; adds overhead so off by default. +#idp.logout.elaboration = false + +# Whether to require logout requests/responses be signed/authenticated. +#idp.logout.authenticated = true + +# Message freshness and replay cache tuning +#idp.policy.messageLifetime = PT3M +#idp.policy.clockSkew = PT3M + +# Set to custom bean for alternate storage of replay cache +#idp.replayCache.StorageService = shibboleth.StorageService + +# Toggles whether to allow outbound messages via SAML artifact +#idp.artifact.enabled = true +# Suppresses typical signing/encryption when artifact binding used +#idp.artifact.secureChannel = true +# May differ to direct SAML 2 artifact lookups to specific server nodes +#idp.artifact.endpointIndex = 2 +# Set to custom bean for alternate storage of artifact map state +#idp.artifact.StorageService = shibboleth.StorageService + +# Comma-delimited languages to use if not match can be found with the +# browser-supported languages, defaults to an empty list. +idp.ui.fallbackLanguages= en,fr,de + +# Storage service used by CAS protocol +# Defaults to shibboleth.StorageService (in-memory) +# MUST be server-side storage (e.g. in-memory, memcached, database) +# NOTE that idp.session.StorageService requires server-side storage +# when CAS protocol is enabled +#idp.cas.StorageService=shibboleth.StorageService + +# CAS service registry implementation class +#idp.cas.serviceRegistryClass=net.shibboleth.idp.cas.service.PatternServiceRegistry + +# Profile flows in which the ProfileRequestContext should be exposed +# in servlet request under the key "opensamlProfileRequestContext" +#idp.profile.exposeProfileRequestContextInServletRequest = SAML2/POST/SSO,SAML2/Redirect/SSO + +# F-TICKS auditing - set a salt to include hashed username +#idp.fticks.federation=MyFederation +#idp.fticks.algorithm=SHA-256 +#idp.fticks.salt=somethingsecret +#idp.fticks.loghost=localhost +#idp.fticks.logport=514 diff --git a/conf-from-container/conf/intercept/consent-intercept-config.xml b/conf-from-container/conf/intercept/consent-intercept-config.xml new file mode 100644 index 0000000..ca183a7 --- /dev/null +++ b/conf-from-container/conf/intercept/consent-intercept-config.xml @@ -0,0 +1,136 @@ + + + + + + + + + + + + + + + + + + + + + transientId + persistentId + eduPersonTargetedID + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/conf-from-container/conf/intercept/context-check-intercept-config.xml b/conf-from-container/conf/intercept/context-check-intercept-config.xml new file mode 100644 index 0000000..809f1d4 --- /dev/null +++ b/conf-from-container/conf/intercept/context-check-intercept-config.xml @@ -0,0 +1,42 @@ + + + + + + + + + + + + + + * + + + + + + + + + + \ No newline at end of file diff --git a/conf-from-container/conf/intercept/expiring-password-intercept-config.xml b/conf-from-container/conf/intercept/expiring-password-intercept-config.xml new file mode 100644 index 0000000..5447b16 --- /dev/null +++ b/conf-from-container/conf/intercept/expiring-password-intercept-config.xml @@ -0,0 +1,37 @@ + + + + + + + + + + + + + + + + + + + + diff --git a/conf-from-container/conf/intercept/intercept-events-flow.xml b/conf-from-container/conf/intercept/intercept-events-flow.xml new file mode 100644 index 0000000..5cb30d5 --- /dev/null +++ b/conf-from-container/conf/intercept/intercept-events-flow.xml @@ -0,0 +1,18 @@ + + + + + + + + + + diff --git a/conf-from-container/conf/intercept/profile-intercept.xml b/conf-from-container/conf/intercept/profile-intercept.xml new file mode 100644 index 0000000..4040a10 --- /dev/null +++ b/conf-from-container/conf/intercept/profile-intercept.xml @@ -0,0 +1,38 @@ + + + + + + + + + + + + + + + + + + + + diff --git a/conf-from-container/conf/ldap.properties b/conf-from-container/conf/ldap.properties new file mode 100644 index 0000000..e9d9ffb --- /dev/null +++ b/conf-from-container/conf/ldap.properties @@ -0,0 +1,74 @@ +# LDAP authentication configuration, see authn/ldap-authn-config.xml +# Note, this doesn't apply to the use of JAAS + +## Authenticator strategy, either anonSearchAuthenticator, bindSearchAuthenticator, directAuthenticator, adAuthenticator +idp.authn.LDAP.authenticator= bindSearchAuthenticator + +## Connection properties ## +idp.authn.LDAP.ldapURL= ldaps://ldap.nordu.net +idp.authn.LDAP.useStartTLS= false +idp.authn.LDAP.useSSL= false +# Time in milliseconds that connects will block +#idp.authn.LDAP.connectTimeout = PT3S +# Time in milliseconds to wait for responses +#idp.authn.LDAP.responseTimeout = PT3S + +## SSL configuration, either jvmTrust, certificateTrust, or keyStoreTrust +idp.authn.LDAP.sslConfig= certificateTrust +## If using certificateTrust above, set to the trusted certificate's path +idp.authn.LDAP.trustCertificates= %{idp.home}/credentials/ldap-server.crt +## If using keyStoreTrust above, set to the truststore path +idp.authn.LDAP.trustStore= %{idp.home}/credentials/ldap-server.truststore + +## Return attributes during authentication +idp.authn.LDAP.returnAttributes= passwordExpirationTime,loginGraceRemaining + +## DN resolution properties ## + +# Search DN resolution, used by anonSearchAuthenticator, bindSearchAuthenticator +# for AD: CN=Users,DC=example,DC=org +idp.authn.LDAP.baseDN= dc=nordu,dc=net +#idp.authn.LDAP.subtreeSearch = false +idp.authn.LDAP.userFilter= (uid={user}) +# bind search configuration +# for AD: idp.authn.LDAP.bindDN=adminuser@domain.com +idp.authn.LDAP.bindDN= dc=nordu,dc=net +idp.authn.LDAP.bindDNCredential= blahblah + +# Format DN resolution, used by directAuthenticator, adAuthenticator +# for AD use idp.authn.LDAP.dnFormat=%s@domain.com +idp.authn.LDAP.dnFormat= uid=%s,ou=people,dc=example,dc=org + +# LDAP attribute configuration, see attribute-resolver.xml +# Note, this likely won't apply to the use of legacy V2 resolver configurations +idp.attribute.resolver.LDAP.ldapURL= %{idp.authn.LDAP.ldapURL} +idp.attribute.resolver.LDAP.connectTimeout= %{idp.authn.LDAP.connectTimeout:PT3S} +idp.attribute.resolver.LDAP.responseTimeout= %{idp.authn.LDAP.responseTimeout:PT3S} +idp.attribute.resolver.LDAP.baseDN= %{idp.authn.LDAP.baseDN:undefined} +idp.attribute.resolver.LDAP.bindDN= %{idp.authn.LDAP.bindDN:undefined} +idp.attribute.resolver.LDAP.bindDNCredential= %{idp.authn.LDAP.bindDNCredential:undefined} +idp.attribute.resolver.LDAP.useStartTLS= %{idp.authn.LDAP.useStartTLS:true} +idp.attribute.resolver.LDAP.trustCertificates= %{idp.authn.LDAP.trustCertificates:undefined} +idp.attribute.resolver.LDAP.searchFilter= (uid=$resolutionContext.principal) + +# LDAP pool configuration, used for both authn and DN resolution +#idp.pool.LDAP.minSize = 3 +#idp.pool.LDAP.maxSize = 10 +#idp.pool.LDAP.validateOnCheckout = false +#idp.pool.LDAP.validatePeriodically = true +#idp.pool.LDAP.validatePeriod = PT5M +#idp.pool.LDAP.prunePeriod = PT5M +#idp.pool.LDAP.idleTime = PT10M +#idp.pool.LDAP.blockWaitTime = PT3S +#idp.pool.LDAP.failFastInitialize = false +%{idp.attribute.resolver.LDAP.searchFilter}= +principalCredential= "%{idp.attribute.resolver.LDAP.bindDNCredential}" +baseDN= "%{idp.attribute.resolver.LDAP.baseDN}" +useStartTLS= "%{idp.attribute.resolver.LDAP.useStartTLS:true}" +trustFile= "%{idp.attribute.resolver.LDAP.trustCertificates}" +responseTimeout= "%{idp.attribute.resolver.LDAP.responseTimeout}"> +ldapURL= "%{idp.attribute.resolver.LDAP.ldapURL}" +connectTimeout= "%{idp.attribute.resolver.LDAP.connectTimeout}" += diff --git a/conf-from-container/conf/logback.xml b/conf-from-container/conf/logback.xml new file mode 100644 index 0000000..104ec4c --- /dev/null +++ b/conf-from-container/conf/logback.xml @@ -0,0 +1,186 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + ${idp.logfiles}/idp-process.log + + + ${idp.logfiles}/idp-process-%d{yyyy-MM-dd}.log.gz + ${idp.loghistory:-180} + + + + UTF-8 + %date{ISO8601} - %level [%logger:%line] - %msg%n%ex{short} + + + + + + + VelocityStatusMatcher + ResourceManager : unable to find resource 'status.vm' in any resource loader. + + VelocityStatusMatcher.matches(formattedMessage) + + DENY + + + + + + 0 + + + + + + WARN + + + ${idp.logfiles}/idp-warn.log + + + ${idp.logfiles}/idp-warn-%d{yyyy-MM-dd}.log.gz + ${idp.loghistory:-180} + + + + UTF-8 + %date{ISO8601} - %level [%logger:%line] - %msg%n%ex{short} + + + + + + + VelocityStatusMatcher + ResourceManager : unable to find resource 'status.vm' in any resource loader. + + VelocityStatusMatcher.matches(formattedMessage) + + DENY + + + + + + ${idp.logfiles}/idp-audit.log + + + ${idp.logfiles}/idp-audit-%d{yyyy-MM-dd}.log.gz + ${idp.loghistory:-180} + + + + UTF-8 + %msg%n + + + + + + ${idp.logfiles}/idp-consent-audit.log + + + ${idp.logfiles}/idp-consent-audit-%d{yyyy-MM-dd}.log.gz + ${idp.loghistory:-180} + + + + UTF-8 + %msg%n + + + + + + ${idp.fticks.loghost:-localhost} + ${idp.fticks.logport:-514} + AUTH + [%thread] %logger %msg + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/conf-from-container/conf/metadata-providers.xml b/conf-from-container/conf/metadata-providers.xml new file mode 100644 index 0000000..facc296 --- /dev/null +++ b/conf-from-container/conf/metadata-providers.xml @@ -0,0 +1,67 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/conf-from-container/conf/mvc-beans.xml b/conf-from-container/conf/mvc-beans.xml new file mode 100644 index 0000000..98d9bcd --- /dev/null +++ b/conf-from-container/conf/mvc-beans.xml @@ -0,0 +1,23 @@ + + + + + + diff --git a/conf-from-container/conf/relying-party.xml b/conf-from-container/conf/relying-party.xml new file mode 100644 index 0000000..28c9193 --- /dev/null +++ b/conf-from-container/conf/relying-party.xml @@ -0,0 +1,70 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/conf-from-container/conf/saml-nameid.properties b/conf-from-container/conf/saml-nameid.properties new file mode 100644 index 0000000..8530c4f --- /dev/null +++ b/conf-from-container/conf/saml-nameid.properties @@ -0,0 +1,35 @@ +# Properties involving SAML NameIdentifier/NameID generation/consumption + +# For the most part these settings only deal with "transient" and "persistent" +# identifiers. See saml-nameid.xml and c14n/subject-c14n.xml for advanced +# settings + +# Comment out to disable legacy NameID generation via Attribute Resolver +#idp.nameid.saml2.legacyGenerator = shibboleth.LegacySAML2NameIDGenerator +#idp.nameid.saml1.legacyGenerator = shibboleth.LegacySAML1NameIdentifierGenerator + +# Default NameID Formats to use when nothing else is called for. +# Don't change these just to change the Format used for a single SP! +#idp.nameid.saml2.default = urn:oasis:names:tc:SAML:2.0:nameid-format:transient +#idp.nameid.saml1.default = urn:mace:shibboleth:1.0:nameIdentifier + +# Set to shibboleth.StoredTransientIdGenerator for server-side transient ID storage +#idp.transientId.generator = shibboleth.CryptoTransientIdGenerator + +# Persistent IDs can be computed on the fly with a hash, or managed in a database + +# For computed IDs, set a source attribute and a secret salt: +#idp.persistentId.sourceAttribute = changethistosomethingreal +#idp.persistentId.useUnfilteredAttributes = true +# Do *NOT* share the salt with other people, it's like divulging your private key. +#idp.persistentId.algorithm = SHA +#idp.persistentId.salt = changethistosomethingrandom + +# To use a database, use shibboleth.StoredPersistentIdGenerator +#idp.persistentId.generator = shibboleth.ComputedPersistentIdGenerator +# For basic use, set this to a JDBC DataSource bean name: +#idp.persistentId.dataSource = PersistentIdDataSource +# For advanced use, set to a bean inherited from shibboleth.JDBCPersistentIdStore +#idp.persistentId.store = MyPersistentIdStore +# Set to an empty property to skip hash-based generation of first stored ID +#idp.persistentId.computed = shibboleth.ComputedPersistentIdGenerator diff --git a/conf-from-container/conf/saml-nameid.xml b/conf-from-container/conf/saml-nameid.xml new file mode 100644 index 0000000..ea97448 --- /dev/null +++ b/conf-from-container/conf/saml-nameid.xml @@ -0,0 +1,62 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/conf-from-container/conf/services.properties b/conf-from-container/conf/services.properties new file mode 100644 index 0000000..eee86ee --- /dev/null +++ b/conf-from-container/conf/services.properties @@ -0,0 +1,65 @@ +# Configure the resources to load for various services, +# and the settings for failure handling and auto-reload. + +# failFast=true prevents IdP startup if a configuration is bad +# checkInterval = PT0S means never reload (this is the default) + +# Global default for fail-fast behavior of most subsystems +# with individual override possible below. +#idp.service.failFast = false + +#idp.service.logging.resource = %{idp.home}/conf/logback.xml +#idp.service.logging.failFast = true +idp.service.logging.checkInterval = PT5M + +# Set to shibboleth.LegacyRelyingPartyResolverResources with legacy V2 relying-party.xml +#idp.service.relyingparty.resources = shibboleth.RelyingPartyResolverResources +#idp.service.relyingparty.failFast = false +idp.service.relyingparty.checkInterval = PT15M + +#idp.service.metadata.resources = shibboleth.MetadataResolverResources +#idp.service.metadata.failFast = false +#idp.service.metadata.checkInterval = PT0S + +#idp.service.attribute.resolver.resources = shibboleth.AttributeResolverResources +#idp.service.attribute.resolver.failFast = false +idp.service.attribute.resolver.checkInterval = PT15M +#idp.service.attribute.resolver.maskFailures = true + +#idp.service.attribute.filter.resources = shibboleth.AttributeFilterResources +# NOTE: Failing the filter fast leaves no filters enabled. +#idp.service.attribute.filter.failFast = false +idp.service.attribute.filter.checkInterval = PT15M +#idp.service.attribute.filter.maskFailures = true + +#idp.service.nameidGeneration.resources = shibboleth.NameIdentifierGenerationResources +#idp.service.nameidGeneration.failFast = false +idp.service.nameidGeneration.checkInterval = PT15M + +#idp.service.access.resources = shibboleth.AccessControlResources +#idp.service.access.failFast = true +idp.service.access.checkInterval = PT5M + +#idp.service.cas.registry.resources = shibboleth.CASServiceRegistryResources +#idp.service.cas.registry.failFast = false +idp.service.cas.registry.checkInterval = PT15M + +#idp.message.resources = shibboleth.MessageSourceResources +#idp.message.cacheSeconds = 300 + +# Parameters for pre-defined HttpClient instances which perform in-memory and filesystem caching. +# These are used with components such as remote configuration resources that are explicitly wired +# with these client instances, *not* by default with HTTP metadata resolvers. +#idp.httpclient.useTrustEngineTLSSocketFactory = false +#idp.httpclient.useSecurityEnhancedTLSSocketFactory = false +#idp.httpclient.connectionDisregardTLSCertificate = false +#idp.httpclient.connectionRequestTimeout = 60000 +#idp.httpclient.connectionTimeout = 60000 +#idp.httpclient.socketTimeout = 60000 +#idp.httpclient.maxConnectionsTotal = 100 +#idp.httpclient.maxConnectionsPerRoute = 100 +#idp.httpclient.memorycaching.maxCacheEntries = 50 +#idp.httpclient.memorycaching.maxCacheEntrySize = 1048576 +#idp.httpclient.filecaching.maxCacheEntries = 100 +#idp.httpclient.filecaching.maxCacheEntrySize = 10485760 +idp.httpclient.filecaching.cacheDirectory = %{idp.home}/tmp/httpClientCache \ No newline at end of file diff --git a/conf-from-container/conf/services.xml b/conf-from-container/conf/services.xml new file mode 100644 index 0000000..313b636 --- /dev/null +++ b/conf-from-container/conf/services.xml @@ -0,0 +1,144 @@ + + + + + + + + + + + %{idp.home}/conf/relying-party.xml + %{idp.home}/conf/credentials.xml + %{idp.home}/system/conf/relying-party-system.xml + + + + + %{idp.home}/conf/relying-party.xml + %{idp.home}/system/conf/legacy-relying-party-defaults.xml + + + + %{idp.home}/conf/metadata-providers.xml + %{idp.home}/system/conf/metadata-providers-system.xml + + + + %{idp.home}/conf/attribute-resolver.xml + + + + %{idp.home}/conf/attribute-filter.xml + + + + %{idp.home}/conf/saml-nameid.xml + %{idp.home}/system/conf/saml-nameid-system.xml + + + + %{idp.home}/conf/access-control.xml + %{idp.home}/system/conf/access-control-system.xml + + + + %{idp.home}/conf/cas-protocol.xml + + + + + %{idp.home}/messages/messages + %{idp.home}/system/messages/messages + + + diff --git a/conf-from-container/conf/session-manager.xml b/conf-from-container/conf/session-manager.xml new file mode 100644 index 0000000..f195014 --- /dev/null +++ b/conf-from-container/conf/session-manager.xml @@ -0,0 +1,45 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/conf-from-container/run.sh b/conf-from-container/run.sh new file mode 100644 index 0000000..ce896e5 --- /dev/null +++ b/conf-from-container/run.sh @@ -0,0 +1 @@ +docker cp `docker ps | cut -f 1 -d ' ' | grep -v "CONTAINER"`:/opt/shibboleth-idp/conf /Users/hlk/projects/shibboleth-docker/conf-from-container diff --git a/conf-from-container/shell.sh b/conf-from-container/shell.sh new file mode 100644 index 0000000..182d4c1 --- /dev/null +++ b/conf-from-container/shell.sh @@ -0,0 +1 @@ +docker exec -ti `docker ps | cut -f 1 -d ' ' | grep -v "CONTAINER"` bash diff --git a/install.properties b/install.properties index 2826a8c..3eec93d 100644 --- a/install.properties +++ b/install.properties @@ -5,3 +5,36 @@ idp.scope=nordu.dev # Shibboleth default password, don't change not used on runtime idp.sealer.password=password idp.keystore.password=password + +# Found via build.xml +ldap.merge.properties=/opt/nordu-ldap.properties + +#PROPERTIES: +#The following properties are used. If they are not specified on the command line then +#they will be prompted for if needed. +# +#idp.src.dir (update only): Where to install from. No default +#idp.target.dir (all): where to install to. Default is basedir. +#idp.host.name: If we are creating certificates +#idp.uri.subject.alt.name: If we are creating certificates. Defaulted +#idp.sealer.password: +#idp.sealer.alias: +#idp.keystore.password: +#idp.scope: The scope to assert. If present this should also be present in idp.merge.properties +#idp.merge.properties: The name of a property file to merge with idp.properties. This file only +# used when doing the initial create of idp.properties, and is deleted after processing +# - if idp.noprompt is set, then this file should contain a line setting idp.entityID. +# - if idp.sealer.password is set, then this file should contain a line setting idp.sealer.storePassword and idp.sealer.keyPassword +# - if idp.scope is present, then this file should contain a line setting idp.scope +#services.merge.properties: The name of a property file to merge with services.properties +# - if idp.is.V2 is set, then this file should contain a line setting +# idp.service.relyingparty.resources=shibboleth.LegacyRelyingPartyResolverResources +# nameid.merge.properties: The name of a property file to merge with saml-nameid.properties +# - if idp.is.V2 is set, then this file should contain lines enabling legacy nameid generation +# idp.property.file: The name of a property file to fill in some or all of the above. This file is deleted after processing. +# idp.no.tidy: Do not delete the two above files (debug only) +# idp.jetty.config: Copy jetty configuration from distribution (Unsupported) +# ldap.merge.properties: The name of a property file to merge with ldap.properties +# idp.conf.filemode (default "600"): The permissions to mark the files in conf with (UNIX only). + +# The property idp.noprompt will cause a failure rather than a prompt. diff --git a/nordu-ldap.properties b/nordu-ldap.properties new file mode 100644 index 0000000..71e1301 --- /dev/null +++ b/nordu-ldap.properties @@ -0,0 +1,10 @@ +idp.authn.LDAP.ldapURL=ldaps://ldap.nordu.net +idp.authn.LDAP.authenticator = bindSearchAuthenticator +idp.authn.LDAP.useStartTLS = false +idp.authn.LDAP.useSSL = false +idp.authn.LDAP.sslConfig = certificateTrust +#idp.authn.LDAP.trustCertificates = %{idp.home}/credentials/ldap-server.crt +idp.authn.LDAP.baseDN = dc=nordu,dc=net +idp.authn.LDAP.userFilter = (uid=$requestContext.principalName) +idp.authn.LDAP.bindDN = dc=nordu,dc=net +idp.authn.LDAP.bindDNCredential = blahblah diff --git a/shibboleth-identity-provider-3.3.0.tar.gz b/shibboleth-identity-provider-3.3.0.tar.gz new file mode 100644 index 0000000..d076c1d Binary files /dev/null and b/shibboleth-identity-provider-3.3.0.tar.gz differ diff --git a/template-config/README.md b/template-config/README.md new file mode 100644 index 0000000..6002238 --- /dev/null +++ b/template-config/README.md @@ -0,0 +1,5 @@ +# IDP config templates + +This directory contains the files which are being replaced after running install. + +Dockerfile should install these after running install. diff --git a/template-config/attribute-resolver.xml b/template-config/attribute-resolver.xml new file mode 100644 index 0000000..30627d5 --- /dev/null +++ b/template-config/attribute-resolver.xml @@ -0,0 +1,108 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + -- cgit v1.1