From 633ada5afb580dea9c755554c9a9a66b64434e4c Mon Sep 17 00:00:00 2001 From: Markus Krogh Date: Wed, 27 Sep 2017 15:06:13 +0200 Subject: Structure cleanup + docker compose --- Dockerfile | 31 -- apache-sp/apache-conf/sp.conf | 2 + apache-sp/entrypoint.sh | 8 +- compose-dev.yml | 19 ++ idp/Dockerfile | 33 ++ idp/install.properties | 48 +++ idp/jetty_base/etc/jetty-http-forwarded.xml | 20 ++ idp/jetty_base/start.d/http.ini | 34 ++ idp/jetty_base/webapps/idp.xml | 7 + idp/nordu-ldap.properties | 10 + idp/shib-entrypoint.sh | 9 + idp/shibboleth-identity-provider-3.3.0.tar.gz | Bin 0 -> 41527189 bytes ...hibboleth-identity-provider-3.3.0.tar.gz.sha256 | 1 + idp/shibboleth.db.ddl | 11 + idp/shibboleth.properties | 6 + idp/template-config/README.md | 5 + idp/template-config/attribute-filter.xml | 56 ++++ idp/template-config/attribute-resolver.xml | 227 +++++++++++++ idp/template-config/metadata-providers.xml | 57 ++++ idp/template-config/test.xml | 57 ++++ install.properties | 48 --- jetty_base/etc/jetty-http-forwarded.xml | 20 -- jetty_base/start.d/http.ini | 34 -- jetty_base/webapps/idp.xml | 7 - metadata/test-rw.txt | 0 nordu-ldap.properties | 10 - shibboleth-identity-provider-3.3.0.tar.gz | Bin 41527189 -> 0 bytes shibboleth-identity-provider-3.3.0.tar.gz.sha256 | 1 - shibboleth.db.ddl | 11 - shibboleth.properties | 6 - template-config/README.md | 5 - template-config/attribute-filter.xml | 122 ------- template-config/attribute-resolver.xml | 373 --------------------- template-config/metadata-providers.xml | 64 ---- template-config/relying-party.xml | 78 ----- 35 files changed, 609 insertions(+), 811 deletions(-) delete mode 100644 Dockerfile create mode 100644 compose-dev.yml create mode 100644 idp/Dockerfile create mode 100644 idp/install.properties create mode 100644 idp/jetty_base/etc/jetty-http-forwarded.xml create mode 100644 idp/jetty_base/start.d/http.ini create mode 100644 idp/jetty_base/webapps/idp.xml create mode 100644 idp/nordu-ldap.properties create mode 100755 idp/shib-entrypoint.sh create mode 100644 idp/shibboleth-identity-provider-3.3.0.tar.gz create mode 100644 idp/shibboleth-identity-provider-3.3.0.tar.gz.sha256 create mode 100644 idp/shibboleth.db.ddl create mode 100644 idp/shibboleth.properties create mode 100644 idp/template-config/README.md create mode 100644 idp/template-config/attribute-filter.xml create mode 100644 idp/template-config/attribute-resolver.xml create mode 100644 idp/template-config/metadata-providers.xml create mode 100644 idp/template-config/test.xml delete mode 100644 install.properties delete mode 100644 jetty_base/etc/jetty-http-forwarded.xml delete mode 100644 jetty_base/start.d/http.ini delete mode 100644 jetty_base/webapps/idp.xml delete mode 100644 metadata/test-rw.txt delete mode 100644 nordu-ldap.properties delete mode 100644 shibboleth-identity-provider-3.3.0.tar.gz delete mode 100644 shibboleth-identity-provider-3.3.0.tar.gz.sha256 delete mode 100644 shibboleth.db.ddl delete mode 100644 shibboleth.properties delete mode 100644 template-config/README.md delete mode 100644 template-config/attribute-filter.xml delete mode 100644 template-config/attribute-resolver.xml delete mode 100644 template-config/metadata-providers.xml delete mode 100644 template-config/relying-party.xml diff --git a/Dockerfile b/Dockerfile deleted file mode 100644 index 824481c..0000000 --- a/Dockerfile +++ /dev/null @@ -1,31 +0,0 @@ -FROM jetty:9-alpine -EXPOSE 80 443 -MAINTAINER Jesper B. Rosenkilde - -ENV IDP_VERSION 3.3.0 -COPY install.properties /opt/ -COPY nordu-ldap.properties /opt/ -COPY shibboleth-identity-provider-${IDP_VERSION}.tar.gz.sha256 /opt/ -COPY shibboleth-identity-provider-${IDP_VERSION}.tar.gz /opt/ -COPY template-config/ /opt/template-config -COPY shibboleth.db.ddl /tmp/ -COPY apache-sp/nordunet.png /tmp/ -WORKDIR /opt -RUN apk --no-cache add bash apache-ant sqlite curl && \ - #curl -O https://shibboleth.net/downloads/identity-provider/${IDP_VERSION}/shibboleth-identity-provider-${IDP_VERSION}.tar.gz && \ - sha256sum -c shibboleth-identity-provider-$IDP_VERSION.tar.gz.sha256 && \ - tar xf shibboleth-identity-provider-$IDP_VERSION.tar.gz && \ - mv shibboleth-identity-provider-$IDP_VERSION shibboleth-identity-provider && \ - cp /tmp/nordunet.png ./shibboleth-identity-provider/webapp/images/dummylogo.png && \ - ./shibboleth-identity-provider/bin/install.sh -propertyfile install.properties && \ - apk --no-cache del apache-ant && \ - cp /opt/template-config/*.xml /opt/shibboleth-idp/conf && \ - rm -rf shibboleth-identity-provider* install.properties nordu-ldap.properties - -RUN chown -R jetty:jetty /opt/shibboleth-idp - - -#RUN mkdir -p persistent-id && sqlite3 persistent-id/shibboleth.db < /tmp/shibboleth.db.ddl && rm -f /tmp/shibboleth.db.ddl - -COPY jetty_base $JETTY_BASE -WORKDIR $JETTY_BASE diff --git a/apache-sp/apache-conf/sp.conf b/apache-sp/apache-conf/sp.conf index 5e32cbc..6678f8e 100644 --- a/apache-sp/apache-conf/sp.conf +++ b/apache-sp/apache-conf/sp.conf @@ -37,6 +37,8 @@ SSLHonorCipherOrder on CustomLog /proc/self/fd/1 combined ServerSignature off + DirectoryIndex index.html index.shtml + AuthType shibboleth diff --git a/apache-sp/entrypoint.sh b/apache-sp/entrypoint.sh index 156b5ac..34589e3 100644 --- a/apache-sp/entrypoint.sh +++ b/apache-sp/entrypoint.sh @@ -29,7 +29,13 @@ if [ ! -f "$KEYDIR/private/${SP_HOSTNAME}.key" -o ! -f "$KEYDIR/certs/${SP_HOSTN fi # Fetch metadata -curl http://shibboleth-docker:8080/idp/shibboleth -o /var/www/metadata.xml +if [ -z "$SKIP_METADATA" ]; then + until curl http://shibboleth-docker:8080/idp/shibboleth -o /var/www/metadata.xml + do + sleep 5 + done +fi + chown -R www-data:www-data /var/www/ chmod -R a+r /var/www/ diff --git a/compose-dev.yml b/compose-dev.yml new file mode 100644 index 0000000..ea227a3 --- /dev/null +++ b/compose-dev.yml @@ -0,0 +1,19 @@ +version: '3' +services: + shibboleth-docker: + build: ./idp + environment: + JAVA_OPTIONS: '-Xmx1g' + volumes: + - ./data/idp/metadata:/metadata + sp: + build: ./apache-sp + volumes: + - ./data/apache-sp:/metadata/apache-sp + environment: + - SP_HOSTNAME=sp.nordu.dev + links: + - shibboleth-docker + ports: + - '80:80' + - '443:443' diff --git a/idp/Dockerfile b/idp/Dockerfile new file mode 100644 index 0000000..a411674 --- /dev/null +++ b/idp/Dockerfile @@ -0,0 +1,33 @@ +FROM jetty:9-alpine +EXPOSE 80 443 +MAINTAINER Jesper B. Rosenkilde + +ENV IDP_VERSION 3.3.0 +COPY install.properties /opt/ +COPY nordu-ldap.properties /opt/ +COPY shibboleth-identity-provider-${IDP_VERSION}.tar.gz.sha256 /opt/ +COPY shibboleth-identity-provider-${IDP_VERSION}.tar.gz /opt/ +COPY template-config/ /opt/template-config +COPY shibboleth.db.ddl /tmp/ +COPY apache-sp/nordunet.png /tmp/ +WORKDIR /opt +RUN apk --no-cache add bash apache-ant sqlite curl && \ + #curl -O https://shibboleth.net/downloads/identity-provider/${IDP_VERSION}/shibboleth-identity-provider-${IDP_VERSION}.tar.gz && \ + sha256sum -c shibboleth-identity-provider-$IDP_VERSION.tar.gz.sha256 && \ + tar xf shibboleth-identity-provider-$IDP_VERSION.tar.gz && \ + mv shibboleth-identity-provider-$IDP_VERSION shibboleth-identity-provider && \ + ./shibboleth-identity-provider/bin/install.sh -propertyfile install.properties && \ + apk --no-cache del apache-ant && \ + cp /opt/template-config/*.xml /opt/shibboleth-idp/conf && \ + sed -i '/p:postAuthenticationFlows=/ s/p:postAuthenticationFlows="attribute-release" //' /opt/shibboleth-idp/conf/relying-party.xml && \ + rm -rf shibboleth-identity-provider* install.properties nordu-ldap.properties +ADD https://mds.swamid.se/md/md-signer2.crt /opt/shibboleth-idp/credentials/ + +RUN chown -R jetty:jetty /opt/shibboleth-idp + +#RUN mkdir -p persistent-id && sqlite3 persistent-id/shibboleth.db < /tmp/shibboleth.db.ddl && rm -f /tmp/shibboleth.db.ddl + +COPY jetty_base $JETTY_BASE +COPY shib-entrypoint.sh /shib-entrypoint.sh +ENTRYPOINT /shib-entrypoint.sh +WORKDIR $JETTY_BASE diff --git a/idp/install.properties b/idp/install.properties new file mode 100644 index 0000000..13ca6ad --- /dev/null +++ b/idp/install.properties @@ -0,0 +1,48 @@ +idp.src.dir=/opt/shibboleth-identity-provider +idp.target.dir=/opt/shibboleth-idp +idp.host.name=idp.nordu.dev +idp.scope=nordu.dev +# Shibboleth default password, don't change not used on runtime +idp.sealer.password=password +idp.keystore.password=password + +# Found via build.xml +ldap.merge.properties=/opt/nordu-ldap.properties + +# Skinning it +idp.title = IDP Dev Web Login Service +idp.title.suffix = Error +idp.logo = /images/nordunet.png +idp.logo.alt-text = Nordic Gateway for Research & Education +idp.message = An unidentified error occurred. +idp.footer = IDP dev footer text. + +#PROPERTIES: +#The following properties are used. If they are not specified on the command line then +#they will be prompted for if needed. +# +#idp.src.dir (update only): Where to install from. No default +#idp.target.dir (all): where to install to. Default is basedir. +#idp.host.name: If we are creating certificates +#idp.uri.subject.alt.name: If we are creating certificates. Defaulted +#idp.sealer.password: +#idp.sealer.alias: +#idp.keystore.password: +#idp.scope: The scope to assert. If present this should also be present in idp.merge.properties +#idp.merge.properties: The name of a property file to merge with idp.properties. This file only +# used when doing the initial create of idp.properties, and is deleted after processing +# - if idp.noprompt is set, then this file should contain a line setting idp.entityID. +# - if idp.sealer.password is set, then this file should contain a line setting idp.sealer.storePassword and idp.sealer.keyPassword +# - if idp.scope is present, then this file should contain a line setting idp.scope +#services.merge.properties: The name of a property file to merge with services.properties +# - if idp.is.V2 is set, then this file should contain a line setting +# idp.service.relyingparty.resources=shibboleth.LegacyRelyingPartyResolverResources +# nameid.merge.properties: The name of a property file to merge with saml-nameid.properties +# - if idp.is.V2 is set, then this file should contain lines enabling legacy nameid generation +# idp.property.file: The name of a property file to fill in some or all of the above. This file is deleted after processing. +# idp.no.tidy: Do not delete the two above files (debug only) +# idp.jetty.config: Copy jetty configuration from distribution (Unsupported) +# ldap.merge.properties: The name of a property file to merge with ldap.properties +# idp.conf.filemode (default "600"): The permissions to mark the files in conf with (UNIX only). + +# The property idp.noprompt will cause a failure rather than a prompt. diff --git a/idp/jetty_base/etc/jetty-http-forwarded.xml b/idp/jetty_base/etc/jetty-http-forwarded.xml new file mode 100644 index 0000000..50b8097 --- /dev/null +++ b/idp/jetty_base/etc/jetty-http-forwarded.xml @@ -0,0 +1,20 @@ + + + + + + + + + + + + + + + + + + + + diff --git a/idp/jetty_base/start.d/http.ini b/idp/jetty_base/start.d/http.ini new file mode 100644 index 0000000..cda6a26 --- /dev/null +++ b/idp/jetty_base/start.d/http.ini @@ -0,0 +1,34 @@ +# --------------------------------------- +# Module: http +--module=http + +### HTTP Connector Configuration + +## Connector host/address to bind to +# jetty.http.host=0.0.0.0 + +## Connector port to listen on +jetty.http.port=8080 + +## Connector idle timeout in milliseconds +# jetty.http.idleTimeout=30000 + +## Connector socket linger time in seconds (-1 to disable) +# jetty.http.soLingerTime=-1 + +## Number of acceptors (-1 picks default based on number of cores) +# jetty.http.acceptors=-1 + +## Number of selectors (-1 picks default based on number of cores) +# jetty.http.selectors=-1 + +## ServerSocketChannel backlog (0 picks platform default) +# jetty.http.acceptorQueueSize=0 + +## Thread priority delta to give to acceptor threads +# jetty.http.acceptorPriorityDelta=0 + +## HTTP Compliance: RFC7230, RFC2616, LEGACY +# jetty.http.compliance=RFC7230 + +etc/jetty-http-forwarded.xml diff --git a/idp/jetty_base/webapps/idp.xml b/idp/jetty_base/webapps/idp.xml new file mode 100644 index 0000000..dbe3671 --- /dev/null +++ b/idp/jetty_base/webapps/idp.xml @@ -0,0 +1,7 @@ + + /opt/shibboleth-idp/war/idp.war + /idp + false + false + true + diff --git a/idp/nordu-ldap.properties b/idp/nordu-ldap.properties new file mode 100644 index 0000000..d265541 --- /dev/null +++ b/idp/nordu-ldap.properties @@ -0,0 +1,10 @@ +idp.authn.LDAP.ldapURL=ldaps://ldap.nordu.net +idp.authn.LDAP.authenticator = anonSearchAuthenticator +idp.authn.LDAP.useStartTLS = false +idp.authn.LDAP.useSSL = true +idp.authn.LDAP.sslConfig = jvmTrust +#idp.authn.LDAP.trustCertificates = %{idp.home}/credentials/ldap-server.crt +idp.authn.LDAP.baseDN = ou=People,dc=nordu,dc=net +#idp.authn.LDAP.userFilter = (uid=$requestContext.principalName) +idp.authn.LDAP.bindDN = dc=nordu,dc=net +idp.authn.LDAP.bindDNCredential = blahblah diff --git a/idp/shib-entrypoint.sh b/idp/shib-entrypoint.sh new file mode 100755 index 0000000..eec7dcd --- /dev/null +++ b/idp/shib-entrypoint.sh @@ -0,0 +1,9 @@ +#!/bin/sh + + +# if there is a metadata file for the test sp, enable it. +if [ -f /metadata/sp-metadata.xml ]; then + sed -i -e '/sp.nordu.dev/ s///' /opt/shibboleth-idp/conf/metadata-providers.xml +fi + +/docker-entrypoint.sh "$@" diff --git a/idp/shibboleth-identity-provider-3.3.0.tar.gz b/idp/shibboleth-identity-provider-3.3.0.tar.gz new file mode 100644 index 0000000..d076c1d Binary files /dev/null and b/idp/shibboleth-identity-provider-3.3.0.tar.gz differ diff --git a/idp/shibboleth-identity-provider-3.3.0.tar.gz.sha256 b/idp/shibboleth-identity-provider-3.3.0.tar.gz.sha256 new file mode 100644 index 0000000..ea5cafa --- /dev/null +++ b/idp/shibboleth-identity-provider-3.3.0.tar.gz.sha256 @@ -0,0 +1 @@ +558c6b71e6eba8fbdff19ee8857368d1a6facdfe2c703afc70d5b1655411f552 shibboleth-identity-provider-3.3.0.tar.gz diff --git a/idp/shibboleth.db.ddl b/idp/shibboleth.db.ddl new file mode 100644 index 0000000..3799b91 --- /dev/null +++ b/idp/shibboleth.db.ddl @@ -0,0 +1,11 @@ +CREATE TABLE shibpid ( + localEntity VARCHAR(255) NOT NULL, + peerEntity VARCHAR(255) NOT NULL, + persistentId VARCHAR(50) NOT NULL, + principalName VARCHAR(50) NOT NULL, + localId VARCHAR(50) NOT NULL, + peerProvidedId VARCHAR(50) NULL, + creationDate TIMESTAMP NOT NULL, + deactivationDate TIMESTAMP NULL, + PRIMARY KEY (localEntity, peerEntity, persistentId) +); diff --git a/idp/shibboleth.properties b/idp/shibboleth.properties new file mode 100644 index 0000000..da0a7e7 --- /dev/null +++ b/idp/shibboleth.properties @@ -0,0 +1,6 @@ +idp.src.dir=/opt/shibboleth-identity-provider +idp.target.dir=/opt/shibboleth-idp +idp.host.name=idp.nordu.dev +idp.scope=nordu.dev +idp.keystore.password=lemonade +idp.sealer.password=lemonade diff --git a/idp/template-config/README.md b/idp/template-config/README.md new file mode 100644 index 0000000..6002238 --- /dev/null +++ b/idp/template-config/README.md @@ -0,0 +1,5 @@ +# IDP config templates + +This directory contains the files which are being replaced after running install. + +Dockerfile should install these after running install. diff --git a/idp/template-config/attribute-filter.xml b/idp/template-config/attribute-filter.xml new file mode 100644 index 0000000..4543e99 --- /dev/null +++ b/idp/template-config/attribute-filter.xml @@ -0,0 +1,56 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/idp/template-config/attribute-resolver.xml b/idp/template-config/attribute-resolver.xml new file mode 100644 index 0000000..e761920 --- /dev/null +++ b/idp/template-config/attribute-resolver.xml @@ -0,0 +1,227 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + NORDUnet A/S + + + nordu.net + + + urn:schac:homeOrganizationType:int:NREN + + + NORDUNet + + + + + + + + + + + diff --git a/idp/template-config/metadata-providers.xml b/idp/template-config/metadata-providers.xml new file mode 100644 index 0000000..d813c06 --- /dev/null +++ b/idp/template-config/metadata-providers.xml @@ -0,0 +1,57 @@ + + + + + + + + + + + + + + + + + + + + + + + + md:SPSSODescriptor + + + + + + + diff --git a/idp/template-config/test.xml b/idp/template-config/test.xml new file mode 100644 index 0000000..ea5c36e --- /dev/null +++ b/idp/template-config/test.xml @@ -0,0 +1,57 @@ + + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/template-config/attribute-resolver.xml b/template-config/attribute-resolver.xml deleted file mode 100644 index 9d7b8de..0000000 --- a/template-config/attribute-resolver.xml +++ /dev/null @@ -1,373 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - memberOf - - - - - - - - - - diff --git a/template-config/metadata-providers.xml b/template-config/metadata-providers.xml deleted file mode 100644 index 71b5967..0000000 --- a/template-config/metadata-providers.xml +++ /dev/null @@ -1,64 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/template-config/relying-party.xml b/template-config/relying-party.xml deleted file mode 100644 index 327c8e2..0000000 --- a/template-config/relying-party.xml +++ /dev/null @@ -1,78 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -- cgit v1.1