From a77621f3bc45828834ef4697e983c603735c56ee Mon Sep 17 00:00:00 2001 From: Henrik Lund Kramshoej Date: Mon, 10 Jul 2017 15:28:27 +0200 Subject: sync with syntax working, but not auth --- README.md | 49 ++++++++++++++++++++++++++++++++++++ apache-sp/entrypoint.sh | 5 ++++ apache-sp/run.sh | 2 ++ apache-sp/shibd/shibboleth2.xml | 5 ++-- conf-from-container/conf/logback.xml | 40 ++++++++++++++--------------- install.properties | 8 ++++++ nordu-ldap.properties | 2 +- run.sh | 3 +++ 8 files changed, 90 insertions(+), 24 deletions(-) create mode 100644 apache-sp/run.sh create mode 100644 run.sh diff --git a/README.md b/README.md index 7f0ea74..5b05ebc 100755 --- a/README.md +++ b/README.md @@ -21,7 +21,49 @@ and more File installer.properties Properties written out by the installer and used during upgrades. Scripts may create this ahead of time and feed it in to the installer in order to have a silent install. Deployers are not expected to modify this directly. +# planning +https://shibboleth.net/pipermail/users/2016-July/030260.html +http://shibboleth.1660669.n2.nabble.com/SAML-message-intended-destination-endpoint-did-not-match-the-recipient-endpoint-td7626468.html +We setup a new IdP on the 3.x branch. New hostname, new certificates, new +URL bindings, etc; but responding as the same entityID as the old IdP on +the 2.x version. +... + + + + +# Testing + +run.sh + +``` +#docker build -t $(basename $(pwd)) . && docker run -p80:80 -p 443:443 --rm -ti $(basename $(pwd)) +# shibboleth-docker +docker build -t $(basename $(pwd)) . && docker run --rm -ti --name shibboleth-docker $(basename $(pwd)) +``` + +``` +# Apache SP +docker build -t $(basename $(pwd)) . && docker run --rm -ti -p80:80 -p 443:443 -e SP_HOSTNAME=sp.nordu.dev --link shibboleth-docker $(basename $(pwd)) +``` + +``` +hlk@bujin:hlk$ cat /etc/hosts +## +# Host Database +# +# localhost is used to configure the loopback interface +# when the system is booting. Do not change this entry. +## +127.0.0.1 localhost +255.255.255.255 broadcasthost +::1 localhost + +127.0.0.1 idp.nordu.dev sp.nordu.dev +``` + +Then you should be able to go to: https://sp.nordu.dev/secure/ # Resources @@ -114,6 +156,13 @@ StaticPKIXX509Credential # Other Links + +https://shibboleth.net/products/metadata-aggregator.html +Metadata Aggregator provides a command line tool and REST-based web service to support publishers and consumers of metadata. +- kan måske lette noget arbejde med at vedligeholde filer? + + + https://wiki.shibboleth.net/confluence/display/IDP30/Installation+Directory+and+Configuration+Files describes the Installation Directory and Configuration Files diff --git a/apache-sp/entrypoint.sh b/apache-sp/entrypoint.sh index dc16803..a552c6c 100644 --- a/apache-sp/entrypoint.sh +++ b/apache-sp/entrypoint.sh @@ -1,4 +1,9 @@ #!/bin/sh + +# NORDUnet 2017 + +echo "Starting $0" + # Setup ssl keys KEYDIR=/etc/ssl export KEYDIR diff --git a/apache-sp/run.sh b/apache-sp/run.sh new file mode 100644 index 0000000..9d227b1 --- /dev/null +++ b/apache-sp/run.sh @@ -0,0 +1,2 @@ +# Apache SP +docker build -t $(basename $(pwd)) . && docker run --rm -ti -p80:80 -p 443:443 -e SP_HOSTNAME=sp.nordu.dev --link shibboleth-docker $(basename $(pwd)) diff --git a/apache-sp/shibd/shibboleth2.xml b/apache-sp/shibd/shibboleth2.xml index 2bc8b7a..c6a759f 100644 --- a/apache-sp/shibd/shibboleth2.xml +++ b/apache-sp/shibd/shibboleth2.xml @@ -1,7 +1,7 @@ --> - + @@ -35,4 +35,3 @@ - diff --git a/conf-from-container/conf/logback.xml b/conf-from-container/conf/logback.xml index 104ec4c..861ac26 100644 --- a/conf-from-container/conf/logback.xml +++ b/conf-from-container/conf/logback.xml @@ -5,21 +5,21 @@ Variables for simplifying logging configuration. http://logback.qos.ch/manual/configuration.html#variableSubstitution --> - + - + - + - - + + - + - + @@ -30,7 +30,7 @@ we load the main property file for you. --> - + @@ -40,10 +40,10 @@ - + - + @@ -64,11 +64,11 @@ - + ${idp.logfiles}/idp-process.log - + ${idp.logfiles}/idp-process-%d{yyyy-MM-dd}.log.gz ${idp.loghistory:-180} @@ -102,19 +102,19 @@ WARN - + ${idp.logfiles}/idp-warn.log - + ${idp.logfiles}/idp-warn-%d{yyyy-MM-dd}.log.gz ${idp.loghistory:-180} - + UTF-8 %date{ISO8601} - %level [%logger:%line] - %msg%n%ex{short} - + @@ -127,7 +127,7 @@ DENY - + ${idp.logfiles}/idp-audit.log @@ -142,7 +142,7 @@ %msg%n - + ${idp.logfiles}/idp-consent-audit.log @@ -177,10 +177,10 @@ - + - \ No newline at end of file + diff --git a/install.properties b/install.properties index 3eec93d..a052dcb 100644 --- a/install.properties +++ b/install.properties @@ -9,6 +9,14 @@ idp.keystore.password=password # Found via build.xml ldap.merge.properties=/opt/nordu-ldap.properties +# Skinning it +idp.title = IDP Dev Web Login Service +idp.title.suffix = Error +idp.logo = /images/dummylogo.png +idp.logo.alt-text = Replace or remove this logo +idp.message = An unidentified error occurred. +idp.footer = IDP dev footer text. + #PROPERTIES: #The following properties are used. If they are not specified on the command line then #they will be prompted for if needed. diff --git a/nordu-ldap.properties b/nordu-ldap.properties index 71e1301..dd43f21 100644 --- a/nordu-ldap.properties +++ b/nordu-ldap.properties @@ -1,6 +1,6 @@ idp.authn.LDAP.ldapURL=ldaps://ldap.nordu.net idp.authn.LDAP.authenticator = bindSearchAuthenticator -idp.authn.LDAP.useStartTLS = false +idp.authn.LDAP.useStartTLS = true idp.authn.LDAP.useSSL = false idp.authn.LDAP.sslConfig = certificateTrust #idp.authn.LDAP.trustCertificates = %{idp.home}/credentials/ldap-server.crt diff --git a/run.sh b/run.sh new file mode 100644 index 0000000..a39e8c6 --- /dev/null +++ b/run.sh @@ -0,0 +1,3 @@ +#docker build -t $(basename $(pwd)) . && docker run -p80:80 -p 443:443 --rm -ti $(basename $(pwd)) +# shibboleth-docker +docker build -t $(basename $(pwd)) . && docker run --rm -ti --name shibboleth-docker $(basename $(pwd)) -- cgit v1.1