From 633ada5afb580dea9c755554c9a9a66b64434e4c Mon Sep 17 00:00:00 2001 From: Markus Krogh Date: Wed, 27 Sep 2017 15:06:13 +0200 Subject: Structure cleanup + docker compose --- idp/Dockerfile | 33 +++ idp/install.properties | 48 +++++ idp/jetty_base/etc/jetty-http-forwarded.xml | 20 ++ idp/jetty_base/start.d/http.ini | 34 +++ idp/jetty_base/webapps/idp.xml | 7 + idp/nordu-ldap.properties | 10 + idp/shib-entrypoint.sh | 9 + idp/shibboleth-identity-provider-3.3.0.tar.gz | Bin 0 -> 41527189 bytes ...hibboleth-identity-provider-3.3.0.tar.gz.sha256 | 1 + idp/shibboleth.db.ddl | 11 + idp/shibboleth.properties | 6 + idp/template-config/README.md | 5 + idp/template-config/attribute-filter.xml | 56 +++++ idp/template-config/attribute-resolver.xml | 227 +++++++++++++++++++++ idp/template-config/metadata-providers.xml | 57 ++++++ idp/template-config/test.xml | 57 ++++++ 16 files changed, 581 insertions(+) create mode 100644 idp/Dockerfile create mode 100644 idp/install.properties create mode 100644 idp/jetty_base/etc/jetty-http-forwarded.xml create mode 100644 idp/jetty_base/start.d/http.ini create mode 100644 idp/jetty_base/webapps/idp.xml create mode 100644 idp/nordu-ldap.properties create mode 100755 idp/shib-entrypoint.sh create mode 100644 idp/shibboleth-identity-provider-3.3.0.tar.gz create mode 100644 idp/shibboleth-identity-provider-3.3.0.tar.gz.sha256 create mode 100644 idp/shibboleth.db.ddl create mode 100644 idp/shibboleth.properties create mode 100644 idp/template-config/README.md create mode 100644 idp/template-config/attribute-filter.xml create mode 100644 idp/template-config/attribute-resolver.xml create mode 100644 idp/template-config/metadata-providers.xml create mode 100644 idp/template-config/test.xml (limited to 'idp') diff --git a/idp/Dockerfile b/idp/Dockerfile new file mode 100644 index 0000000..a411674 --- /dev/null +++ b/idp/Dockerfile @@ -0,0 +1,33 @@ +FROM jetty:9-alpine +EXPOSE 80 443 +MAINTAINER Jesper B. Rosenkilde + +ENV IDP_VERSION 3.3.0 +COPY install.properties /opt/ +COPY nordu-ldap.properties /opt/ +COPY shibboleth-identity-provider-${IDP_VERSION}.tar.gz.sha256 /opt/ +COPY shibboleth-identity-provider-${IDP_VERSION}.tar.gz /opt/ +COPY template-config/ /opt/template-config +COPY shibboleth.db.ddl /tmp/ +COPY apache-sp/nordunet.png /tmp/ +WORKDIR /opt +RUN apk --no-cache add bash apache-ant sqlite curl && \ + #curl -O https://shibboleth.net/downloads/identity-provider/${IDP_VERSION}/shibboleth-identity-provider-${IDP_VERSION}.tar.gz && \ + sha256sum -c shibboleth-identity-provider-$IDP_VERSION.tar.gz.sha256 && \ + tar xf shibboleth-identity-provider-$IDP_VERSION.tar.gz && \ + mv shibboleth-identity-provider-$IDP_VERSION shibboleth-identity-provider && \ + ./shibboleth-identity-provider/bin/install.sh -propertyfile install.properties && \ + apk --no-cache del apache-ant && \ + cp /opt/template-config/*.xml /opt/shibboleth-idp/conf && \ + sed -i '/p:postAuthenticationFlows=/ s/p:postAuthenticationFlows="attribute-release" //' /opt/shibboleth-idp/conf/relying-party.xml && \ + rm -rf shibboleth-identity-provider* install.properties nordu-ldap.properties +ADD https://mds.swamid.se/md/md-signer2.crt /opt/shibboleth-idp/credentials/ + +RUN chown -R jetty:jetty /opt/shibboleth-idp + +#RUN mkdir -p persistent-id && sqlite3 persistent-id/shibboleth.db < /tmp/shibboleth.db.ddl && rm -f /tmp/shibboleth.db.ddl + +COPY jetty_base $JETTY_BASE +COPY shib-entrypoint.sh /shib-entrypoint.sh +ENTRYPOINT /shib-entrypoint.sh +WORKDIR $JETTY_BASE diff --git a/idp/install.properties b/idp/install.properties new file mode 100644 index 0000000..13ca6ad --- /dev/null +++ b/idp/install.properties @@ -0,0 +1,48 @@ +idp.src.dir=/opt/shibboleth-identity-provider +idp.target.dir=/opt/shibboleth-idp +idp.host.name=idp.nordu.dev +idp.scope=nordu.dev +# Shibboleth default password, don't change not used on runtime +idp.sealer.password=password +idp.keystore.password=password + +# Found via build.xml +ldap.merge.properties=/opt/nordu-ldap.properties + +# Skinning it +idp.title = IDP Dev Web Login Service +idp.title.suffix = Error +idp.logo = /images/nordunet.png +idp.logo.alt-text = Nordic Gateway for Research & Education +idp.message = An unidentified error occurred. +idp.footer = IDP dev footer text. + +#PROPERTIES: +#The following properties are used. If they are not specified on the command line then +#they will be prompted for if needed. +# +#idp.src.dir (update only): Where to install from. No default +#idp.target.dir (all): where to install to. Default is basedir. +#idp.host.name: If we are creating certificates +#idp.uri.subject.alt.name: If we are creating certificates. Defaulted +#idp.sealer.password: +#idp.sealer.alias: +#idp.keystore.password: +#idp.scope: The scope to assert. If present this should also be present in idp.merge.properties +#idp.merge.properties: The name of a property file to merge with idp.properties. This file only +# used when doing the initial create of idp.properties, and is deleted after processing +# - if idp.noprompt is set, then this file should contain a line setting idp.entityID. +# - if idp.sealer.password is set, then this file should contain a line setting idp.sealer.storePassword and idp.sealer.keyPassword +# - if idp.scope is present, then this file should contain a line setting idp.scope +#services.merge.properties: The name of a property file to merge with services.properties +# - if idp.is.V2 is set, then this file should contain a line setting +# idp.service.relyingparty.resources=shibboleth.LegacyRelyingPartyResolverResources +# nameid.merge.properties: The name of a property file to merge with saml-nameid.properties +# - if idp.is.V2 is set, then this file should contain lines enabling legacy nameid generation +# idp.property.file: The name of a property file to fill in some or all of the above. This file is deleted after processing. +# idp.no.tidy: Do not delete the two above files (debug only) +# idp.jetty.config: Copy jetty configuration from distribution (Unsupported) +# ldap.merge.properties: The name of a property file to merge with ldap.properties +# idp.conf.filemode (default "600"): The permissions to mark the files in conf with (UNIX only). + +# The property idp.noprompt will cause a failure rather than a prompt. diff --git a/idp/jetty_base/etc/jetty-http-forwarded.xml b/idp/jetty_base/etc/jetty-http-forwarded.xml new file mode 100644 index 0000000..50b8097 --- /dev/null +++ b/idp/jetty_base/etc/jetty-http-forwarded.xml @@ -0,0 +1,20 @@ + + + + + + + + + + + + + + + + + + + + diff --git a/idp/jetty_base/start.d/http.ini b/idp/jetty_base/start.d/http.ini new file mode 100644 index 0000000..cda6a26 --- /dev/null +++ b/idp/jetty_base/start.d/http.ini @@ -0,0 +1,34 @@ +# --------------------------------------- +# Module: http +--module=http + +### HTTP Connector Configuration + +## Connector host/address to bind to +# jetty.http.host=0.0.0.0 + +## Connector port to listen on +jetty.http.port=8080 + +## Connector idle timeout in milliseconds +# jetty.http.idleTimeout=30000 + +## Connector socket linger time in seconds (-1 to disable) +# jetty.http.soLingerTime=-1 + +## Number of acceptors (-1 picks default based on number of cores) +# jetty.http.acceptors=-1 + +## Number of selectors (-1 picks default based on number of cores) +# jetty.http.selectors=-1 + +## ServerSocketChannel backlog (0 picks platform default) +# jetty.http.acceptorQueueSize=0 + +## Thread priority delta to give to acceptor threads +# jetty.http.acceptorPriorityDelta=0 + +## HTTP Compliance: RFC7230, RFC2616, LEGACY +# jetty.http.compliance=RFC7230 + +etc/jetty-http-forwarded.xml diff --git a/idp/jetty_base/webapps/idp.xml b/idp/jetty_base/webapps/idp.xml new file mode 100644 index 0000000..dbe3671 --- /dev/null +++ b/idp/jetty_base/webapps/idp.xml @@ -0,0 +1,7 @@ + + /opt/shibboleth-idp/war/idp.war + /idp + false + false + true + diff --git a/idp/nordu-ldap.properties b/idp/nordu-ldap.properties new file mode 100644 index 0000000..d265541 --- /dev/null +++ b/idp/nordu-ldap.properties @@ -0,0 +1,10 @@ +idp.authn.LDAP.ldapURL=ldaps://ldap.nordu.net +idp.authn.LDAP.authenticator = anonSearchAuthenticator +idp.authn.LDAP.useStartTLS = false +idp.authn.LDAP.useSSL = true +idp.authn.LDAP.sslConfig = jvmTrust +#idp.authn.LDAP.trustCertificates = %{idp.home}/credentials/ldap-server.crt +idp.authn.LDAP.baseDN = ou=People,dc=nordu,dc=net +#idp.authn.LDAP.userFilter = (uid=$requestContext.principalName) +idp.authn.LDAP.bindDN = dc=nordu,dc=net +idp.authn.LDAP.bindDNCredential = blahblah diff --git a/idp/shib-entrypoint.sh b/idp/shib-entrypoint.sh new file mode 100755 index 0000000..eec7dcd --- /dev/null +++ b/idp/shib-entrypoint.sh @@ -0,0 +1,9 @@ +#!/bin/sh + + +# if there is a metadata file for the test sp, enable it. +if [ -f /metadata/sp-metadata.xml ]; then + sed -i -e '/sp.nordu.dev/ s///' /opt/shibboleth-idp/conf/metadata-providers.xml +fi + +/docker-entrypoint.sh "$@" diff --git a/idp/shibboleth-identity-provider-3.3.0.tar.gz b/idp/shibboleth-identity-provider-3.3.0.tar.gz new file mode 100644 index 0000000..d076c1d Binary files /dev/null and b/idp/shibboleth-identity-provider-3.3.0.tar.gz differ diff --git a/idp/shibboleth-identity-provider-3.3.0.tar.gz.sha256 b/idp/shibboleth-identity-provider-3.3.0.tar.gz.sha256 new file mode 100644 index 0000000..ea5cafa --- /dev/null +++ b/idp/shibboleth-identity-provider-3.3.0.tar.gz.sha256 @@ -0,0 +1 @@ +558c6b71e6eba8fbdff19ee8857368d1a6facdfe2c703afc70d5b1655411f552 shibboleth-identity-provider-3.3.0.tar.gz diff --git a/idp/shibboleth.db.ddl b/idp/shibboleth.db.ddl new file mode 100644 index 0000000..3799b91 --- /dev/null +++ b/idp/shibboleth.db.ddl @@ -0,0 +1,11 @@ +CREATE TABLE shibpid ( + localEntity VARCHAR(255) NOT NULL, + peerEntity VARCHAR(255) NOT NULL, + persistentId VARCHAR(50) NOT NULL, + principalName VARCHAR(50) NOT NULL, + localId VARCHAR(50) NOT NULL, + peerProvidedId VARCHAR(50) NULL, + creationDate TIMESTAMP NOT NULL, + deactivationDate TIMESTAMP NULL, + PRIMARY KEY (localEntity, peerEntity, persistentId) +); diff --git a/idp/shibboleth.properties b/idp/shibboleth.properties new file mode 100644 index 0000000..da0a7e7 --- /dev/null +++ b/idp/shibboleth.properties @@ -0,0 +1,6 @@ +idp.src.dir=/opt/shibboleth-identity-provider +idp.target.dir=/opt/shibboleth-idp +idp.host.name=idp.nordu.dev +idp.scope=nordu.dev +idp.keystore.password=lemonade +idp.sealer.password=lemonade diff --git a/idp/template-config/README.md b/idp/template-config/README.md new file mode 100644 index 0000000..6002238 --- /dev/null +++ b/idp/template-config/README.md @@ -0,0 +1,5 @@ +# IDP config templates + +This directory contains the files which are being replaced after running install. + +Dockerfile should install these after running install. diff --git a/idp/template-config/attribute-filter.xml b/idp/template-config/attribute-filter.xml new file mode 100644 index 0000000..4543e99 --- /dev/null +++ b/idp/template-config/attribute-filter.xml @@ -0,0 +1,56 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/idp/template-config/attribute-resolver.xml b/idp/template-config/attribute-resolver.xml new file mode 100644 index 0000000..e761920 --- /dev/null +++ b/idp/template-config/attribute-resolver.xml @@ -0,0 +1,227 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + NORDUnet A/S + + + nordu.net + + + urn:schac:homeOrganizationType:int:NREN + + + NORDUNet + + + + + + + + + + + diff --git a/idp/template-config/metadata-providers.xml b/idp/template-config/metadata-providers.xml new file mode 100644 index 0000000..d813c06 --- /dev/null +++ b/idp/template-config/metadata-providers.xml @@ -0,0 +1,57 @@ + + + + + + + + + + + + + + + + + + + + + + + + md:SPSSODescriptor + + + + + + + diff --git a/idp/template-config/test.xml b/idp/template-config/test.xml new file mode 100644 index 0000000..ea5c36e --- /dev/null +++ b/idp/template-config/test.xml @@ -0,0 +1,57 @@ + +