[cpp-sp] branch master updated: SSPCPP-586 - Generate two private keys on installation
Scott Cantor
cantor.2 at osu.edu
Mon Apr 30 19:43:04 EDT 2018
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch master
in repository cpp-sp.
View the commit online:
http://git.shibboleth.net/view/?p=cpp-sp.git;a=commit;h=a690f97251505b13bc6124a22682814d52ad9bc8
The following commit(s) were added to refs/heads/master by this push:
new a690f97 SSPCPP-586 - Generate two private keys on installation
a690f97 is described below
commit a690f97251505b13bc6124a22682814d52ad9bc8
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Mon Apr 30 19:37:02 2018 -0400
SSPCPP-586 - Generate two private keys on installation
https://issues.shibboleth.net/jira/browse/SSPCPP-586
---
configs/Makefile.am | 3 ++-
configs/example-shibboleth3.xml | 9 ++++++---
configs/shibboleth3.xml | 9 ++++++---
configs/win-shibboleth3.xml | 9 ++++++---
msi/WiX/ShibbolethSP-noarch.wxs | 15 ++++++++++-----
shibboleth.spec.in | 19 ++++++++++---------
6 files changed, 40 insertions(+), 24 deletions(-)
diff --git a/configs/Makefile.am b/configs/Makefile.am
index bfa0840..cbfb912 100644
--- a/configs/Makefile.am
+++ b/configs/Makefile.am
@@ -140,7 +140,8 @@ install-data-hook:
chmod +x $(DESTDIR)$(pkgsysconfdir)/metagen.sh
if test -z "$(NOKEYGEN)"; then \
cd $(DESTDIR)$(pkgsysconfdir); \
- sh ./keygen.sh -b ; \
+ /bin/sh ./keygen.sh -b -n sp-signing ; \
+ /bin/sh ./keygen.sh -b -n sp-encrypt ; \
fi
CLEANFILES = \
diff --git a/configs/example-shibboleth3.xml b/configs/example-shibboleth3.xml
index 11e8d84..4dcbff1 100644
--- a/configs/example-shibboleth3.xml
+++ b/configs/example-shibboleth3.xml
@@ -260,9 +260,12 @@
<!-- Default filtering policy for recognized attributes, lets other data pass. -->
<AttributeFilter type="XML" validate="true" path="attribute-policy.xml"/>
- <!-- Simple file-based resolver for using a single keypair. -->
- <CredentialResolver type="File" key="sp-key.pem" certificate="sp-cert.pem"/>
-
+ <!-- Simple file-based resolvers for separate signing/encryption keys. -->
+ <CredentialResolver type="File" use="signing"
+ key="sp-signing-key.pem" certificate="sp-signing-cert.pem"/>
+ <CredentialResolver type="File" use="encryption"
+ key="sp-encrypt-key.pem" certificate="sp-encrypt-cert.pem"/>
+
<!--
The default settings can be overridden by creating ApplicationOverride elements.
Resource requests are mapped by web server commands, or the RequestMapper, to an
diff --git a/configs/shibboleth3.xml b/configs/shibboleth3.xml
index 609791a..9a8c06f 100644
--- a/configs/shibboleth3.xml
+++ b/configs/shibboleth3.xml
@@ -90,9 +90,12 @@
<!-- Default filtering policy for recognized attributes, lets other data pass. -->
<AttributeFilter type="XML" validate="true" path="attribute-policy.xml"/>
- <!-- Simple file-based resolver for using a single keypair. -->
- <CredentialResolver type="File" key="sp-key.pem" certificate="sp-cert.pem"/>
-
+ <!-- Simple file-based resolvers for separate signing/encryption keys. -->
+ <CredentialResolver type="File" use="signing"
+ key="sp-signing-key.pem" certificate="sp-signing-cert.pem"/>
+ <CredentialResolver type="File" use="encryption"
+ key="sp-encrypt-key.pem" certificate="sp-encrypt-cert.pem"/>
+
</ApplicationDefaults>
<!-- Policies that determine how to process and authenticate runtime messages. -->
diff --git a/configs/win-shibboleth3.xml b/configs/win-shibboleth3.xml
index c09b04b..f4f0db4 100644
--- a/configs/win-shibboleth3.xml
+++ b/configs/win-shibboleth3.xml
@@ -138,9 +138,12 @@
<!-- Default filtering policy for recognized attributes, lets other data pass. -->
<AttributeFilter type="XML" validate="true" path="attribute-policy.xml"/>
- <!-- Simple file-based resolver for using a single keypair. -->
- <CredentialResolver type="File" key="sp-key.pem" certificate="sp-cert.pem"/>
-
+ <!-- Simple file-based resolvers for separate signing/encryption keys. -->
+ <CredentialResolver type="File" use="signing"
+ key="sp-signing-key.pem" certificate="sp-signing-cert.pem"/>
+ <CredentialResolver type="File" use="encryption"
+ key="sp-encrypt-key.pem" certificate="sp-encrypt-cert.pem"/>
+
</ApplicationDefaults>
<!-- Policies that determine how to process and authenticate runtime messages. -->
diff --git a/msi/WiX/ShibbolethSP-noarch.wxs b/msi/WiX/ShibbolethSP-noarch.wxs
index d2b4128..42284d7 100644
--- a/msi/WiX/ShibbolethSP-noarch.wxs
+++ b/msi/WiX/ShibbolethSP-noarch.wxs
@@ -177,8 +177,11 @@
<CustomAction Id="EditConfigFiles" BinaryKey="EditConfigFileSrc" VBScriptCall="" Execute="deferred" Impersonate="no" />
<CustomAction Id="SetEditConfigFiles" Property="EditConfigFiles" Value="[INSTALLDIR];@;[IS64BITINSTALL]" />
- <CustomAction Id="KeyGen" BinaryKey="WixCA" DllEntry="WixQuietExec" Execute="deferred" Impersonate="no" />
- <CustomAction Id="SetKeyGen" Property="KeyGen" Value=""[INSTALLDIR]etc\shibboleth\keygen.bat" [KEYGEN_EXTRA]" />
+ <CustomAction Id="KeyGenSigning" BinaryKey="WixCA" DllEntry="WixQuietExec" Execute="deferred" Impersonate="no" />
+ <CustomAction Id="SetKeyGenSigning" Property="KeyGenSigning" Value=""[INSTALLDIR]etc\shibboleth\keygen.bat" -n sp-signing [KEYGEN_EXTRA]" />
+
+ <CustomAction Id="KeyGenEncrypt" BinaryKey="WixCA" DllEntry="WixQuietExec" Execute="deferred" Impersonate="no" />
+ <CustomAction Id="SetKeyGenEncrypt" Property="KeyGenEncrypt" Value=""[INSTALLDIR]etc\shibboleth\keygen.bat" -n sp-encrypt [KEYGEN_EXTRA]" />
<!-- Inherit the installation dir if one was set -->
<CustomAction Id="InheritInstallDir" Property="INSTALLDIR" Value="[OLD_INSTALLDIR]" />
@@ -200,11 +203,13 @@
<Custom Action="SetEditConfigFiles" Before="CostInitialize">NOT Installed</Custom>
<Custom Action="EditConfigFiles" After="InstallFiles">NOT Installed</Custom>
- <Custom Action="SetKeyGen" Before="CostInitialize">NOT Installed</Custom>
+ <Custom Action="SetKeyGenSigning" Before="CostInitialize">NOT Installed</Custom>
+ <Custom Action="SetKeyGenEncrypt" Before="CostInitialize">NOT Installed</Custom>
<!-- Run KeyGen after WriteEnvironmentStrings so the path is set -->
- <Custom Action="KeyGen" After="WriteEnvironmentStrings">NOT Installed</Custom>
+ <Custom Action="KeyGenSigning" After="WriteEnvironmentStrings">NOT Installed</Custom>
+ <Custom Action="KeyGenEncrypt" After="WriteEnvironmentStrings">NOT Installed</Custom>
- <!-- IIS handling is no longer architecture independant and happens in ShibbolethSP-main-x?? -->
+ <!-- IIS handling is no longer architecture independent and happens in ShibbolethSP-main-x?? -->
<!-- Duplicate actions from the UI case -->
<Custom Action="InheritInstallDir" After="AppSearch">
diff --git a/shibboleth.spec.in b/shibboleth.spec.in
index 1aea2c3..3206fb8 100644
--- a/shibboleth.spec.in
+++ b/shibboleth.spec.in
@@ -276,21 +276,21 @@ exit 0
/sbin/ldconfig
%endif
-# Key generation or ownership fix
-cd %{_sysconfdir}/shibboleth
-if [ -f sp-key.pem ] ; then
- %{__chown} %{runuser}:%{runuser} sp-key.pem sp-cert.pem 2>/dev/null || :
-else
- /bin/sh ./keygen.sh -b -u %{runuser} -g %{runuser}
+# Key ownership fix.
+if [ -f %{_sysconfdir}/shibboleth/sp-key.pem ] ; then
+ %{__chown} %{runuser}:%{runuser} %{_sysconfdir}/shibboleth/sp-key.pem %{_sysconfdir}/shibboleth/sp-cert.pem 2>/dev/null || :
fi
# Fix ownership of log files (even on new installs, if they're left from an older one).
%{__chown} %{runuser}:%{runuser} %{_localstatedir}/log/shibboleth/* 2>/dev/null || :
-# Install config file if no existing files are found.
+# Install config file and generate new keys if no existing config is found.
if [ ! -f %{_sysconfdir}/shibboleth/shibboleth3.xml ] ; then
if [ ! -f %{_sysconfdir}/shibboleth/shibboleth2.xml ] ; then
install $RPM_BUILD_ROOT%{_sysconfdir}/shibboleth/shibboleth3.xml %{_sysconfdir}/shibboleth/
+ cd %{_sysconfdir}/shibboleth
+ /bin/sh ./keygen.sh -b -n sp-signing -u %{runuser} -g %{runuser}
+ /bin/sh ./keygen.sh -b -n sp-encrypt -u %{runuser} -g %{runuser}
fi
fi
@@ -465,10 +465,11 @@ exit 0
%doc %{pkgdocdir}/api
%changelog
-* Tue Nov 21 2017 Scott Cantor <cantor.2 at osu.edu> - 3.0.0-1
+* Mon Apr 30 2018 Scott Cantor <cantor.2 at osu.edu> - 3.0.0-1
- Bump dependency versions
-- Require Xerces 3.2 as shipped by me on all platforms
+- Require updated libraries across the board
- Add logic to handle new config outside of RPM scope
+- Generate two keys on new installs
* Tue May 03 2016 Scott Cantor <cantor.2 at osu.edu> - 2.6.0-1
- Bump opensaml dependency version
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list