[java-idp-jetty-base] 01/01: IDP-1110 Initial commit of embedded (Windows) changes
Rod Widdowson
rdw at steadingsoftware.com
Tue Sep 4 09:34:23 EDT 2018
This is an automated email from the git hooks/post-receive script.
rdw pushed a commit to branch 9.4-windows
in repository java-idp-jetty-base.
View the commit online:
http://git.shibboleth.net/view/?p=java-idp-jetty-base.git;a=commit;h=9d3fc2201df438cbbdd149dfc9bc41892e182a0b
commit 9d3fc2201df438cbbdd149dfc9bc41892e182a0b
Author: Rod Widdowson <rdw at steadingsoftware.com>
AuthorDate: Sat Sep 1 17:03:31 2018 +0100
IDP-1110 Initial commit of embedded (Windows) changes
https://issues.shibboleth.net/jira/browse/IDP-1110
Comprising:
- jetty-deploy.xml from 9.4 jetty, edited to source properties
from idp.ini
- jetty-ssl-context.xml from jetty, edited to allow simpler
property configuration
- logging-logback.mod from jetty, edited to remove setting of
system property (jetty.sslContext.renegotiationAllowed)
- idp-system.ini: new file containing the --module definitions
from mainline and the new property we do not want edited
- idp.xml: from 9.4 branch but using Properties, not SystemProperties
- idp.ini.rewrite.property.names: reflecting property name changes
between Jetty 9.3 and 9.4
- idp.ini.windows The only properties we allow people to change on
windows (3 each for the 2 keystores). Plus some properties we
used to allow adjustment of (so they have to stay here)
but want to deprecrate (jetty.ssl.port, jetty.http.port,
jetty.http.host)
https://wiki.shibboleth.net/confluence/display/DEV/JettyBase9.4ForWindows
Note that this does require the comapnion changes in java-identity-provider
(12c6a3e & 2c5c651)
---
src/main/resources/jetty-base/etc/jetty-deploy.xml | 75 ++++++++++++++++++++++
.../resources/jetty-base/etc/jetty-ssl-context.xml | 49 ++++++++++++++
.../jetty-base/modules/logging-logback.mod | 16 +++++
.../resources/jetty-base/start.d/idp-system.ini | 10 +++
.../start.d/idp.ini.rewrite.property.names | 21 +++++-
.../resources/jetty-base/start.d/idp.ini.windows | 41 ++++++++++++
src/main/resources/jetty-base/webapps/idp.xml | 4 +-
7 files changed, 212 insertions(+), 4 deletions(-)
diff --git a/src/main/resources/jetty-base/etc/jetty-deploy.xml b/src/main/resources/jetty-base/etc/jetty-deploy.xml
new file mode 100644
index 0000000..9803202
--- /dev/null
+++ b/src/main/resources/jetty-base/etc/jetty-deploy.xml
@@ -0,0 +1,75 @@
+<?xml version="1.0"?>
+<!DOCTYPE Configure PUBLIC "-//Jetty//Configure//EN" "http://www.eclipse.org/jetty/configure_9_3.dtd">
+
+<!-- =============================================================== -->
+<!-- Create the deployment manager -->
+<!-- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -->
+<!-- The deplyment manager handles the lifecycle of deploying web -->
+<!-- applications. Apps are provided by instances of the -->
+<!-- AppProvider interface. -->
+<!-- =============================================================== -->
+<Configure id="Server" class="org.eclipse.jetty.server.Server">
+
+ <Call name="addBean">
+ <Arg>
+ <New id="DeploymentManager" class="org.eclipse.jetty.deploy.DeploymentManager">
+ <Set name="contexts">
+ <Ref refid="Contexts" />
+ </Set>
+ <Call name="setContextAttribute">
+ <Arg>org.eclipse.jetty.server.webapp.ContainerIncludeJarPattern</Arg>
+ <Arg>.*/[^/]*servlet-api-[^/]*\.jar$|.*/javax.servlet.jsp.jstl-.*\.jar$|.*/org.apache.taglibs.taglibs-standard-impl-.*\.jar$</Arg>
+ </Call>
+
+ <!-- Add a customize step to the deployment lifecycle -->
+ <!-- uncomment and replace DebugBinding with your extended AppLifeCycle.Binding class
+ <Call name="insertLifeCycleNode">
+ <Arg>deployed</Arg>
+ <Arg>starting</Arg>
+ <Arg>customise</Arg>
+ </Call>
+ <Call name="addLifeCycleBinding">
+ <Arg>
+ <New class="org.eclipse.jetty.deploy.bindings.DebugBinding">
+ <Arg>customise</Arg>
+ </New>
+ </Arg>
+ </Call> -->
+
+ <Call id="webappprovider" name="addAppProvider">
+ <Arg>
+ <New class="org.eclipse.jetty.deploy.providers.WebAppProvider">
+ <Set name="monitoredDirName">
+ <Property>
+ <Name>jetty.deploy.monitoredPath</Name>
+ <Default>
+ <Property name="jetty.base" default="." />/<Property name="jetty.deploy.monitoredDir" deprecated="jetty.deploy.monitoredDirName" default="webapps"/>
+ </Default>
+ </Property>
+ </Set>
+ <Set name="defaultsDescriptor">
+ <Property>
+ <Name>jetty.deploy.defaultsDescriptorPath</Name>
+ <Default>
+ <Property name="jetty.home" default="." />/etc/webdefault.xml
+ </Default>
+ </Property>
+ </Set>
+ <Set name="scanInterval"><Property name="jetty.deploy.scanInterval" default="1"/></Set>
+ <Set name="extractWars"><Property name="jetty.deploy.extractWars" default="true"/></Set>
+ <Set name="configurationManager">
+ <New class="org.eclipse.jetty.deploy.PropertiesConfigurationManager">
+ <!-- file of context configuration properties -->
+ <Set name="file"><SystemProperty name="jetty.base"/>/start.d/idp.ini</Set>
+ <!-- set a context configuration property
+ <Call name="put"><Arg>name</Arg><Arg>value</Arg></Call>
+ -->
+ </New>
+ </Set>
+ </New>
+ </Arg>
+ </Call>
+ </New>
+ </Arg>
+ </Call>
+</Configure>
diff --git a/src/main/resources/jetty-base/etc/jetty-ssl-context.xml b/src/main/resources/jetty-base/etc/jetty-ssl-context.xml
new file mode 100644
index 0000000..2ed0584
--- /dev/null
+++ b/src/main/resources/jetty-base/etc/jetty-ssl-context.xml
@@ -0,0 +1,49 @@
+<?xml version="1.0"?>
+<!DOCTYPE Configure PUBLIC "-//Jetty//Configure//EN" "http://www.eclipse.org/jetty/configure_9_3.dtd">
+
+<!-- ============================================================= -->
+<!-- SSL ContextFactory configuration -->
+<!-- ============================================================= -->
+
+<!--
+ To configure Includes / Excludes for Cipher Suites or Protocols see tweak-ssl.xml example at
+ https://www.eclipse.org/jetty/documentation/current/configuring-ssl.html#configuring-sslcontextfactory-cipherSuites
+-->
+
+<Configure id="sslContextFactory" class="org.eclipse.jetty.util.ssl.SslContextFactory">
+ <Set name="Provider"><Property name="jetty.sslContext.provider"/></Set>
+ <Set name="KeyStorePath"><Property name="jetty.sslContext.keyStorePath" deprecated="jetty.keystore" default="etc/keystore"/></Set>
+ <Set name="KeyStorePassword"><Property name="jetty.sslContext.keyStorePassword" deprecated="jetty.keystore.password" default="OBF:1vny1zlo1x8e1vnw1vn61x8g1zlu1vn4"/></Set>
+ <Set name="KeyStoreType"><Property name="jetty.sslContext.keyStoreType" default="JKS"/></Set>
+ <Set name="KeyStoreProvider"><Property name="jetty.sslContext.keyStoreProvider"/></Set>
+ <Set name="EndpointIdentificationAlgorithm"></Set>
+ <Set name="NeedClientAuth"><Property name="jetty.sslContext.needClientAuth" deprecated="jetty.ssl.needClientAuth" default="false"/></Set>
+ <Set name="WantClientAuth"><Property name="jetty.sslContext.wantClientAuth" deprecated="jetty.ssl.wantClientAuth" default="false"/></Set>
+ <Set name="useCipherSuitesOrder"><Property name="jetty.sslContext.useCipherSuitesOrder" default="true"/></Set>
+ <Set name="sslSessionCacheSize"><Property name="jetty.sslContext.sslSessionCacheSize" default="-1"/></Set>
+ <Set name="sslSessionTimeout"><Property name="jetty.sslContext.sslSessionTimeout" default="-1"/></Set>
+ <Set name="RenegotiationAllowed"><Property name="jetty.sslContext.renegotiationAllowed" default="true"/></Set>
+ <Set name="RenegotiationLimit"><Property name="jetty.sslContext.renegotiationLimit" default="5"/></Set>
+
+ <!-- Example of how to configure a PKIX Certificate Path revocation Checker
+ <Call id="pkixPreferCrls" class="java.security.cert.PKIXRevocationChecker$Option" name="valueOf"><Arg>PREFER_CRLS</Arg></Call>
+ <Call id="pkixSoftFail" class="java.security.cert.PKIXRevocationChecker$Option" name="valueOf"><Arg>SOFT_FAIL</Arg></Call>
+ <Call id="pkixNoFallback" class="java.security.cert.PKIXRevocationChecker$Option" name="valueOf"><Arg>NO_FALLBACK</Arg></Call>
+ <Call class="java.security.cert.CertPathBuilder" name="getInstance">
+ <Arg>PKIX</Arg>
+ <Call id="pkixRevocationChecker" name="getRevocationChecker">
+ <Call name="setOptions">
+ <Arg>
+ <Call class="java.util.EnumSet" name="of">
+ <Arg><Ref refid="pkixPreferCrls"/></Arg>
+ <Arg><Ref refid="pkixSoftFail"/></Arg>
+ <Arg><Ref refid="pkixNoFallback"/></Arg>
+ </Call>
+ </Arg>
+ </Call>
+ </Call>
+ </Call>
+ <Set name="PkixCertPathChecker"><Ref refid="pkixRevocationChecker"/></Set>
+ -->
+
+</Configure>
diff --git a/src/main/resources/jetty-base/modules/logging-logback.mod b/src/main/resources/jetty-base/modules/logging-logback.mod
new file mode 100644
index 0000000..6bcd3b2
--- /dev/null
+++ b/src/main/resources/jetty-base/modules/logging-logback.mod
@@ -0,0 +1,16 @@
+DO NOT EDIT - See: https://www.eclipse.org/jetty/documentation/current/startup-modules.html
+
+[description]
+Configure jetty logging to use Logback Logging.
+SLF4J is used as the core logging mechanism.
+
+[tags]
+logging
+
+[depends]
+slf4j-logback
+logback-impl
+
+[provides]
+logging
+
diff --git a/src/main/resources/jetty-base/start.d/idp-system.ini b/src/main/resources/jetty-base/start.d/idp-system.ini
new file mode 100644
index 0000000..d65fa6e
--- /dev/null
+++ b/src/main/resources/jetty-base/start.d/idp-system.ini
@@ -0,0 +1,10 @@
+#
+# Do not edit anything in this file
+#
+--module=http
+--module=idp
+--module=idp-backchannel
+--module=idp-logging
+
+## Deny SSL renegotiation
+jetty.sslContext.renegotiationAllowed=false
diff --git a/src/main/resources/jetty-base/start.d/idp.ini.rewrite.property.names b/src/main/resources/jetty-base/start.d/idp.ini.rewrite.property.names
index 30d1961..fa45418 100644
--- a/src/main/resources/jetty-base/start.d/idp.ini.rewrite.property.names
+++ b/src/main/resources/jetty-base/start.d/idp.ini.rewrite.property.names
@@ -1,5 +1,22 @@
# Property names to change.
-# The format is "oldPopertyName=currentPropertyName"
+# The format is "oldPropertyName=currentPropertyName"
#
# Note that in order to guarantee backwards compatibility we can only add to this list.
-#
\ No newline at end of file
+#
+# IDP
+jetty.host=jetty.ssl.host
+jetty.https.port=jetty.ssl.port
+jetty.browser.keystore.path=jetty.sslContext.keyStorePath
+jetty.browser.keystore.password=jetty.sslContext.keyStorePassword
+jetty.browser.keystore.type=jetty.sslContext.keyStoreType
+jetty.nonhttps.host=jetty.http.host
+jetty.nonhttps.port=jetty.http.port
+jetty.context.path=idp.context.path
+jetty.backchannel.host=idp.backchannel.host
+jetty.backchannel.port=idp.backchannel.port
+jetty.backchannel.keystore.path=idp.backchannel.keystore.path
+jetty.backchannel.keystore.password=idp.backchannel.keystore.password
+jetty.backchannel.keystore.type=idp.backchannel.keystore.type
+jetty.nonhttps.host=jetty.http.host
+jetty.nonhttps.port=jetty.http.port
+jetty.war.path=idp.war.path
diff --git a/src/main/resources/jetty-base/start.d/idp.ini.windows b/src/main/resources/jetty-base/start.d/idp.ini.windows
new file mode 100644
index 0000000..f15f707
--- /dev/null
+++ b/src/main/resources/jetty-base/start.d/idp.ini.windows
@@ -0,0 +1,41 @@
+#
+# Note for Windows users:
+#
+# These are the only six properties which are guaranteed to work between
+# upgrades. You may find more elsewhere and add them here and they may
+# work. For this release.
+#
+# To repeat, only properties listed below are guarantee to work between
+# upgrades.
+#
+
+#
+# KeyStore Management.
+# In the following
+# "idp.backchannel.*" refers to the TLS connection on the SOAP port (8443)
+# "jetty.sslContext.*" refers to the TLS connection on 443
+
+# Path to keystores (relative to idp\idp-base)
+#
+idp.backchannel.keystore.path=../credentials/idp-backchannel.p12
+jetty.sslContext.keyStorePath=../credentials/idp-userfacing.p12
+
+# Keystore passwords
+#
+idp.backchannel.keystore.password=changeit
+jetty.sslContext.keyStorePassword=changeit
+
+# Keystore types
+# You ahould not need to change them and support
+# may be removed in future releases
+idp.backchannel.keystore.type=PKCS12
+jetty.sslContext.keyStoreType=PKCS12
+
+
+#
+# Do not change these properties. They are purely present
+# to reduce the footprint of the install. Support for them
+# may be removed without warning in future releases
+jetty.ssl.port=443
+jetty.http.port=80
+jetty.http.host=localhost
\ No newline at end of file
diff --git a/src/main/resources/jetty-base/webapps/idp.xml b/src/main/resources/jetty-base/webapps/idp.xml
index ffb3007..a1171cc 100644
--- a/src/main/resources/jetty-base/webapps/idp.xml
+++ b/src/main/resources/jetty-base/webapps/idp.xml
@@ -4,8 +4,8 @@
<!-- Configure the Shibboleth IdP webapp -->
<!-- =============================================================== -->
<Configure class="org.eclipse.jetty.webapp.WebAppContext">
- <Set name="war"><SystemProperty name="idp.war.path" default="../war/idp.war" /></Set>
- <Set name="contextPath"><SystemProperty name="idp.context.path" default="/idp" /></Set>
+ <Set name="war"><Property name="idp.war.path" default="../war/idp.war" /></Set>
+ <Set name="contextPath"><Property name="idp.context.path" default="/idp" /></Set>
<Set name="extractWAR">false</Set>
<Set name="copyWebDir">false</Set>
<Set name="copyWebInf">true</Set>
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list