[java-idp-jetty-base] 01/01: IDP-1110 Initial commit of embedded (Windows) changes

Rod Widdowson rdw at steadingsoftware.com
Tue Sep 4 09:34:23 EDT 2018


This is an automated email from the git hooks/post-receive script.

rdw pushed a commit to branch 9.4-windows
in repository java-idp-jetty-base.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-jetty-base.git;a=commit;h=9d3fc2201df438cbbdd149dfc9bc41892e182a0b

commit 9d3fc2201df438cbbdd149dfc9bc41892e182a0b
Author: Rod Widdowson <rdw at steadingsoftware.com>
AuthorDate: Sat Sep 1 17:03:31 2018 +0100

    IDP-1110 Initial commit of embedded (Windows) changes
    
    https://issues.shibboleth.net/jira/browse/IDP-1110
    
    Comprising:
      - jetty-deploy.xml from 9.4 jetty, edited to source properties
        from idp.ini
    
      - jetty-ssl-context.xml from jetty, edited to allow simpler
        property configuration
    
      - logging-logback.mod from jetty, edited to remove setting of
        system property (jetty.sslContext.renegotiationAllowed)
    
      - idp-system.ini: new file containing the --module definitions
        from mainline and the new property we do not want edited
    
      - idp.xml: from 9.4 branch but using Properties, not SystemProperties
    
      - idp.ini.rewrite.property.names: reflecting property name changes
        between Jetty 9.3 and 9.4
    
      - idp.ini.windows The only properties we allow people to change on
        windows (3 each for the 2 keystores).  Plus some properties we
        used to allow adjustment of (so they have to stay here)
        but want to deprecrate (jetty.ssl.port, jetty.http.port,
        jetty.http.host)
    
    https://wiki.shibboleth.net/confluence/display/DEV/JettyBase9.4ForWindows
    
    Note that this does require the comapnion changes in java-identity-provider
    (12c6a3e & 2c5c651)
---
 src/main/resources/jetty-base/etc/jetty-deploy.xml | 75 ++++++++++++++++++++++
 .../resources/jetty-base/etc/jetty-ssl-context.xml | 49 ++++++++++++++
 .../jetty-base/modules/logging-logback.mod         | 16 +++++
 .../resources/jetty-base/start.d/idp-system.ini    | 10 +++
 .../start.d/idp.ini.rewrite.property.names         | 21 +++++-
 .../resources/jetty-base/start.d/idp.ini.windows   | 41 ++++++++++++
 src/main/resources/jetty-base/webapps/idp.xml      |  4 +-
 7 files changed, 212 insertions(+), 4 deletions(-)

diff --git a/src/main/resources/jetty-base/etc/jetty-deploy.xml b/src/main/resources/jetty-base/etc/jetty-deploy.xml
new file mode 100644
index 0000000..9803202
--- /dev/null
+++ b/src/main/resources/jetty-base/etc/jetty-deploy.xml
@@ -0,0 +1,75 @@
+<?xml version="1.0"?>
+<!DOCTYPE Configure PUBLIC "-//Jetty//Configure//EN" "http://www.eclipse.org/jetty/configure_9_3.dtd">
+
+<!-- =============================================================== -->
+<!-- Create the deployment manager                                   -->
+<!-- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -->
+<!-- The deplyment manager handles the lifecycle of deploying web    -->
+<!-- applications. Apps are provided by instances of the             -->
+<!-- AppProvider interface.                                          -->
+<!-- =============================================================== -->
+<Configure id="Server" class="org.eclipse.jetty.server.Server">
+
+  <Call name="addBean">
+    <Arg>
+      <New id="DeploymentManager" class="org.eclipse.jetty.deploy.DeploymentManager">
+        <Set name="contexts">
+          <Ref refid="Contexts" />
+        </Set>
+        <Call name="setContextAttribute">
+          <Arg>org.eclipse.jetty.server.webapp.ContainerIncludeJarPattern</Arg>
+          <Arg>.*/[^/]*servlet-api-[^/]*\.jar$|.*/javax.servlet.jsp.jstl-.*\.jar$|.*/org.apache.taglibs.taglibs-standard-impl-.*\.jar$</Arg>
+        </Call>
+
+        <!-- Add a customize step to the deployment lifecycle -->
+        <!-- uncomment and replace DebugBinding with your extended AppLifeCycle.Binding class
+        <Call name="insertLifeCycleNode">
+          <Arg>deployed</Arg>
+          <Arg>starting</Arg>
+          <Arg>customise</Arg>
+        </Call>
+        <Call name="addLifeCycleBinding">
+          <Arg>
+            <New class="org.eclipse.jetty.deploy.bindings.DebugBinding">
+              <Arg>customise</Arg>
+            </New>
+          </Arg>
+        </Call> -->
+
+        <Call id="webappprovider" name="addAppProvider">
+          <Arg>
+            <New class="org.eclipse.jetty.deploy.providers.WebAppProvider">
+              <Set name="monitoredDirName">
+                <Property>
+                  <Name>jetty.deploy.monitoredPath</Name>
+                  <Default>
+                    <Property name="jetty.base" default="." />/<Property name="jetty.deploy.monitoredDir" deprecated="jetty.deploy.monitoredDirName" default="webapps"/>
+                  </Default>
+                </Property>
+              </Set>
+              <Set name="defaultsDescriptor">
+                <Property>
+                  <Name>jetty.deploy.defaultsDescriptorPath</Name>
+                  <Default>
+                    <Property name="jetty.home" default="." />/etc/webdefault.xml
+                  </Default>
+                </Property>
+              </Set>
+              <Set name="scanInterval"><Property name="jetty.deploy.scanInterval" default="1"/></Set>
+              <Set name="extractWars"><Property name="jetty.deploy.extractWars" default="true"/></Set>
+              <Set name="configurationManager">
+                <New class="org.eclipse.jetty.deploy.PropertiesConfigurationManager">
+                  <!-- file of context configuration properties -->
+                  <Set name="file"><SystemProperty name="jetty.base"/>/start.d/idp.ini</Set>
+                  <!-- set a context configuration property
+                  <Call name="put"><Arg>name</Arg><Arg>value</Arg></Call>
+                  -->
+                </New>
+              </Set>
+            </New>
+          </Arg>
+        </Call>
+      </New>
+    </Arg>
+  </Call>
+</Configure>
diff --git a/src/main/resources/jetty-base/etc/jetty-ssl-context.xml b/src/main/resources/jetty-base/etc/jetty-ssl-context.xml
new file mode 100644
index 0000000..2ed0584
--- /dev/null
+++ b/src/main/resources/jetty-base/etc/jetty-ssl-context.xml
@@ -0,0 +1,49 @@
+<?xml version="1.0"?>
+<!DOCTYPE Configure PUBLIC "-//Jetty//Configure//EN" "http://www.eclipse.org/jetty/configure_9_3.dtd">
+
+<!-- ============================================================= -->
+<!-- SSL ContextFactory configuration                              -->
+<!-- ============================================================= -->
+
+<!-- 
+  To configure Includes / Excludes for Cipher Suites or Protocols see tweak-ssl.xml example at 
+     https://www.eclipse.org/jetty/documentation/current/configuring-ssl.html#configuring-sslcontextfactory-cipherSuites
+-->
+
+<Configure id="sslContextFactory" class="org.eclipse.jetty.util.ssl.SslContextFactory">
+  <Set name="Provider"><Property name="jetty.sslContext.provider"/></Set>
+  <Set name="KeyStorePath"><Property name="jetty.sslContext.keyStorePath" deprecated="jetty.keystore" default="etc/keystore"/></Set>
+  <Set name="KeyStorePassword"><Property name="jetty.sslContext.keyStorePassword" deprecated="jetty.keystore.password" default="OBF:1vny1zlo1x8e1vnw1vn61x8g1zlu1vn4"/></Set>
+  <Set name="KeyStoreType"><Property name="jetty.sslContext.keyStoreType" default="JKS"/></Set>
+  <Set name="KeyStoreProvider"><Property name="jetty.sslContext.keyStoreProvider"/></Set>
+  <Set name="EndpointIdentificationAlgorithm"></Set>
+  <Set name="NeedClientAuth"><Property name="jetty.sslContext.needClientAuth" deprecated="jetty.ssl.needClientAuth" default="false"/></Set>
+  <Set name="WantClientAuth"><Property name="jetty.sslContext.wantClientAuth" deprecated="jetty.ssl.wantClientAuth" default="false"/></Set>
+  <Set name="useCipherSuitesOrder"><Property name="jetty.sslContext.useCipherSuitesOrder" default="true"/></Set>
+  <Set name="sslSessionCacheSize"><Property name="jetty.sslContext.sslSessionCacheSize" default="-1"/></Set>
+  <Set name="sslSessionTimeout"><Property name="jetty.sslContext.sslSessionTimeout" default="-1"/></Set>
+  <Set name="RenegotiationAllowed"><Property name="jetty.sslContext.renegotiationAllowed" default="true"/></Set>
+  <Set name="RenegotiationLimit"><Property name="jetty.sslContext.renegotiationLimit" default="5"/></Set>
+ 
+  <!-- Example of how to configure a PKIX Certificate Path revocation Checker
+  <Call id="pkixPreferCrls" class="java.security.cert.PKIXRevocationChecker$Option" name="valueOf"><Arg>PREFER_CRLS</Arg></Call>
+  <Call id="pkixSoftFail" class="java.security.cert.PKIXRevocationChecker$Option" name="valueOf"><Arg>SOFT_FAIL</Arg></Call>
+  <Call id="pkixNoFallback" class="java.security.cert.PKIXRevocationChecker$Option" name="valueOf"><Arg>NO_FALLBACK</Arg></Call>
+  <Call class="java.security.cert.CertPathBuilder" name="getInstance">
+    <Arg>PKIX</Arg>
+    <Call id="pkixRevocationChecker" name="getRevocationChecker">
+      <Call name="setOptions">
+        <Arg>
+          <Call class="java.util.EnumSet" name="of">
+            <Arg><Ref refid="pkixPreferCrls"/></Arg>
+            <Arg><Ref refid="pkixSoftFail"/></Arg>
+            <Arg><Ref refid="pkixNoFallback"/></Arg>
+          </Call>
+        </Arg>
+      </Call>
+    </Call>
+  </Call>
+  <Set name="PkixCertPathChecker"><Ref refid="pkixRevocationChecker"/></Set>
+  -->
+  
+</Configure>
diff --git a/src/main/resources/jetty-base/modules/logging-logback.mod b/src/main/resources/jetty-base/modules/logging-logback.mod
new file mode 100644
index 0000000..6bcd3b2
--- /dev/null
+++ b/src/main/resources/jetty-base/modules/logging-logback.mod
@@ -0,0 +1,16 @@
+DO NOT EDIT - See: https://www.eclipse.org/jetty/documentation/current/startup-modules.html
+
+[description]
+Configure jetty logging to use Logback Logging. 
+SLF4J is used as the core logging mechanism.
+
+[tags]
+logging
+
+[depends]
+slf4j-logback
+logback-impl
+
+[provides]
+logging
+
diff --git a/src/main/resources/jetty-base/start.d/idp-system.ini b/src/main/resources/jetty-base/start.d/idp-system.ini
new file mode 100644
index 0000000..d65fa6e
--- /dev/null
+++ b/src/main/resources/jetty-base/start.d/idp-system.ini
@@ -0,0 +1,10 @@
+#
+# Do not edit anything in this file
+#
+--module=http
+--module=idp
+--module=idp-backchannel
+--module=idp-logging
+
+## Deny SSL renegotiation
+jetty.sslContext.renegotiationAllowed=false
diff --git a/src/main/resources/jetty-base/start.d/idp.ini.rewrite.property.names b/src/main/resources/jetty-base/start.d/idp.ini.rewrite.property.names
index 30d1961..fa45418 100644
--- a/src/main/resources/jetty-base/start.d/idp.ini.rewrite.property.names
+++ b/src/main/resources/jetty-base/start.d/idp.ini.rewrite.property.names
@@ -1,5 +1,22 @@
 # Property names to change.
-# The format is "oldPopertyName=currentPropertyName"
+# The format is "oldPropertyName=currentPropertyName"
 #
 # Note that in order to guarantee backwards compatibility we can only add to this list.
-#
\ No newline at end of file
+#
+# IDP 
+jetty.host=jetty.ssl.host
+jetty.https.port=jetty.ssl.port
+jetty.browser.keystore.path=jetty.sslContext.keyStorePath
+jetty.browser.keystore.password=jetty.sslContext.keyStorePassword
+jetty.browser.keystore.type=jetty.sslContext.keyStoreType
+jetty.nonhttps.host=jetty.http.host
+jetty.nonhttps.port=jetty.http.port
+jetty.context.path=idp.context.path
+jetty.backchannel.host=idp.backchannel.host
+jetty.backchannel.port=idp.backchannel.port
+jetty.backchannel.keystore.path=idp.backchannel.keystore.path
+jetty.backchannel.keystore.password=idp.backchannel.keystore.password
+jetty.backchannel.keystore.type=idp.backchannel.keystore.type
+jetty.nonhttps.host=jetty.http.host
+jetty.nonhttps.port=jetty.http.port
+jetty.war.path=idp.war.path
diff --git a/src/main/resources/jetty-base/start.d/idp.ini.windows b/src/main/resources/jetty-base/start.d/idp.ini.windows
new file mode 100644
index 0000000..f15f707
--- /dev/null
+++ b/src/main/resources/jetty-base/start.d/idp.ini.windows
@@ -0,0 +1,41 @@
+#
+# Note for Windows users:
+#
+# These are the only six properties which are guaranteed to work between 
+# upgrades.  You may find more elsewhere and add them here and they may
+# work. For this release.
+# 
+# To repeat, only properties listed below are guarantee to work between
+# upgrades.
+#
+
+#
+# KeyStore Management.
+# In the following
+#     "idp.backchannel.*" refers to the TLS connection on the SOAP port (8443)
+#     "jetty.sslContext.*" refers to the TLS connection on 443
+
+# Path to keystores (relative to idp\idp-base)
+#
+idp.backchannel.keystore.path=../credentials/idp-backchannel.p12
+jetty.sslContext.keyStorePath=../credentials/idp-userfacing.p12
+
+# Keystore passwords
+#
+idp.backchannel.keystore.password=changeit
+jetty.sslContext.keyStorePassword=changeit
+
+# Keystore types
+# You ahould not need to change them and support
+# may be removed in future releases
+idp.backchannel.keystore.type=PKCS12
+jetty.sslContext.keyStoreType=PKCS12
+
+
+#
+# Do not change these properties.  They are purely present
+# to reduce the footprint of the install.  Support for them
+# may be removed without warning in future releases
+jetty.ssl.port=443
+jetty.http.port=80
+jetty.http.host=localhost
\ No newline at end of file
diff --git a/src/main/resources/jetty-base/webapps/idp.xml b/src/main/resources/jetty-base/webapps/idp.xml
index ffb3007..a1171cc 100644
--- a/src/main/resources/jetty-base/webapps/idp.xml
+++ b/src/main/resources/jetty-base/webapps/idp.xml
@@ -4,8 +4,8 @@
 <!-- Configure the Shibboleth IdP webapp                             -->
 <!-- =============================================================== -->
 <Configure class="org.eclipse.jetty.webapp.WebAppContext">
-  <Set name="war"><SystemProperty name="idp.war.path" default="../war/idp.war" /></Set>
-  <Set name="contextPath"><SystemProperty name="idp.context.path" default="/idp" /></Set>
+  <Set name="war"><Property name="idp.war.path" default="../war/idp.war" /></Set>
+  <Set name="contextPath"><Property name="idp.context.path" default="/idp" /></Set>
   <Set name="extractWAR">false</Set>
   <Set name="copyWebDir">false</Set>
   <Set name="copyWebInf">true</Set>

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.


More information about the commits mailing list