[java-identity-provider] branch master updated: IDP-1523 Secrets.properties moves to credentials
Rod Widdowson
rdw at steadingsoftware.com
Sat Dec 28 11:35:47 EST 2019
This is an automated email from the git hooks/post-receive script.
rdw pushed a commit to branch master
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=271e742a6e3ac11e1f29dea1fba9c8f48ec1a7bb
The following commit(s) were added to refs/heads/master by this push:
new 271e742 IDP-1523 Secrets.properties moves to credentials
271e742 is described below
commit 271e742a6e3ac11e1f29dea1fba9c8f48ec1a7bb
Author: Rod Widdowson <rdw at steadingsoftware.com>
AuthorDate: Sat Dec 28 16:25:17 2019 +0000
IDP-1523 Secrets.properties moves to credentials
https://issues.shibboleth.net/jira/browse/IDP-1523
- Remove all previous code which copied this from idp-conf
to the distribution and then installed it.
- Remove Windows code to generate a merge file
- Create the file by long hand based on properties provided
---
.../resources/credentials/secrets.properties | 0
idp-distribution/pom.xml | 2 +-
.../src/main/assembly/idp-assembly-zip.xml | 2 -
.../shibboleth/idp/installer/CopyDistribution.java | 1 -
.../idp/installer/CurrentInstallState.java | 7 +-
.../idp/installer/InstallerProperties.java | 15 ++--
.../idp/installer/InstallerPropertiesImpl.java | 16 ++---
.../net/shibboleth/idp/installer/V4Install.java | 80 ++++++++++++----------
.../installer/impl/CurrentInstallStateImpl.java | 9 ---
.../src/main/wix/scripts/shib_write_configs.vbs | 17 +----
.../java/net/shibboleth/idp/installer/Test.java | 2 +-
11 files changed, 63 insertions(+), 88 deletions(-)
diff --git a/idp-conf/src/main/resources/credentials/secrets.properties b/idp-conf/src/test/resources/credentials/secrets.properties
similarity index 100%
rename from idp-conf/src/main/resources/credentials/secrets.properties
rename to idp-conf/src/test/resources/credentials/secrets.properties
diff --git a/idp-distribution/pom.xml b/idp-distribution/pom.xml
index 233d872..96ca803 100644
--- a/idp-distribution/pom.xml
+++ b/idp-distribution/pom.xml
@@ -157,7 +157,7 @@
<version>${project.version}</version>
<type>jar</type>
<outputDirectory>${idp.assemblyDirectory}</outputDirectory>
- <excludes>**/META-INF/**,**/logs/*</excludes>
+ <excludes>**/META-INF/**,**/logs/*,**/credentials/*</excludes>
</artifactItem>
</artifactItems>
</configuration>
diff --git a/idp-distribution/src/main/assembly/idp-assembly-zip.xml b/idp-distribution/src/main/assembly/idp-assembly-zip.xml
index a1ee189..26544a3 100644
--- a/idp-distribution/src/main/assembly/idp-assembly-zip.xml
+++ b/idp-distribution/src/main/assembly/idp-assembly-zip.xml
@@ -10,7 +10,6 @@
<excludes>
<exclude>**/*.bat</exclude>
<exclude>**/*.config</exclude>
- <exclude>**/*.credentials</exclude>
<exclude>**/*.ini</exclude>
<exclude>**/*.properties</exclude>
<exclude>**/*.txt</exclude>
@@ -24,7 +23,6 @@
<includes>
<include>**/*.bat</include>
<include>**/*.config</include>
- <include>**/*.credentials</include>
<include>**/*.ini</include>
<include>**/*.properties</include>
<include>**/*.txt</include>
diff --git a/idp-installer/src/main/java/net/shibboleth/idp/installer/CopyDistribution.java b/idp-installer/src/main/java/net/shibboleth/idp/installer/CopyDistribution.java
index 54d4773..8174630 100644
--- a/idp-installer/src/main/java/net/shibboleth/idp/installer/CopyDistribution.java
+++ b/idp-installer/src/main/java/net/shibboleth/idp/installer/CopyDistribution.java
@@ -157,7 +157,6 @@ public final class CopyDistribution extends AbstractInitializableComponent {
throw new BuildException("Source distribution not found");
}
distCopy(src, dist, "conf");
- distCopy(src, dist, "credentials");
distCopy(src, dist, "flows");
distCopy(src, dist, "messages");
distCopy(src, dist, "views");
diff --git a/idp-installer/src/main/java/net/shibboleth/idp/installer/CurrentInstallState.java b/idp-installer/src/main/java/net/shibboleth/idp/installer/CurrentInstallState.java
index a082059..51adcd5 100644
--- a/idp-installer/src/main/java/net/shibboleth/idp/installer/CurrentInstallState.java
+++ b/idp-installer/src/main/java/net/shibboleth/idp/installer/CurrentInstallState.java
@@ -46,16 +46,11 @@ public interface CurrentInstallState extends InitializableComponent {
*/
boolean isIdPPropertiesPresent();
- /** Was ldap.properties present in the target file when we started the install?
+ /** Was ldapp.properties present in the target file when we started the install?
* @return if it was.
*/
boolean isLDAPPropertiesPresent();
- /** Was secrets.properties present in the target file when we started the install?
- * @return if it was.
- */
- boolean isSecretsPropertiesPresent();
-
/** Get the properties associated with the current configuration.
* This comes idp.properties and anything it points to via
* {@value IdPPropertiesApplicationContextInitializer#IDP_ADDITIONAL_PROPERTY}.
diff --git a/idp-installer/src/main/java/net/shibboleth/idp/installer/InstallerProperties.java b/idp-installer/src/main/java/net/shibboleth/idp/installer/InstallerProperties.java
index cbb7e13..a8ec348 100644
--- a/idp-installer/src/main/java/net/shibboleth/idp/installer/InstallerProperties.java
+++ b/idp-installer/src/main/java/net/shibboleth/idp/installer/InstallerProperties.java
@@ -118,15 +118,14 @@ public interface InstallerProperties extends InitializableComponent {
*/
@Nullable public Path getLDAPMergeProperties() throws BuildException;
- /** Get the a file to merge with secrets.properties or null.
- *
- * @return the path or null if it none required.
- * @throws BuildException if badness happens
- */
- @Nullable public Path getSecretsMergeProperties() throws BuildException;
-
+ /** Get the LDAP password iff one was provided. DO NOT PROMPT
+ *
+ * @return the password if provided by a properties
+ * @throws BuildException if badness happens
+ */
+ @Nullable public String getLDAPPassword() throws BuildException;
- /** Get a directory to use to "pre-overlay" the conf directory.
+ /** Get a directory to use to "pre-overlay" the conf directory.
* Files will be copied from here if they don't already exist in conf,
* <b>before</b> the files are copied from the distribution.
* @return the path or null if non specified.
diff --git a/idp-installer/src/main/java/net/shibboleth/idp/installer/InstallerPropertiesImpl.java b/idp-installer/src/main/java/net/shibboleth/idp/installer/InstallerPropertiesImpl.java
index c803174..87caf62 100644
--- a/idp-installer/src/main/java/net/shibboleth/idp/installer/InstallerPropertiesImpl.java
+++ b/idp-installer/src/main/java/net/shibboleth/idp/installer/InstallerPropertiesImpl.java
@@ -62,8 +62,8 @@ public class InstallerPropertiesImpl extends AbstractInitializableComponent impl
/** The name of a property file to merge with ldap.properties. */
public static final String LDAP_PROPERTIES_MERGE = "ldap.merge.properties";
- /** The name of a property file to merge with ldap.properties. */
- public static final String SECRETS_PROPERTIES_MERGE = "secrets.merge.properties";
+ /** The LDAP Password (usually associated with a username in ldap.properties). */
+ public static final String LDAP_PASSWORD = "idp.LDAP.Credentials";
/** The name of a directory to overlay "under" the distribution conf. */
public static final String CONF_PRE_OVERLAY = "idp.conf.preoverlay";
@@ -176,7 +176,7 @@ public class InstallerPropertiesImpl extends AbstractInitializableComponent impl
/** Local overload of properties (to deal with nested calling). */
private Map<String, String> inheritedProperties = Collections.EMPTY_MAP;
- /** Inout handler from the prompting. */
+ /** Input handler from the prompting. */
private final InputHandler inputHandler;
/**
@@ -492,6 +492,11 @@ public class InstallerPropertiesImpl extends AbstractInitializableComponent impl
}
/** {@inheritDoc}. */
+ @Override @Nullable public String getLDAPPassword() throws BuildException {
+ return installerProperties.getProperty(LDAP_PASSWORD);
+ }
+
+ /** {@inheritDoc}. */
@Override @Nonnull public String getSubjectAltName() {
return "https://" + getHostName() + "/idp/shibboleth";
}
@@ -591,11 +596,6 @@ public class InstallerPropertiesImpl extends AbstractInitializableComponent impl
}
/** {@inheritDoc}. */
- @Override public Path getSecretsMergeProperties() throws BuildException {
- return getMergeFile(SECRETS_PROPERTIES_MERGE);
- }
-
- /** {@inheritDoc}. */
@Override public Path getConfPreOverlay() throws BuildException {
return getMergeFile(CONF_PRE_OVERLAY);
}
diff --git a/idp-installer/src/main/java/net/shibboleth/idp/installer/V4Install.java b/idp-installer/src/main/java/net/shibboleth/idp/installer/V4Install.java
index 6946610..4e43073 100644
--- a/idp-installer/src/main/java/net/shibboleth/idp/installer/V4Install.java
+++ b/idp-installer/src/main/java/net/shibboleth/idp/installer/V4Install.java
@@ -17,9 +17,11 @@
package net.shibboleth.idp.installer;
+import java.io.BufferedWriter;
import java.io.File;
import java.io.FileInputStream;
import java.io.FileOutputStream;
+import java.io.FileWriter;
import java.io.IOException;
import java.io.OutputStream;
import java.nio.file.Files;
@@ -203,7 +205,7 @@ public class V4Install extends AbstractInitializableComponent {
// CheckStyle: CyclomaticComplexity|MethodLength OFF
protected void populatePropertyFiles(final boolean sealerCreated) throws BuildException {
final Path conf = installerProps.getTargetDir().resolve("conf");
- final Path distConf = installerProps.getTargetDir().resolve("dist").resolve("conf");
+ final Path dstConf = installerProps.getTargetDir().resolve("dist").resolve("conf");
if (!currentState.isIdPPropertiesPresent()) {
// We have to populate it
try {
@@ -212,7 +214,7 @@ public class V4Install extends AbstractInitializableComponent {
throw new BuildException("Internal error - idp.properties");
}
final Path mergePath = installerProps.getIdPMergeProperties();
- final Path source = distConf.resolve("idp.properties");
+ final Path source = dstConf.resolve("idp.properties");
if (!Files.exists(source)) {
throw new BuildException("missing idp.properties in dist");
}
@@ -246,7 +248,7 @@ public class V4Install extends AbstractInitializableComponent {
if (Files.exists(target)) {
throw new BuildException("Internal error - ldap.properties");
}
- final Path source = distConf.resolve("ldap.properties");
+ final Path source = dstConf.resolve("ldap.properties");
if (!Files.exists(source)) {
throw new BuildException("missing ldap.properties in dist");
}
@@ -266,44 +268,50 @@ public class V4Install extends AbstractInitializableComponent {
}
}
- if (sealerCreated) {
- // We need to write the passwords to secrets.properties
- try {
- final Path target = installerProps.getTargetDir().resolve("credentials").resolve("secrets.properties");
- if (Files.exists(target)) {
- throw new BuildException("Internal error - secrets.properties");
- }
- final Path distCreds = installerProps.getTargetDir().resolve("dist").resolve("credentials");
- final Path source = distCreds.resolve("secrets.properties");
- if (!Files.exists(source)) {
- throw new BuildException("missing secrets.properties in dist");
- }
- final Properties replacements;
- final Path mergePath = installerProps.getSecretsMergeProperties();
- if (mergePath != null) {
- log.debug("Creating {} from {} and {}", target, source, mergePath);
- replacements = new Properties();
- final File mergeFile = mergePath.toFile();
- if (!installerProps.isNoTidy()) {
- mergeFile.deleteOnExit();
- }
- replacements.load(new FileInputStream(mergeFile));
+ if (null == currentState.getInstalledVersion()) {
+ log.debug("Detected a new Install. Creating secrets.properties.");
+ final Path secrets = installerProps.getTargetDir().resolve("credentials").resolve("secrets.properties");
+ try (final FileWriter fileWriter = new FileWriter(secrets.toFile());
+ final BufferedWriter out = new BufferedWriter(fileWriter)) {
+
+ out.write("# This is a reserved spot for most properties containing passwords or other secrets.");
+ out.newLine();
+ out.write("# Created by install at " + Instant.now());
+ out.newLine();
+ out.newLine();
+ out.write("# Access to internal AES encryption key");
+ out.newLine();
+ final String password;
+ if (sealerCreated) {
+ password = installerProps.getSealerPassword();
} else {
- replacements = new Properties(2);
- replacements .setProperty("idp.sealer.storePassword", installerProps.getSealerPassword());
- replacements .setProperty("idp.sealer.keyPassword", installerProps.getSealerPassword());
- log.debug("Creating {} from {} and {}", target, source, replacements.keySet());
+ password = "password";
}
- final PropertiesWithComments propertiesToReWrite = new PropertiesWithComments();
- propertiesToReWrite.load(new FileInputStream(source.toFile()));
- propertiesToReWrite.replaceProperties(replacements);
- propertiesToReWrite.store(new FileOutputStream(target.toFile()));
+ out.write("idp.sealer.storePassword = " + password);
+ out.newLine();
+ out.write("idp.sealer.keyPassword = " + password);
+ out.newLine();
+ out.newLine();
+ String ldapPassword = installerProps.getLDAPPassword();
+ if (null == ldapPassword) {
+ ldapPassword = "myServicePassword";
+ }
+ out.write("# Default access to LDAP authn and attribute stores. ");
+ out.newLine();
+ out.write("idp.authn.LDAP.bindDNCredential = " + ldapPassword);
+ out.newLine();
+ out.write("idp.attribute.resolver.LDAP.bindDNCredential " +
+ "= %{idp.authn.LDAP.bindDNCredential:undefined}");
+ out.newLine();
+ out.newLine();
+ out.write("# Salt used to generate persistent/pairwise IDs, must be kept secret");
+ out.newLine();
+ out.write("#idp.persistentId.salt = changethistosomethingrandom");
+ out.newLine();
} catch (final IOException e) {
throw new BuildException("Failed to generate secrets.properties", e);
}
- }
-
- if (CurrentInstallState.V3_VERSION.equals(currentState.getInstalledVersion())) {
+ } else if (CurrentInstallState.V3_VERSION.equals(currentState.getInstalledVersion())) {
log.debug("Detected a V3 to V4 update. Editing services.properties");
final Path servicesProps = conf.resolve("services.properties");
if (!Files.exists(servicesProps)) {
diff --git a/idp-installer/src/main/java/net/shibboleth/idp/installer/impl/CurrentInstallStateImpl.java b/idp-installer/src/main/java/net/shibboleth/idp/installer/impl/CurrentInstallStateImpl.java
index 355ac5a..963bcda 100644
--- a/idp-installer/src/main/java/net/shibboleth/idp/installer/impl/CurrentInstallStateImpl.java
+++ b/idp-installer/src/main/java/net/shibboleth/idp/installer/impl/CurrentInstallStateImpl.java
@@ -62,9 +62,6 @@ public final class CurrentInstallStateImpl extends AbstractInitializableComponen
/** Whether the LDAP properties file exists.*/
private boolean ldapPropertiesPresent;
- /** Whether the secrets properties file exists.*/
- private boolean secretsPropertiesPresent;
-
/** Old Version. */
private String oldVersion;
@@ -157,7 +154,6 @@ public final class CurrentInstallStateImpl extends AbstractInitializableComponen
super.doInitialize();
idpPropertiesPresent = Files.exists(targetDir.resolve("conf").resolve("idp.properties"));
ldapPropertiesPresent = Files.exists(targetDir.resolve("conf").resolve("ldap.properties"));
- secretsPropertiesPresent = Files.exists(targetDir.resolve("conf").resolve("secrets.properties"));
findPreviousVersion();
setupPreviousProps();
@@ -196,11 +192,6 @@ public final class CurrentInstallStateImpl extends AbstractInitializableComponen
}
/** {@inheritDoc} */
- public boolean isSecretsPropertiesPresent() {
- return secretsPropertiesPresent;
- }
-
- /** {@inheritDoc} */
@Nullable public Properties getCurrentlyInstalledProperties() {
return props;
}
diff --git a/idp-installer/src/main/wix/scripts/shib_write_configs.vbs b/idp-installer/src/main/wix/scripts/shib_write_configs.vbs
index e7884a0..57c517b 100644
--- a/idp-installer/src/main/wix/scripts/shib_write_configs.vbs
+++ b/idp-installer/src/main/wix/scripts/shib_write_configs.vbs
@@ -64,11 +64,11 @@ if (Err.Number = 0 ) then
AntFile.WriteLine "idp.sealer.password=" & SealerPassword
AntFile.WriteLine "idp.target.dir=" & InstallDirJava
AntFile.WriteLine "idp.merge.properties=idp.install.replace.properties"
- AntFile.WriteLine "secrets.merge.properties=secrets.replace.properties"
if (IdPScope <> "") then
AntFile.WriteLine "idp.scope=" & IdPScope
end if
if ConfigureAd = "true" then
+ AntFile.Writeline "idp.LDAP.credential=" & AdPass
AntFile.WriteLine "ldap.merge.properties=ldap.mergeProperties"
end if
AntFile.WriteLine "#"
@@ -96,21 +96,6 @@ else
LogFile.Writeline "PropsFile failed " & Err & " - " & PropsFile
end if
-set SecretsFile=FileSystemObj.OpenTextFile(InstallDir & "\secrets.replace.properties" , 2, True)
-if (Err.Number = 0 ) then
- SecretsFile.WriteLine "#"
- SecretsFile.WriteLine "# File to be merged into secrets.properties"
- SecretsFile.WriteLine "#"
- SecretsFile.WriteLine "idp.sealer.storePassword=" & SealerPassword
- SecretsFile.WriteLine "idp.sealer.keyPassword=" & SealerPassword
- if ConfigureAd = "true" then
- SecretsFile.Writeline "idp.authn.LDAP.bindDNCredential=" & AdPass
- end if
- SecretsFile.Close
-else
- LogFile.Writeline "SecretsFile failed " & Err & " - " & SecretsFile
-end if
-
if (InstallJetty <> "") then
set JettyAntFile=FileSystemObj.OpenTextFile(InstallDir & "\jetty.install.properties" , 2, True)
if (Err.Number = 0 ) then
diff --git a/idp-installer/src/test/java/net/shibboleth/idp/installer/Test.java b/idp-installer/src/test/java/net/shibboleth/idp/installer/Test.java
index 4643e6a..6a390fb 100644
--- a/idp-installer/src/test/java/net/shibboleth/idp/installer/Test.java
+++ b/idp-installer/src/test/java/net/shibboleth/idp/installer/Test.java
@@ -43,7 +43,7 @@ public class Test {
*/
public static void main(String[] args) throws IOException, ComponentInitializationException {
- System.setProperty(InstallerPropertiesImpl.TARGET_DIR,"H:\\Downloads\\v4test");
+ System.setProperty(InstallerPropertiesImpl.TARGET_DIR,"H:\\Downloads\\v4install");
System.setProperty(InstallerPropertiesImpl.SOURCE_DIR,
"h:\\Perforce\\Juno\\New\\java-identity-provider\\idp-distribution\\target\\shibboleth-identity-provider-4.0.0-SNAPSHOT");
System.setProperty(InstallerPropertiesImpl.ANT_BASE_DIR,
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list