[java-identity-provider] 06/06: IDP-1927 Make Jetty run under its own credentials for windows installs
Rod Widdowson
rdw at steadingsoftware.com
Fri Dec 9 14:51:40 UTC 2022
This is an automated email from the git hooks/post-receive script.
rdw pushed a commit to branch maint-4
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=66289423494a51cc6130a96b10290e6983a44d86
commit 66289423494a51cc6130a96b10290e6983a44d86
Author: Rod Widdowson <rdw at steadingsoftware.com>
AuthorDate: Fri Dec 9 14:39:40 2022 +0000
IDP-1927 Make Jetty run under its own credentials for windows installs
https://shibboleth.atlassian.net/browse/IDP-1927
Bug fixing for existing installs (where ther are artifacts in place
already)
1) Set the ACE everywhere that we specify a RegistryKey
2) Run cacls over the various parts of the directory tree to make
sure that the process has access to the existing configuration
---
idp-installer/src/main/wix/ShibbolethIdP-gui.wxs | 6 ++-
idp-installer/src/main/wix/ShibbolethIdP-main.wxs | 51 +++++++++++++++++++---
.../src/main/wix/ShibbolethIdP-registry.wxs | 21 +++++++--
idp-installer/src/main/wix/procrun.wxs | 22 ++++++++--
4 files changed, 87 insertions(+), 13 deletions(-)
diff --git a/idp-installer/src/main/wix/ShibbolethIdP-gui.wxs b/idp-installer/src/main/wix/ShibbolethIdP-gui.wxs
index aedce5153..f3db5f683 100644
--- a/idp-installer/src/main/wix/ShibbolethIdP-gui.wxs
+++ b/idp-installer/src/main/wix/ShibbolethIdP-gui.wxs
@@ -46,7 +46,7 @@ permissions and limitations under the License. -->
<DialogRef Id="LicenseAgreementDlg" />
<DialogRef Id="WelcomeDlg" />
- <!-- "In addition, WixUI_InstallDir includes the following common
+ <!-- "In addition, WixUI_InstallDir includes the following common
dialogs that appear in all WixUI dialog sets:" -->
<DialogRef Id="CancelDlg" />
<DialogRef Id="ErrorDlg" />
@@ -121,6 +121,10 @@ permissions and limitations under the License. -->
<ProgressText Action="QtIdpAnt">Performing IdP Installation tasks; this may take some time.</ProgressText>
<ProgressText Action="QtJettyAnt">Configuring Jetty</ProgressText>
+ <ProgressText Action="QtSetACEJettyLogs">Setting ACE onto the Jetty Logs</ProgressText>
+ <ProgressText Action="QtSetACEJettyTmp">Setting ACE onto the Jetty TMP dir</ProgressText>
+ <ProgressText Action="QtSetACEProcrunLog">Setting ACE onto the ProcRun Logs</ProgressText>
+
</UI>
</Fragment>
</Wix>
diff --git a/idp-installer/src/main/wix/ShibbolethIdP-main.wxs b/idp-installer/src/main/wix/ShibbolethIdP-main.wxs
index 3e20de362..6c47206cd 100644
--- a/idp-installer/src/main/wix/ShibbolethIdP-main.wxs
+++ b/idp-installer/src/main/wix/ShibbolethIdP-main.wxs
@@ -163,6 +163,27 @@
<CustomAction Id="SetJavaJvmMx" Property="JAVA_JVMMX" Value="#2048" />
+ <!-- Actions to add an appropriate ACE to existing file when we are running as a user -->
+ <CustomAction Id="SetACEUser" Property="ACE_USER" Value="[JETTYD_DOMAIN.684B3207_0D64_43E6_9E6A_3ACB8B7672D7]\[JETTYD_USER.684B3207_0D64_43E6_9E6A_3ACB8B7672D7]" />
+ <CustomAction Id="SetACEConf" Property="QtSetACEConf" Value=""c:\Windows\System32\cacls.exe" "[INSTALLDIR]\conf" /e /t /g [ACE_USER]:r" />
+ <CustomAction Id="SetACECreds" Property="QtSetACECreds" Value=""c:\Windows\System32\cacls.exe" "[INSTALLDIR]\credentials" /e /t /g [ACE_USER]:r" />
+ <CustomAction Id="SetACELogs" Property="QtSetACELogs" Value=""c:\Windows\System32\cacls.exe" "[INSTALLDIR]\logs" /e /t /g [ACE_USER]:f" />
+
+ <CustomAction Id="QtSetACEConf" BinaryKey="WixCA" DllEntry="CAQuietExec" Execute="deferred" Impersonate="no" />
+ <CustomAction Id="QtSetACECreds" BinaryKey="WixCA" DllEntry="CAQuietExec" Execute="deferred" Impersonate="no" />
+ <CustomAction Id="QtSetACELogs" BinaryKey="WixCA" DllEntry="CAQuietExec" Execute="deferred" Impersonate="no" />
+
+ <CustomAction Id="SetACEJettyStart" Property="QtSetACEJettyStart" Value=""c:\Windows\System32\cacls.exe" "[INSTALLDIR]\jetty-base\start.d" /e /t /g [ACE_USER]:r" />
+ <CustomAction Id="SetACEJettyLogs" Property="QtSetACEJettyLogs" Value=""c:\Windows\System32\cacls.exe" "[INSTALLDIR]\jetty-base\logs" /e /t /g [ACE_USER]:f" />
+ <CustomAction Id="SetACEJettyTmp" Property="QtSetACEJettyTmp" Value=""c:\Windows\System32\cacls.exe" "[INSTALLDIR]\jetty-base\tmp" /e /t /g [ACE_USER]:f" />
+
+ <CustomAction Id="QtSetACEJettyStart" BinaryKey="WixCA" DllEntry="CAQuietExec" Execute="deferred" Impersonate="no" />
+ <CustomAction Id="QtSetACEJettyLogs" BinaryKey="WixCA" DllEntry="CAQuietExec" Execute="deferred" Impersonate="no" />
+ <CustomAction Id="QtSetACEJettyTmp" BinaryKey="WixCA" DllEntry="CAQuietExec" Execute="deferred" Impersonate="no" />
+
+ <CustomAction Id="SetACEProcrunLog" Property="QtSetACEProcrunLog" Value=""c:\Windows\System32\cacls.exe" "[SHIBBOLETHDIR]ProcRun\log" /e /t /g [ACE_USER]:f" />
+ <CustomAction Id="QtSetACEProcrunLog" BinaryKey="WixCA" DllEntry="CAQuietExec" Execute="deferred" Impersonate="no" />
+
<InstallUISequence>
<!-- inherit installationDir if there is something to inherit (Conditions set in ShibolethIdP-registry) -->
@@ -174,13 +195,9 @@
<Custom Action="InheritInstallJetty" After="AppSearch">OLD_INSTALL_JETTY AND NOT INSTALL_JETTY</Custom>
<!-- Could we find JAVA.EXE ?-->
- <Custom Action="NoJavaBin" After="AppSearch">
- NOT JAVA_EXECUTABLE and NOT Installed
- </Custom>
+ <Custom Action="NoJavaBin" After="AppSearch">NOT JAVA_EXECUTABLE and NOT Installed</Custom>
- <Custom Action="SetDNSName" After="AppSearch">
- NOT DNSNAME
- </Custom>
+ <Custom Action="SetDNSName" After="AppSearch">NOT DNSNAME</Custom>
</InstallUISequence>
@@ -195,6 +212,28 @@
<Custom Action="PassdownNoFireWall" After="AppSearch">NO_FIREWALL_EXCEPTION</Custom>
<Custom Action="PassdownStartService" After="AppSearch"/>
+ <!-- Do the ACE setting just after the directories -->
+ <Custom Action="SetACEUser" After="CreateFolders">INSTALL_JETTYD_USER.684B3207_0D64_43E6_9E6A_3ACB8B7672D7</Custom>
+
+ <Custom Action="SetACEConf" After="SetACEUser">INSTALL_JETTYD_USER.684B3207_0D64_43E6_9E6A_3ACB8B7672D7</Custom>
+ <Custom Action="SetACECreds" After="SetACEUser">INSTALL_JETTYD_USER.684B3207_0D64_43E6_9E6A_3ACB8B7672D7</Custom>
+ <Custom Action="SetACELogs" After="SetACEUser">INSTALL_JETTYD_USER.684B3207_0D64_43E6_9E6A_3ACB8B7672D7</Custom>
+
+ <Custom Action="QtSetACEConf" After="SetACEConf">INSTALL_JETTYD_USER.684B3207_0D64_43E6_9E6A_3ACB8B7672D7</Custom>
+ <Custom Action="QtSetACECreds" After="SetACECreds">INSTALL_JETTYD_USER.684B3207_0D64_43E6_9E6A_3ACB8B7672D7</Custom>
+ <Custom Action="QtSetACELogs" After="SetACELogs">INSTALL_JETTYD_USER.684B3207_0D64_43E6_9E6A_3ACB8B7672D7</Custom>
+
+ <Custom Action="SetACEJettyStart" After="SetACEUser">INSTALL_JETTYD_USER.684B3207_0D64_43E6_9E6A_3ACB8B7672D7</Custom>
+ <Custom Action="SetACEJettyLogs" After="SetACEUser">INSTALL_JETTYD_USER.684B3207_0D64_43E6_9E6A_3ACB8B7672D7</Custom>
+ <Custom Action="SetACEJettyTmp" After="SetACEUser">INSTALL_JETTYD_USER.684B3207_0D64_43E6_9E6A_3ACB8B7672D7</Custom>
+
+ <Custom Action="QtSetACEJettyStart" After="SetACEJettyStart">INSTALL_JETTYD_USER.684B3207_0D64_43E6_9E6A_3ACB8B7672D7</Custom>
+ <Custom Action="QtSetACEJettyLogs" After="SetACEJettyLogs">INSTALL_JETTYD_USER.684B3207_0D64_43E6_9E6A_3ACB8B7672D7</Custom>
+ <Custom Action="QtSetACEJettyTmp" After="SetACEJettyTmp">INSTALL_JETTYD_USER.684B3207_0D64_43E6_9E6A_3ACB8B7672D7</Custom>
+
+ <Custom Action="SetACEProcrunLog" After="SetACEUser">INSTALL_JETTYD_USER.684B3207_0D64_43E6_9E6A_3ACB8B7672D7</Custom>
+ <Custom Action="QtSetACEProcrunLog" After="SetACEProcrunLog">INSTALL_JETTYD_USER.684B3207_0D64_43E6_9E6A_3ACB8B7672D7</Custom>
+
<!-- Setup JAVA_IDP_HOME before we use it -->
<Custom Action="SetJavaIdpHome" Before="SetIdpAnt1" />
diff --git a/idp-installer/src/main/wix/ShibbolethIdP-registry.wxs b/idp-installer/src/main/wix/ShibbolethIdP-registry.wxs
index 77175ab96..4767af0dc 100644
--- a/idp-installer/src/main/wix/ShibbolethIdP-registry.wxs
+++ b/idp-installer/src/main/wix/ShibbolethIdP-registry.wxs
@@ -34,7 +34,13 @@
</Component>
<!-- Jetty Configuration-->
<Component Id="JettyConfig" Directory="INSTALLDIR" Guid="{FE729EF2-8293-493A-80C9-69CF54DC4565}" KeyPath="yes" Win64="no">
- <RegistryKey Key="SOFTWARE\Apache Software Foundation\Procrun 2.0\$(var.ServiceName)\Parameters\Java" Root="HKLM" ForceCreateOnInstall="yes">
+ <RegistryKey ForceDeleteOnUninstall="yes" ForceCreateOnInstall="yes" Key="SOFTWARE\Apache Software Foundation\Procrun 2.0\$(var.ServiceName)\Parameters" Root="HKLM">
+ <Permission User="Administrators" GenericAll="yes" />
+ <Permission User="SYSTEM" GenericAll="yes" />
+ <Permission Domain="[JETTYD_DOMAIN.684B3207_0D64_43E6_9E6A_3ACB8B7672D7]" User="[PERMISSION_USER.684B3207_0D64_43E6_9E6A_3ACB8B7672D7]" GenericRead="yes" GenericExecute="yes" Read="yes" />
+ </RegistryKey>
+
+ <RegistryKey ForceDeleteOnUninstall="yes" ForceCreateOnInstall="yes" Key="SOFTWARE\Apache Software Foundation\Procrun 2.0\$(var.ServiceName)\Parameters\Java" Root="HKLM">
<RegistryValue Name="Options" Type="multiString">
<MultiStringValue>-Didp.home=[JAVA_IDP_HOME]</MultiStringValue>
<MultiStringValue>-Djdk.tls.ephemeralDHKeySize=2048</MultiStringValue>
@@ -45,20 +51,29 @@
<RegistryValue Name="JvmMx" Value="[JAVA_JVMMX]" Type="string">
<!-- Its an integer, but we added the # -->
</RegistryValue>
+ <Permission User="Administrators" GenericAll="yes" />
+ <Permission User="SYSTEM" GenericAll="yes" />
+ <Permission Domain="[JETTYD_DOMAIN.684B3207_0D64_43E6_9E6A_3ACB8B7672D7]" User="[PERMISSION_USER.684B3207_0D64_43E6_9E6A_3ACB8B7672D7]" GenericRead="yes" GenericExecute="yes" Read="yes" />
</RegistryKey>
- <RegistryKey Key="SOFTWARE\Apache Software Foundation\Procrun 2.0\$(var.ServiceName)\Parameters\Start" Root="HKLM" ForceCreateOnInstall="yes">
+ <RegistryKey ForceDeleteOnUninstall="yes" ForceCreateOnInstall="yes" Key="SOFTWARE\Apache Software Foundation\Procrun 2.0\$(var.ServiceName)\Parameters\Start" Root="HKLM" >
<RegistryValue Name="Params" Type="multiString" Action="append">
<MultiStringValue>jetty.http.compliance=RFC7230_NO_AMBIGUOUS_URIS</MultiStringValue>
<MultiStringValue>jetty.base=[INSTALLDIR]\jetty-base</MultiStringValue>
<MultiStringValue>jetty.logging.dir=[INSTALLDIR]\jetty-base\logs</MultiStringValue>
</RegistryValue>
<RegistryValue Name="WorkingPath" Type="string" Value="[INSTALLDIR]\jetty-base\"/>
+ <Permission User="Administrators" GenericAll="yes" />
+ <Permission User="SYSTEM" GenericAll="yes" />
+ <Permission Domain="[JETTYD_DOMAIN.684B3207_0D64_43E6_9E6A_3ACB8B7672D7]" User="[PERMISSION_USER.684B3207_0D64_43E6_9E6A_3ACB8B7672D7]" GenericRead="yes" GenericExecute="yes" Read="yes" />
</RegistryKey>
- <RegistryKey Key="SOFTWARE\Apache Software Foundation\Procrun 2.0\$(var.ServiceName)\Parameters\Stop" Root="HKLM" ForceCreateOnInstall="yes">
+ <RegistryKey ForceDeleteOnUninstall="yes" ForceCreateOnInstall="yes" Key="SOFTWARE\Apache Software Foundation\Procrun 2.0\$(var.ServiceName)\Parameters\Stop" Root="HKLM" >
<RegistryValue Name="Params" Type="multiString" Action="append">
<MultiStringValue>jetty.base=[INSTALLDIR]\jetty-base</MultiStringValue>
<MultiStringValue>jetty.logging.dir=[INSTALLDIR]\jetty-base\logs</MultiStringValue>
</RegistryValue>
+ <Permission User="Administrators" GenericAll="yes" />
+ <Permission User="SYSTEM" GenericAll="yes" />
+ <Permission Domain="[JETTYD_DOMAIN.684B3207_0D64_43E6_9E6A_3ACB8B7672D7]" User="[PERMISSION_USER.684B3207_0D64_43E6_9E6A_3ACB8B7672D7]" GenericRead="yes" GenericExecute="yes" Read="yes" />
</RegistryKey>
<Condition>INSTALL_JETTY</Condition>
</Component>
diff --git a/idp-installer/src/main/wix/procrun.wxs b/idp-installer/src/main/wix/procrun.wxs
index 9d070ce45..d93dd7896 100644
--- a/idp-installer/src/main/wix/procrun.wxs
+++ b/idp-installer/src/main/wix/procrun.wxs
@@ -87,7 +87,11 @@
<Component Id="ServiceParameters" Directory="PROCRUNROOT" Guid="{EC1EA760-0113-4CAD-9719-ADFF1885FC53}" KeyPath="yes">
<Condition>NOT Installed</Condition>
<!-- Start component here - that way if the start fails the user will be prompted and things will continue with the service declared. -->
- <RegistryKey ForceCreateOnInstall="yes" Key="SYSTEM\CurrentControlSet\services\$(var.ServiceName)\Parameters" Root="HKLM" />
+ <RegistryKey ForceDeleteOnUninstall="yes" ForceCreateOnInstall="yes" Key="SYSTEM\CurrentControlSet\services\$(var.ServiceName)\Parameters" Root="HKLM">
+ <Permission User="Administrators" GenericAll="yes" />
+ <Permission User="SYSTEM" GenericAll="yes" />
+ <Permission Domain="[JETTYD_DOMAIN]" User="[PERMISSION_USER]" GenericRead="yes" GenericExecute="yes" Read="yes" />
+ </RegistryKey>
<ServiceControl Id="controlService" Name="$(var.ServiceName)" Stop="install" Start="install" Wait="no" />
<ServiceControl Id="controlServiceUninstall" Name="$(var.ServiceName)" Stop="uninstall" Remove="uninstall" Wait="yes" />
</Component>
@@ -100,6 +104,9 @@
<MultiStringValue>STOP.PORT=8963</MultiStringValue>
<MultiStringValue>STOP.Key=[JETTY_PASS]</MultiStringValue>
</RegistryValue>
+ <Permission User="Administrators" GenericAll="yes" />
+ <Permission User="SYSTEM" GenericAll="yes" />
+ <Permission Domain="[JETTYD_DOMAIN]" User="[PERMISSION_USER]" GenericRead="yes" GenericExecute="yes" Read="yes" />
</RegistryKey>
</Component>
<Component Id="cmpF05C4062771C368BB8F3DD6673EECF15" Directory="PROCRUNROOT" Guid="{BB7062F1-573B-40BF-A761-21C31A897881}" KeyPath="yes">
@@ -111,21 +118,30 @@
<MultiStringValue>STOP.PORT=8963</MultiStringValue>
<MultiStringValue>STOP.Key=[JETTY_PASS]</MultiStringValue>
</RegistryValue>
+ <Permission User="Administrators" GenericAll="yes" />
+ <Permission User="SYSTEM" GenericAll="yes" />
+ <Permission Domain="[JETTYD_DOMAIN]" User="[PERMISSION_USER]" GenericRead="yes" GenericExecute="yes" Read="yes" />
</RegistryKey>
</Component>
<Component Id="cmpBE4E97DA105319AE7A75741FACA90364" Directory="PROCRUNROOT" Guid="{0FA07510-6387-4D0D-8984-86C17759B745}" KeyPath="yes">
- <RegistryKey Key="SOFTWARE\Apache Software Foundation\Procrun 2.0\$(var.ServiceName)\Parameters\Log" Root="HKLM">
+ <RegistryKey ForceDeleteOnUninstall="yes" ForceCreateOnInstall="yes" Key="SOFTWARE\Apache Software Foundation\Procrun 2.0\$(var.ServiceName)\Parameters\Log" Root="HKLM">
<RegistryValue Name="Path" Value="[PROCRUNROOT]\log" Type="string" />
<RegistryValue Name="StdError" Value="auto" Type="string" />
<RegistryValue Name="StdOutput" Value="auto" Type="string" />
+ <Permission User="Administrators" GenericAll="yes" />
+ <Permission User="SYSTEM" GenericAll="yes" />
+ <Permission Domain="[JETTYD_DOMAIN]" User="[PERMISSION_USER]" GenericRead="yes" GenericExecute="yes" Read="yes" />
</RegistryKey>
</Component>
<Component Id="cmpD450CE822D5D1E635C3D66423D0E27B8" Directory="PROCRUNROOT" Guid="{62BACF23-6B8B-43C6-9B37-3992D6B86E5C}" KeyPath="yes">
- <RegistryKey Key="SOFTWARE\Apache Software Foundation\Procrun 2.0\$(var.ServiceName)\Parameters\Java" Root="HKLM">
+ <RegistryKey ForceDeleteOnUninstall="yes" ForceCreateOnInstall="yes" Key="SOFTWARE\Apache Software Foundation\Procrun 2.0\$(var.ServiceName)\Parameters\Java" Root="HKLM">
<RegistryValue Name="JavaHome" Value="[%JAVA_HOME]" Type="string" />
<RegistryValue Name="Jvm" Value="auto" Type="string" />
<RegistryValue Name="Classpath" Value="[JETTYROOT]\start.jar" Type="string" />
<RegistryValue Name="JvmMs" Value="256" Type="integer" />
+ <Permission User="Administrators" GenericAll="yes" />
+ <Permission User="SYSTEM" GenericAll="yes" />
+ <Permission Domain="[JETTYD_DOMAIN]" User="[PERMISSION_USER]" GenericRead="yes" GenericExecute="yes" Read="yes" />
</RegistryKey>
</Component>
</ComponentGroup>
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list