[java-identity-provider] 06/06: IDP-1927 Make Jetty run under its own credentials for windows installs

Rod Widdowson rdw at steadingsoftware.com
Fri Dec 9 14:51:40 UTC 2022


This is an automated email from the git hooks/post-receive script.

rdw pushed a commit to branch maint-4
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=66289423494a51cc6130a96b10290e6983a44d86

commit 66289423494a51cc6130a96b10290e6983a44d86
Author: Rod Widdowson <rdw at steadingsoftware.com>
AuthorDate: Fri Dec 9 14:39:40 2022 +0000

    IDP-1927 Make Jetty run under its own credentials for windows installs
    
    https://shibboleth.atlassian.net/browse/IDP-1927
    
    Bug fixing for existing installs (where ther are artifacts in place
    already)
    
    1) Set the ACE everywhere that we specify a RegistryKey
    2) Run cacls over the various parts of the directory tree to make
    sure that the process has access to the existing configuration
---
 idp-installer/src/main/wix/ShibbolethIdP-gui.wxs   |  6 ++-
 idp-installer/src/main/wix/ShibbolethIdP-main.wxs  | 51 +++++++++++++++++++---
 .../src/main/wix/ShibbolethIdP-registry.wxs        | 21 +++++++--
 idp-installer/src/main/wix/procrun.wxs             | 22 ++++++++--
 4 files changed, 87 insertions(+), 13 deletions(-)

diff --git a/idp-installer/src/main/wix/ShibbolethIdP-gui.wxs b/idp-installer/src/main/wix/ShibbolethIdP-gui.wxs
index aedce5153..f3db5f683 100644
--- a/idp-installer/src/main/wix/ShibbolethIdP-gui.wxs
+++ b/idp-installer/src/main/wix/ShibbolethIdP-gui.wxs
@@ -46,7 +46,7 @@ permissions and limitations under the License.  -->
         <DialogRef Id="LicenseAgreementDlg" />
         <DialogRef Id="WelcomeDlg" />
 
-  	<!-- "In addition, WixUI_InstallDir includes the following common
+        <!-- "In addition, WixUI_InstallDir includes the following common
              dialogs that appear in all WixUI dialog sets:" -->
         <DialogRef Id="CancelDlg" />
         <DialogRef Id="ErrorDlg" />
@@ -121,6 +121,10 @@ permissions and limitations under the License.  -->
 
         <ProgressText Action="QtIdpAnt">Performing IdP Installation tasks; this may take some time.</ProgressText>
         <ProgressText Action="QtJettyAnt">Configuring Jetty</ProgressText>
+        <ProgressText Action="QtSetACEJettyLogs">Setting ACE onto the Jetty Logs</ProgressText>
+        <ProgressText Action="QtSetACEJettyTmp">Setting ACE onto the Jetty TMP dir</ProgressText>
+        <ProgressText Action="QtSetACEProcrunLog">Setting ACE onto the ProcRun Logs</ProgressText>
+
     </UI>
   </Fragment>
 </Wix>
diff --git a/idp-installer/src/main/wix/ShibbolethIdP-main.wxs b/idp-installer/src/main/wix/ShibbolethIdP-main.wxs
index 3e20de362..6c47206cd 100644
--- a/idp-installer/src/main/wix/ShibbolethIdP-main.wxs
+++ b/idp-installer/src/main/wix/ShibbolethIdP-main.wxs
@@ -163,6 +163,27 @@
 
         <CustomAction Id="SetJavaJvmMx" Property="JAVA_JVMMX" Value="#2048" />
 
+        <!-- Actions to add an appropriate ACE to existing file when we are running as a user -->
+        <CustomAction Id="SetACEUser" Property="ACE_USER" Value="[JETTYD_DOMAIN.684B3207_0D64_43E6_9E6A_3ACB8B7672D7]\[JETTYD_USER.684B3207_0D64_43E6_9E6A_3ACB8B7672D7]" />
+        <CustomAction Id="SetACEConf" Property="QtSetACEConf" Value=""c:\Windows\System32\cacls.exe" "[INSTALLDIR]\conf" /e /t /g [ACE_USER]:r" />
+        <CustomAction Id="SetACECreds" Property="QtSetACECreds" Value=""c:\Windows\System32\cacls.exe" "[INSTALLDIR]\credentials" /e /t /g [ACE_USER]:r" />
+        <CustomAction Id="SetACELogs" Property="QtSetACELogs" Value=""c:\Windows\System32\cacls.exe" "[INSTALLDIR]\logs" /e /t /g [ACE_USER]:f" />
+
+        <CustomAction Id="QtSetACEConf" BinaryKey="WixCA" DllEntry="CAQuietExec" Execute="deferred" Impersonate="no" />
+        <CustomAction Id="QtSetACECreds" BinaryKey="WixCA" DllEntry="CAQuietExec" Execute="deferred" Impersonate="no" />
+        <CustomAction Id="QtSetACELogs" BinaryKey="WixCA" DllEntry="CAQuietExec" Execute="deferred" Impersonate="no" />
+
+        <CustomAction Id="SetACEJettyStart" Property="QtSetACEJettyStart" Value=""c:\Windows\System32\cacls.exe" "[INSTALLDIR]\jetty-base\start.d" /e /t /g [ACE_USER]:r" />
+        <CustomAction Id="SetACEJettyLogs" Property="QtSetACEJettyLogs" Value=""c:\Windows\System32\cacls.exe" "[INSTALLDIR]\jetty-base\logs" /e /t /g [ACE_USER]:f" />
+        <CustomAction Id="SetACEJettyTmp" Property="QtSetACEJettyTmp" Value=""c:\Windows\System32\cacls.exe" "[INSTALLDIR]\jetty-base\tmp" /e /t /g [ACE_USER]:f" />
+
+        <CustomAction Id="QtSetACEJettyStart" BinaryKey="WixCA" DllEntry="CAQuietExec" Execute="deferred" Impersonate="no" />
+        <CustomAction Id="QtSetACEJettyLogs" BinaryKey="WixCA" DllEntry="CAQuietExec" Execute="deferred" Impersonate="no" />
+        <CustomAction Id="QtSetACEJettyTmp" BinaryKey="WixCA" DllEntry="CAQuietExec" Execute="deferred" Impersonate="no" />
+
+        <CustomAction Id="SetACEProcrunLog" Property="QtSetACEProcrunLog" Value=""c:\Windows\System32\cacls.exe" "[SHIBBOLETHDIR]ProcRun\log" /e /t /g [ACE_USER]:f" />
+        <CustomAction Id="QtSetACEProcrunLog" BinaryKey="WixCA" DllEntry="CAQuietExec" Execute="deferred" Impersonate="no" />
+
         <InstallUISequence>
 
             <!-- inherit installationDir if there is something to inherit (Conditions set in ShibolethIdP-registry) -->
@@ -174,13 +195,9 @@
             <Custom Action="InheritInstallJetty" After="AppSearch">OLD_INSTALL_JETTY AND NOT INSTALL_JETTY</Custom>
 
             <!-- Could we find JAVA.EXE ?-->
-            <Custom Action="NoJavaBin" After="AppSearch">
-        NOT JAVA_EXECUTABLE and NOT Installed
-      </Custom>
+            <Custom Action="NoJavaBin" After="AppSearch">NOT JAVA_EXECUTABLE and NOT Installed</Custom>
 
-            <Custom Action="SetDNSName" After="AppSearch">
-        NOT DNSNAME
-      </Custom>
+            <Custom Action="SetDNSName" After="AppSearch">NOT DNSNAME</Custom>
 
         </InstallUISequence>
 
@@ -195,6 +212,28 @@
             <Custom Action="PassdownNoFireWall" After="AppSearch">NO_FIREWALL_EXCEPTION</Custom>
             <Custom Action="PassdownStartService" After="AppSearch"/>
 
+            <!-- Do the ACE setting just after the directories -->
+            <Custom Action="SetACEUser" After="CreateFolders">INSTALL_JETTYD_USER.684B3207_0D64_43E6_9E6A_3ACB8B7672D7</Custom>
+
+            <Custom Action="SetACEConf"  After="SetACEUser">INSTALL_JETTYD_USER.684B3207_0D64_43E6_9E6A_3ACB8B7672D7</Custom>
+            <Custom Action="SetACECreds" After="SetACEUser">INSTALL_JETTYD_USER.684B3207_0D64_43E6_9E6A_3ACB8B7672D7</Custom>
+            <Custom Action="SetACELogs" After="SetACEUser">INSTALL_JETTYD_USER.684B3207_0D64_43E6_9E6A_3ACB8B7672D7</Custom>
+
+            <Custom Action="QtSetACEConf" After="SetACEConf">INSTALL_JETTYD_USER.684B3207_0D64_43E6_9E6A_3ACB8B7672D7</Custom>
+            <Custom Action="QtSetACECreds" After="SetACECreds">INSTALL_JETTYD_USER.684B3207_0D64_43E6_9E6A_3ACB8B7672D7</Custom>
+            <Custom Action="QtSetACELogs" After="SetACELogs">INSTALL_JETTYD_USER.684B3207_0D64_43E6_9E6A_3ACB8B7672D7</Custom>
+
+            <Custom Action="SetACEJettyStart" After="SetACEUser">INSTALL_JETTYD_USER.684B3207_0D64_43E6_9E6A_3ACB8B7672D7</Custom>
+            <Custom Action="SetACEJettyLogs" After="SetACEUser">INSTALL_JETTYD_USER.684B3207_0D64_43E6_9E6A_3ACB8B7672D7</Custom>
+            <Custom Action="SetACEJettyTmp" After="SetACEUser">INSTALL_JETTYD_USER.684B3207_0D64_43E6_9E6A_3ACB8B7672D7</Custom>
+
+            <Custom Action="QtSetACEJettyStart"  After="SetACEJettyStart">INSTALL_JETTYD_USER.684B3207_0D64_43E6_9E6A_3ACB8B7672D7</Custom>
+            <Custom Action="QtSetACEJettyLogs"  After="SetACEJettyLogs">INSTALL_JETTYD_USER.684B3207_0D64_43E6_9E6A_3ACB8B7672D7</Custom>
+            <Custom Action="QtSetACEJettyTmp"  After="SetACEJettyTmp">INSTALL_JETTYD_USER.684B3207_0D64_43E6_9E6A_3ACB8B7672D7</Custom>
+
+            <Custom Action="SetACEProcrunLog" After="SetACEUser">INSTALL_JETTYD_USER.684B3207_0D64_43E6_9E6A_3ACB8B7672D7</Custom>
+            <Custom Action="QtSetACEProcrunLog"  After="SetACEProcrunLog">INSTALL_JETTYD_USER.684B3207_0D64_43E6_9E6A_3ACB8B7672D7</Custom>
+
             <!-- Setup JAVA_IDP_HOME before we use it -->
 
             <Custom Action="SetJavaIdpHome" Before="SetIdpAnt1" />
diff --git a/idp-installer/src/main/wix/ShibbolethIdP-registry.wxs b/idp-installer/src/main/wix/ShibbolethIdP-registry.wxs
index 77175ab96..4767af0dc 100644
--- a/idp-installer/src/main/wix/ShibbolethIdP-registry.wxs
+++ b/idp-installer/src/main/wix/ShibbolethIdP-registry.wxs
@@ -34,7 +34,13 @@
             </Component>
             <!-- Jetty Configuration-->
             <Component Id="JettyConfig" Directory="INSTALLDIR" Guid="{FE729EF2-8293-493A-80C9-69CF54DC4565}" KeyPath="yes" Win64="no">
-                <RegistryKey Key="SOFTWARE\Apache Software Foundation\Procrun 2.0\$(var.ServiceName)\Parameters\Java" Root="HKLM" ForceCreateOnInstall="yes">
+                <RegistryKey ForceDeleteOnUninstall="yes" ForceCreateOnInstall="yes" Key="SOFTWARE\Apache Software Foundation\Procrun 2.0\$(var.ServiceName)\Parameters" Root="HKLM">
+                    <Permission User="Administrators" GenericAll="yes" />
+                    <Permission User="SYSTEM" GenericAll="yes" />
+                    <Permission Domain="[JETTYD_DOMAIN.684B3207_0D64_43E6_9E6A_3ACB8B7672D7]" User="[PERMISSION_USER.684B3207_0D64_43E6_9E6A_3ACB8B7672D7]" GenericRead="yes" GenericExecute="yes" Read="yes" />
+                </RegistryKey>
+
+                <RegistryKey ForceDeleteOnUninstall="yes" ForceCreateOnInstall="yes" Key="SOFTWARE\Apache Software Foundation\Procrun 2.0\$(var.ServiceName)\Parameters\Java" Root="HKLM">
                     <RegistryValue Name="Options" Type="multiString">
                         <MultiStringValue>-Didp.home=[JAVA_IDP_HOME]</MultiStringValue>
                         <MultiStringValue>-Djdk.tls.ephemeralDHKeySize=2048</MultiStringValue>
@@ -45,20 +51,29 @@
                     <RegistryValue Name="JvmMx" Value="[JAVA_JVMMX]" Type="string">
                         <!-- Its an integer, but we added the # -->
                     </RegistryValue>
+                    <Permission User="Administrators" GenericAll="yes" />
+                    <Permission User="SYSTEM" GenericAll="yes" />
+                    <Permission Domain="[JETTYD_DOMAIN.684B3207_0D64_43E6_9E6A_3ACB8B7672D7]" User="[PERMISSION_USER.684B3207_0D64_43E6_9E6A_3ACB8B7672D7]" GenericRead="yes" GenericExecute="yes" Read="yes" />
                 </RegistryKey>
-                <RegistryKey Key="SOFTWARE\Apache Software Foundation\Procrun 2.0\$(var.ServiceName)\Parameters\Start" Root="HKLM" ForceCreateOnInstall="yes">
+                <RegistryKey ForceDeleteOnUninstall="yes" ForceCreateOnInstall="yes" Key="SOFTWARE\Apache Software Foundation\Procrun 2.0\$(var.ServiceName)\Parameters\Start" Root="HKLM" >
                     <RegistryValue Name="Params" Type="multiString" Action="append">
                         <MultiStringValue>jetty.http.compliance=RFC7230_NO_AMBIGUOUS_URIS</MultiStringValue>
                         <MultiStringValue>jetty.base=[INSTALLDIR]\jetty-base</MultiStringValue>
                         <MultiStringValue>jetty.logging.dir=[INSTALLDIR]\jetty-base\logs</MultiStringValue>
                     </RegistryValue>
                     <RegistryValue Name="WorkingPath" Type="string" Value="[INSTALLDIR]\jetty-base\"/>
+                    <Permission User="Administrators" GenericAll="yes" />
+                    <Permission User="SYSTEM" GenericAll="yes" />
+                    <Permission Domain="[JETTYD_DOMAIN.684B3207_0D64_43E6_9E6A_3ACB8B7672D7]" User="[PERMISSION_USER.684B3207_0D64_43E6_9E6A_3ACB8B7672D7]" GenericRead="yes" GenericExecute="yes" Read="yes" />
                 </RegistryKey>
-                <RegistryKey Key="SOFTWARE\Apache Software Foundation\Procrun 2.0\$(var.ServiceName)\Parameters\Stop" Root="HKLM" ForceCreateOnInstall="yes">
+                <RegistryKey ForceDeleteOnUninstall="yes" ForceCreateOnInstall="yes" Key="SOFTWARE\Apache Software Foundation\Procrun 2.0\$(var.ServiceName)\Parameters\Stop" Root="HKLM" >
                     <RegistryValue Name="Params" Type="multiString" Action="append">
                         <MultiStringValue>jetty.base=[INSTALLDIR]\jetty-base</MultiStringValue>
                         <MultiStringValue>jetty.logging.dir=[INSTALLDIR]\jetty-base\logs</MultiStringValue>
                     </RegistryValue>
+                    <Permission User="Administrators" GenericAll="yes" />
+                    <Permission User="SYSTEM" GenericAll="yes" />
+                    <Permission Domain="[JETTYD_DOMAIN.684B3207_0D64_43E6_9E6A_3ACB8B7672D7]" User="[PERMISSION_USER.684B3207_0D64_43E6_9E6A_3ACB8B7672D7]" GenericRead="yes" GenericExecute="yes" Read="yes" />
                 </RegistryKey>
                 <Condition>INSTALL_JETTY</Condition>
             </Component>
diff --git a/idp-installer/src/main/wix/procrun.wxs b/idp-installer/src/main/wix/procrun.wxs
index 9d070ce45..d93dd7896 100644
--- a/idp-installer/src/main/wix/procrun.wxs
+++ b/idp-installer/src/main/wix/procrun.wxs
@@ -87,7 +87,11 @@
             <Component Id="ServiceParameters" Directory="PROCRUNROOT" Guid="{EC1EA760-0113-4CAD-9719-ADFF1885FC53}" KeyPath="yes">
                 <Condition>NOT Installed</Condition>
                 <!-- Start component here - that way if the start fails the user will be prompted and things will continue with the service declared. -->
-                <RegistryKey ForceCreateOnInstall="yes" Key="SYSTEM\CurrentControlSet\services\$(var.ServiceName)\Parameters" Root="HKLM" />
+                <RegistryKey ForceDeleteOnUninstall="yes" ForceCreateOnInstall="yes" Key="SYSTEM\CurrentControlSet\services\$(var.ServiceName)\Parameters" Root="HKLM">
+                    <Permission User="Administrators" GenericAll="yes" />
+                    <Permission User="SYSTEM" GenericAll="yes" />
+                    <Permission Domain="[JETTYD_DOMAIN]" User="[PERMISSION_USER]" GenericRead="yes" GenericExecute="yes" Read="yes" />
+                </RegistryKey>
                 <ServiceControl Id="controlService" Name="$(var.ServiceName)" Stop="install" Start="install" Wait="no" />
                 <ServiceControl Id="controlServiceUninstall" Name="$(var.ServiceName)" Stop="uninstall" Remove="uninstall" Wait="yes" />
             </Component>
@@ -100,6 +104,9 @@
                         <MultiStringValue>STOP.PORT=8963</MultiStringValue>
                         <MultiStringValue>STOP.Key=[JETTY_PASS]</MultiStringValue>
                     </RegistryValue>
+                    <Permission User="Administrators" GenericAll="yes" />
+                    <Permission User="SYSTEM" GenericAll="yes" />
+                    <Permission Domain="[JETTYD_DOMAIN]" User="[PERMISSION_USER]" GenericRead="yes" GenericExecute="yes" Read="yes" />
                 </RegistryKey>
             </Component>
             <Component Id="cmpF05C4062771C368BB8F3DD6673EECF15" Directory="PROCRUNROOT" Guid="{BB7062F1-573B-40BF-A761-21C31A897881}" KeyPath="yes">
@@ -111,21 +118,30 @@
                         <MultiStringValue>STOP.PORT=8963</MultiStringValue>
                         <MultiStringValue>STOP.Key=[JETTY_PASS]</MultiStringValue>
                     </RegistryValue>
+                    <Permission User="Administrators" GenericAll="yes" />
+                    <Permission User="SYSTEM" GenericAll="yes" />
+                    <Permission Domain="[JETTYD_DOMAIN]" User="[PERMISSION_USER]" GenericRead="yes" GenericExecute="yes" Read="yes" />
                 </RegistryKey>
             </Component>
             <Component Id="cmpBE4E97DA105319AE7A75741FACA90364" Directory="PROCRUNROOT" Guid="{0FA07510-6387-4D0D-8984-86C17759B745}" KeyPath="yes">
-                <RegistryKey Key="SOFTWARE\Apache Software Foundation\Procrun 2.0\$(var.ServiceName)\Parameters\Log" Root="HKLM">
+                <RegistryKey ForceDeleteOnUninstall="yes" ForceCreateOnInstall="yes" Key="SOFTWARE\Apache Software Foundation\Procrun 2.0\$(var.ServiceName)\Parameters\Log" Root="HKLM">
                     <RegistryValue Name="Path" Value="[PROCRUNROOT]\log" Type="string" />
                     <RegistryValue Name="StdError" Value="auto" Type="string" />
                     <RegistryValue Name="StdOutput" Value="auto" Type="string" />
+                    <Permission User="Administrators" GenericAll="yes" />
+                    <Permission User="SYSTEM" GenericAll="yes" />
+                    <Permission Domain="[JETTYD_DOMAIN]" User="[PERMISSION_USER]" GenericRead="yes" GenericExecute="yes" Read="yes" />
                 </RegistryKey>
             </Component>
             <Component Id="cmpD450CE822D5D1E635C3D66423D0E27B8" Directory="PROCRUNROOT" Guid="{62BACF23-6B8B-43C6-9B37-3992D6B86E5C}" KeyPath="yes">
-                <RegistryKey Key="SOFTWARE\Apache Software Foundation\Procrun 2.0\$(var.ServiceName)\Parameters\Java" Root="HKLM">
+                <RegistryKey ForceDeleteOnUninstall="yes" ForceCreateOnInstall="yes" Key="SOFTWARE\Apache Software Foundation\Procrun 2.0\$(var.ServiceName)\Parameters\Java" Root="HKLM">
                     <RegistryValue Name="JavaHome" Value="[%JAVA_HOME]" Type="string" />
                     <RegistryValue Name="Jvm" Value="auto" Type="string" />
                     <RegistryValue Name="Classpath" Value="[JETTYROOT]\start.jar" Type="string" />
                     <RegistryValue Name="JvmMs" Value="256" Type="integer" />
+                    <Permission User="Administrators" GenericAll="yes" />
+                    <Permission User="SYSTEM" GenericAll="yes" />
+                    <Permission Domain="[JETTYD_DOMAIN]" User="[PERMISSION_USER]" GenericRead="yes" GenericExecute="yes" Read="yes" />
                 </RegistryKey>
             </Component>
         </ComponentGroup>

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.


More information about the commits mailing list