[java-identity-provider] 01/03: IDP-1927 Make Jetty run under its own credentials for windows installs
Rod Widdowson
rdw at steadingsoftware.com
Tue Nov 1 10:16:10 UTC 2022
This is an automated email from the git hooks/post-receive script.
rdw pushed a commit to branch dev/IDP-1927
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=7c7c8fedf504a8c4ea42670cf54a9fc8e593ee19
commit 7c7c8fedf504a8c4ea42670cf54a9fc8e593ee19
Author: Rod Widdowson <rdw at steadingsoftware.com>
AuthorDate: Thu Oct 13 15:37:15 2022 +0100
IDP-1927 Make Jetty run under its own credentials for windows installs
https://shibboleth.atlassian.net/browse/IDP-1927
Initial attempt at the mechanics of adding the ACLS to the objects and the service
---
idp-installer/src/main/wix/Jetty.bat | 4 +-
idp-installer/src/main/wix/ShibbolethIdP-main.wxs | 22 +++++++-
.../src/main/wix/ShibbolethIdP-registry.wxs | 16 +-----
idp-installer/src/main/wix/procrun.wxs | 59 ++++++++++------------
4 files changed, 50 insertions(+), 51 deletions(-)
diff --git a/idp-installer/src/main/wix/Jetty.bat b/idp-installer/src/main/wix/Jetty.bat
index db81b13d0..d498b4471 100644
--- a/idp-installer/src/main/wix/Jetty.bat
+++ b/idp-installer/src/main/wix/Jetty.bat
@@ -134,12 +134,12 @@ del *.wixobj *.wixpdb
REM compile Jetty and procrun contents as well as the merge module for x64
-"%WIX%/BIN/CANDLE" -nologo -dJettySrc=jetty-extract\%Jex% -dJettyClass=%JETTY_CLASS% -dProcrunSrc=procrun-extract -dPlatform=x86 -arch x86 jetty_contents.wxs MergeModule.wxs procrun.wxs -ext WixFirewallExtension
+"%WIX%/BIN/CANDLE" -nologo -dJettySrc=jetty-extract\%Jex% -dJettyClass=%JETTY_CLASS% -dProcrunSrc=procrun-extract -dPlatform=x86 -arch x86 jetty_contents.wxs MergeModule.wxs procrun.wxs -ext WixFirewallExtension -ext WixUtilExtension
if ERRORLEVEL 1 goto done
REM link for x64
-"%WIX%/BIN/LIGHT" -nologo -out Jetty-x64.msm jetty_contents.wixobj procrun.wixobj mergemodule.wixobj -ext WixFirewallExtension -sw1072
+"%WIX%/BIN/LIGHT" -nologo -out Jetty-x64.msm jetty_contents.wixobj procrun.wixobj mergemodule.wixobj -ext WixFirewallExtension -sw1072 -ext WixUtilExtension
if ERRORLEVEL 1 goto done
dir Jetty-*.msm
diff --git a/idp-installer/src/main/wix/ShibbolethIdP-main.wxs b/idp-installer/src/main/wix/ShibbolethIdP-main.wxs
index 691579138..f935478e5 100644
--- a/idp-installer/src/main/wix/ShibbolethIdP-main.wxs
+++ b/idp-installer/src/main/wix/ShibbolethIdP-main.wxs
@@ -56,6 +56,8 @@
<Directory Id="ConfFolder" Name="conf" />
<Directory Id="JettyBaseFolder" Name="jetty-base">
<Directory Id="StartDotD" Name="start.d" />
+ <Directory Id="JettyLogs" Name="logs" />
+ <Directory Id="JettyTmp" Name="tmp" />
</Directory>
<Directory Id="BinFolder" Name="bin">
<Component Id="Shibd_idpw" Guid="{30E1130E-BEBF-4167-83A0-BBDE083968C4}" Win64="no">
@@ -67,17 +69,33 @@
<RegistryValue Id="SetPermissions" Root="HKLM" Key="SOFTWARE\Shibboleth\IdP" Name="SetPermissions" Value="TRUE" Type="string" KeyPath="yes" />
<CreateFolder Directory="CredsFolder">
<Permission User="Administrators" GenericAll="yes" />
+ <Permission User="SYSTEM" GenericAll="yes" />
+ <Permission User="SHIBD_USER" ReadPermission="yes" GenericRead="yes" GenericExecute="yes" Read="yes" />
</CreateFolder>
<CreateFolder Directory="ConfFolder">
<Permission User="Administrators" GenericAll="yes" />
+ <Permission User="SYSTEM" GenericAll="yes" />
+ <Permission User="SHIBD_USER" ReadPermission="yes" Read="yes" GenericRead="yes" GenericExecute="yes" />
</CreateFolder>
</Component>
<Component Id="JettyPermissions" Guid="{900980C5-CF3D-4816-9922-6142C12F6D13}" Win64="no">
<RegistryValue Id="SetPermissionsJetty" Root="HKLM" Key="SOFTWARE\Shibboleth\IdP" Name="SetPermissionsJetty" Value="TRUE" Type="string" KeyPath="yes" />
<CreateFolder Directory="StartDotD">
<Permission User="Administrators" GenericAll="yes" />
+ <Permission User="SYSTEM" GenericAll="yes" />
+ <Permission User="SHIBD_USER" ReadPermission="yes" GenericRead="yes" Read="yes" GenericExecute="yes" />
</CreateFolder>
- </Component>
+ <CreateFolder Directory="JettyLogs">
+ <Permission User="Administrators" GenericAll="yes" />
+ <Permission User="SYSTEM" GenericAll="yes" />
+ <Permission User="SHIBD_USER" GenericAll="yes"/>
+ </CreateFolder>
+ <CreateFolder Directory="JettyTmp">
+ <Permission User="Administrators" GenericAll="yes" />
+ <Permission User="SYSTEM" GenericAll="yes" />
+ <Permission User="SHIBD_USER" GenericAll="yes"/>
+ </CreateFolder>
+ </Component>
</Directory>
</Directory>
</Directory>
@@ -89,7 +107,7 @@
</DirectorySearch>
</Property>
- <Property Id="UCRTBASE_DLL" Secure="yes">
+ <Property Id="UCRTBASE_DLL" Secure="yes">
<DirectorySearch Id="UcrtBaseSearch" Depth="0" Path="[System64Folder]">
<FileSearch Id="UcrtnSearch" Name="ucrtbase.dll" />
</DirectorySearch>
diff --git a/idp-installer/src/main/wix/ShibbolethIdP-registry.wxs b/idp-installer/src/main/wix/ShibbolethIdP-registry.wxs
index fb4627de2..c570e32e4 100644
--- a/idp-installer/src/main/wix/ShibbolethIdP-registry.wxs
+++ b/idp-installer/src/main/wix/ShibbolethIdP-registry.wxs
@@ -35,11 +35,7 @@
<!-- Jetty Configuration-->
<Component Id="JettyConfig" Directory="INSTALLDIR" Guid="{FE729EF2-8293-493A-80C9-69CF54DC4565}" KeyPath="yes" Win64="no">
<RegistryKey Key="SOFTWARE\Apache Software Foundation\Procrun 2.0\$(var.ServiceName)\Parameters\Java" Root="HKLM" ForceCreateOnInstall="yes">
- <Permission User="Administrators" GenericAll="yes" />
- <Permission User="SYSTEM" GenericAll="yes" />
<RegistryValue Name="Options" Type="multiString">
- <Permission User="Administrators" GenericAll="yes" />
- <Permission User="SYSTEM" GenericAll="yes" />
<MultiStringValue>-Didp.home=[JAVA_IDP_HOME]</MultiStringValue>
<MultiStringValue>-Djdk.tls.ephemeralDHKeySize=2048</MultiStringValue>
<MultiStringValue>-Dorg.eclipse.jetty.util.log.class=org.eclipse.jetty.util.log.Slf4jLog</MultiStringValue>
@@ -48,28 +44,18 @@
</RegistryValue>
<RegistryValue Name="JvmMx" Value="[JAVA_JVMMX]" Type="string">
<!-- Its an integer, but we added the # -->
- <Permission User="Administrators" GenericAll="yes" />
- <Permission User="SYSTEM" GenericAll="yes" />
</RegistryValue>
</RegistryKey>
<RegistryKey Key="SOFTWARE\Apache Software Foundation\Procrun 2.0\$(var.ServiceName)\Parameters\Start" Root="HKLM" ForceCreateOnInstall="yes">
- <Permission User="Administrators" GenericAll="yes" />
- <Permission User="SYSTEM" GenericAll="yes" />
<RegistryValue Name="Params" Type="multiString" Action="append">
- <Permission User="Administrators" GenericAll="yes" />
- <Permission User="SYSTEM" GenericAll="yes" />
- <MultiStringValue>jetty.http.compliance=RFC7230_NO_AMBIGUOUS_URIS</MultiStringValue>
+ <MultiStringValue>jetty.http.compliance=RFC7230_NO_AMBIGUOUS_URIS</MultiStringValue>
<MultiStringValue>jetty.base=[INSTALLDIR]\jetty-base</MultiStringValue>
<MultiStringValue>jetty.logging.dir=[INSTALLDIR]\jetty-base\logs</MultiStringValue>
</RegistryValue>
<RegistryValue Name="WorkingPath" Type="string" Value="[INSTALLDIR]\jetty-base\"/>
</RegistryKey>
<RegistryKey Key="SOFTWARE\Apache Software Foundation\Procrun 2.0\$(var.ServiceName)\Parameters\Stop" Root="HKLM" ForceCreateOnInstall="yes">
- <Permission User="Administrators" GenericAll="yes" />
- <Permission User="SYSTEM" GenericAll="yes" />
<RegistryValue Name="Params" Type="multiString" Action="append">
- <Permission User="Administrators" GenericAll="yes" />
- <Permission User="SYSTEM" GenericAll="yes" />
<MultiStringValue>jetty.base=[INSTALLDIR]\jetty-base</MultiStringValue>
<MultiStringValue>jetty.logging.dir=[INSTALLDIR]\jetty-base\logs</MultiStringValue>
</RegistryValue>
diff --git a/idp-installer/src/main/wix/procrun.wxs b/idp-installer/src/main/wix/procrun.wxs
index 3d7a13779..4e42fef92 100644
--- a/idp-installer/src/main/wix/procrun.wxs
+++ b/idp-installer/src/main/wix/procrun.wxs
@@ -14,12 +14,14 @@
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
implied. See the License for the specific language governing
permissions and limitations under the License. -->
-<Wix xmlns="http://schemas.microsoft.com/wix/2006/wi" xmlns:fw="http://schemas.microsoft.com/wix/FirewallExtension">
+<Wix xmlns="http://schemas.microsoft.com/wix/2006/wi" xmlns:fw="http://schemas.microsoft.com/wix/FirewallExtension"
+ xmlns:util="http://schemas.microsoft.com/wix/UtilExtension">
<?define ServiceStart="auto"?>
<?define ServiceName="shibd_idp"?>
<Fragment>
<DirectoryRef Id="PROCRUNROOT">
<Directory Id="dir64" Name="amd64" />
+ <Directory Id="procrunLogFolder" Name="log" />
</DirectoryRef>
<Binary Id="DoRandomSrc" SourceFile="scripts\shib_random.vbs" />
<CustomAction Id="MakeRandom" BinaryKey="DoRandomSrc" VBScriptCall="" Execute="immediate" />
@@ -41,12 +43,21 @@
<Component Id="procrun_relnotes" Directory="PROCRUNROOT" Guid="{F0B94ECE-2029-43E6-B9AE-11A6C782D7D5}">
<File Id="procrun_relnotes" KeyPath="yes" Source="$(var.ProcrunSrc)\RELEASE-NOTES.txt" />
</Component>
- <!-- Install the service. The X64 case is cumbersome since in that case we want to install both the 32 and 64 bit exe
-
- Any 64 bit architecture - do not install the 32 bit service, otherwise do
- X64 install the 32 bit file and the x64 service
-
- -->
+ <Component Id="procrun_permissions" Directory="PROCRUNROOT" Guid="{C6B2ABD3-68BD-459F-BE86-2CA0DB52A638}" KeyPath="yes">
+ <RegistryKey ForceCreateOnInstall="yes" Key="SOFTWARE\Apache Software Foundation\Procrun 2.0\$(var.ServiceName)" Root="HKLM">
+ <Permission User="Administrators" GenericAll="yes" />
+ <Permission User="SYSTEM" GenericAll="yes" />
+ <Permission User="SHIBD_USER" GenericRead="yes" GenericExecute="yes" Read="yes" />
+ </RegistryKey>
+ <CreateFolder Directory="procrunLogFolder">
+ <Permission User="Administrators" GenericAll="yes" />
+ <Permission User="SYSTEM" GenericAll="yes" />
+ <Permission User="SHIBD_USER" GenericAll="yes" />
+ </CreateFolder>
+ </Component>
+
+ <!-- Install the service. -->
+
<Component Id="procrun_32_service" Directory="PROCRUNROOT" Guid="{544A5D33-CF99-4384-A74D-79FB29DE904D}">
<File Id="file_procrun_32_service" KeyPath="yes" Source="$(var.ProcrunSrc)\prunsrv.exe" Name="$(var.ServiceName).exe" />
</Component>
@@ -58,7 +69,11 @@
<Component Id="procrun_AMD64_service" Directory="dir64" Guid="{2673BCBE-3659-4AC6-B39C-DF1EEDF72C0E}">
<Condition>VersionNT64 And Not Intel64</Condition>
<File Id="file_procrun_AMD64_service" KeyPath="yes" Source="$(var.ProcrunSrc)\amd64\prunsrv.exe" Name="$(var.ServiceName).exe" />
- <ServiceInstall Id="ServiceX64" Name="$(var.ServiceName)" DisplayName="Shibboleth IdP Daemon" Description="Runs the Jetty Container" Arguments="service $(var.ServiceName)" Type="ownProcess" Start="$(var.ServiceStart)" ErrorControl="ignore" />
+ <ServiceInstall Id="ServiceX64" Name="$(var.ServiceName)" DisplayName="Shibboleth IdP Daemon" Description="Runs the Jetty Container"
+ Arguments="service $(var.ServiceName)" Type="ownProcess" Start="$(var.ServiceStart)" ErrorControl="ignore"
+ Account=".\SHIBD_USER" Password="********">
+ <util:ServiceConfig FirstFailureActionType="none" SecondFailureActionType="none" ThirdFailureActionType="none"/>
+ </ServiceInstall>
</Component>
<Component Id="procrun_AMD64_Firewall" Directory="dir64" Guid="{BC605FF4-0233-4332-BC90-0C2E5FEC37D2}" KeyPath="yes">
<Condition>NOT NO_FIREWALL And VersionNT64 And Not Intel64</Condition>
@@ -77,19 +92,9 @@
<Component Id="cmp92C942ECAFC0924D02B9B447DB497D3A" Directory="PROCRUNROOT" Guid="{F4D1B5FA-F7CC-4693-9123-84B960DB98B0}" KeyPath="yes">
<!-- ForceDeleteOnUninstall stops us accumulating Stop keys -->
<RegistryKey ForceDeleteOnUninstall="yes" ForceCreateOnInstall="yes" Key="SOFTWARE\Apache Software Foundation\Procrun 2.0\$(var.ServiceName)\Parameters\Start" Root="HKLM">
- <Permission User="Administrators" GenericAll="yes" />
- <Permission User="SYSTEM" GenericAll="yes" />
- <RegistryValue Name="Class" Value="$(var.JettyClass)" Type="string">
- <Permission User="Administrators" GenericAll="yes" />
- <Permission User="SYSTEM" GenericAll="yes" />
- </RegistryValue>
- <RegistryValue Name="Mode" Value="jvm" Type="string">
- <Permission User="Administrators" GenericAll="yes" />
- <Permission User="SYSTEM" GenericAll="yes" />
- </RegistryValue>
+ <RegistryValue Name="Class" Value="$(var.JettyClass)" Type="string"/>
+ <RegistryValue Name="Mode" Value="jvm" Type="string"/>
<RegistryValue Name="Params" Type="multiString" Action="append">
- <Permission User="Administrators" GenericAll="yes" />
- <Permission User="SYSTEM" GenericAll="yes" />
<MultiStringValue>STOP.PORT=8963</MultiStringValue>
<MultiStringValue>STOP.Key=[JETTY_PASS]</MultiStringValue>
</RegistryValue>
@@ -97,19 +102,9 @@
</Component>
<Component Id="cmpF05C4062771C368BB8F3DD6673EECF15" Directory="PROCRUNROOT" Guid="{BB7062F1-573B-40BF-A761-21C31A897881}" KeyPath="yes">
<RegistryKey ForceDeleteOnUninstall="yes" ForceCreateOnInstall="yes" Key="SOFTWARE\Apache Software Foundation\Procrun 2.0\$(var.ServiceName)\Parameters\Stop" Root="HKLM">
- <Permission User="Administrators" GenericAll="yes" />
- <Permission User="SYSTEM" GenericAll="yes" />
- <RegistryValue Name="Class" Value="$(var.JettyClass)" Type="string">
- <Permission User="Administrators" GenericAll="yes" />
- <Permission User="SYSTEM" GenericAll="yes" />
- </RegistryValue>
- <RegistryValue Name="Mode" Value="jvm" Type="string">
- <Permission User="Administrators" GenericAll="yes" />
- <Permission User="SYSTEM" GenericAll="yes" />
- </RegistryValue>
+ <RegistryValue Name="Class" Value="$(var.JettyClass)" Type="string"/>
+ <RegistryValue Name="Mode" Value="jvm" Type="string"/>
<RegistryValue Name="Params" Type="multiString" Action="append">
- <Permission User="Administrators" GenericAll="yes" />
- <Permission User="SYSTEM" GenericAll="yes" />
<MultiStringValue>--stop</MultiStringValue>
<MultiStringValue>STOP.PORT=8963</MultiStringValue>
<MultiStringValue>STOP.Key=[JETTY_PASS]</MultiStringValue>
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list