[java-identity-provider] 02/03: IDP-1927 Make Jetty run under its own credentials for windows installs
Rod Widdowson
rdw at steadingsoftware.com
Tue Nov 1 10:16:11 UTC 2022
This is an automated email from the git hooks/post-receive script.
rdw pushed a commit to branch dev/IDP-1927
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=f928216b5484edbe146051a73713ac14addb82f1
commit f928216b5484edbe146051a73713ac14addb82f1
Author: Rod Widdowson <rdw at steadingsoftware.com>
AuthorDate: Fri Oct 28 16:54:02 2022 +0100
IDP-1927 Make Jetty run under its own credentials for windows installs
https://shibboleth.atlassian.net/browse/IDP-1927
Start trying to make this property driven. Tested with and without
properties provided.
---
idp-installer/src/main/wix/MergeModule.wxs | 33 +++++++++++++++++++++-
idp-installer/src/main/wix/ShibbolethIdP-main.wxs | 15 ++++++----
.../src/main/wix/ShibbolethIdP-registry.wxs | 16 ++++++++++-
idp-installer/src/main/wix/procrun.wxs | 14 ++++-----
4 files changed, 64 insertions(+), 14 deletions(-)
diff --git a/idp-installer/src/main/wix/MergeModule.wxs b/idp-installer/src/main/wix/MergeModule.wxs
index 362ba6dfe..d25753208 100644
--- a/idp-installer/src/main/wix/MergeModule.wxs
+++ b/idp-installer/src/main/wix/MergeModule.wxs
@@ -19,12 +19,43 @@
<Module Id="Jetty" Language="1033" Version="3.2.2.0">
<Package Id="684b3207-0d64-43e6-9e6a-3acb8b7672d7" Manufacturer="The Shibboleth Consortium" InstallerVersion="310" Description="Merge Module for Jetty" Comments="This module is built by the Shibboleth Consortium. Includes Jetty (from Eclipse) and Procrun (from Apache)" Platform="x64" />
<Directory Id="TARGETDIR" Name="SourceDir">
+ <Component Id="SaveTarget" Guid="{B5B909A2-E246-4069-808D-7F3AC98D062B}" Win64="no">
+ <RegistryValue Id="targetRegShibUser" Root="HKLM" Key="SOFTWARE\Shibboleth\IdP" Name="JettydUser" Value="[JETTYD_USER]" Type="string" />
+ <RegistryValue Id="targetRegShibDomain" Root="HKLM" Key="SOFTWARE\Shibboleth\IdP" Name="JettydDomain" Value="[JETTYD_DOMAIN]" Type="string" />
+ <RegistryValue Id="targetRegInstallShibUser" Root="HKLM" Key="SOFTWARE\Shibboleth\IdP" Name="InstallJettydUser" Value="[INSTALL_JETTYD_USER]" Type="string" />
+ </Component>
<Directory Id="JETTYROOT" Name="Jetty" />
<Directory Id="PROCRUNROOT" Name="ProcRun" />
</Directory>
+ <CustomAction Id="InheritJettydUser" Property="JETTYD_USER" Value="[OLD_JETTYD_USER]" />
+ <CustomAction Id="InheritJettydDomain" Property="JETTYD_DOMAIN" Value="[OLD_JETTYD_DOMAIN]" />
+ <CustomAction Id="SetJettydDomain" Property="JETTYD_DOMAIN" Value="[%USERDOMAIN]" />
+ <CustomAction Id="InheritInstallJettydUser" Property="INSTALL_JETTYD_USER" Value="[OLD_INSTALL_JETTYD_USER]" />
+ <CustomAction Id="SetInstallJettydUser" Property="INSTALL_JETTYD_USER" Value="TRUE" />
+
+ <InstallUISequence>
+ <!-- inherit JettydUser stuff-->
+ <Custom Action="InheritJettydUser" After="AppSearch">OLD_JETTYD_USER AND NOT JETTYD_USER</Custom>
+ <Custom Action="InheritJettydDomain" After="AppSearch">OLD_JETTYD_DOMAIN AND NOT JETTYD_DOMAIN</Custom>
+ <Custom Action="SetJettydDomain" After="AppSearch">NOT OLD_JETTYD_DOMAIN AND NOT JETTYD_DOMAIN</Custom>
+ <Custom Action="InheritInstallJettydUser" After="AppSearch">OLD_INSTALL_JETTYD_USER AND NOT JETTYD_USER</Custom>
+ <Custom Action="SetInstallJettydUser" After="AppSearch">JETTYD_USER</Custom>
+ </InstallUISequence>
+
+ <CustomAction Id="UserSpecified" Property="PERMISSION_USER" Value="[JETTYD_USER]"/>
+ <CustomAction Id="UserDefault" Property="PERMISSION_USER" Value="Administrators"/>
+ <CustomAction Id="DomainDefault" Property="JETTYD_DOMAIN" Value=""/>
+ <CustomAction Id="ServiceUser" Property="SERVICE_USER" Value="[JETTYD_DOMAIN]\[JETTYD_USER]"/>
+
+ <InstallExecuteSequence>
+ <Custom Action="UserSpecified" Before="CreateFolders">INSTALL_JETTYD_USER</Custom>
+ <Custom Action="UserDefault" Before="CreateFolders">NOT INSTALL_JETTYD_USER</Custom>
+ <Custom Action="DomainDefault" Before="CreateFolders">NOT INSTALL_JETTYD_USER</Custom>
+ <Custom Action="ServiceUser" Before="InstallServices">INSTALL_JETTYD_USER</Custom>
+ </InstallExecuteSequence>
+
<ComponentGroupRef Id="JettyGroup" />
<ComponentGroupRef Id="ProcrunGroup" />
-
</Module>
</Wix>
diff --git a/idp-installer/src/main/wix/ShibbolethIdP-main.wxs b/idp-installer/src/main/wix/ShibbolethIdP-main.wxs
index f935478e5..6d85a1f3a 100644
--- a/idp-installer/src/main/wix/ShibbolethIdP-main.wxs
+++ b/idp-installer/src/main/wix/ShibbolethIdP-main.wxs
@@ -70,12 +70,14 @@
<CreateFolder Directory="CredsFolder">
<Permission User="Administrators" GenericAll="yes" />
<Permission User="SYSTEM" GenericAll="yes" />
- <Permission User="SHIBD_USER" ReadPermission="yes" GenericRead="yes" GenericExecute="yes" Read="yes" />
+ <Permission Domain="[JETTYD_DOMAIN.684B3207_0D64_43E6_9E6A_3ACB8B7672D7]" User="[PERMISSION_USER.684B3207_0D64_43E6_9E6A_3ACB8B7672D7]"
+ ReadPermission="yes" GenericRead="yes" GenericExecute="yes" Read="yes" />
</CreateFolder>
<CreateFolder Directory="ConfFolder">
<Permission User="Administrators" GenericAll="yes" />
<Permission User="SYSTEM" GenericAll="yes" />
- <Permission User="SHIBD_USER" ReadPermission="yes" Read="yes" GenericRead="yes" GenericExecute="yes" />
+ <Permission Domain="[JETTYD_DOMAIN.684B3207_0D64_43E6_9E6A_3ACB8B7672D7]" User="[PERMISSION_USER.684B3207_0D64_43E6_9E6A_3ACB8B7672D7]"
+ ReadPermission="yes" Read="yes" GenericRead="yes" GenericExecute="yes" />
</CreateFolder>
</Component>
<Component Id="JettyPermissions" Guid="{900980C5-CF3D-4816-9922-6142C12F6D13}" Win64="no">
@@ -83,17 +85,20 @@
<CreateFolder Directory="StartDotD">
<Permission User="Administrators" GenericAll="yes" />
<Permission User="SYSTEM" GenericAll="yes" />
- <Permission User="SHIBD_USER" ReadPermission="yes" GenericRead="yes" Read="yes" GenericExecute="yes" />
+ <Permission Domain="[JETTYD_DOMAIN.684B3207_0D64_43E6_9E6A_3ACB8B7672D7]" User="[PERMISSION_USER.684B3207_0D64_43E6_9E6A_3ACB8B7672D7]"
+ ReadPermission="yes" GenericRead="yes" Read="yes" GenericExecute="yes" />
</CreateFolder>
<CreateFolder Directory="JettyLogs">
<Permission User="Administrators" GenericAll="yes" />
<Permission User="SYSTEM" GenericAll="yes" />
- <Permission User="SHIBD_USER" GenericAll="yes"/>
+ <Permission Domain="[JETTYD_DOMAIN.684B3207_0D64_43E6_9E6A_3ACB8B7672D7]" User="[PERMISSION_USER.684B3207_0D64_43E6_9E6A_3ACB8B7672D7]"
+ GenericAll="yes"/>
</CreateFolder>
<CreateFolder Directory="JettyTmp">
<Permission User="Administrators" GenericAll="yes" />
<Permission User="SYSTEM" GenericAll="yes" />
- <Permission User="SHIBD_USER" GenericAll="yes"/>
+ <Permission Domain="[JETTYD_DOMAIN.684B3207_0D64_43E6_9E6A_3ACB8B7672D7]" User="[PERMISSION_USER.684B3207_0D64_43E6_9E6A_3ACB8B7672D7]"
+ GenericAll="yes"/>
</CreateFolder>
</Component>
</Directory>
diff --git a/idp-installer/src/main/wix/ShibbolethIdP-registry.wxs b/idp-installer/src/main/wix/ShibbolethIdP-registry.wxs
index c570e32e4..77175ab96 100644
--- a/idp-installer/src/main/wix/ShibbolethIdP-registry.wxs
+++ b/idp-installer/src/main/wix/ShibbolethIdP-registry.wxs
@@ -80,5 +80,19 @@
<RegistrySearch Id="OldQIDir" Root="HKLM" Key="SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{D54EF89F-F134-450C-A64D-593F5602F175}" Name="InstallLocation" Type="raw" Win64="no" />
</Property>
+ <!-- Should be in Mergemodule -->
+ <Property Id="INSTALL_JETTYD_USER.684B3207_0D64_43E6_9E6A_3ACB8B7672D7" Secure="yes"/>
+ <Property Id="JETTYD_USER.684B3207_0D64_43E6_9E6A_3ACB8B7672D7" Secure="yes"/>
+ <Property Id="JETTYD_PASSWORD.684B3207_0D64_43E6_9E6A_3ACB8B7672D7" Secure="yes" Hidden="yes"/>
+ <Property Id="OLD_JETTYD_USER.684B3207_0D64_43E6_9E6A_3ACB8B7672D7" Secure="yes">
+ <RegistrySearch Id="OldJettydUser" Root="HKLM" Key="SOFTWARE\Shibboleth\IdP" Name="JettydUser" Type="raw" Win64="no" />
+ </Property>
+ <Property Id="OLD_JETTYD_DOMAIN.684B3207_0D64_43E6_9E6A_3ACB8B7672D7" Secure="yes">
+ <RegistrySearch Id="OldJettydDomain" Root="HKLM" Key="SOFTWARE\Shibboleth\IdP" Name="JettydDomain" Type="raw" Win64="no" />
+ </Property>
+ <Property Id="OLD_INSTALL_JETTYD_USER.684B3207_0D64_43E6_9E6A_3ACB8B7672D7" Secure="yes">
+ <RegistrySearch Id="OldInstallJettydUser" Root="HKLM" Key="SOFTWARE\Shibboleth\IdP" Name="InstallJettydUser" Type="raw" Win64="no" />
+ </Property>
</Fragment>
-</Wix>
+</Wix> <!--msiexec /lv* log.log /i idp-x64.msi JETTYD_USER.684B3207_0D64_43E6_9E6A_3ACB8B7672D7=SHIBD_USER JETTYD_PASSSWORD.684B3207_0D64_43E6_9E6A_3ACB8B7672D7=Gold12! -->
+
diff --git a/idp-installer/src/main/wix/procrun.wxs b/idp-installer/src/main/wix/procrun.wxs
index 4e42fef92..e7f6d1659 100644
--- a/idp-installer/src/main/wix/procrun.wxs
+++ b/idp-installer/src/main/wix/procrun.wxs
@@ -21,7 +21,7 @@
<Fragment>
<DirectoryRef Id="PROCRUNROOT">
<Directory Id="dir64" Name="amd64" />
- <Directory Id="procrunLogFolder" Name="log" />
+ <Directory Id="procrunLogFolder" Name="log" />
</DirectoryRef>
<Binary Id="DoRandomSrc" SourceFile="scripts\shib_random.vbs" />
<CustomAction Id="MakeRandom" BinaryKey="DoRandomSrc" VBScriptCall="" Execute="immediate" />
@@ -47,14 +47,14 @@
<RegistryKey ForceCreateOnInstall="yes" Key="SOFTWARE\Apache Software Foundation\Procrun 2.0\$(var.ServiceName)" Root="HKLM">
<Permission User="Administrators" GenericAll="yes" />
<Permission User="SYSTEM" GenericAll="yes" />
- <Permission User="SHIBD_USER" GenericRead="yes" GenericExecute="yes" Read="yes" />
- </RegistryKey>
- <CreateFolder Directory="procrunLogFolder">
+ <Permission Domain="[JETTYD_DOMAIN]" User="[PERMISSION_USER]" GenericRead="yes" GenericExecute="yes" Read="yes" />
+ </RegistryKey>
+ <CreateFolder Directory="procrunLogFolder">
<Permission User="Administrators" GenericAll="yes" />
<Permission User="SYSTEM" GenericAll="yes" />
- <Permission User="SHIBD_USER" GenericAll="yes" />
+ <Permission Domain="[JETTYD_DOMAIN]" User="[PERMISSION_USER]" GenericAll="yes" />
</CreateFolder>
- </Component>
+ </Component>
<!-- Install the service. -->
@@ -71,7 +71,7 @@
<File Id="file_procrun_AMD64_service" KeyPath="yes" Source="$(var.ProcrunSrc)\amd64\prunsrv.exe" Name="$(var.ServiceName).exe" />
<ServiceInstall Id="ServiceX64" Name="$(var.ServiceName)" DisplayName="Shibboleth IdP Daemon" Description="Runs the Jetty Container"
Arguments="service $(var.ServiceName)" Type="ownProcess" Start="$(var.ServiceStart)" ErrorControl="ignore"
- Account=".\SHIBD_USER" Password="********">
+ Account="[SERVICE_USER]" Password="[JETTYD_PASSWORD]">
<util:ServiceConfig FirstFailureActionType="none" SecondFailureActionType="none" ThirdFailureActionType="none"/>
</ServiceInstall>
</Component>
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list