[cpp-sp] branch main updated: SSPCPP-961 Lock down the installaltion dir

[Rod Widdowson]

This is an automated email from the git hooks/post-receive script.

rdw pushed a commit to branch main
in repository cpp-sp.

View the commit online:
http://git.shibboleth.net/view/?p=cpp-sp.git;a=commit;h=0bfa50b9cbccae325393a0f1a9e00ef154929401

The following commit(s) were added to refs/heads/main by this push:
     new 0bfa50b9 SSPCPP-961 Lock down the installaltion dir
0bfa50b9 is described below

commit 0bfa50b9cbccae325393a0f1a9e00ef154929401
Author: Rod Widdowson <rdw at steadingsoftware.com>
AuthorDate: Sat Nov 26 16:15:52 2022 +0000

    SSPCPP-961 Lock down the installaltion dir
    
    https://shibboleth.atlassian.net/browse/SSPCPP-961?focusedCommentId=33939
---
 msi/WiX/ShibbolethSP-noarch.wxs     | 8 ++++----
 msi/WiX/ShibbolethSP-properties.wxi | 5 ++++-
 2 files changed, 8 insertions(+), 5 deletions(-)

diff --git a/msi/WiX/ShibbolethSP-noarch.wxs b/msi/WiX/ShibbolethSP-noarch.wxs
index c9ced978..0ad04fdb 100644
--- a/msi/WiX/ShibbolethSP-noarch.wxs
+++ b/msi/WiX/ShibbolethSP-noarch.wxs
@@ -28,8 +28,10 @@
     <DirectoryRef Id="INSTALLDIR">
       <Component Id="ProtectInstallDir" Guid="{9F695B93-0575-4D91-9E22-35A8D6966F1B}">
         <CreateFolder>
-          <Permission  User="Administrators" GenericAll="yes" />
-          <Permission  User="SYSTEM" GenericAll="yes" />
+          <Permission User="Administrators" GenericAll="yes" />
+          <Permission User="SYSTEM" GenericAll="yes" />
+          <Permission User="USERS" ReadPermission="yes" GenericRead="yes" GenericExecute="yes" Read="yes" />
+          <Permission User="[WEBSERVER_USER]" ReadPermission="yes" GenericRead="yes" GenericExecute="yes" Read="yes" />
         </CreateFolder>
       </Component>
       <Directory Id="doc" Name="doc">
@@ -218,8 +220,6 @@
       <Custom Action="SetSetDisplayName" Before="CostInitialize">ALREADYINSTALLED</Custom>
       <Custom Action="SetDisplayName" After="InstallServices">ALREADYINSTALLED</Custom>
 
-      <!-- IIS handling is no longer architecture independent and happens in ShibbolethSP-main-x?? -->
-
       <!-- Duplicate actions from the UI case -->
       <Custom Action="InheritInstallDir" After="AppSearch">
         OLD_INSTALLDIR
diff --git a/msi/WiX/ShibbolethSP-properties.wxi b/msi/WiX/ShibbolethSP-properties.wxi
index 4b1f9bf4..ad749055 100644
--- a/msi/WiX/ShibbolethSP-properties.wxi
+++ b/msi/WiX/ShibbolethSP-properties.wxi
@@ -35,8 +35,11 @@
   <!-- Do we want to force the ServiceStart to happen? -->
   <Property Id="ALWAYS_START_SERVICE" Value="TRUE" Secure="yes" />
 
+  <!-- Identity to give Read access to -->
+  <Property Id="WEBSERVER_USER" Value="USERS"  Secure="yes" />
+
   <!-- UPGRADINGPRODUCTCODE set in the uninstall if this is an upgrade uninstall -->
-  <!-- SSPCPP-568 We need a default for InstallDir -->
+  <!-- SSPCPP-568 We need a default for InstallDir
   <Property Id="INSTALLDIR" Value="C:\opt\shibboleth-sp\" />
   <!-- IISMAJORVERSION if IIS installed -->
   <PropertyRef Id="IISMAJORVERSION" />

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.