[java-identity-provider] branch main updated: IDP-2150 Add batch script to "lock down" a windows installation

[Rod Widdowson]

This is an automated email from the git hooks/post-receive script.

rdw pushed a commit to branch main
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=4f1e9d2d963db60f06dc1977ce54ed7294d0c1f7

The following commit(s) were added to refs/heads/main by this push:
     new 4f1e9d2d9 IDP-2150 Add batch script to "lock down" a windows installation
4f1e9d2d9 is described below

commit 4f1e9d2d963db60f06dc1977ce54ed7294d0c1f7
Author: Rod Widdowson <rdw at steadingsoftware.com>
AuthorDate: Tue Aug 1 15:26:04 2023 +0100

    IDP-2150 Add batch script to "lock down" a windows installation
    
    https://shibboleth.atlassian.net/browse/IDP-2150
    
    First attempt and implementation
---
 .../net/shibboleth/idp/module/bin/setacl.bat       | 64 ++++++++++++++++++++++
 .../idp/module/core/impl/module.properties         |  5 +-
 2 files changed, 68 insertions(+), 1 deletion(-)

diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/bin/setacl.bat b/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/bin/setacl.bat
new file mode 100644
index 000000000..07d67b4c6
--- /dev/null
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/bin/setacl.bat
@@ -0,0 +1,64 @@
+ at echo off
+setlocal
+
+REM
+REM EXAMPLE batch file to set restrictive ACLs on a Shibboleth IdP installation.
+REM
+REM You should consider this a sample rather than set in stone and adapt it for
+REM your own use
+REM
+REM Two optional Parameters:
+REM    The first is the ID to be given explicit read access to the configuration
+REM    and write access to the logs.  This could be the OD or a low priv user you
+REM    run the container as
+REM
+REM    The second is the ID to be given ownership of the files.  This finesses an
+REM    issue wherebywhich happen if the owner of the files is not given access.
+REM    The directory tree then becaomes an unmaintainable mess.
+REM
+REM    Defaults to 'Administrators'
+REM
+
+if "%2%" EQU "" (
+   set OWNER_ID=Administrators
+) else (
+   set OWNER_ID=%2%
+)
+
+REM
+REM First up, take ownership
+REM   /t means recursive
+
+echo Setting owner to %OWNER_ID%
+icacls %~dp0\.. /t /setowner %OWNER_ID%
+if ERRORLEVEL 1 (
+   echo Error: Could not set ownership
+   goto done
+)
+
+if "%1%"=="" (
+   REM Set the ACLS Default ACLS
+   REM   /t recursive
+   REM   /inheritance:r Remove inhetited ACLS
+   REM   /grant:r SYSTEM:F Administrators:F Full access for SYSTEM&Administrators (replacing any existing)
+
+   echo Setting ACL for SYSTEM and Administrators
+   icacls %~dp0\.. /t /inheritance:r /grant:r SYSTEM:F Administrators:F
+) else (
+   REM As above, but add read for the supplied user
+   REM GR=GENERIC_READ RD=READ_DATA/ENUMERATE_DIR X=EXECUTE/TRAVERSE_DIR
+   echo Setting ACL for SYSTEM, Administrators and %OWNER_ID%
+   icacls %~dp0\.. /t /inheritance:r /grant:r SYSTEM:F Administrators:F "%1%:(GR,RD,X)"
+   if ERRORLEVEL 1 (
+      echo Error: Could not set ACL
+      goto done
+   )
+   REM And the logs (which may not be present yet)
+   icacls %~dp0\..\logs /t /grant:r SYSTEM:F Administrators:F %1%:F
+)
+if ERRORLEVEL 1 (
+   echo Error: Could not set ACL
+   goto done
+)
+
+:done
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/core/impl/module.properties b/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/core/impl/module.properties
index e7b093e38..172a06673 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/core/impl/module.properties
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/core/impl/module.properties
@@ -300,4 +300,7 @@ idp.Core.47.dest = bin/build.bat
 idp.Core.47.replace = true
 idp.Core.47.nonwindows = false
 
-
+idp.Core.48.src = /net/shibboleth/idp/module/bin/setacl.bat
+idp.Core.48.dest = bin/setacl.bat
+idp.Core.48.replace = true
+idp.Core.48.nonwindows = false

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.