[java-identity-provider] branch main updated: IDP-2150 Add batch script to "lock down" a windows installation

[Rod Widdowson]

This is an automated email from the git hooks/post-receive script.

rdw pushed a commit to branch main
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=bb967ccd3ee1a5d9da871615dab4de258fe3e09f

The following commit(s) were added to refs/heads/main by this push:
     new bb967ccd3 IDP-2150 Add batch script to "lock down" a windows installation
bb967ccd3 is described below

commit bb967ccd3ee1a5d9da871615dab4de258fe3e09f
Author: Rod Widdowson <rdw at steadingsoftware.com>
AuthorDate: Mon Aug 7 14:17:02 2023 +0100

    IDP-2150 Add batch script to "lock down" a windows installation
    
    https://shibboleth.atlassian.net/browse/IDP-2150
    
    Multiple bug fixes.
---
 .../net/shibboleth/idp/module/bin/setacl.bat       | 32 ++++++++++++++++------
 idp-installer/src/main/wix/IdP.bat                 |  1 -
 idp-installer/src/main/wix/ShibbolethIdP-gui.wxs   |  6 +---
 3 files changed, 24 insertions(+), 15 deletions(-)

diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/bin/setacl.bat b/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/bin/setacl.bat
index 07d67b4c6..df7204906 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/bin/setacl.bat
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/bin/setacl.bat
@@ -30,7 +30,8 @@ REM First up, take ownership
 REM   /t means recursive
 
 echo Setting owner to %OWNER_ID%
-icacls %~dp0\.. /t /setowner %OWNER_ID%
+icacls "%~dp0\.." /t /setowner %OWNER_ID%
+
 if ERRORLEVEL 1 (
    echo Error: Could not set ownership
    goto done
@@ -39,22 +40,35 @@ if ERRORLEVEL 1 (
 if "%1%"=="" (
    REM Set the ACLS Default ACLS
    REM   /t recursive
-   REM   /inheritance:r Remove inhetited ACLS
-   REM   /grant:r SYSTEM:F Administrators:F Full access for SYSTEM&Administrators (replacing any existing)
+   REM   /inheritance:r Remove inherited ACLS
+   REM   /grant:r ID:(CI)(OI)(F) Full access for ID (replacing any existing)
+   REM   /grant:r ID:(CI)(OI)(F) Full access for ID (replacing any existing, but causing kids to be inherited) DIRECTORIES ONLY
+
+   echo Setting FULL ACL on DIRS SYSTEM and Administrators
+   icacls "%~dp0\.." /t /inheritance:r /grant:r "SYSTEM:(OI)(CI)(F)" "Administrators:(OI)(CI)(F)"
+
+   echo Setting FULL ACL on FILES SYSTEM and Administrators
+   icacls "%~dp0\.." /t /inheritance:r /grant:r SYSTEM:F Administrators:F
 
-   echo Setting ACL for SYSTEM and Administrators
-   icacls %~dp0\.. /t /inheritance:r /grant:r SYSTEM:F Administrators:F
 ) else (
    REM As above, but add read for the supplied user
    REM GR=GENERIC_READ RD=READ_DATA/ENUMERATE_DIR X=EXECUTE/TRAVERSE_DIR
-   echo Setting ACL for SYSTEM, Administrators and %OWNER_ID%
-   icacls %~dp0\.. /t /inheritance:r /grant:r SYSTEM:F Administrators:F "%1%:(GR,RD,X)"
+
+   echo Setting FULL ACL with inheritance on DIRS SYSTEM and Administrators, Readonly ACL %1%
+   icacls "%~dp0\.." /t /inheritance:r /grant:r "SYSTEM:(OI)(CI)(F)" "Administrators:(OI)(CI)(F)" "%1%:(OI)(CI)(GR,RD,X)"
+   echo Setting FULL ACL with inheritance on FILES SYSTEM and Administrators, Readonly ACL %1%
+   icacls "%~dp0\.." /t /inheritance:r /grant:r SYSTEM:F Administrators:F "%1%:(GR,RD,X)"
+
    if ERRORLEVEL 1 (
       echo Error: Could not set ACL
       goto done
    )
-   REM And the logs (which may not be present yet)
-   icacls %~dp0\..\logs /t /grant:r SYSTEM:F Administrators:F %1%:F
+
+   REM And the logs
+   echo Setting FULL ACL on logs DIRS SYSTEM,  Administrators and %1%
+   icacls "%~dp0\..\logs" /t /inheritance:r /grant:r "SYSTEM:(OI)(CI)(F)" "Administrators:(OI)(CI)(F)" "%1%:(OI)(CI)(F)"
+   echo Setting FULL ACL on logs FILES SYSTEM,  Administrators and %1%
+   icacls "%~dp0\..\logs" /t /inheritance:r /grant:r SYSTEM:F Administrators:F "%1%:F"
 )
 if ERRORLEVEL 1 (
    echo Error: Could not set ACL
diff --git a/idp-installer/src/main/wix/IdP.bat b/idp-installer/src/main/wix/IdP.bat
index a904c66cc..e207a064e 100644
--- a/idp-installer/src/main/wix/IdP.bat
+++ b/idp-installer/src/main/wix/IdP.bat
@@ -109,7 +109,6 @@ dir idp*.msi
 REM Tidy up in the Sucessful exit case
    del *.wixobj *.wixpdb
    rd /s /q idp-extract
-   rd /s /q idp-jetty-base-extract
    del idp_contents.wxs
 :done
 
diff --git a/idp-installer/src/main/wix/ShibbolethIdP-gui.wxs b/idp-installer/src/main/wix/ShibbolethIdP-gui.wxs
index 4cbdc2b33..81bd9dce5 100644
--- a/idp-installer/src/main/wix/ShibbolethIdP-gui.wxs
+++ b/idp-installer/src/main/wix/ShibbolethIdP-gui.wxs
@@ -115,11 +115,7 @@
             Installed AND NOT PATCH
         </Publish>
 
-        <ProgressText Action="QtIdpAnt">Performing IdP Installation tasks; this may take some time.</ProgressText>
-        <ProgressText Action="QtJettyAnt">Configuring Jetty</ProgressText>
-        <ProgressText Action="QtSetACEJettyLogs">Setting ACE onto the Jetty Logs</ProgressText>
-        <ProgressText Action="QtSetACEJettyTmp">Setting ACE onto the Jetty TMP dir</ProgressText>
-        <ProgressText Action="QtSetACEProcrunLog">Setting ACE onto the ProcRun Logs</ProgressText>
+        <ProgressText Action="QtIdpInstall">Performing IdP Installation tasks; this may take some time.</ProgressText>
 
     </UI>
   </Fragment>

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.