[java-identity-provider] 01/04: IDP-2107 Misc V5 Installer tasks
Rod Widdowson
rdw at steadingsoftware.com
Tue Jul 11 15:59:05 UTC 2023
This is an automated email from the git hooks/post-receive script.
rdw pushed a commit to branch main
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=44580b94b6bfc231f1bd8ac883fed3506c6ecaa5
commit 44580b94b6bfc231f1bd8ac883fed3506c6ecaa5
Author: Rod Widdowson <rdw at steadingsoftware.com>
AuthorDate: Thu Jul 6 10:48:11 2023 +0100
IDP-2107 Misc V5 Installer tasks
https://shibboleth.atlassian.net/browse/IDP-2107
Do not prompt for passwords for our keystores and the like
if they are not provided. Rather generate 32 bytes of
randomness and Base64Encode that.
---
.../idp/installer/impl/InstallerProperties.java | 26 ++---
.../idp/installer/impl/PasswordHandler.java | 107 ---------------------
.../shibboleth/idp/installer/TestInstallerCLI.java | 6 --
3 files changed, 15 insertions(+), 124 deletions(-)
diff --git a/idp-installer/src/main/java/net/shibboleth/idp/installer/impl/InstallerProperties.java b/idp-installer/src/main/java/net/shibboleth/idp/installer/impl/InstallerProperties.java
index 648aa5bc3..668bb3659 100644
--- a/idp-installer/src/main/java/net/shibboleth/idp/installer/impl/InstallerProperties.java
+++ b/idp-installer/src/main/java/net/shibboleth/idp/installer/impl/InstallerProperties.java
@@ -25,6 +25,10 @@ import java.net.NetworkInterface;
import java.net.SocketException;
import java.nio.file.Files;
import java.nio.file.Path;
+import java.security.KeyPair;
+import java.security.KeyPairGenerator;
+import java.security.NoSuchAlgorithmException;
+import java.security.SecureRandom;
import java.util.Arrays;
import java.util.Collections;
import java.util.HashSet;
@@ -44,6 +48,8 @@ import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
import net.shibboleth.shared.annotation.constraint.NotEmpty;
import net.shibboleth.shared.annotation.constraint.NotLive;
import net.shibboleth.shared.annotation.constraint.Unmodifiable;
+import net.shibboleth.shared.codec.Base64Support;
+import net.shibboleth.shared.codec.EncodingException;
import net.shibboleth.shared.collection.CollectionSupport;
import net.shibboleth.shared.component.ComponentInitializationException;
import net.shibboleth.shared.primitive.LoggerFactory;
@@ -299,18 +305,16 @@ public class InstallerProperties {
if (value != null) {
return value;
}
- if (noPrompt) {
- throw new BuildException("No value for " + propertyName + " specified");
- }
-
- final InputRequest request = new InputRequest(prompt);
-
- new PasswordHandler().handleInput(request);
- @Nullable final String result = request.getInput();
- if (result == null) {
- throw new BuildException("Null result from Ant PasswordHandler");
+ try {
+ final byte key[] = new byte[32];
+ SecureRandom.getInstance("SHA1PRNG").nextBytes(key);
+ final String s = Base64Support.encode(key, false).substring(0, 32);
+ assert s != null;
+ return s;
+ } catch (NoSuchAlgorithmException|EncodingException e) {
+ log.error("Password Generation failed", e);
+ throw new BuildException("Password Generation failed", e);
}
- return result;
}
/**
diff --git a/idp-installer/src/main/java/net/shibboleth/idp/installer/impl/PasswordHandler.java b/idp-installer/src/main/java/net/shibboleth/idp/installer/impl/PasswordHandler.java
deleted file mode 100644
index 3a0170698..000000000
--- a/idp-installer/src/main/java/net/shibboleth/idp/installer/impl/PasswordHandler.java
+++ /dev/null
@@ -1,107 +0,0 @@
-/*
- * Licensed to the University Corporation for Advanced Internet Development,
- * Inc. (UCAID) under one or more contributor license agreements. See the
- * NOTICE file distributed with this work for additional information regarding
- * copyright ownership. The UCAID licenses this file to You under the Apache
- * License, Version 2.0 (the "License"); you may not use this file except in
- * compliance with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package net.shibboleth.idp.installer.impl;
-
-import java.io.ByteArrayInputStream;
-import java.io.ByteArrayOutputStream;
-import java.io.IOException;
-import java.util.Properties;
-
-import javax.annotation.Nonnull;
-
-import org.apache.tools.ant.input.InputRequest;
-import org.apache.tools.ant.input.SecureInputHandler;
-
-import net.shibboleth.idp.installer.PropertiesWithComments;
-import net.shibboleth.shared.annotation.constraint.NotEmpty;
-import net.shibboleth.shared.primitive.LoggerFactory;
-import org.slf4j.Logger;
-
-
-/** Ant helper class to ask for passwords, rejecting zero length passwords and asking for confirmation. */
-public class PasswordHandler extends SecureInputHandler {
-
- /** Logger. */
- @Nonnull final private Logger log = LoggerFactory.getLogger(PasswordHandler.class);
-
- /** Spool the file to a {@link PropertiesWithComments}, read it in again as a {@link Properties} and check
- * for equivalence.
- * @param password what to look at
- * @return if the password can go to a property file OK
- */
- private boolean passwordSavesOK(final @Nonnull @NotEmpty String password) {
- final String propertyName="pass";
- try {
- final PropertiesWithComments saveProps = new PropertiesWithComments();
- // init
- saveProps.load(new ByteArrayInputStream(new byte[0]));
-
- // set up
- saveProps.replaceProperty(propertyName, password);
- final Properties loadProps = new Properties();
-
- try (final ByteArrayOutputStream saveStream = new ByteArrayOutputStream()) {
- saveProps.store(saveStream);
-
- // reload
- try(final ByteArrayInputStream loadStream = new ByteArrayInputStream(saveStream.toByteArray())) {
- loadProps.load(loadStream);
- }
- }
- // test
- return password.equals(loadProps.getProperty(propertyName));
- } catch (final IOException e) {
- log.error("Internal error", e);
- return false;
- }
- }
-
- /** {@inheritDoc} */
- @Override
- public void handleInput(final InputRequest arg0) {
- while (true) {
- System.console().printf("%s", arg0.getPrompt());
- System.console().flush();
- char[] result = System.console().readPassword();
- if (null == result || result.length == 0) {
- System.console().printf("Password cannot be zero length\n");
- continue;
- }
- final String firstPass = String.copyValueOf(result);
- assert firstPass != null;
- if (!passwordSavesOK(firstPass)) {
- System.console().printf("Password contains unsafe characters\n");
- continue;
- }
- System.console().printf("Re-enter password: ");
- System.console().flush();
- result = System.console().readPassword();
- if (null == result || result.length == 0) {
- System.console().printf("Password cannot be zero length\n");
- continue;
- }
- final String secondPass = String.copyValueOf(result);
- if (firstPass.equals(secondPass)) {
- arg0.setInput(firstPass);
- return;
- }
- System.console().printf("Passwords did not match\n");
- }
- }
-
-}
\ No newline at end of file
diff --git a/idp-installer/src/test/java/net/shibboleth/idp/installer/TestInstallerCLI.java b/idp-installer/src/test/java/net/shibboleth/idp/installer/TestInstallerCLI.java
index a122eec72..34b6c3e8e 100644
--- a/idp-installer/src/test/java/net/shibboleth/idp/installer/TestInstallerCLI.java
+++ b/idp-installer/src/test/java/net/shibboleth/idp/installer/TestInstallerCLI.java
@@ -30,11 +30,7 @@ public class TestInstallerCLI {
@Test(enabled = false)
public void install() {
-
- System.setProperty(InstallerProperties.KEY_STORE_PASSWORD, "p1");
- System.setProperty(InstallerProperties.SEALER_PASSWORD, "p1");
System.setProperty(InstallerProperties.HOST_NAME, "machine.org.uk");
- System.setProperty(InstallerProperties.TARGET_DIR, "h:\\downloads\\idp");
IdPInstallerCLI.runMain(new String[] {
"-t", "h:\\downloads\\idp",
"-s",
@@ -46,8 +42,6 @@ public class TestInstallerCLI {
public void silentInstall() {
IdPInstallerCLI.runMain(new String[] {
- "-kp", "p1",
- "--sealerPassword", "p1",
"-e", "https://test.example.org/id",
"--hostName", "machine.org",
"--scope", "machine.org",
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list