[java-identity-provider] 03/07: IDP-2136 Consider Splitting the Windows Installer into IdP and Jetty+Procrun
Rod Widdowson
rdw at steadingsoftware.com
Sat Jul 29 14:30:12 UTC 2023
This is an automated email from the git hooks/post-receive script.
rdw pushed a commit to branch main
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=f5b2bd2e69f7c982e6794eeb1a5c0ba362e4f0fc
commit f5b2bd2e69f7c982e6794eeb1a5c0ba362e4f0fc
Author: Rod Widdowson <rdw at steadingsoftware.com>
AuthorDate: Tue Jul 25 10:39:45 2023 +0100
IDP-2136 Consider Splitting the Windows Installer into IdP and Jetty+Procrun
https://shibboleth.atlassian.net/browse/IDP-2136
Introduce control over the user which runs the daemon.
---
.../main/wix/{Jetty-main.wxs => Jetty-Main.wxs} | 24 ++-
idp-installer/src/main/wix/Jetty-Procrun.wxs | 2 +-
idp-installer/src/main/wix/Jetty-User.wxs | 166 +++++++++++++++++++++
idp-installer/src/main/wix/JettyNew.bat | 8 +-
.../src/main/wix/ShibbolethIdP-registry.wxs | 2 +-
5 files changed, 182 insertions(+), 20 deletions(-)
diff --git a/idp-installer/src/main/wix/Jetty-main.wxs b/idp-installer/src/main/wix/Jetty-Main.wxs
similarity index 85%
rename from idp-installer/src/main/wix/Jetty-main.wxs
rename to idp-installer/src/main/wix/Jetty-Main.wxs
index c11e67425..e8f2fc882 100644
--- a/idp-installer/src/main/wix/Jetty-main.wxs
+++ b/idp-installer/src/main/wix/Jetty-Main.wxs
@@ -18,7 +18,7 @@
<?define UpgradeUUID="FB2B7404-37B2-4CE5-8E2E-EEB53F9FF472"?>
<Wix xmlns="http://schemas.microsoft.com/wix/2006/wi">
- <Product Id="*" Name="Shibboleth IdP V5" Language="1033" Version="11.0.13.0" Manufacturer="The Shibboleth Consortium" UpgradeCode="$(var.UpgradeUUID)">
+ <Product Id="*" Name="Jetty Installer for the Shibboleth IdP V5" Language="1033" Version="11.0.13.0" Manufacturer="The Shibboleth Consortium" UpgradeCode="$(var.UpgradeUUID)">
<Package InstallerVersion="310" Compressed="yes" InstallScope="perMachine" Platform="x64" Description="Jetty Installation for Shibboleth IdP V5"
Manufacturer="The Shibboleth Consortium" />
@@ -43,8 +43,8 @@
<ComponentGroupRef Id="JettyBaseGroup" /> <!-- heat -->
<ComponentGroupRef Id="DeleteFiles" /> <!--DOne-->
-<!-- <ComponentRef Id="SaveRegistry" />
- <ComponentRef Id="Shibd_idpw" /> -->
+ <ComponentRef Id="SaveUserInfo" />
+ <ComponentRef Id="Icon" />
</Feature>
<Directory Id="TARGETDIR" Name="SourceDir">
@@ -68,6 +68,10 @@
</Directory>
</Directory>
+ <Component Id="Icon" Guid="{948A6709-00B7-49B5-947D-3346DC1C9AC3}" Directory="IDP_INSTALLDIR" Win64="yes">
+ <RegistryValue Root="HKLM" Key="Software\Microsoft\Windows\CurrentVersion\Uninstall\[ProductCode]" Name="DisplayIcon" Value="[IDP_INSTALLDIR]\shib.ico,0" Type="string" />
+ </Component>
+
<CustomAction Id="SetFinalizeJetty" Property="QtFinalizeJetty" Value=""[JAVA_EXECUTABLE]" -cp "[IDPDISTDIR]\bin\lib\*;[IDPDISTDIR]\webapp\WEB-INF\lib\*" -Didp.home="[JAVA_IDP_HOME]" net.shibboleth.idp.installer.impl.FinalizeJettyBase" />
<CustomAction Id="RunFinalizeJetty" Directory="SHIBBOLETHDIR" ExeCommand="[QtFinalizeJetty]" Execute="deferred" Impersonate="no" />
<CustomAction Id="QtFinalizeJetty" BinaryKey="WixCA" DllEntry="CAQuietExec" Execute="deferred" Impersonate="no" />
@@ -75,10 +79,10 @@
<InstallExecuteSequence>
<Custom Action="SetFinalizeJetty" After="InstallFiles">(NOT Installed)</Custom>
<Custom Action="RunFinalizeJetty" After="SetFinalizeJetty">(NOT Installed) AND DEBUG_INSTALL</Custom>
- <Custom Action="QtFinalizeJetty" After="SetFinalizeJetty">(NOT Installed) AND (NOT DEBUG_INSTALL)</Custom>
+ <Custom Action="QtFinalizeJetty" After="RunFinalizeJetty">(NOT Installed) AND (NOT DEBUG_INSTALL)</Custom>
</InstallExecuteSequence>
- <!-- Parameters -->
+ <!-- Parameters: See also Jetty-User -->
<Property Id="ALWAYS_START_SERVICE" Value="TRUE" Secure="yes" />
<Property Id="JAVA_JVMMX" Secure="yes">
<RegistrySearch Id="JvmMx" Root="HKLM" Key="SOFTWARE\Apache Software Foundation\Procrun 2.0\shibd_idp\Parameters\Java" Name="JvmMx" Type="raw" Win64="no" />
@@ -102,16 +106,6 @@
<RegistrySearch Id="OldInstallDir" Root="HKLM" Key="SOFTWARE\Shibboleth\IdP" Name="InstallDir" Type="directory" Win64="no" />
</Property>
- <Property Id="OLD_JETTYD_USER" Secure="yes">
- <RegistrySearch Id="OldJettydUser" Root="HKLM" Key="SOFTWARE\Shibboleth\IdP" Name="JettydUser" Type="raw" Win64="no" />
- </Property>
- <Property Id="OLD_JETTYD_DOMAIN" Secure="yes">
- <RegistrySearch Id="OldJettydDomain" Root="HKLM" Key="SOFTWARE\Shibboleth\IdP" Name="JettydDomain" Type="raw" Win64="no" />
- </Property>
- <Property Id="OLD_INSTALL_JETTYD_USER" Secure="yes">
- <RegistrySearch Id="OldInstallJettydUser" Root="HKLM" Key="SOFTWARE\Shibboleth\IdP" Name="InstallJettydUser" Type="raw" Win64="no" />
- </Property>
-
<Upgrade Id="$(var.UpgradeUUID)">
<UpgradeVersion ExcludeLanguages="yes" IncludeMaximum="yes" Maximum="127.255.255" Minimum="0.0.1" OnlyDetect="yes" Property="ALREADYINSTALLED" />
</Upgrade>
diff --git a/idp-installer/src/main/wix/Jetty-Procrun.wxs b/idp-installer/src/main/wix/Jetty-Procrun.wxs
index a5670bd4d..43f21c24f 100644
--- a/idp-installer/src/main/wix/Jetty-Procrun.wxs
+++ b/idp-installer/src/main/wix/Jetty-Procrun.wxs
@@ -64,7 +64,7 @@
</Component>
<Component Id="procrun_Firewall" Directory="dir64" Guid="{BC605FF4-0233-4332-BC90-0C2E5FEC37D2}" KeyPath="yes">
<Condition>NOT NO_FIREWALL And VersionNT64 And Not Intel64</Condition>
- <fw:FirewallException Id="Win64Shibd_idp" Program="[#file_procrun_AMD64_service]" Name="Win64Shibd_idp" Description="The Shibboleth IdP" Protocol="tcp" Scope="any" />
+ <fw:FirewallException Id="Win64Shibd_idp" Program="[#file_procrun_AMD64_service]" Name="Win64Shibd_idp" Description="The Shibboleth IdP Daemon" Protocol="tcp" Scope="any" />
</Component>
<!-- Configure the service -->
diff --git a/idp-installer/src/main/wix/Jetty-User.wxs b/idp-installer/src/main/wix/Jetty-User.wxs
new file mode 100644
index 000000000..9faf5fffb
--- /dev/null
+++ b/idp-installer/src/main/wix/Jetty-User.wxs
@@ -0,0 +1,166 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Licensed to the University Corporation for Advanced Internet
+ Development, Inc. (UCAID) under one or more contributor license
+ agreements. See the NOTICE file distributed with this work for
+ additional information regarding copyright ownership. The UCAID
+ licenses this file to You under the Apache License, Version 2.0
+ (the 'License'); you may not use this file except in compliance
+ with the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an 'AS IS' BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+ implied. See the License for the specific language governing
+ permissions and limitations under the License. -->
+<Wix xmlns="http://schemas.microsoft.com/wix/2006/wi" xmlns:fw="http://schemas.microsoft.com/wix/FirewallExtension"
+ xmlns:util="http://schemas.microsoft.com/wix/UtilExtension">
+
+ <!-- User management for a dedicate process.
+ Input Properties- Created by the GUI.
+ NO Inheritance if not the GUI.
+
+ JETTYD_USER - The user name.
+ Must be supplied on GUIless installs if INSTALL_JETTYD_USER is TRUE
+ Saved and reloaded on updates (for GUI use only)
+
+ JETTYD_DOMAIN - Domain, defaults to [%USERDOMAIN] in the GUI
+ Must be supplied on GUIless installs if INSTALL_JETTYD_USER is TRUE
+ Saved and reloaded on updates (for GUI use only)
+
+ INSTALL_JETTYD_USER - Are we configuring a specific user to run the IdP.
+ Saved and reloaded on updates (for GUI use only)
+
+ JETTYD_PASSWORD - The password. Never saved. Must be provided if INSTALL_JETTYD_USER is true.
+
+ Created Properties
+ SERVICE_USER - Username to the service.
+ Only set up if a user (and domain) is specified
+
+ PERMISSION_USER - Administrators if no input supplied otherwise [JETTYD_USER]
+ Used in 'Permission' statments
+
+ ACE_USER - [JETTYD_DOMAIN]\[PERMISSION_USER] if JETTYD_DOMAIN supplied
+ [PERMISSION_USER] Otherwise
+ used in icacles
+ -->
+
+ <Fragment>
+
+ <!-- Restore saved settings -->
+ <Property Id="OLD_JETTYD_USER" Secure="yes">
+ <RegistrySearch Id="OldJettydUser" Root="HKLM" Key="SOFTWARE\Shibboleth\IdP" Name="JettydUser" Type="raw" Win64="no" />
+ </Property>
+ <Property Id="OLD_JETTYD_DOMAIN" Secure="yes">
+ <RegistrySearch Id="OldJettydDomain" Root="HKLM" Key="SOFTWARE\Shibboleth\IdP" Name="JettydDomain" Type="raw" Win64="no" />
+ </Property>
+ <Property Id="OLD_INSTALL_JETTYD_USER" Secure="yes">
+ <RegistrySearch Id="OldInstallJettydUser" Root="HKLM" Key="SOFTWARE\Shibboleth\IdP" Name="InstallJettydUser" Type="raw" Win64="no" />
+ </Property>
+ <!-- Save settings -->
+ <DirectoryRef Id="TARGETDIR">
+ <Component Id="SaveUserInfo" Guid="{B5B909A2-E246-4069-808D-7F3AC98D062B}" Win64="no">
+ <RegistryValue Id="targetRegShibUser" Root="HKLM" Key="SOFTWARE\Shibboleth\IdP" Name="JettydUser" Value="[JETTYD_USER]" Type="string" />
+ <RegistryValue Id="targetRegShibDomain" Root="HKLM" Key="SOFTWARE\Shibboleth\IdP" Name="JettydDomain" Value="[JETTYD_DOMAIN]" Type="string" />
+ <RegistryValue Id="targetRegInstallShibUser" Root="HKLM" Key="SOFTWARE\Shibboleth\IdP" Name="InstallJettydUser" Value="[INSTALL_JETTYD_USER]" Type="string" />
+ </Component>
+ </DirectoryRef>
+
+ <!-- Set up work properties for GUI -->
+ <CustomAction Id="InheritJettydUser" Property="JETTYD_USER" Value="[OLD_JETTYD_USER]" />
+ <CustomAction Id="InheritJettydDomain" Property="JETTYD_DOMAIN" Value="[OLD_JETTYD_DOMAIN]" />
+ <CustomAction Id="SetJettydDomain" Property="JETTYD_DOMAIN" Value="[%USERDOMAIN]" />
+ <CustomAction Id="InheritInstallJettydUser" Property="INSTALL_JETTYD_USER" Value="[OLD_INSTALL_JETTYD_USER]" />
+ <CustomAction Id="SetInstallJettydUser" Property="INSTALL_JETTYD_USER" Value="TRUE" />
+
+ <InstallUISequence>
+ <Custom Action="InheritJettydUser" After="AppSearch">OLD_JETTYD_USER AND NOT JETTYD_USER</Custom>
+ <Custom Action="InheritJettydDomain" After="AppSearch">OLD_JETTYD_DOMAIN AND NOT JETTYD_DOMAIN</Custom>
+ <Custom Action="SetJettydDomain" After="AppSearch">NOT OLD_JETTYD_DOMAIN AND NOT JETTYD_DOMAIN</Custom>
+ <Custom Action="InheritInstallJettydUser" After="InheritJettydUser">OLD_INSTALL_JETTYD_USER AND NOT JETTYD_USER</Custom>
+ <Custom Action="SetInstallJettydUser" After="InheritJettydUser">JETTYD_USER</Custom>
+ </InstallUISequence>
+
+ <!-- Set up work properties for the installer -->
+ <CustomAction Id="PermissionUserSpecified" Property="PERMISSION_USER" Value="[JETTYD_USER]"/>
+ <CustomAction Id="PermissionUserDefault" Property="PERMISSION_USER" Value="Administrators"/>
+ <CustomAction Id="DomainDefault" Property="JETTYD_DOMAIN" Value=""/>
+ <CustomAction Id="ServiceUser" Property="SERVICE_USER" Value="[JETTYD_DOMAIN]\[JETTYD_USER]"/>
+ <CustomAction Id="AceUserDomain" Property="ACE_USER" Value="[JETTYD_DOMAIN]\[PERMISSION_USER]"/>
+ <CustomAction Id="AceUserNoDomain" Property="ACE_USER" Value="[PERMISSION_USER]"/>
+
+ <InstallExecuteSequence>
+ <Custom Action="PermissionUserSpecified" Before="DomainDefault">INSTALL_JETTYD_USER</Custom>
+ <Custom Action="PermissionUserDefault" Before="DomainDefault">NOT INSTALL_JETTYD_USER</Custom>
+ <Custom Action="DomainDefault" Before="AceUserDomain">NOT INSTALL_JETTYD_USER</Custom>
+ <Custom Action="ServiceUser" After="DomainDefault">INSTALL_JETTYD_USER</Custom>
+ <Custom Action="AceUserDomain" Before="AceUserNoDomain">JETTYD_DOMAIN</Custom>
+ <Custom Action="AceUserNoDomain" Before="CreateFolders">NOT JETTYD_DOMAIN</Custom>
+ </InstallExecuteSequence>
+
+ <!-- Actions to set acls
+ /t recursive
+ /inheritance:r Remove inhetited ACLS
+ /grant:r SYSTEM:F *add* Full access for SYSTEM (replacing any existing)
+ [ACE_USER]:(GR,RD,X) *add* GENERIC_READ,READ_DATA,TRAVERSE access
+ (Remember, when user not supplied ACE_USER is Administrators
+ -->
+ <CustomAction Id="SetIcaclsVerb" Property="IcaclsVerb" Value="/t /inheritance:r /grant SYSTEM:F Administrators:F"/>
+ <CustomAction Id="SetACEConf" Property="QtSetACEConf"
+ Value=""c:\Windows\System32\icacls.exe" "[IDP_INSTALLDIR]\conf" [IcaclsVerb] [ACE_USER]:(GR,RD,X)" />
+ <CustomAction Id="QtSetACEConf" BinaryKey="WixCA" DllEntry="CAQuietExec" Execute="deferred" Impersonate="no" />
+
+ <CustomAction Id="SetACECreds" Property="QtSetACECreds"
+ Value=""c:\Windows\System32\icacls.exe" "[IDP_INSTALLDIR]\credentials" [IcaclsVerb] [ACE_USER]:(GR,RD,X)" />
+ <CustomAction Id="QtSetACECreds" BinaryKey="WixCA" DllEntry="CAQuietExec" Execute="deferred" Impersonate="no" />
+
+ <CustomAction Id="SetACELogs" Property="QtSetACELogs"
+ Value=""c:\Windows\System32\icacls.exe" "[IDP_INSTALLDIR]\logs" [IcaclsVerb] [ACE_USER]:F" />
+ <CustomAction Id="QtSetACELogs" BinaryKey="WixCA" DllEntry="CAQuietExec" Execute="deferred" Impersonate="no" />
+
+ <CustomAction Id="SetACEJettyStart" Property="QtSetACEJettyStart"
+ Value=""c:\Windows\System32\icacls.exe" "[IDP_INSTALLDIR]\jetty-base\start.d" [IcaclsVerb] [ACE_USER]:(GR,RD,X)" />
+ <CustomAction Id="QtSetACEJettyStart" BinaryKey="WixCA" DllEntry="CAQuietExec" Execute="deferred" Impersonate="no" />
+
+ <CustomAction Id="SetACEJettyTmp" Property="QtSetACEJettyTmp"
+ Value=""c:\Windows\System32\icacls.exe" "[IDP_INSTALLDIR]\jetty-base\tmp" [IcaclsVerb] [ACE_USER]:F" />
+ <CustomAction Id="QtSetACEJettyTmp" BinaryKey="WixCA" DllEntry="CAQuietExec" Execute="deferred" Impersonate="no" />
+
+ <CustomAction Id="SetACEJettyLogs" Property="QtSetACEJettyLogs"
+ Value=""c:\Windows\System32\icacls.exe" "[IDP_INSTALLDIR]\jetty-base\logs" [IcaclsVerb] [ACE_USER]:F" />
+ <CustomAction Id="QtSetACEJettyLogs" BinaryKey="WixCA" DllEntry="CAQuietExec" Execute="deferred" Impersonate="no" />
+
+ <CustomAction Id="SetACEProcrunLog" Property="QtSetACEProcrunLog"
+ Value=""c:\Windows\System32\icacls.exe" "[SHIBBOLETHDIR]ProcRun\log" [IcaclsVerb] [ACE_USER]:F" />
+ <CustomAction Id="QtSetACEProcrunLog" BinaryKey="WixCA" DllEntry="CAQuietExec" Execute="deferred" Impersonate="no" />
+
+ <InstallExecuteSequence>
+ <!-- Write the ACEs. IdP : conf, creds, logs -->
+ <Custom Action="SetIcaclsVerb" Before="InstallFiles"/>
+ <Custom Action="SetACEConf" After="SetIcaclsVerb"/>
+ <Custom Action="QtSetACEConf" After="QtFinalizeJetty"/>
+
+ <Custom Action="SetACECreds" After="SetIcaclsVerb"/>
+ <Custom Action="QtSetACECreds" After="QtFinalizeJetty"/>
+
+ <Custom Action="SetACELogs" After="SetIcaclsVerb"/>
+ <Custom Action="QtSetACELogs" After="QtFinalizeJetty"/>
+
+ <!-- Write the ACEs. jetty : start.d, tmp, logs -->
+ <Custom Action="SetACEJettyStart" After="SetIcaclsVerb"/>
+ <Custom Action="QtSetACEJettyStart" After="QtFinalizeJetty"/>
+
+ <Custom Action="SetACEJettyTmp" After="SetIcaclsVerb"/>
+ <Custom Action="QtSetACEJettyTmp" After="QtFinalizeJetty"/>
+
+ <Custom Action="SetACEJettyLogs" After="SetIcaclsVerb"/>
+ <Custom Action="QtSetACEJettyLogs" After="QtFinalizeJetty"/>
+
+ <!-- Write the ACEs. Procron: log -->
+ <Custom Action="SetACEProcrunLog" After="SetIcaclsVerb"/>
+ <Custom Action="QtSetACEProcrunLog" After="QtFinalizeJetty"/>
+ </InstallExecuteSequence>
+
+ </Fragment>
+</Wix>
diff --git a/idp-installer/src/main/wix/JettyNew.bat b/idp-installer/src/main/wix/JettyNew.bat
index f646f4cbd..4962db9d9 100644
--- a/idp-installer/src/main/wix/JettyNew.bat
+++ b/idp-installer/src/main/wix/JettyNew.bat
@@ -149,9 +149,11 @@ if ERRORLEVEL 1 (
echo jetty-base/start.d directory not found?
goto done;
)
-rem IDP-1149 make doubley sure that we have a jetty-base\tmp dir
+rem IDP-1149 make doubley sure that we have a jetty-base\tmp & log dir
mkdir tmp
echo "keeper" > tmp\.keep
+mkdir log
+echo "keeper" > log\.log
cd ..\..
"%WIX%/BIN/HEAT" dir idp-jetty-base-extract\jetty-base -platform -gg -dr IDP_INSTALLDIR -var var.jettyBaseRoot -cg JettyBaseGroup -out jetty_base_contents.wxs -src
@@ -188,13 +190,13 @@ REM compile Jetty and procrun contents as well as the main command line
"%WIX%/BIN/CANDLE" -nologo -dJettySrc=jetty-extract\%Jex% -dProcrunSrc=procrun-extract -dPlatform=x86 -arch x86 jetty_contents.wxs Jetty-main.wxs Jetty-Procrun.wxs -ext WixFirewallExtension -ext WixUtilExtension
if ERRORLEVEL 1 goto done
-"%WIX%/BIN/CANDLE" -nologo -arch x86 -djettyBaseRoot=idp-jetty-base-extract\jetty-base jetty_base_contents.wxs jetty-delete.wxs -ext WixUtilExtension
+"%WIX%/BIN/CANDLE" -nologo -arch x86 -djettyBaseRoot=idp-jetty-base-extract\jetty-base jetty_base_contents.wxs Jetty-User.wxs jetty-delete.wxs -ext WixUtilExtension
if ERRORLEVEL 1 goto done
REM link for x64
-"%WIX%/BIN/LIGHT" -nologo -out Jetty-x64.msi jetty_base_contents.wixobj jetty_contents.wixobj Jetty-Procrun.wixobj Jetty-main.wixobj jetty-delete.wixobj -ext WixFirewallExtension -sw1072 -ext WixUtilExtension -sice:ICE61
+"%WIX%/BIN/LIGHT" -nologo -out Jetty-x64.msi jetty_base_contents.wixobj jetty_contents.wixobj Jetty-Procrun.wixobj Jetty-main.wixobj jetty-delete.wixobj Jetty-User.wixobj -ext WixFirewallExtension -sw1072 -ext WixUtilExtension -sice:ICE61
if ERRORLEVEL 1 goto done
dir Jetty-*.msi
diff --git a/idp-installer/src/main/wix/ShibbolethIdP-registry.wxs b/idp-installer/src/main/wix/ShibbolethIdP-registry.wxs
index abedba793..a8880ab8b 100644
--- a/idp-installer/src/main/wix/ShibbolethIdP-registry.wxs
+++ b/idp-installer/src/main/wix/ShibbolethIdP-registry.wxs
@@ -28,7 +28,7 @@
<RegistryValue Id="targetRegJetty" Root="HKLM" Key="SOFTWARE\Shibboleth\IdP" Name="InstallJetty" Value="[INSTALL_JETTY]" Type="string" />
</Component>
<!-- pretty icon for the "install programs" page -->
- <Component Id="shib.ico" Guid="{7F4CE60B-A27B-4E07-8DD9-19F16B008C56}" Directory="TARGETDIR" Win64="yes">
+ <Component Id="shib.ico" Guid="{7F4CE60B-A27B-4E07-8DD9-19F16B008C56}" Directory="INSTALLDIR" Win64="yes">
<File KeyPath="yes" Source="$(var.ProjectDir)\shib.ico" />
<RegistryValue Root="HKLM" Key="Software\Microsoft\Windows\CurrentVersion\Uninstall\[ProductCode]" Name="DisplayIcon" Value="[#shib.ico],0" Type="string" />
</Component>
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list