[java-idp-jetty-base] 01/02: IDP-2297 Explore extending the Plugin and Module Infrastructure to allow Jetty installation

[Rod Widdowson]

This is an automated email from the git hooks/post-receive script.

rdw pushed a commit to branch dev/IDP-2297
in repository java-idp-jetty-base.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-jetty-base.git;a=commit;h=d724251e7335180d1f651d29bdd9b526dc355d8e

commit d724251e7335180d1f651d29bdd9b526dc355d8e
Author: Rod Widdowson <rdw at steadingsoftware.com>
AuthorDate: Wed Oct 9 13:51:11 2024 +0100

    IDP-2297 Explore extending the Plugin and Module Infrastructure to allow Jetty installation
    
    https://shibboleth.atlassian.net/browse/IDP-2297
    
    More work on jetty-config.bat.
---
 .../idp/plugin/jettybase/module/config-jetty.bat   | 48 ++++++++++++++++++----
 1 file changed, 39 insertions(+), 9 deletions(-)

diff --git a/jetty-base-impl/src/main/resources/net/shibboleth/idp/plugin/jettybase/module/config-jetty.bat b/jetty-base-impl/src/main/resources/net/shibboleth/idp/plugin/jettybase/module/config-jetty.bat
index 895225a..e91e058 100644
--- a/jetty-base-impl/src/main/resources/net/shibboleth/idp/plugin/jettybase/module/config-jetty.bat
+++ b/jetty-base-impl/src/main/resources/net/shibboleth/idp/plugin/jettybase/module/config-jetty.bat
@@ -1,4 +1,4 @@
-rem @echo off
+ at echo off
 setlocal
 
 REM We need a JVM
@@ -14,6 +14,7 @@ if not exist "%JAVA_HOME%\bin\server\jvm.dll" (
 
 set IDP_HOME_WINDOWS=%~dp0..
 set JETTY_BASE=%~dp0..\jetty-base
+set JETTY_HOME=%~dp0..\jetty-home
 set PRUNSRV=%IDP_HOME_WINDOWS%\shibd_idp\amd64\prunsrv.exe
 
 for /f "tokens=* USEBACKQ" %%F in (`type "%JETTY_BASE%\jetty.base.linux"`) do (
@@ -43,7 +44,7 @@ if NOT "%2" EQU "" (
    SET PR_SERVICEUSER=%USERNAME%
    SET PR_SERVICEPASSWORD=%PASSWORD%
 ) else (
-    SET PR_SERVICEUSER=LocalSystem
+    SET USERNAME=LocalService
 )
 
 
@@ -56,13 +57,15 @@ REM
 SET PORTPASS=%random%-%random%-%random%-%random%
 
 REM
-REM Use PR_xxx for parameters to keep things legible but also to allow spaces
+REM Use PR_xxx for parameters to keep things legible and to allow for spaces in paths
+REM
 SET PR_DISPLAYNAME=Shibboleth IdP Daemon
 SET PR_DESCRIPTION=Runs the Jetty Container
-SET PR_CLASSPATH=%JETTY_BASE%\start.jar
-SET PR_JVMOPTIONS=-DIdpHome=%IDP_HOME_UNIX%;-Djdk.tls.ephemeralDHKeySize=2048;-Dorg.eclipse.jetty.util.log.class=org.eclipse.jetty.util.log.Slf4jLog;-Djava.io.tmpdir=%JETTY_BASE%\tmp;-XX:+UseG1GC
+SET PR_CLASSPATH=%JETTY_HOME%\start.jar
+SET PR_JVMOPTIONS=-Didp.home=%IDP_HOME_UNIX%;-Djdk.tls.ephemeralDHKeySize=2048;-Dorg.eclipse.jetty.util.log.class=org.eclipse.jetty.util.log.Slf4jLog;-Djava.io.tmpdir=%JETTY_BASE%\tmp;-XX:+UseG1GC
 SET PR_JVMMX=2048
 SET PR_JVM=auto
+SET PR_JAVAHOME=%JAVA_HOME%
 
 SET PR_LOGPATH=%IDP_HOME_WINDOWS%\logs
 SET PR_STDOUTPUT=auto
@@ -74,20 +77,47 @@ SET PR_STARTPARAMS=STOP_PORT=8963;STOP.KEY=%PORTPASS%;jetty.base=%JETTY_BASE%;je
 
 SET PR_STOPMODE=JVM
 SET PR_STOPCLASS=org.eclipse.jetty.start.Main
-SET PR_STOPPARAMS=--stop;STOP_PORT=8963;STOP.KEY=%PORTPASS%;jetty.base=%JETTY_BASE%;jetty.logging.dir=%IDP_HOME_WINDOWS%\logs
+SET PR_STOPPARAMS=--stop;%PR_STARTPARAMS%
 
 %PRUNSRV% //IS/Shibd_idp --Startup=auto
 
-exit /r
 REM
 REM With that done poke holes in the firewall using "netsh advfirewall"
 REM
-.
+REM netsh advfirewall firewall add rule name="Shibboleth IdP Service" dir=in action=allow program="%PRUNSRV% " enable=yes protocol=tcp
+
 REM
-REM And finally lock down the install
+REM Lock down the install
 REM
 call %~dp0\setacl.bat %USERNAME%
 
+REM
+REM We also need to lock down jetty-base-tmp
+REM
+echo Setting FULL ACL on %JETTY_BASE%\tmp directory for SYSTEM,  Administrators and %USERNAME%
+icacls "%JETTY_BASE%\tmp" /t /inheritance:r /grant:r "SYSTEM:(OI)(CI)(F)" "Administrators:(OI)(CI)(F)" "%USERNAME%:(OI)(CI)(F)" /q
+if ERRORLEVEL 1 (
+   echo Error: Could not set ACL
+   exit /b
+)
+
+echo Setting FULL ACL on %JETTY_BASE%\tmp directory content for SYSTEM,  Administrators and %USERNAME%
+icacls "%JETTY_BASE%\tmp" /t /inheritance:r /grant:r SYSTEM:F Administrators:F "%USERNAME%:F" /q
+if ERRORLEVEL 1 (
+  echo Error: Could not set ACL
+  exit /b
+)
+
+
+REM
+REM start the service
+REM
+
+%PRUNSRV% //ES/Shibd_idp
+
+REM
+REM All done!
+REM
 exit /b
 
 

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.