<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0">
<base href="https://shibboleth.atlassian.net">
<title>Message Title</title>
</head>
<body class="jira" style="color: #333333; font-family: Arial, sans-serif; font-size: 14px; line-height: 1.429">
<table id="background-table" cellpadding="0" cellspacing="0" width="100%" style="border-collapse: collapse; mso-table-lspace: 0; mso-table-rspace: 0; background-color: #f5f5f5; border-collapse: collapse; mso-table-lspace: 0; mso-table-rspace: 0" bgcolor="#f5f5f5"><!-- header here -->
<tbody>
<tr>
<td id="header-pattern-container" style="padding: 0; border-collapse: collapse; padding: 10px 20px">
<table id="header-pattern" cellspacing="0" cellpadding="0" border="0" style="border-collapse: collapse; mso-table-lspace: 0; mso-table-rspace: 0">
<tbody>
<tr>
<td id="header-avatar-image-container" valign="top" style="padding: 0; border-collapse: collapse; vertical-align: top; width: 32px; padding-right: 8px" width="32"><img id="header-avatar-image" class="image_fix" src="https://avatar-management--avatars.us-west-2.prod.public.atl-paas.net/59fb32bbc24efb3c4ed3c977/a0c45ae9-ceeb-41b4-94a1-1eed64e25ae4/48" height="32" width="32" border="0" style="border-radius: 3px; vertical-align: top"></td>
<td id="header-text-container" valign="middle" style="padding: 0; border-collapse: collapse; vertical-align: middle; font-family: Arial, sans-serif; font-size: 14px; line-height: 20px; mso-line-height-rule: exactly; mso-text-raise: 1px"><a class="user-hover" rel="59fb32bbc24efb3c4ed3c977" style="color:#3b73af;; color: #3b73af; text-decoration: none" id="email_59fb32bbc24efb3c4ed3c977" href="https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=59fb32bbc24efb3c4ed3c977"> Rod Widdowson </a><strong>commented</strong> on <a href="https://shibboleth.atlassian.net/browse/IDP-1927?atlOrigin=eyJpIjoiMzVlNDM0NWE0NDlkNGViNjgyZjBkYjdhOTBlODE3YmEiLCJwIjoiaiJ9" style="color: #3b73af; text-decoration: none"><img src="cid:jira-generated-image-avatar-b0c33cbe-33c6-451b-93f3-1eafa43a4c76" height="16" width="16" border="0" align="absmiddle" alt="Improvement"> IDP-1927</a></td>
</tr>
</tbody>
</table></td>
</tr>
<tr>
<td id="email-content-container" style="padding: 0; border-collapse: collapse; padding: 0 20px">
<table id="email-content-table" cellspacing="0" cellpadding="0" border="0" width="100%" style="border-collapse: collapse; mso-table-lspace: 0; mso-table-rspace: 0; border-spacing: 0; border-collapse: separate">
<tbody>
<tr><!-- there needs to be content in the cell for it to render in some clients -->
<td class="email-content-rounded-top mobile-expand" style="padding: 0; border-collapse: collapse; color: #ffffff; padding: 0 15px 0 16px; height: 15px; background-color: #ffffff; border-left: 1px solid #cccccc; border-top: 1px solid #cccccc; border-right: 1px solid #cccccc; border-bottom: 0; border-top-right-radius: 5px; border-top-left-radius: 5px; height: 10px; line-height: 10px; padding: 0 15px 0 16px; mso-line-height-rule: exactly" height="10" bgcolor="#ffffff"> </td>
</tr>
<tr>
<td class="email-content-main mobile-expand " style="padding: 0; border-collapse: collapse; border-left: 1px solid #cccccc; border-right: 1px solid #cccccc; border-top: 0; border-bottom: 0; padding: 0 15px 0 16px; background-color: #ffffff" bgcolor="#ffffff">
<table class="page-title-pattern" cellspacing="0" cellpadding="0" border="0" width="100%" style="border-collapse: collapse; mso-table-lspace: 0; mso-table-rspace: 0">
<tbody>
<tr>
<td style="vertical-align: top;; padding: 0; border-collapse: collapse; padding-right: 5px; font-size: 20px; line-height: 30px; mso-line-height-rule: exactly" class="page-title-pattern-header-container"><span class="page-title-pattern-header" style="font-family: Arial, sans-serif; padding: 0; font-size: 20px; line-height: 30px; mso-text-raise: 2px; mso-line-height-rule: exactly; vertical-align: middle"> <a href="https://shibboleth.atlassian.net/browse/IDP-1927?atlOrigin=eyJpIjoiMzVlNDM0NWE0NDlkNGViNjgyZjBkYjdhOTBlODE3YmEiLCJwIjoiaiJ9" style="color: #3b73af; text-decoration: none">Re: Make Jetty run under its own credentials for windows installs</a> </span></td>
</tr>
</tbody>
</table></td>
</tr>
<tr>
<td id="text-paragraph-pattern-top" class="email-content-main mobile-expand comment-top-pattern" style="padding: 0; border-collapse: collapse; border-left: 1px solid #cccccc; border-right: 1px solid #cccccc; border-top: 0; border-bottom: 0; padding: 0 15px 0 16px; background-color: #ffffff; border-bottom: none; padding-bottom: 0" bgcolor="#ffffff">
<table class="text-paragraph-pattern" cellspacing="0" cellpadding="0" border="0" width="100%" style="border-collapse: collapse; mso-table-lspace: 0; mso-table-rspace: 0; font-family: Arial, sans-serif; font-size: 14px; line-height: 20px; mso-line-height-rule: exactly; mso-text-raise: 2px">
<tbody>
<tr>
<td class="text-paragraph-pattern-container mobile-resize-text " style="padding: 0; border-collapse: collapse; padding: 0 0 10px">
<blockquote style="margin: 10px 0 0; margin-top: 0; border-left: 1px solid #cccccc; color: #707070; margin-left: 19px; padding: 10px 20px">
<p style="margin: 10px 0 0; margin-top: 0">I thought there was a way to have a root-like account impersonate a lower-privilege one at runtime.</p>
</blockquote><p style="margin: 10px 0 0">Absolutely. It's what servers (like SMB and indeed) use to pretend that they are the user who’d data they are servicing. (Of course when they came to do V1 of docker they introduced an entirely different mechanism, but I digress).</p><p style="margin: 10px 0 0">I’ve been avoiding this for several reasons</p>
<ul>
<li>It’s all done programmatically and I’m still hoping to avoid writing any C/C++/C# to make this work. (actually I’d need a great deal of persuasion to write code)</li>
<li>Impersonation is a per-thread characteristic - I’d need to be completely convinced that the JVM was inheriting the impersonation token correctly when it created threads (and I have never been impressed by the Windows expertise demonstrated by the Windows JVM writers).</li>
<li>When it comes to it there is still a privileged process kicking around.</li>
</ul><p style="margin: 10px 0 0">Running a service as a specific process is the “Windows way”, but it comes at the cost of needing a password to start the process (AFAIK - but see below). You don’t actually <em>need</em> a password to start a process - just call <a href="https://learn.microsoft.com/en-us/windows/win32/api/processthreadsapi/nf-processthreadsapi-createprocessasuserw" class="external-link" rel="nofollow noreferrer" style="color: #3b73af; text-decoration: none">CreateProcessAsUser</a>). </p><p style="margin: 10px 0 0">The nice thing about creating a process as a user (with or without password) is that there is no way that privilege can escape. The user can be as unempowered as we choose (it just has to have read and write access to the right files and be allowed to listen on port 80 & 443).</p><p style="margin: 10px 0 0">We are diving deep into the area about which I know nothing but it appears that <a href="https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/understand-service-accounts" class="external-link" rel="nofollow noreferrer" style="color: #3b73af; text-decoration: none">Virtual Accounts</a> offer some of the advantages of the rather more coherent Unix “Run as this process which doesn’t have a password” (How hard would that have been to orchestrate for Windows?)</p><p style="margin: 10px 0 0">Of course the architecturally correct (but probably infeasible) way to do this is to spot that Jetty wants to start itself as a slave process (indeed, the installer sweats buckets to stop it doing that). So there is an natural alignment between the Windows Service idea of “Do something on Start”, “create a process”, do “something to stop” and Jetty. But that would require mixed mode code and surgery inside Jetty where it forks the process (to make it call CreateProcessAsUser). it would probably also require some abuse of the Windows Service architecture as well.</p><p style="margin: 10px 0 0">We are <b>so</b> not in that business (which not to say that the jetty people should be - but if they had cycles they would be better invested in doing a decent runtime JVM).</p><p style="margin: 10px 0 0">On reflection overnight I am reasonably convinced that creating a user as part of the installation is the wrong way to go. It seems like a far better bet to pass the name of an already existing account in to the installation (and we can persist a username so that we can survive updates). That puts the question of passwords and passwordless deployment back on the deployer who should be the domain expert (or of course our colleagues in the Federations who have to support them).</p><p style="margin: 10px 0 0">I have some further and details spelunking to do around the service installation (about password inheritance) which I’ll detail in further technical notes but my current plan (once my research is done is)</p>
<ul>
<li>Document how to take an existing installation and make it run as a non privileged account. (Possibly with notification of things you need to redo after every update)</li>
<li>If possible, encapsulate this into the installer (<tt>msiexec /i idp.msi SHIBD_USER=.\foobar</tt>)</li>
<li>Otherwise (and again only if possible) investigate (or encourage others to investigate) writing scripting post installation options (ugh, powershell I really don’t want to learn that)</li>
</ul></td>
</tr>
</tbody>
</table></td>
</tr>
<tr>
<td class="email-content-main mobile-expand " style="padding: 0; border-collapse: collapse; border-left: 1px solid #cccccc; border-right: 1px solid #cccccc; border-top: 0; border-bottom: 0; padding: 0 15px 0 16px; background-color: #ffffff" bgcolor="#ffffff"><script type="application/ld+json">
{
"@context": "http://schema.org",
"@type": "EmailMessage",
"description": "View Issue",
"potentialAction": {
"@type": "ViewAction",
"target": "https://shibboleth.atlassian.net/browse/IDP-1927?inbox=true&focusedCommentId=33610&page=com.atlassian.jira.plugin.system.issuetabpanels%3Acomment-tabpanel#comment-33610",
"name": "View Comment"
},
"publisher": {
"@type": "Organization",
"name": "Atlassian",
"url": "https://www.atlassian.com"
}
}
</script>
<table id="actions-pattern" cellspacing="0" cellpadding="0" border="0" width="100%" style="border-collapse: collapse; mso-table-lspace: 0; mso-table-rspace: 0; font-family: Arial, sans-serif; font-size: 14px; line-height: 20px; mso-line-height-rule: exactly; mso-text-raise: 1px">
<tbody>
<tr>
<td id="actions-pattern-container" valign="middle" style="padding: 0; border-collapse: collapse; padding: 10px 0 10px 24px; vertical-align: middle; padding-left: 0">
<table align="left" style="border-collapse: collapse; mso-table-lspace: 0; mso-table-rspace: 0">
<tbody>
<tr>
<td class="actions-pattern-action-icon-container" style="padding: 0; border-collapse: collapse; font-family: Arial, sans-serif; font-size: 14px; line-height: 20px; mso-line-height-rule: exactly; mso-text-raise: 0; vertical-align: middle"><a href="https://shibboleth.atlassian.net/browse/IDP-1927#add-comment?atlOrigin=eyJpIjoiMzVlNDM0NWE0NDlkNGViNjgyZjBkYjdhOTBlODE3YmEiLCJwIjoiaiJ9" target="_blank" title="Add Comment" style="color: #3b73af; text-decoration: none"> <img class="actions-pattern-action-icon-image" src="cid:jira-generated-image-static-comment-icon-003d7c2a-60a6-4eec-8065-b2f45621bb63" alt="Add Comment" title="Add Comment" height="16" width="16" border="0" style="vertical-align: middle"> </a></td>
<td class="actions-pattern-action-text-container" style="padding: 0; border-collapse: collapse; font-family: Arial, sans-serif; font-size: 14px; line-height: 20px; mso-line-height-rule: exactly; mso-text-raise: 4px; padding-left: 5px"><a href="https://shibboleth.atlassian.net/browse/IDP-1927#add-comment?atlOrigin=eyJpIjoiMzVlNDM0NWE0NDlkNGViNjgyZjBkYjdhOTBlODE3YmEiLCJwIjoiaiJ9" target="_blank" title="Add Comment" style="color: #3b73af; text-decoration: none">Add Comment</a></td>
</tr>
</tbody>
</table></td>
</tr>
</tbody>
</table></td>
</tr><!-- there needs to be content in the cell for it to render in some clients -->
<tr>
<td class="email-content-rounded-bottom mobile-expand" style="padding: 0; border-collapse: collapse; color: #ffffff; padding: 0 15px 0 16px; height: 5px; line-height: 5px; background-color: #ffffff; border-top: 0; border-left: 1px solid #cccccc; border-bottom: 1px solid #cccccc; border-right: 1px solid #cccccc; border-bottom-right-radius: 5px; border-bottom-left-radius: 5px; mso-line-height-rule: exactly" height="5" bgcolor="#ffffff"> </td>
</tr>
</tbody>
</table></td>
</tr>
<tr>
<td id="footer-pattern" style="padding: 0; border-collapse: collapse; padding: 12px 20px">
<table id="footer-pattern-container" cellspacing="0" cellpadding="0" border="0" style="border-collapse: collapse; mso-table-lspace: 0; mso-table-rspace: 0">
<tbody>
<tr>
<td id="footer-pattern-mobile-separated-links" class="mobile-resize-text" width="100%" colspan="2" style="padding: 0; border-collapse: collapse; color: #999999; font-size: 12px; line-height: 18px; font-family: Arial, sans-serif; mso-line-height-rule: exactly; mso-text-raise: 2px"> Get Jira notifications on your phone! Download the Jira Cloud app for <a href="https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&referrer=utm_source%3DNotificationLink%26utm_medium%3DEmail" style="color: #3b73af; text-decoration: none">Android</a> or <a href="https://itunes.apple.com/app/apple-store/id1006972087?pt=696495&ct=EmailNotificationLink&mt=8" style="color: #3b73af; text-decoration: none">iOS</a>
<hr></td>
</tr>
<tr>
<td id="footer-pattern-text" class="mobile-resize-text" width="100%" style="padding: 0; border-collapse: collapse; color: #999999; font-size: 12px; line-height: 18px; font-family: Arial, sans-serif; mso-line-height-rule: exactly; mso-text-raise: 2px"> This message was sent by Atlassian Jira <span id="footer-build-information">(v1001.0.0-SNAPSHOT#100207-<span title="427dab2cbcad9a46dab0b522e31b5431758f83b4" data-commit-id="427dab2cbcad9a46dab0b522e31b5431758f83b4}">sha1:427dab2</span>)</span></td>
<td id="footer-pattern-logo-desktop-container" valign="top" style="padding: 0; border-collapse: collapse; padding-left: 20px; vertical-align: top">
<table style="border-collapse: collapse; mso-table-lspace: 0; mso-table-rspace: 0">
<tbody>
<tr>
<td id="footer-pattern-logo-desktop-padding" style="padding: 0; border-collapse: collapse; padding-top: 3px; opacity: 0.150"><img id="footer-pattern-logo-desktop" src="cid:jira-generated-image-static-footer-desktop-logo-0ad260e0-dffb-416c-8ff4-13fca907d85b" alt="Atlassian logo" title="Atlassian logo" width="192" height="24" class="image_fix"></td>
</tr>
</tbody>
</table></td>
</tr>
</tbody>
</table></td>
</tr>
</tbody>
</table>
</body>
</html>