<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0">
<base href="https://shibboleth.atlassian.net">
<title>Message Title</title>
</head>
<body class="jira" style="color: #333333; font-family: Arial, sans-serif; font-size: 14px; line-height: 1.429">
<table id="background-table" cellpadding="0" cellspacing="0" width="100%" style="border-collapse: collapse; mso-table-lspace: 0; mso-table-rspace: 0; background-color: #f5f5f5; border-collapse: collapse; mso-table-lspace: 0; mso-table-rspace: 0" bgcolor="#f5f5f5"><!-- header here -->
<tbody>
<tr>
<td id="header-pattern-container" style="padding: 0; border-collapse: collapse; padding: 10px 20px">
<table id="header-pattern" cellspacing="0" cellpadding="0" border="0" style="border-collapse: collapse; mso-table-lspace: 0; mso-table-rspace: 0">
<tbody>
<tr>
<td id="header-avatar-image-container" valign="top" style="padding: 0; border-collapse: collapse; vertical-align: top; width: 32px; padding-right: 8px" width="32"><img id="header-avatar-image" class="image_fix" src="https://avatar-management--avatars.us-west-2.prod.public.atl-paas.net/59fb32bbc24efb3c4ed3c977/a0c45ae9-ceeb-41b4-94a1-1eed64e25ae4/48" height="32" width="32" border="0" style="border-radius: 3px; vertical-align: top"></td>
<td id="header-text-container" valign="middle" style="padding: 0; border-collapse: collapse; vertical-align: middle; font-family: Arial, sans-serif; font-size: 14px; line-height: 20px; mso-line-height-rule: exactly; mso-text-raise: 1px"><a class="user-hover" rel="59fb32bbc24efb3c4ed3c977" style="color:#3b73af;; color: #3b73af; text-decoration: none" id="email_59fb32bbc24efb3c4ed3c977" href="https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=59fb32bbc24efb3c4ed3c977"> Rod Widdowson </a><strong>commented</strong> on <a href="https://shibboleth.atlassian.net/browse/IDP-1927?atlOrigin=eyJpIjoiNWYwNjgwNTU0YjI2NDFhODhjOTY5MzRiM2RhNDA0ZjAiLCJwIjoiaiJ9" style="color: #3b73af; text-decoration: none"><img src="cid:jira-generated-image-avatar-6e69dc7e-5c14-40df-a624-7ca963a2275b" height="16" width="16" border="0" align="absmiddle" alt="Improvement"> IDP-1927</a></td>
</tr>
</tbody>
</table></td>
</tr>
<tr>
<td id="email-content-container" style="padding: 0; border-collapse: collapse; padding: 0 20px">
<table id="email-content-table" cellspacing="0" cellpadding="0" border="0" width="100%" style="border-collapse: collapse; mso-table-lspace: 0; mso-table-rspace: 0; border-spacing: 0; border-collapse: separate">
<tbody>
<tr><!-- there needs to be content in the cell for it to render in some clients -->
<td class="email-content-rounded-top mobile-expand" style="padding: 0; border-collapse: collapse; color: #ffffff; padding: 0 15px 0 16px; height: 15px; background-color: #ffffff; border-left: 1px solid #cccccc; border-top: 1px solid #cccccc; border-right: 1px solid #cccccc; border-bottom: 0; border-top-right-radius: 5px; border-top-left-radius: 5px; height: 10px; line-height: 10px; padding: 0 15px 0 16px; mso-line-height-rule: exactly" height="10" bgcolor="#ffffff"> </td>
</tr>
<tr>
<td class="email-content-main mobile-expand " style="padding: 0; border-collapse: collapse; border-left: 1px solid #cccccc; border-right: 1px solid #cccccc; border-top: 0; border-bottom: 0; padding: 0 15px 0 16px; background-color: #ffffff" bgcolor="#ffffff">
<table class="page-title-pattern" cellspacing="0" cellpadding="0" border="0" width="100%" style="border-collapse: collapse; mso-table-lspace: 0; mso-table-rspace: 0">
<tbody>
<tr>
<td style="vertical-align: top;; padding: 0; border-collapse: collapse; padding-right: 5px; font-size: 20px; line-height: 30px; mso-line-height-rule: exactly" class="page-title-pattern-header-container"><span class="page-title-pattern-header" style="font-family: Arial, sans-serif; padding: 0; font-size: 20px; line-height: 30px; mso-text-raise: 2px; mso-line-height-rule: exactly; vertical-align: middle"> <a href="https://shibboleth.atlassian.net/browse/IDP-1927?atlOrigin=eyJpIjoiNWYwNjgwNTU0YjI2NDFhODhjOTY5MzRiM2RhNDA0ZjAiLCJwIjoiaiJ9" style="color: #3b73af; text-decoration: none">Re: Make Jetty run under its own credentials for windows installs</a> </span></td>
</tr>
</tbody>
</table></td>
</tr>
<tr>
<td id="text-paragraph-pattern-top" class="email-content-main mobile-expand comment-top-pattern" style="padding: 0; border-collapse: collapse; border-left: 1px solid #cccccc; border-right: 1px solid #cccccc; border-top: 0; border-bottom: 0; padding: 0 15px 0 16px; background-color: #ffffff; border-bottom: none; padding-bottom: 0" bgcolor="#ffffff">
<table class="text-paragraph-pattern" cellspacing="0" cellpadding="0" border="0" width="100%" style="border-collapse: collapse; mso-table-lspace: 0; mso-table-rspace: 0; font-family: Arial, sans-serif; font-size: 14px; line-height: 20px; mso-line-height-rule: exactly; mso-text-raise: 2px">
<tbody>
<tr>
<td class="text-paragraph-pattern-container mobile-resize-text " style="padding: 0; border-collapse: collapse; padding: 0 0 10px"><p style="margin: 10px 0 0; margin-top: 0">After making the changes described in the above document, if you install a next version, the permissions on everything is reverted except</p>
<ul>
<li><tt>IdP/logs</tt></li>
<li><tt>IdP/jetty-base/logs</tt></li>
<li><tt>HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Apache Software Foundation\Procrun 2.0\shibd_idp</tt></li>
</ul><p style="margin: 10px 0 0">We can argue the toss about this, but the critical thing is that the service account is reset (the rest can be fixed easily in the installer) I suspect that this is because we use <tt>afterInstallInitialize</tt> rather than <tt>afterInstallExecute</tt> for the <a href="https://wixtoolset.org/documentation/manual/v3/xsd/wix/majorupgrade.html" class="external-link" rel="nofollow noreferrer" style="color: #3b73af; text-decoration: none"><MajorUpgrade/></a>. This means that the service is removed and then re-installed (with what the installer says which is to say no account). If we ‘just' change the installer to run as an account (and this is critical) in order to keep things working, every upgrade requires the password. </p><p style="margin: 10px 0 0">The options are</p>
<ol>
<li>Require Service Accounts. I don’t like this because I don’t believe that we are expert in that domain and I’m pretty sure that there isn’t a “one size fits all” answer. For this reason - spoiler alert - I (think I) will be pushing for the account to be created outwith the installation - providing hooks for federations that want to automate the issue.</li>
<li>try <tt>afterInstallExecute</tt> . This is always a bit white knuckle because it require adherence requires to the component rules. The only things that carry versions are the procrun executables. Specifically the jars do not carry version information (in the Windows sense) and hence the component rules will rely on date. This is a super flaky thing to do: Consider <tt>important-jar.3.1.2.jar</tt> which needs to be replaced by <tt>important-jat-3.2.0.jar</tt> but somewhere in the handling (including area outside our control like maven central) the dates get mangled and the 3.1.2 jar appears more modern than the 3.20 one. We end up short of luck.<br> The mitigation to this would be to bring forward the installation technique I want to do for 5.0 which is to say that the install (at least of the IdP bits) is to somewhere else and we devolved the entire “IdP installation” thing to the IdP installer (in practical terms to use the <tt>install</tt> target rather than the <tt>install-nocopy</tt> one).</li>
<li>Force the person installing to put in the password every time (ugh)</li>
<li>Pin the service component with the password that is entered initially. The down side is that the service will continue to exist (and will just fail to start) after an uninstall.</li>
<li>Force the person installing to change the password in the services control panel thingy after an upgrade.</li>
</ol><p style="margin: 10px 0 0">I hate (3) & (5). I really don’t like (1), I’m not keen on (4) and (2) scares me more than somewhat. Guess it sucks to be me.</p></td>
</tr>
</tbody>
</table></td>
</tr>
<tr>
<td class="email-content-main mobile-expand " style="padding: 0; border-collapse: collapse; border-left: 1px solid #cccccc; border-right: 1px solid #cccccc; border-top: 0; border-bottom: 0; padding: 0 15px 0 16px; background-color: #ffffff" bgcolor="#ffffff"><script type="application/ld+json">
{
"@context": "http://schema.org",
"@type": "EmailMessage",
"description": "View Issue",
"potentialAction": {
"@type": "ViewAction",
"target": "https://shibboleth.atlassian.net/browse/IDP-1927?inbox=true&focusedCommentId=33645&page=com.atlassian.jira.plugin.system.issuetabpanels%3Acomment-tabpanel#comment-33645",
"name": "View Comment"
},
"publisher": {
"@type": "Organization",
"name": "Atlassian",
"url": "https://www.atlassian.com"
}
}
</script>
<table id="actions-pattern" cellspacing="0" cellpadding="0" border="0" width="100%" style="border-collapse: collapse; mso-table-lspace: 0; mso-table-rspace: 0; font-family: Arial, sans-serif; font-size: 14px; line-height: 20px; mso-line-height-rule: exactly; mso-text-raise: 1px">
<tbody>
<tr>
<td id="actions-pattern-container" valign="middle" style="padding: 0; border-collapse: collapse; padding: 10px 0 10px 24px; vertical-align: middle; padding-left: 0">
<table align="left" style="border-collapse: collapse; mso-table-lspace: 0; mso-table-rspace: 0">
<tbody>
<tr>
<td class="actions-pattern-action-icon-container" style="padding: 0; border-collapse: collapse; font-family: Arial, sans-serif; font-size: 14px; line-height: 20px; mso-line-height-rule: exactly; mso-text-raise: 0; vertical-align: middle"><a href="https://shibboleth.atlassian.net/browse/IDP-1927#add-comment?atlOrigin=eyJpIjoiNWYwNjgwNTU0YjI2NDFhODhjOTY5MzRiM2RhNDA0ZjAiLCJwIjoiaiJ9" target="_blank" title="Add Comment" style="color: #3b73af; text-decoration: none"> <img class="actions-pattern-action-icon-image" src="cid:jira-generated-image-static-comment-icon-47a56176-4ef1-4975-896d-6d0d922deacc" alt="Add Comment" title="Add Comment" height="16" width="16" border="0" style="vertical-align: middle"> </a></td>
<td class="actions-pattern-action-text-container" style="padding: 0; border-collapse: collapse; font-family: Arial, sans-serif; font-size: 14px; line-height: 20px; mso-line-height-rule: exactly; mso-text-raise: 4px; padding-left: 5px"><a href="https://shibboleth.atlassian.net/browse/IDP-1927#add-comment?atlOrigin=eyJpIjoiNWYwNjgwNTU0YjI2NDFhODhjOTY5MzRiM2RhNDA0ZjAiLCJwIjoiaiJ9" target="_blank" title="Add Comment" style="color: #3b73af; text-decoration: none">Add Comment</a></td>
</tr>
</tbody>
</table></td>
</tr>
</tbody>
</table></td>
</tr><!-- there needs to be content in the cell for it to render in some clients -->
<tr>
<td class="email-content-rounded-bottom mobile-expand" style="padding: 0; border-collapse: collapse; color: #ffffff; padding: 0 15px 0 16px; height: 5px; line-height: 5px; background-color: #ffffff; border-top: 0; border-left: 1px solid #cccccc; border-bottom: 1px solid #cccccc; border-right: 1px solid #cccccc; border-bottom-right-radius: 5px; border-bottom-left-radius: 5px; mso-line-height-rule: exactly" height="5" bgcolor="#ffffff"> </td>
</tr>
</tbody>
</table></td>
</tr>
<tr>
<td id="footer-pattern" style="padding: 0; border-collapse: collapse; padding: 12px 20px">
<table id="footer-pattern-container" cellspacing="0" cellpadding="0" border="0" style="border-collapse: collapse; mso-table-lspace: 0; mso-table-rspace: 0">
<tbody>
<tr>
<td id="footer-pattern-mobile-separated-links" class="mobile-resize-text" width="100%" colspan="2" style="padding: 0; border-collapse: collapse; color: #999999; font-size: 12px; line-height: 18px; font-family: Arial, sans-serif; mso-line-height-rule: exactly; mso-text-raise: 2px"> Get Jira notifications on your phone! Download the Jira Cloud app for <a href="https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&referrer=utm_source%3DNotificationLink%26utm_medium%3DEmail" style="color: #3b73af; text-decoration: none">Android</a> or <a href="https://itunes.apple.com/app/apple-store/id1006972087?pt=696495&ct=EmailNotificationLink&mt=8" style="color: #3b73af; text-decoration: none">iOS</a>
<hr></td>
</tr>
<tr>
<td id="footer-pattern-text" class="mobile-resize-text" width="100%" style="padding: 0; border-collapse: collapse; color: #999999; font-size: 12px; line-height: 18px; font-family: Arial, sans-serif; mso-line-height-rule: exactly; mso-text-raise: 2px"> This message was sent by Atlassian Jira <span id="footer-build-information">(v1001.0.0-SNAPSHOT#100208-<span title="38b2e238772c3c75cb3ed24c8d4429848901b70e" data-commit-id="38b2e238772c3c75cb3ed24c8d4429848901b70e}">sha1:38b2e23</span>)</span></td>
<td id="footer-pattern-logo-desktop-container" valign="top" style="padding: 0; border-collapse: collapse; padding-left: 20px; vertical-align: top">
<table style="border-collapse: collapse; mso-table-lspace: 0; mso-table-rspace: 0">
<tbody>
<tr>
<td id="footer-pattern-logo-desktop-padding" style="padding: 0; border-collapse: collapse; padding-top: 3px; opacity: 0.150"><img id="footer-pattern-logo-desktop" src="cid:jira-generated-image-static-footer-desktop-logo-51d1be18-4dae-4434-8219-06c5ec709155" alt="Atlassian logo" title="Atlassian logo" width="192" height="24" class="image_fix"></td>
</tr>
</tbody>
</table></td>
</tr>
</tbody>
</table></td>
</tr>
</tbody>
</table>
</body>
</html>