A maven approach to deploying the Idp

[Cantor, Scott]

On 5/5/15, 7:44 AM, "Misagh Moayyed" <mmoayyed at unicon.net> wrote:
>
>While it's perfectly true that maven does not verify signatures, there are
>plugins that can do the job fairly easily. Provided signatures exist, a
>plugin can check and compare and produce results that are for example:

It was my understanding no such plugins existed, or if they did they didn't work quite the way they needed to, but time may have moved on. I guess the primary issue is whether they will fail the build if the signatures don't involve a trusted key.

We'll certainly look into it.

>Coincidentally, I realized that not all artifacts that are bundled in the
>webapp carry signatures. An example that the plugin is warning me about is
>the hibernate-core dependency, or did you mean artifacts that are produced
>by Shib Dev are signed?

We import everything signed, or sign it ourselves if it's not, but lacking a plugin checking it, we might have missed one.

>At any rate, I believe limiting repository selection and checking
>signatures are doable, unless of course the transport layer is
>questionable as well.

It's very questionable if the basis is commercial TLS.

>On the subject of redeployments, this is certainly a valid concern. As an
>extension to what the IdP does today, an alternative might be to drive the
>loading of various configuration files via environment properties, rather
>than expecting one wholesome directory to contain everything. So for
>example, something like this would work:
>
><import resource="${idp.system.conf.home}/utilities.xml" />

That's probably a good idea just in general rather than relying on layout.

>Where the property is defined in idp.properties or some such that resolves
>prior to loading that particular xml file. This implies that while by
>default everything is packaged up by the idp in its own context, if I
>needed to overwrite the utilities.xml file, I could add that to my overlay
>and simply set that property to my file location.

Yes, that's a good suggestion.

-- Scott