IdP V4 Installer

[Etienne Dysli Metref]

On 19/12/2019 14.06, Cantor, Scott wrote:
>> Passwords end up in idp.properties (and in the output).
> 
> Which output?

In the installer's log which ends up in the console. More precisely this
line:

> DEBUG [net.shibboleth.idp.installer.V4Install:234] - Creating /home/user/Downloads/test_idp4/conf/idp.properties from /home/user/Downloads/test_idp4/dist/conf/idp.properties and {idp.entityID=https://mymachine.switch.ch/idp/shibboleth, idp.sealer.keyPassword=mypassword, idp.sealer.storePassword=mypassword, idp.scope=switch.ch}


>> This one is more dangerous than confusing. Can we avoid mixing secret
>> bits and configuration by putting all passwords in a separate properties
>> file?
> 
> Not for upgrades obviously, but I think we should fix the defaults.
> I'm not sure how that impacts the installer though.
We currently separate secrets for v3 by storing them into
`conf/credentials.properties` which is included from
`conf/idp.properties`. We have a wrapper script for the installer [1]
that generates this file and executes the installer with
`-Didp.sealer.password=$(cut -d " " -f3 <credentials.properties)` among
other flags.

[1] https://www.switch.ch/aai/guides/idp/installation/idp-install.sh

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
URL: <http://shibboleth.net/pipermail/dev/attachments/20191219/b196fe12/attachment-0001.sig>