Shibboleth-IDP rpm packaging

[Philip Prindeville]

The "why" is: this is a set of requirements that got dumped in my lap 2 weeks ago to support SSO for an existing product (based on Centos 6.6).

========
From: dev <dev-bounces at shibboleth.net> on behalf of Ian Young <ian at iay.org.uk>
Reply-To: Shib Dev <dev at shibboleth.net>
Date: Monday, June 17, 2019 at 3:54 AM
To: Shib Dev <dev at shibboleth.net>
Subject: Re: Shibboleth-IDP rpm packaging

On 15 Jun 2019, at 22:32, Philip Prindeville <mailto:philip.prindeville at gigamon.com> wrote:

My understanding of Shibboleth is that it gets configured, then installed, then built/rebuilt in the target directory, which is almost the reverse of the traditional RPM packaging steps.

I think that's a fair summary, as far as it goes. It's like that for good reasons, of course: the mechanism by which IdP extensions and customisations are incorporated into what the servlet container sees being the most obvious.

The other aspect you haven't touched on is the dependency on the servlet container, and the way in which the two are integrated. Both RHEL/CentOS 6 and 7 come with versions of Tomcat and Jetty we don't support and wouldn't actually recommend, so you might end up needing to repackage newer versions (along with the integration configuration, which isn't part of the IdP product) as well as the IdP.

Not saying this is impossible, by any means, but it's far from easy which is I guess why someone hasn't done it already. I'd be particularly wary of putting a lot of effort into packaging for CentOS 6, which only has 18 months or so left to run. I'd be pretty surprised if anyone was making new deployments based on it, given that RHEL 8 is already out (and CentOS 8 soon(TM)).

It's definitely going to depend on _why_ you want to do this, which you haven't indicated in your post. If what you're trying to do is build a packaging solution for the future, for a large number of systems, I'd suggest looking at (Linux) containers instead. Several people have built IdP appliances using Docker-like systems, and although it's still tricky depending on what level of customisation you want there's at least proof of concept level stuff out there.


    -- Ian





This message may contain confidential and privileged information. If it has been sent to you in error, please reply to advise the sender of the error and then immediately delete it. If you are not the intended recipient, do not read, copy, disclose or otherwise use this message. The sender disclaims any liability for such unauthorized use. NOTE that all incoming emails sent to Gigamon email accounts will be archived and may be scanned by us and/or by external service providers to detect and prevent threats to our systems, investigate illegal or inappropriate behavior, and/or eliminate unsolicited promotional emails (“spam”).