Setup of the local development for Shibboleth and the corresponding development of plugins for Shibboleth

[Cantor, Scott]

Michael,

I don't have a lot I can spend the time to tell you here, but I did want to note that in the absence of a really good reason, I suspect the project's view of this idea is that it's better to deal with security events as a downstream matter based on audit logging than to add attack surface to the codebase with a lot of ancillary stuff like this.

That would go triple for any sort of ingestion of events, but I don't know of this really involves inbound flows, it's probably more outbound anyway.

>    * I would like to know how you build the setup for local development
> of Shibboleth as well as for the associated plugins? 

This varies by developer but mine is to heavily rely on the testbed project that exists because it allows the whole IdP to be run from within Eclipse using the active sources rather than requiring an installed IdP.

However, it is a very minimal testbed that doesn't come with a lot of back-ends, it doesn't really exercise that aspect of things. But with additional work it can be configured to do anything more or less one could do for real by adjusting the configuration. I've tested many advanced features, just not in a sustained way.

https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/2983559169/How+to+Run+the+Testbed+in+Eclipse+with+Jetty+10

>    * Do you use a docker-compose stack for all dependencies, such as
> database, LDAP, etc.?

I go nowhere near Docker unless I'm forced to, it doesn't work for me and the way my mind thinks about problems, and I'm horrible at scripting and automation so it takes me ten times longer to do anything with it than to do whatever I have to do by hand. I envy people who can do that kind of thing and I do agree that it's a good way to set up test environments if you can get your mind right with it.

>    * Which of the project's java-identity-provider artifacts will be
> deployed inside Tomcat?

The testbed uses Jetty and I don't use Tomcat anymore.

>    * What arguments, configurations, or even env variables are used to
> start Shibboleth during development? 

The testtbed covers that with an Eclipse launch config.

>    * Can you provide me with further documentation or help so that I can
> start developing? 

That's the big one: no, I can't. I don't have the bandwidth to provide the necessary documentation, which would take twice as long as the code itself did. The wiki is all there is and it has very little on design and development of the internals.

-- Scott