Externalizing parameters in attribute-resolver.xml to a properties file

[Smith, Matthew J.]

Excellent, thank you!

Matthew J. Smith
University of Connecticut UITS
matt.smith at uconn.edu
________________________________________
From: users-bounces at shibboleth.net [users-bounces at shibboleth.net] On Behalf Of Christopher Bongaarts [cab at umn.edu]
Sent: Monday, August 27, 2012 12:13 PM
To: users at shibboleth.net
Subject: Re: Externalizing parameters in attribute-resolver.xml to a properties file

On 8/27/2012 10:51 AM, Smith, Matthew J. wrote:

> I'd like to store Shib IdP configs in our git VCS, but do not want to
> check in files with sensitive information.  Is it possible to
> externalize parameters, such as the principalCredential of the LDAP
> DataConnector, to an external properties file which can be referenced
> by attribute-resolver.xml?  I have search the wiki to no avail, but
> if documentation for this already does exist, please feel free to
> just hit me over the head with it.

   https://wiki.shibboleth.net/confluence/display/SHIB2/IdPConfigResource

As an example, our services.xml:

     <srv:Service id="shibboleth.AttributeResolver"
              xsi:type="attribute-resolver:ShibbolethAttributeResolver"
              configurationResourcePollingFrequency="PT3M"
              configurationResourcePollingRetryAttempts="5">
         <srv:ConfigurationResource
file="/.../idp/conf/attribute-resolver.xml"
xsi:type="resource:FilesystemResource">
       <ResourceFilter xsi:type="PropertyReplacement"
                         xmlns="urn:mace:shibboleth:2.0:resource"

propertyFile="/.../idp/conf/attribute-resolver.xml.properties"/>
         </srv:ConfigurationResource>
     </srv:Service>

Then in attribute-resolver.xml:

     <resolver:DataConnector id="umnLDAP" xsi:type="LDAPDirectory"
xmlns="urn:mace:shibboleth:2.0:resolver:dc"
         ldapURL="${ldap.url}"
         baseDN="o=university of minnesota,c=us"
         principal="cn=Shibboleth Manager,ou=Application
Services,o=University of Minnesota,c=US"
         principalCredential="${ldap.password}">

Then in attribute-resolver.xml.properties:

ldap.url = ldap://ldap1.umn.edu ldap://ldap2.umn.edu ldap://ldap3.umn.edu
ldap.password = yeah_you_wish

--
%%  Christopher A. Bongaarts   %%  cab at umn.edu          %%
%%  OIT - Identity Management  %%  http://umn.edu/~cab  %%
%%  University of Minnesota    %%  +1 (612) 625-1809    %%
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net