Managing Shib2 IdP configuration in VCS

[Peter Schober]

* Farrukh Najmi <farrukh at wellfleetsoftware.com> [2013-06-17 15:54]:
> In my limited experience with Shib2 IdP I have found that I have
> made customizations in the following area:
> 
>  * Changes to .../shibboleth-identityprovider-2.4.0/src/main/webapp/*.jsp
>  * Changes to .../shibboleth-identityprovider-2.4.0/installation/conf/*.xml

In the past I've versioned the former and never touched the latter.
(I changed the configuration files generated from the latter, though.)

> Before I do this I thought to check and see if there are any
> recommended best practices on how to do this. Please share any
> experience doing this sort of thing.

I had roughly the following structure in a VCS for a given IdP:

config/
  The complete conf directory for the IdP. Assuming you don't want
  any passwords ending up in the VCS some credentials can be
  replaced with references to property files (or moved to the
  container config e.g. when using container managed JDBC
  connections), not so for the JAAS config in login.conf, AFAIK.
  
metadata/
  Containing additional metadata sources for the IdP, managed locally.

tomcat/
  Relevant container configuration (context deployment fragment,
  server.xml, logging.properties, start-up scripts, etc.)

web/
  Content for the webserver living outside the war (i.e., outside the
  IdP application like CSS, logos, HTML, CGI, whathaveyou)

web/war-webapp
  Content for the webserver living inside the war (our adapted copy of
  src/main/webapp/*.jsp)

Contents from those versioned directories would then be scattered
thoughout the filesystem to the appriopriate places e.g. using
symlinks or something like cfengine,
-peter