Shibboleth SP on RHEL7- issues between shibd <-> systemd?

[Jarno Huuskonen]

Hi,

On Tue, Jun 09, Cantor, Scott wrote:
> >Does that mean you're not a systemd fan :) ?
> 
> I think it's about the most ridiculous thing I've seen. It takes all the 
> dumb things about Windows and puts them in Linux.

:) Well at least systemd doesn't force reboot for every little change.

At first I didn't like systemd, but now after using it with redhat/centos7
I kind of like it.

> >Is shibd ready to process requests when it calls
> >listener->run(&shibd_shutdown) (shibd.cpp:L442) ? (With forking shibd
> >signals parent with SIGUSR1 just before listener->run).
> 
> I'd have to research how it all works, but I believe it is. The metadata 
> is being loaded in this call:
>  
>     if (!conf.instantiate(shar_config)) {
> 
> 
> Once that's done, the run step is just socket work.
> 
> >If calling sd_notify(0, "READY=1") just before listener->run is ok, then
> >I can try to create a small patch (with autoconf: --enable-systemd).
> 
> It should be.

I'm attaching a short patch to enable sd_notify (configure ...
--enable-systemd).

Tested with a shibd.service like this (I didn't test with
LD_LIBRARY_PATH... (my build uses statically linked curl)).

[Unit]
Description=Shibboleth Service Provider Daemon
After=network.target
Before=httpd.service

[Service]
Type=notify
User=shibd
#Environment=LD_LIBRARY_PATH=/opt/shibboleth/...
ExecStart=/usr/sbin/shibd -c /etc/shibboleth/shibboleth2.xml -f -F
StandardInput=null
StandardOutput=null
StandardError=journal
TimeoutStopSec=5s
TimeoutStartSec=90s
Restart=on-failure
RestartSec=30s

[Install]
WantedBy=multi-user.target

Perhaps more systemd users could test this to see if it works/compiles
as expected.
(I've tested that it compiles/works for me on rhel7(--enable-systemd) and
rhel6(w/out systemd)).

-Jarno

-- 
Jarno Huuskonen
-------------- next part --------------
diff --git a/shibd/Makefile.am b/shibd/Makefile.am
index 3d6521a..a89e7c0 100644
--- a/shibd/Makefile.am
+++ b/shibd/Makefile.am
@@ -5,6 +5,6 @@ sbin_PROGRAMS = shibd
 shibd_SOURCES = shibd.cpp
 
 shibd_LDADD = $(XMLSEC_LIBS) \
-  $(top_builddir)/shibsp/libshibsp.la
+  $(top_builddir)/shibsp/libshibsp.la $(SYSTEMD_LIBS)
 
 EXTRA_DIST = shibd.vcxproj shibd_win32.cpp resource.h shibd.rc
diff --git a/shibd/shibd.cpp b/shibd/shibd.cpp
index 8c67563..e8afdea 100644
--- a/shibd/shibd.cpp
+++ b/shibd/shibd.cpp
@@ -56,6 +56,19 @@
 #include <xmltooling/util/XMLConstants.h>
 #include <xmltooling/util/XMLHelper.h>
 
+#ifdef HAVE_SD_NOTIFY
+#include <systemd/sd-daemon.h>
+#else
+#define SD_EMERG   ""
+#define SD_ALERT   ""
+#define SD_CRIT    ""
+#define SD_ERR     ""
+#define SD_WARNING ""
+#define SD_NOTICE  ""
+#define SD_INFO    ""
+#define SD_DEBUG   ""
+#endif
+
 using namespace shibsp;
 using namespace xmltooling;
 using namespace std;
@@ -380,7 +393,7 @@ int main(int argc, char *argv[])
         (shar_checkonly ? SPConfig::RequestMapping : SPConfig::Logging)
         );
     if (!conf.init(shar_schemadir, shar_prefix)) {
-        fprintf(stderr, "configuration is invalid, check console for specific problems\n");
+        fprintf(stderr, SD_ERR "configuration is invalid, check console for specific problems\n");
         return -1;
     }
 
@@ -400,7 +413,7 @@ int main(int argc, char *argv[])
     }
 
     if (!conf.instantiate(shar_config)) {
-        fprintf(stderr, "configuration is invalid, check console for specific problems\n");
+        fprintf(stderr, SD_ERR "configuration is invalid, check console for specific problems\n");
         conf.term();
         return -2;
     }
@@ -411,7 +424,7 @@ int main(int argc, char *argv[])
         // Init the listener.
         ListenerService* listener = conf.getServiceProvider()->getListenerService();
         if (!listener->init(unlink_socket)) {
-            fprintf(stderr, "listener failed to initialize\n");
+            fprintf(stderr, SD_ERR "listener failed to initialize\n");
             conf.term();
             return -3;
         }
@@ -446,8 +459,11 @@ int main(int argc, char *argv[])
         }
 
         // Run the listener.
+#ifdef HAVE_SD_NOTIFY
+        sd_notify(0, "READY=1");
+#endif
         if (!listener->run(&shibd_shutdown)) {
-            fprintf(stderr, "listener failure during service\n");
+            fprintf(stderr, SD_ERR "listener failure during service\n");
             listener->term();
             conf.term();
             if (daemonize && pidfile)
@@ -456,7 +472,9 @@ int main(int argc, char *argv[])
         }
         listener->term();
     }
-
+#ifdef HAVE_SD_NOTIFY
+    sd_notify(0, "STOPPING=1");
+#endif
     conf.term();
     if (daemonize && pidfile)
         unlink(pidfile);

diff --git a/configure.ac b/configure.ac
index a980f0a..3793f2d 100644
--- a/configure.ac
+++ b/configure.ac
@@ -430,6 +430,31 @@ else
     WANT_SUBDIRS="$WANT_SUBDIRS adfs"
 fi
 
+## systemd
+dnl Systemd will be disabled by default and requires you to run configure with
+dnl --enable-systemd to look for and enable systemd.
+AC_ARG_ENABLE(systemd,
+    AS_HELP_STRING([--enable-systemd],[Build with systemd (Default = no)]),
+	[if test "x$enableval" = "x" ; then
+         WANT_SYSTEMD=no
+	 else
+	     WANT_SYSTEMD="$enableval"
+	 fi
+	],[ WANT_SYSTEMD=no ])
+AC_MSG_CHECKING(whether to build with systemd)
+
+AC_MSG_RESULT($WANT_SYSTEMD)
+if test "$WANT_SYSTEMD" = "yes" ; then
+	AC_CHECK_HEADER([systemd/sd-daemon.h], [
+	    AC_CHECK_LIB([systemd-daemon], [sd_notify], [hassdnotify="y"])])
+	AS_IF([test "x$hassdnotify=" = x], [
+	   AC_MSG_ERROR([Unable to find a suitable libsystemd-daemon library])
+	])
+	AC_DEFINE([HAVE_SD_NOTIFY],[1],[Define to 1 if you have the sd_notify function.])
+	PKG_CHECK_MODULES([SYSTEMD], [libsystemd-daemon])
+	AC_SUBST([SYSTEMD_CFLAGS])
+	AC_SUBST([SYSTEMD_LIBS])
+fi
 
 #
 # Build NSAPI module?