tomcat-only, linux, non-root

[Peter Schober]

Trying to support institutions where admins are only "allowed" to run
their IDP on RHEL/CentOS (v7 is what I aimed for) I've researched a
bit wrt non-root deployments and have now fully documented 2 more
methods:
https://wiki.shibboleth.net/confluence/display/SHIB2/IdPLinuxNonRoot

Besides authbind (trivial to use on Debian/Ubuntu, less so everywhere
else) and packet filter-based port mapping I've now documented use of

* jsvc (Apache commons deamon) with a custom systemd unit,

as well as use of

* POSIX capabilities, allowing the java binary to open ports < 1024
  even when run as unpriviledged user.

All the needed software comes packaged with CentOS/RHEL 7 from
standard yum repositories (as there will certainly be institutional
policies in place about that, too).  For such systems everything in
the wiki should be cut-and-paste-able, allowing to configure port 443
(and maybe port 80 on the loopback interface) directly in Tomcat's
server.xml, using systemd/systemctl to start/stop/enable/etc services
as usual.

I haven't invented anything here (though use of inotify-based
capability re-setting might be a novel approach, making capabilities
[more] usable for this use-case) but would still like to ask for
feedback or experiences from those having used one of those approaches
in the past (whether as tighly integrated or not).

Note that I have documented these methods using (default) Tomcat and
OpenJDK JRE packages from CentOS 7, *neither* of which are officially
supported by the Shibboleth project!
But both methods can of course be used with a JDK (OpenJDK or Oracle),
with other Tomcat packages (RPM/yum or otherwise), as well as with
Jetty instead of Tomcat, so I think this is still OK for this list.

-peter
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: Digital signature
URL: <http://shibboleth.net/pipermail/users/attachments/20160811/4e139543/attachment.sig>