Dockerized IdP

[John Gasper]

Hello all,
 
I wanted to take a moment and share a project that I've been working on for
the last year. That project is a dockerized Shibboleth IdP image, which
includes Java and Jetty. With this image, one simply overlays their local
configuration changes, builds the custom image, and they are up in seconds.
If someone needs a new configuration, it supports easily provisioning (and
externalizing) a new IdP configuration.

I've been working on making this the ideal base image. All of the components
are downloaded and validated with embedded hashes that were obtained from
their respective websites. Build steps are grouped to optimize the image
size. Jetty has been configured to point directly to the IDP_HOME/webapp
directory, so there is no need to run rebuild.sh/rebuild.bat when
customizing the idp.war; just overlay your changes.

We are using it internally with several projects here at Unicon. It is
planned that we will be moving our own Unicon IdP to an image that uses it
as a base in the coming weeks. In fact, our new IAM in the Cloud (hosted
IdP) service uses it as well.
 
The Docker Hub site is at https://hub.docker.com/r/unicon/shibboleth-idp/
with the source being available at
https://github.com/Unicon/shibboleth-idp-dockerized.

 

I've also put together a testbed that exercises the image:
https://github.com/UniconLabs/dockerized-idp-testbed/. The testbed spins up
an LDAP server, Shib SP, CAS client (the CAS client work is currently under
a branch), and the IdP image, which makes the IdP container testing
painless. Besides being a quick way to see the IdP image in action, it also
demonstrates how one might deploy the IdP layering their own config on top
of this base image.

 

I think this is the answer if you are thinking of running the IdP in Docker,
but feel free to make up your own mind. I'd love any constructive criticism
and contributions. Please share any feedback you might have via the Github
repo.


Thanks,

John

-- 
John Gasper
IAM Consultant
Unicon, Inc.
PGP/GPG Key: 0xbafee3ef



-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160307/e5569f05/attachment-0001.html>