Dockerized IdP

[Greg Haverkamp]

On Wed, Mar 9, 2016 at 4:27 AM, Etienne Dysli-Metref <
etienne.dysli-metref at switch.ch> wrote:

> How do you handle secret configuration elements? (private key files,
> passwords for LDAP and database access, etc.) If your image contains
> such elements then it becomes just as sensitive as those and is hard to
> distribute (enough to get it where it needs to be run without exposing
> it)...
>

I'm not sure why an image is much more difficult than files.  Distributing
that information is a difficult problem, regardless.

Right now, the image repository lives on the same set of hosts on the same,
IAM-dedicated network.

If we shared infrastructure with others, it would be a greater concern.  If
we ever want to get where we can readily deploy outside of our network, it
will become a much greater concern.



> Our "get a new VM" process has at least one manual step so it's not
> instantaneous, but once Puppet takes over we can quickly deploy changes.
> I agree that having less VMs to maintain is a benefit though.
>
> Your load balancers do terminate the TLS connections I guess, since they
> look at cookies for routing. This removes the keys needed for HTTPS from
> Docker images.
>

For many of our services, we re-encrypt the connection.  However, it is
correct that we do not re-encrypt the connections going back to the IdP.

Yet another challenge if we get to the point where we want to distribute
images and run containers elsewhere.  Fortunately, those are not my current
problems.

Greg
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160309/f8a821c1/attachment.html>