idp-sealer-rollover for a clustered setup

[Claudio Ramirez]

In case it's useful for other shib users here, I uploaded to GitHub
the script we use for doing the rollover of the data sealer:
https://github.com/KULeuven-CCIS/idp-sealer-rollover

>From the Readme:

idp-sealer-rollover is a helper program for the Open Source Shibboleth
IdP 3 SAML Identity Provider.

The program does a rollover of the data sealer files and uploads them
to the target servers. Its main use case is in a clustering mode when
several Shibboleth IdP 3 backends share the same data sealer. Ideally
it should be run from an scheduler like cron (cron file included as
idp-sealer-rollover.cron).

The Shibboleth IdP 3 binaries needed to create and rollover the data
sealer files are encapsulated with Docker. The size of the image is
small by using an Alpine Linux image and only keeping the IdP files
needed for the key management. Therefore, the deployment machines (not
the target machines), must have Docker installed. In case you don't
want to use the image on the Docker Hub, you can create your own with
the Dockerfile in the /utils directory.

The idp-sealer-rollover is an executable created from the source in
src/ and it includes all the dependencies (YAML::Tiny). There is no
need to install the dependencies separably.

This project is hosted and used by the KU Leuven University.

Usage

$ idp-sealer-rollover <project> <environment>

Claudio Ramirez
Competence Centre Information Security - KU Leuven