Shib IdP v3 on RHEL8

[Ian Young]

(catching up)

> On 8 Aug 2019, at 20:50, Peter Schober <peter.schober at univie.ac.at> wrote:
> 
> * ryazanov at bc.edu <ryazanov at bc.edu> [2019-08-08 21:34]:
>> We are moving Shib IdP services from RHEL6 servers to a newer OS version. 
>> Trying to decide whether we should migrate to RHEL7 or go straight to RHEL8.  
>> Does anybody have any experience with Shib IdP v3 running on RHEL8? 
> 
> At least on the Java side you should be covered:
> https://developers.redhat.com/blog/2018/12/10/install-java-rhel8/
> 
> I have no idea whether RedHat is packaging a usable Jetty or Tomcat
> version, though.

Tomcat and Jetty were both shipped as part of RHEL 7 (in the case of Jetty, as an optional package) but both have been removed from RHEL 8:

https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html-single/considerations_in_adopting_rhel_8/index



> (I know the developers may not support those, same as
> they didn't with OS-packaged Java until very recently, but getting
> security fixes automatically seems worthwhile to me, esp if you're
> using those servlet containers as TLS-enbaled web servers, too.)

You're right, that would be an advantage. The downside is that you're never quite sure which version you're really running, because of all the back-porting they do.


> On 8 Aug 2019, at 20:33, ryazanov at bc.edu wrote:
> 
> We are moving Shib IdP services from RHEL6 servers to a newer OS version. 
> Trying to decide whether we should migrate to RHEL7 or go straight to RHEL8.  
> Does anybody have any experience with Shib IdP v3 running on RHEL8?

I don't think RHEL 8 has been out long enough for people to have migrated a lot of production to it yet. I've played around with a developer license and given that we're talking about Java and they ship a decent JDK with it, I would expect it to be fine. It certainly runs our internal tests for the software.

One thing I did notice while validating the statement above is that the system-wide cryptographic policy system introduced in RHEL 8 can catch you unawares if you have anything expecting to, say, use 1024-bit RSA (turned out we had a couple of tests that did that).

I think the other point of note is that they have removed their own support for Docker (I suspect very few people used the RHEL-supplied Docker, it was always rather out of date) in favour of their own compatible but daemon-less container runtime. This allows tighter integration with systemd and the like, so it may actually be a better fit for service deployment if you're going the container route.

With the disclaimer that I have no real experience in the risk tradeoffs in enterprise deployments, I'd personally lean towards RHEL 8 (or for those of us in the cheap seats, CentOS 8, which is expected fairly soon now) for new deployments.

    -- Ian




-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20190813/364fcaa9/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 3883 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/users/attachments/20190813/364fcaa9/attachment.p7s>