Can env vars be referenced in shibboleth2.xml?

[Wessel, Keith]

Funny you should mention that, Ryan. I just helped a coworker use envsubst in her Nginx container last week because it doesn't allow for arbitrary env vars in its config, either. The Nginx image maintainers recommend envsubst specifically for that purpose. I didn't realize it was part of the gettext package, though. Just for reference, what do the substitutions look like inside your shibboleth2.xml? That is, what do the tokens look like that envsubst is replacing with values from env vars?

I guess this is just a slightly more elegant version of what I'm currently doing with sed:

sed -i "s|%SP_ENTITY_ID|$SP_ENTITY_ID|" /etc/shibboleth/shibboleth2.xml

Keith

From: users <users-bounces at shibboleth.net> On Behalf Of Ryan Larscheidt via users
Sent: Monday, October 5, 2020 4:19 PM
To: Shib Users <users at shibboleth.net>
Cc: Ryan Larscheidt <larscheidt at wisc.edu>
Subject: Re: Can env vars be referenced in shibboleth2.xml?

We've had success using envsubst (provided by gettext on CentOS 8) to do token replacement of shibboleth2.xml, we have the following in the init step for our containers:

# Perform one-time token replacement on shibboleth2.xml
if [ ! -f /etc/shibboleth/shibboleth2.xml.done ]; then
    # Make a copy of shibboleth2.xml for token replacement input
    cp /etc/shibboleth/shibboleth2.xml /etc/shibboleth/shibboleth2.xml.in

    # Do token substitution
    envsubst < /etc/shibboleth/shibboleth2.xml.in > /etc/shibboleth/shibboleth2.xml

    # Remove input file
    rm /etc/shibboleth/shibboleth2.xml.in

    # Touch done file so this only runs once
    touch /etc/shibboleth/shibboleth2.xml.done
fi

________________________________
From: users <users-bounces at shibboleth.net<mailto:users-bounces at shibboleth.net>> on behalf of Wessel, Keith <kwessel at illinois.edu<mailto:kwessel at illinois.edu>>
Sent: Thursday, October 1, 2020 11:58
To: Shib Users <users at shibboleth.net<mailto:users at shibboleth.net>>
Subject: RE: Can env vars be referenced in shibboleth2.xml?

Apache clearly assumes that the use of env vars is up to each module. Kind of silly that there's not a fallback case, but I suppose they could argue it's more secure this way.

At any rate, I'm perfectly happy with my sed commands on container boot. So, I've no motivation to make this a feature request.

Thanks, Scott and Peter, for the guidance on this one.

Keith


-----Original Message-----
From: users <users-bounces at shibboleth.net<mailto:users-bounces at shibboleth.net>> On Behalf Of Cantor, Scott
Sent: Thursday, October 1, 2020 11:43 AM
To: Shib Users <users at shibboleth.net<mailto:users at shibboleth.net>>
Subject: Re: Can env vars be referenced in shibboleth2.xml?

On 10/1/20, 12:28 PM, "users on behalf of Peter Schober" <users-bounces at shibboleth.net on behalf of peter.schober at univie.ac.at<mailto:users-bounces at shibboleth.net%20on%20behalf%20of%20peter.schober at univie.ac.at>> wrote:

>    This does sound a bit involved:

Yes, it's clearly not what I assumed. Basically it's the same thing...I don't support env replacement and neither does Apache in any meaningful sense. So it becomes a case of how far down the stack before somebody agrees to implement it. I just assumed they had.

I have enough indirection now with a lot of (but not all) settings that I could implement some degree of it but it would be hit or miss where it worked and difficult to document all the cases.

Honestly pre-processing the XML itself with some other template language is probably the best direction.

-- Scott


--
For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>
--
For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20201005/3e1d727a/attachment.htm>