<html><head><meta http-equiv="Content-Type" content="text/html; charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><br class=""><div><blockquote type="cite" class=""><div class="">On 2020-05-05, at 16:05, David Wen Riccardi-Zhu <<a href="mailto:davidwen.riccardizhu@gooduncle.com" class="">davidwen.riccardizhu@gooduncle.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div dir="ltr" class=""><div class="">My
Dockerfile installs Apache and Shibboleth, copies over the SAML
certificate and key into the container, and finally starts the
Shibboleth daemon and httpd service.</div></div></div></blockquote><div><br class=""></div><div>I'm not clear exactly what you're doing here. Dockerfiles are normally used to generate images which are then stored in a repository, rather than being used as the way to deploy a service directly. There's a grey area, though, because doing a `docker build` does cause the Dockerfile to run the commands in a container. I guess you _can_ use that as a deployment technique, but it's very unusual. </div><div><br class=""></div><div><br class=""></div><blockquote type="cite" class=""><div class=""><div dir="ltr" class=""><div class="">I do this to make sure that the
autogenerated keys on installation don't replace the ones currently in
use, if the container gets restarted.</div></div></div></blockquote><div><br class=""></div><div><div>This sounds as if you're installing Apache and Shibboleth on container startup: again, the normal process is to do that installation as part of the creation of the image, not on container startup. My apologies if I've misunderstood what you're saying here.</div><div><br class=""></div><div><br class=""></div></div><blockquote type="cite" class=""><div class=""><div dir="ltr" class=""><div class="">I'm
wondering if I'm missing anything with this approach.</div></div></div></blockquote><div><br class=""></div><div>Clarifying the above might help us understand this better.</div><div><br class=""></div><br class=""><blockquote type="cite" class=""><div class=""><div dir="ltr" class=""><div class=""> I've come across
some documentation discussing rollovers, as well as generating a new
certificate and key daily. Is that seen as a best practice, or am will
my approach work?</div></div></div></blockquote><div><br class=""></div><div>Generating a new SAML key every day would not be seen as a best practice. Doing that would require you to perform a key roll-over every day, which requires getting the new metadata to every IdP using the SP every day. Not good.</div><div><br class=""></div><div>The usual approach would be to keep one, long-lived key, but acquire it from a secrets store at runtime rather than building it in statically.</div><div><br class=""></div></div>Hope that helps,<br class=""><div class="">
<span class="Apple-style-span" style="border-collapse: separate; font-variant-ligatures: normal; font-variant-east-asian: normal; font-variant-position: normal; line-height: normal; border-spacing: 0px; -webkit-text-decorations-in-effect: none;"><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><span class="Apple-style-span" style="border-collapse: separate; color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; border-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-stroke-width: 0px;"><div class=""><span class="Apple-tab-span" style="white-space: pre;"><br class="Apple-interchange-newline"></span> -- Ian<br class=""></div><div class=""><span class="Apple-style-span" style="font-size: medium;"><br class=""></span></div></span></div></span><br class="Apple-interchange-newline"><br class="Apple-interchange-newline">
</div>
<br class=""></body></html>