<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
span.EmailStyle20
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal">Funny you should mention that, Ryan. I just helped a coworker use envsubst in her Nginx container last week because it doesn’t allow for arbitrary env vars in its config, either. The Nginx image maintainers recommend envsubst specifically
for that purpose. I didn’t realize it was part of the gettext package, though. Just for reference, what do the substitutions look like inside your shibboleth2.xml? That is, what do the tokens look like that envsubst is replacing with values from env vars?<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I guess this is just a slightly more elegant version of what I’m currently doing with sed:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">sed -i "s|%SP_ENTITY_ID|$SP_ENTITY_ID|" /etc/shibboleth/shibboleth2.xml<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Keith<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b>From:</b> users <users-bounces@shibboleth.net> <b>On Behalf Of
</b>Ryan Larscheidt via users<br>
<b>Sent:</b> Monday, October 5, 2020 4:19 PM<br>
<b>To:</b> Shib Users <users@shibboleth.net><br>
<b>Cc:</b> Ryan Larscheidt <larscheidt@wisc.edu><br>
<b>Subject:</b> Re: Can env vars be referenced in shibboleth2.xml?<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black">We've had success using envsubst (provided by gettext on CentOS 8) to do token replacement of shibboleth2.xml, we have the following in the init step for our containers:<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black"># Perform one-time token replacement on shibboleth2.xml<o:p></o:p></span></p>
</div>
<div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black">if [ ! -f /etc/shibboleth/shibboleth2.xml.done ]; then<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black"> # Make a copy of shibboleth2.xml for token replacement input<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black"> cp /etc/shibboleth/shibboleth2.xml /etc/shibboleth/shibboleth2.xml.in<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black"> # Do token substitution<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black"> envsubst < /etc/shibboleth/shibboleth2.xml.in > /etc/shibboleth/shibboleth2.xml<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black"> # Remove input file<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black"> rm /etc/shibboleth/shibboleth2.xml.in<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black"> # Touch done file so this only runs once<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black"> touch /etc/shibboleth/shibboleth2.xml.done<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black">fi<o:p></o:p></span></p>
</div>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black"><o:p> </o:p></span></p>
</div>
<div class="MsoNormal" align="center" style="text-align:center">
<hr size="2" width="98%" align="center">
</div>
<div id="divRplyFwdMsg">
<p class="MsoNormal"><b><span style="color:black">From:</span></b><span style="color:black"> users <<a href="mailto:users-bounces@shibboleth.net">users-bounces@shibboleth.net</a>> on behalf of Wessel, Keith <<a href="mailto:kwessel@illinois.edu">kwessel@illinois.edu</a>><br>
<b>Sent:</b> Thursday, October 1, 2020 11:58<br>
<b>To:</b> Shib Users <<a href="mailto:users@shibboleth.net">users@shibboleth.net</a>><br>
<b>Subject:</b> RE: Can env vars be referenced in shibboleth2.xml?</span> <o:p></o:p></p>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
</div>
<div>
<div>
<p class="MsoNormal">Apache clearly assumes that the use of env vars is up to each module. Kind of silly that there's not a fallback case, but I suppose they could argue it's more secure this way.<br>
<br>
At any rate, I'm perfectly happy with my sed commands on container boot. So, I've no motivation to make this a feature request.<br>
<br>
Thanks, Scott and Peter, for the guidance on this one.<br>
<br>
Keith<br>
<br>
<br>
-----Original Message-----<br>
From: users <<a href="mailto:users-bounces@shibboleth.net">users-bounces@shibboleth.net</a>> On Behalf Of Cantor, Scott<br>
Sent: Thursday, October 1, 2020 11:43 AM<br>
To: Shib Users <<a href="mailto:users@shibboleth.net">users@shibboleth.net</a>><br>
Subject: Re: Can env vars be referenced in shibboleth2.xml?<br>
<br>
On 10/1/20, 12:28 PM, "users on behalf of Peter Schober" <<a href="mailto:users-bounces@shibboleth.net%20on%20behalf%20of%20peter.schober@univie.ac.at">users-bounces@shibboleth.net on behalf of peter.schober@univie.ac.at</a>> wrote:<br>
<br>
> This does sound a bit involved:<br>
<br>
Yes, it's clearly not what I assumed. Basically it's the same thing...I don't support env replacement and neither does Apache in any meaningful sense. So it becomes a case of how far down the stack before somebody agrees to implement it. I just assumed they
had.<br>
<br>
I have enough indirection now with a lot of (but not all) settings that I could implement some degree of it but it would be hit or miss where it worked and difficult to document all the cases.<br>
<br>
Honestly pre-processing the XML itself with some other template language is probably the best direction.<br>
<br>
-- Scott<br>
<br>
<br>
-- <br>
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg">
https://wiki.shibboleth.net/confluence/x/coFAAg</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">
users-unsubscribe@shibboleth.net</a><br>
-- <br>
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg">
https://wiki.shibboleth.net/confluence/x/coFAAg</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">
users-unsubscribe@shibboleth.net</a><o:p></o:p></p>
</div>
</div>
</div>
</body>
</html>