<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
We've had success using envsubst (provided by gettext on CentOS 8) to do token replacement of shibboleth2.xml, we have the following in the init step for our containers:</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="color: rgb(0, 0, 0); font-family: Calibri, Helvetica, sans-serif; font-size: 12pt;"># Perform one-time token replacement on shibboleth2.xml</span><br>
</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<div>if [ ! -f /etc/shibboleth/shibboleth2.xml.done ]; then</div>
<div> # Make a copy of shibboleth2.xml for token replacement input</div>
<div> cp /etc/shibboleth/shibboleth2.xml /etc/shibboleth/shibboleth2.xml.in</div>
<div><br>
</div>
<div> # Do token substitution</div>
<div> envsubst < /etc/shibboleth/shibboleth2.xml.in > /etc/shibboleth/shibboleth2.xml</div>
<div><br>
</div>
<div> # Remove input file</div>
<div> rm /etc/shibboleth/shibboleth2.xml.in</div>
<div><br>
</div>
<div> # Touch done file so this only runs once</div>
<div> touch /etc/shibboleth/shibboleth2.xml.done</div>
<div>fi</div>
</div>
<div id="appendonsend"></div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>From:</b> users <users-bounces@shibboleth.net> on behalf of Wessel, Keith <kwessel@illinois.edu><br>
<b>Sent:</b> Thursday, October 1, 2020 11:58<br>
<b>To:</b> Shib Users <users@shibboleth.net><br>
<b>Subject:</b> RE: Can env vars be referenced in shibboleth2.xml?</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt">
<div class="PlainText">Apache clearly assumes that the use of env vars is up to each module. Kind of silly that there's not a fallback case, but I suppose they could argue it's more secure this way.<br>
<br>
At any rate, I'm perfectly happy with my sed commands on container boot. So, I've no motivation to make this a feature request.<br>
<br>
Thanks, Scott and Peter, for the guidance on this one.<br>
<br>
Keith<br>
<br>
<br>
-----Original Message-----<br>
From: users <users-bounces@shibboleth.net> On Behalf Of Cantor, Scott<br>
Sent: Thursday, October 1, 2020 11:43 AM<br>
To: Shib Users <users@shibboleth.net><br>
Subject: Re: Can env vars be referenced in shibboleth2.xml?<br>
<br>
On 10/1/20, 12:28 PM, "users on behalf of Peter Schober" <users-bounces@shibboleth.net on behalf of peter.schober@univie.ac.at> wrote:<br>
<br>
> This does sound a bit involved:<br>
<br>
Yes, it's clearly not what I assumed. Basically it's the same thing...I don't support env replacement and neither does Apache in any meaningful sense. So it becomes a case of how far down the stack before somebody agrees to implement it. I just assumed they
had.<br>
<br>
I have enough indirection now with a lot of (but not all) settings that I could implement some degree of it but it would be hit or miss where it worked and difficult to document all the cases.<br>
<br>
Honestly pre-processing the XML itself with some other template language is probably the best direction.<br>
<br>
-- Scott<br>
<br>
<br>
-- <br>
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg">
https://wiki.shibboleth.net/confluence/x/coFAAg</a><br>
To unsubscribe from this list send an email to users-unsubscribe@shibboleth.net<br>
-- <br>
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg">
https://wiki.shibboleth.net/confluence/x/coFAAg</a><br>
To unsubscribe from this list send an email to users-unsubscribe@shibboleth.net<br>
</div>
</span></font></div>
</body>
</html>