[infra-disco] branch master updated: Initial functional checkin
Ian Young
ian at iay.org.uk
Mon Apr 27 12:56:46 EDT 2020
This is an automated email from the git hooks/post-receive script.
iay pushed a commit to branch master
in repository infra-disco.
The following commit(s) were added to refs/heads/master by this push:
new 18025c0 Initial functional checkin
18025c0 is described below
commit 18025c06a416988062e1a0f3661ea8db6b523ff0
Author: Ian Young <ian at iay.org.uk>
AuthorDate: Mon Apr 27 16:54:35 2020 +0000
Initial functional checkin
---
.gitignore | 5 +
discoshibb.xml | 439 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++
refresh | 69 +++++++++
3 files changed, 513 insertions(+)
diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..a548827
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,5 @@
+# editor files
+*~
+# output file
+discofeed.xml
+# end
diff --git a/discoshibb.xml b/discoshibb.xml
new file mode 100644
index 0000000..ffdbb2c
--- /dev/null
+++ b/discoshibb.xml
@@ -0,0 +1,439 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+ MDA configuration duplicating the discovery feed generated
+ by the shibboleth.net service provider.
+-->
+<beans xmlns="http://www.springframework.org/schema/beans"
+ default-lazy-init="true"
+ xmlns:c="http://www.springframework.org/schema/c"
+ xmlns:context="http://www.springframework.org/schema/context"
+ xmlns:p="http://www.springframework.org/schema/p"
+ xmlns:util="http://www.springframework.org/schema/util"
+ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xsi:schemaLocation="
+ http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
+ http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
+ http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd">
+
+ <!-- Locations of files and feeds. -->
+ <bean id="shibboleth.metadata" parent="File"
+ c:_="${config.dir:/etc/shibboleth}/idp.shibboleth.net-metadata.xml"/>
+ <bean id="protectnetwork.metadata" parent="File"
+ c:_="${config.dir:/etc/shibboleth}/protectnetwork-metadata.xml"/>
+
+ <bean id="InCommon.key" parent="X509CertificateFactoryBean"
+ p:resource="file:${config.dir:/etc/shibboleth}/incommon.pem"/>
+ <bean id="InCommon.url" parent="String"
+ c:_="http://md.incommon.org/InCommon/InCommon-metadata-idp-only.xml"/>
+
+ <bean id="Tuakiri.key" parent="X509CertificateFactoryBean"
+ p:resource="file:${config.dir:/etc/shibboleth}/tuakiri-metadata-cert.pem"/>
+ <bean id="Tuakiri.url" parent="String"
+ c:_="https://directory.tuakiri.ac.nz/metadata/tuakiri-metadata-signed.xml"/>
+
+ <bean id="AAF.key" parent="X509CertificateFactoryBean"
+ p:resource="file:${config.dir:/etc/shibboleth}/aaf-metadata-cert.pem"/>
+ <bean id="AAF.url" parent="String"
+ c:_="https://md.aaf.edu.au/aaf-metadata.xml"/>
+
+ <!--
+ ***********************************
+ *** ***
+ *** P A R E N T B E A N S ***
+ *** ***
+ ***********************************
+ -->
+
+ <!--
+ Java class parent shorthand beans.
+ -->
+ <bean id="File" abstract="true" class="java.io.File"/>
+ <bean id="String" abstract="true" class="java.lang.String"/>
+
+ <!--
+ component_parent
+
+ Parent for anything based on the Shibboleth component system.
+ These all require initialization before use.
+ -->
+ <bean id="component_parent" abstract="true"
+ init-method="initialize" destroy-method="destroy"/>
+
+ <!--
+ XMLSignatureValidationStage
+
+ Parent for XML Signature validation stages.
+
+ Applies global algorithm blacklists. For values, see:
+ http://www.w3.org/TR/xmlsec-algorithms/
+
+ Establishes a default of *not* permitting empty references
+ in signatures, per the SAML specification. This will be
+ overridden in specific beans where a signature is known to
+ require it.
+ -->
+ <bean id="XMLSignatureValidationStage" abstract="true" parent="mda.XMLSignatureValidationStage">
+ <property name="blacklistedDigests">
+ <list>
+ <value>http://www.w3.org/2001/04/xmldsig-more#md5</value>
+ </list>
+ </property>
+ <property name="blacklistedSignatureMethods">
+ <list>
+ <value>http://www.w3.org/2001/04/xmldsig-more#rsa-md5</value>
+ </list>
+ </property>
+ <property name="permittingEmptyReferences" value="false"/>
+ </bean>
+
+ <!--
+ XMLSignatureValidationStageSHA256
+
+ Parent for XML signature validation stages where we know
+ the signature will not be made with MD5 or SHA-1.
+ -->
+ <bean id="XMLSignatureValidationStageSHA256" abstract="true"
+ parent="XMLSignatureValidationStage">
+ <property name="blacklistedDigests">
+ <list>
+ <value>http://www.w3.org/2000/09/xmldsig#sha1</value>
+ <value>http://www.w3.org/2001/04/xmldsig-more#md5</value>
+ </list>
+ </property>
+ <property name="blacklistedSignatureMethods">
+ <list>
+ <value>http://www.w3.org/2000/09/xmldsig#rsa-sha1</value>
+ <value>http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha1</value>
+ <value>http://www.w3.org/2001/04/xmldsig-more#rsa-md5</value>
+ </list>
+ </property>
+ </bean>
+
+ <!--
+ Shibboleth-defined Resource class parent bean.
+ -->
+ <bean id="HTTPResource" abstract="true"
+ class="net.shibboleth.ext.spring.resource.HTTPResource"/>
+
+ <!--
+ Pick up Shibboleth MDA beans.
+ -->
+ <import resource="classpath:net/shibboleth/metadata/beans.xml"/>
+
+ <bean id="X509CertificateFactoryBean" abstract="true"
+ class="net.shibboleth.ext.spring.factory.X509CertificateFactoryBean"/>
+
+ <!-- *** Default Shibboleth component bean id property from Spring bean id *** -->
+ <bean class="net.shibboleth.ext.spring.config.IdentifiableBeanPostProcessor" lazy-init="false"/>
+
+ <!--
+ *****************************
+ *** ***
+ *** U T I L I T I E S ***
+ *** ***
+ *****************************
+ -->
+
+ <!--
+ Enable property placeholder replacement from system properties only.
+ -->
+ <context:property-placeholder/>
+
+ <!-- This bean MUST be called "conversionService" to work properly. -->
+ <bean id="conversionService" class="org.springframework.context.support.ConversionServiceFactoryBean">
+ <property name="converters">
+ <set>
+ <bean class="net.shibboleth.ext.spring.config.StringToDurationConverter" />
+ <bean class="net.shibboleth.ext.spring.config.StringToIPRangeConverter" />
+ <bean class="net.shibboleth.ext.spring.config.BooleanToPredicateConverter" />
+ <bean class="net.shibboleth.ext.spring.config.StringBooleanToPredicateConverter" />
+ <bean class="net.shibboleth.ext.spring.config.StringToResourceConverter" />
+ </set>
+ </property>
+ </bean>
+
+ <!--
+ Populate ItemId values from entities.
+ -->
+ <bean id="populateItemIds" parent="mda.EntityDescriptorItemIdPopulationStage"/>
+
+ <!--
+ Basic EntitiesDescriptor disassembler pipeline stage.
+ -->
+ <bean id="disassemble" parent="mda.EntitiesDescriptorDisassemblerStage"/>
+
+ <!--
+ errorAnnouncer
+
+ A pipeline stage that logs any errors present,
+ but takes no action on them.
+ -->
+ <bean id="errorAnnouncer" parent="mda.StatusMetadataLoggingStage">
+ <!-- <property name="identificationStrategy" ref="identificationStrategy"/> -->
+ <property name="selectionRequirements">
+ <list>
+ <value>#{T(net.shibboleth.metadata.ErrorStatus)}</value>
+ </list>
+ </property>
+ </bean>
+
+ <!--
+ errorTerminator
+
+ This pipeline stage causes CLI termination if any item is marked with an error status.
+ -->
+ <bean id="errorTerminator" parent="mda.ItemMetadataTerminationStage">
+ <!-- <property name="identificationStrategy" ref="identificationStrategy"/> -->
+ <property name="selectionRequirements">
+ <list>
+ <value>#{T(net.shibboleth.metadata.ErrorStatus)}</value>
+ </list>
+ </property>
+ </bean>
+
+ <!--
+ errorTerminatingFilter
+
+ Announces any errors encountered, and then terminates if any are present.
+
+ Warnings are not announced, and do not cause termination.
+ -->
+ <bean id="errorTerminatingFilter" parent="mda.CompositeStage">
+ <property name="composedStages">
+ <list>
+ <ref bean="errorAnnouncer"/>
+ <ref bean="errorTerminator"/>
+ </list>
+ </property>
+ </bean>
+
+ <!--
+ Merge strategy that removes duplicates.
+ -->
+ <bean id="deduplicateMergeStrategy" parent="mda.DeduplicatingItemIdMergeStrategy"/>
+
+ <!--
+ *************************************
+ *** ***
+ *** D O M U T I L I T I E S ***
+ *** ***
+ *************************************
+ -->
+
+ <!--
+ httpClientBuilder
+
+ Factory for the httpClient bean below.
+
+ Sets the option to ignore validation of a server's TLS credentials.
+
+ Sets socket and connection timeouts explicitly (to 100s) to
+ override the tight defaults in java-support, see:
+
+ https://github.com/ukf/ukf-meta/issues/1
+ https://issues.shibboleth.net/jira/browse/JSPT-48
+
+ These options can be removed once the underlying issue has been resolved.
+ -->
+ <bean id="httpClientBuilder"
+ class="net.shibboleth.utilities.java.support.httpclient.HttpClientBuilder"
+ p:connectionDisregardTLSCertificate="true"
+ p:socketTimeout="100000"
+ p:connectionTimeout="100000"
+ />
+
+ <!--
+ httpClient
+
+ Common, basic, HTTP client for use with HTTP resources.
+ -->
+ <bean id="httpClient" factory-bean="httpClientBuilder" factory-method="buildClient"/>
+
+ <!--
+ parserPool
+
+ A pre-configured parser pool for use by source stages.
+ -->
+ <bean id="parserPool" parent="component_parent"
+ class="net.shibboleth.utilities.java.support.xml.BasicParserPool"
+ p:ignoreComments="false"
+ p:ignoreElementContentWhitespace="false"/>
+
+ <!--
+ ***************************
+ *** ***
+ *** I N C O M M O N ***
+ *** ***
+ ***************************
+ -->
+
+ <bean id="InCommon.pipeline" parent="mda.SimplePipeline">
+ <property name="stages">
+ <list>
+ <bean id="aggregate" parent="mda.DOMResourceSourceStage">
+ <property name="parserPool" ref="parserPool"/>
+ <property name="DOMResource">
+ <bean parent="HTTPResource">
+ <constructor-arg name="client" ref="httpClient"/>
+ <constructor-arg name="url" ref="InCommon.url"/>
+ </bean>
+ </property>
+ </bean>
+
+ <!--
+ Check for fatal errors at the aggregate level:
+ missing or expired validUntil attribute
+ invalid signature
+ -->
+ <bean id="checkValidIntil" parent="mda.ValidateValidUntilStage"
+ p:requireValidUntil="true" p:maxValidityInterval="P14D"/>
+ <bean id="checkSignature" parent="XMLSignatureValidationStageSHA256"
+ p:verificationCertificate-ref="InCommon.key"/>
+ <ref bean="errorTerminatingFilter"/>
+
+ <ref bean="disassemble"/>
+ <ref bean="populateItemIds"/>
+ </list>
+ </property>
+ </bean>
+
+ <!--
+ *************************
+ *** ***
+ *** T U A K I R I ***
+ *** ***
+ *************************
+ -->
+
+ <bean id="Tuakiri.pipeline" parent="mda.SimplePipeline">
+ <property name="stages">
+ <list>
+ <bean id="aggregate" parent="mda.DOMResourceSourceStage">
+ <property name="parserPool" ref="parserPool"/>
+ <property name="DOMResource">
+ <bean parent="HTTPResource">
+ <constructor-arg name="client" ref="httpClient"/>
+ <constructor-arg name="url" ref="Tuakiri.url"/>
+ </bean>
+ </property>
+ </bean>
+
+ <!--
+ Check for fatal errors at the aggregate level:
+ missing or expired validUntil attribute
+ invalid signature
+ -->
+ <bean id="checkValidIntil" parent="mda.ValidateValidUntilStage"
+ p:requireValidUntil="true" p:maxValidityInterval="P28D"/>
+ <bean id="checkSignature" parent="XMLSignatureValidationStageSHA256"
+ p:verificationCertificate-ref="Tuakiri.key"/>
+ <ref bean="errorTerminatingFilter"/>
+
+ <ref bean="disassemble"/>
+ <ref bean="populateItemIds"/>
+ </list>
+ </property>
+ </bean>
+
+ <!--
+ *****************
+ *** ***
+ *** A A F ***
+ *** ***
+ *****************
+ -->
+
+ <bean id="AAF.pipeline" parent="mda.SimplePipeline">
+ <property name="stages">
+ <list>
+ <bean id="aggregate" parent="mda.DOMResourceSourceStage">
+ <property name="parserPool" ref="parserPool"/>
+ <property name="DOMResource">
+ <bean parent="HTTPResource">
+ <constructor-arg name="client" ref="httpClient"/>
+ <constructor-arg name="url" ref="AAF.url"/>
+ </bean>
+ </property>
+ </bean>
+
+ <!--
+ Check for fatal errors at the aggregate level:
+ missing or expired validUntil attribute
+ invalid signature
+ -->
+ <bean id="checkValidIntil" parent="mda.ValidateValidUntilStage"
+ p:requireValidUntil="true" p:maxValidityInterval="P28D"/>
+ <bean id="checkSignature" parent="XMLSignatureValidationStageSHA256"
+ p:verificationCertificate-ref="AAF.key"/>
+ <ref bean="errorTerminatingFilter"/>
+
+ <ref bean="disassemble"/>
+ <ref bean="populateItemIds"/>
+ </list>
+ </property>
+ </bean>
+
+ <!--
+ *************************************
+ *** ***
+ *** M A I N P I P E L I N E ***
+ *** ***
+ *************************************
+ -->
+
+ <bean id="DiscoFeed" parent="mda.SimplePipeline">
+ <property name="stages">
+ <list>
+
+ <!-- Acquire local metadata. -->
+ <bean id="local.shib" parent="mda.DOMFilesystemSourceStage"
+ p:parserPool-ref="parserPool"
+ p:source-ref="shibboleth.metadata"
+ p:noSourceFilesAnError="true"/>
+ <bean id="local.pn" parent="mda.DOMFilesystemSourceStage"
+ p:parserPool-ref="parserPool"
+ p:source-ref="protectnetwork.metadata"
+ p:noSourceFilesAnError="true"/>
+
+ <!-- Disassemble into individual entities. -->
+ <bean id="disassemble" parent="mda.EntitiesDescriptorDisassemblerStage"/>
+
+ <ref bean="populateItemIds"/>
+
+ <!--
+ Merge in remote metadata pipelines.
+
+ For the moment, duplicate the SP's behaviour and just add
+ everyhing from the other pipelines, without deduplication.
+ -->
+ <bean id="merge" parent="mda.PipelineMergeStage"
+ p:collectionMergeStrategy-ref="deduplicateMergeStrategy">
+ <property name="mergedPipelines">
+ <list>
+ <!-- entries earlier in the list have higher precedence -->
+ <ref bean="InCommon.pipeline"/>
+ <ref bean="Tuakiri.pipeline"/>
+ <ref bean="AAF.pipeline"/>
+ </list>
+ </property>
+ </bean>
+
+ <!-- Serialise as a discovery feed into an output file. -->
+ <bean id="serialize" parent="mda.SerializationStage">
+ <property name="serializer">
+ <bean id="discogen" parent="mda.DiscoFeedCollectionSerializer"
+ p:includingLegacyDisplayNames="true"
+ p:prettyPrinting="true"/>
+ </property>
+ <property name="outputFile">
+ <bean parent="File">
+ <constructor-arg value="${output.file:discofeed.xml}"/>
+ </bean>
+ </property>
+ </bean>
+
+ </list>
+ </property>
+ </bean>
+
+</beans>
diff --git a/refresh b/refresh
new file mode 100755
index 0000000..921c77f
--- /dev/null
+++ b/refresh
@@ -0,0 +1,69 @@
+#!/bin/bash
+
+#
+# Exit when any command fails.
+#
+set -e
+
+#
+# Where are we?
+#
+declare LOCATION
+LOCATION=$0
+LOCATION=${LOCATION%/*}
+
+#
+# Locate Java
+#
+if [ -z "$JAVA_HOME" ] ; then
+ if [ -d "/usr/lib/jvm/jre-11-openjdk" ] ; then
+ export JAVA_HOME=/usr/lib/jvm/jre-11-openjdk
+ else
+ echo "Could not locate JAVA_HOME"
+ exit 1
+ fi
+fi
+
+#
+# Find the CLI.
+#
+declare MDA_CMD
+MDA_CMD=${LOCATION}/aggregator-cli/mda.sh
+
+#
+# Locate the output file for the flow.
+#
+declare OUTFILE
+OUTFILE=${LOCATION}/discofeed.xml
+
+#
+# Construct the Java options for the flow.
+#
+export JVMOPTS="-Doutput.file=${OUTFILE}"
+# echo "JVMOPTS will be '${JVMOPTS}'"
+
+#
+# Run the flow to generate a temporary output file here.
+#
+${MDA_CMD} --quiet ${LOCATION}/discoshibb.xml DiscoFeed
+
+#
+# Double-check that the output file exists, and that it is not
+# empty.
+#
+if [ ! -f ${OUTFILE} ] ; then
+ echo "No output file created"
+ exit 1
+fi
+if [ ! -s ${OUTFILE} ] ; then
+ echo "Output file was empty"
+ exit 1
+fi
+
+# Set permissions on the file and move it into place
+chmod og+r ${OUTFILE}
+mv ${OUTFILE} ${LOCATION}/..
+
+#
+# End.
+#
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list