TM- DO NOT MERGE demonstrate start at improved secrets management

.gitignore

@@ -7,4 +7,6 @@
 .settings/
 target/
 node_modules/
-.DS_Store
+.DS_Store
+secrets.yml
+private-secrets/

demo.yml

@@ -135,14 +135,14 @@ networks:
 
 secrets:
   idp_backchannel:
-    file: ./secrets/idp/idp-backchannel.p12
+    file: ./sample-secrets/idp/idp-backchannel.p12
   idp_browser:
-    file: ./secrets/idp/idp-browser.p12
+    file: ./sample-secrets/idp/idp-browser.p12
   idp_encryption:
-    file: ./secrets/idp/idp-encryption.key
+    file: ./sample-secrets/idp/idp-encryption.key
   idp_signing:
-    file: ./secrets/idp/idp-signing.key
+    file: ./sample-secrets/idp/idp-signing.key
   idp_sealer:
-    file: ./secrets/idp/sealer.jks
+    file: ./sample-secrets/idp/sealer.jks
   sp_key:
-    file: ./secrets/sp/sp-key.pem
+    file: ./sample-secrets/sp/sp-key.pem

docker-compose.yml

@@ -315,14 +315,14 @@ networks:
 
 secrets:
   idp_backchannel:
-    file: ./secrets/idp/idp-backchannel.p12
+    file: ./sample-secrets/idp/idp-backchannel.p12
   idp_browser:
-    file: ./secrets/idp/idp-browser.p12
+    file: ./sample-secrets/idp/idp-browser.p12
   idp_encryption:
-    file: ./secrets/idp/idp-encryption.key
+    file: ./sample-secrets/idp/idp-encryption.key
   idp_signing:
-    file: ./secrets/idp/idp-signing.key
+    file: ./sample-secrets/idp/idp-signing.key
   idp_sealer:
-    file: ./secrets/idp/sealer.jks
+    file: ./sample-secrets/idp/sealer.jks
   sp_key:
-    file: ./secrets/sp/sp-key.pem
+    file: ./sample-secrets/sp/sp-key.pem

eclipse-pass.base.yml

@@ -131,14 +131,14 @@ networks:
 
 secrets:
   idp_backchannel:
-    file: ./secrets/idp/idp-backchannel.p12
+    file: ./sample-secrets/idp/idp-backchannel.p12
   idp_browser:
-    file: ./secrets/idp/idp-browser.p12
+    file: ./sample-secrets/idp/idp-browser.p12
   idp_encryption:
-    file: ./secrets/idp/idp-encryption.key
+    file: ./sample-secrets/idp/idp-encryption.key
   idp_signing:
-    file: ./secrets/idp/idp-signing.key
+    file: ./sample-secrets/idp/idp-signing.key
   idp_sealer:
-    file: ./secrets/idp/sealer.jks
+    file: ./sample-secrets/idp/sealer.jks
   sp_key:
-    file: ./secrets/sp/sp-key.pem
+    file: ./sample-secrets/sp/sp-key.pem

eclipse-pass.demo.yml

@@ -20,3 +20,9 @@ services:
 
   loader:
     env_file: .eclipse-pass.demo_env
+
+  idp:
+    build:
+      args:
+        IDP_ENV: local
+    image: dee3c85737f2

harvard.yml

@@ -307,14 +307,14 @@ networks:
 
 secrets:
   idp_backchannel:
-    file: ./secrets/idp/idp-backchannel.p12
+    file: ./sample-secrets/idp/idp-backchannel.p12
   idp_browser:
-    file: ./secrets/idp/idp-browser.p12
+    file: ./sample-secrets/idp/idp-browser.p12
   idp_encryption:
-    file: ./secrets/idp/idp-encryption.key
+    file: ./sample-secrets/idp/idp-encryption.key
   idp_signing:
-    file: ./secrets/idp/idp-signing.key
+    file: ./sample-secrets/idp/idp-signing.key
   idp_sealer:
-    file: ./secrets/idp/sealer.jks
+    file: ./sample-secrets/idp/sealer.jks
   sp_key:
-    file: ./secrets/sp/sp-key.pem
+    file: ./sample-secrets/sp/sp-key.pem

idp/Dockerfile

@@ -7,7 +7,7 @@ COPY common/shibboleth-idp/ /opt/shibboleth-idp/
 COPY common/shib-jetty-base/ /opt/shib-jetty-base/
 
 COPY ${TENANT}/shibboleth-idp/ /opt/shibboleth-idp/
-COPY metadata/{IDP_ENV}/ /opt/shibboleth-idp/metadata/
+COPY metadata/${IDP_ENV}/ /opt/shibboleth-idp/metadata/
 
 COPY styling/main.css /opt/shibboleth-idp/webapp/css/main.css
 COPY styling/dummylogo.png /opt/shibboleth-idp/webapp/images/dummylogo.png

idp/jhu/shibboleth-idp/conf/idp.properties

@@ -14,7 +14,7 @@
 # limitations under the License.
 #
 # Load any additional property resources from a comma-delimited list
-idp.additionalProperties= /conf/ldap.properties, /conf/saml-nameid.properties, /conf/services.properties
+idp.additionalProperties= /conf/ldap.properties, /conf/saml-nameid.properties, /conf/services.properties, /conf/idp_secrets.properties
 
 # Set the entityID of the IdP
 idp.entityID= https://pass.local/idp/shibboleth
@@ -36,23 +36,26 @@ idp.scope= johnshopkins.edu
 #idp.views = %{idp.home}/views
 
 # Settings for internal AES encryption key
+# JHU: moved to secrets:
 #idp.sealer.storeType = JCEKS
 #idp.sealer.updateInterval = PT15M
 #idp.sealer.aliasBase = secret
-idp.sealer.storeResource= /run/secrets/idp_sealer
-idp.sealer.versionResource= %{idp.home}/credentials/sealer.kver
-idp.sealer.storePassword= password
-idp.sealer.keyPassword= password
+#idp.sealer.storeResource= 
+#idp.sealer.versionResource= 
+#idp.sealer.storePassword= 
+#idp.sealer.keyPassword= 
 
 # Settings for public/private signing and encryption key(s)
 # During decryption key rollover, point the ".2" properties at a second
 # keypair, uncomment in credentials.xml, then publish it in your metadata.
-idp.signing.key= /run/secrets/idp_signing
-idp.signing.cert= %{idp.home}/credentials/idp-signing.crt
-idp.encryption.key= /run/secrets/idp_encryption
-idp.encryption.cert= %{idp.home}/credentials/idp-encryption.crt
-#idp.encryption.key.2 = %{idp.home}/credentials/idp-encryption-old.key
-#idp.encryption.cert.2 = %{idp.home}/credentials/idp-encryption-old.crt
+# JHU: moved to secrets:
+#idp.signing.key= 
+#idp.signing.cert= 
+#idp.encryption.key= 
+#idp.encryption.cert= 
+# JHU: presently unused:
+#idp.encryption.key.2 = 
+#idp.encryption.cert.2 = 
 
 # Sets the bean ID to use as a default security configuration set
 #idp.security.config = shibboleth.DefaultSecurityConfiguration

idp/jhu/shibboleth-idp/conf/idp_secrets.properties

@@ -0,0 +1 @@
+/run/secrets/idp_secrets_properties

sample-secrets/idp/idp-cert.pem

@@ -0,0 +1,17 @@
+-----BEGIN CERTIFICATE-----
+MIICoDCCAYgCCQCs7hi46wwVvTANBgkqhkiG9w0BAQsFADASMRAwDgYDVQQDDAd0
+ZXN0YmVkMB4XDTIyMTIwODIyMzIwNFoXDTIzMTIwMzIyMzIwNFowEjEQMA4GA1UE
+AwwHdGVzdGJlZDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAIFe/Sjd
++ZPyKW7IuMniUEBUJb5lFXIRc9hC5GLu98Nw7hrp3WTGIkuxorRbzxU3GMVBGvw+
+AORavby/CgfWuCTikuyzMsPjwMHMP3jal4mX9LoWewgmOZodwGHils2FTjKjC7re
+IqS+22txkARukSujpnwLOJYTHyzLChpgRAaJ8+Sv05FXoKfe3Gr72AwF48bjUau1
+mtQYi77Gud0vRKGHg+rR6r/0wCxWUghcRrz1Z8fwnaQVxM5+ha0hzvRvtMtlCzHh
+ic1yesYtJQRyy0XI8tf5e2/lI1kXz044jFdU2M2+ATkNslv2EwzhQAWoj7Vuj1Cq
+3HBOGNz+w68jHM0CAwEAATANBgkqhkiG9w0BAQsFAAOCAQEAe7cktK/QKZNw6fJD
+EYbTWYF8pJqNgaQn6ZAxW5H275vzNNGUC2cAk4yin9HGKGVLASplySNLcAUtEpFk
+iuH5OOvXR/aZPQ3SElk9oBBHdd5w77BO+czGDQvk3yO/lVBMQIXIVLC11tc2+EQB
+573X/JKPoF/Uz+GuK5ulIw3ai7VZ4mO9u6uk3iwMdutkPDO/3OjT1xVrvhaFVwsS
+P7Bpdfre3ZMNEdIg8L0dpPclVPmJh6AntsJFXBj8Zulqqq4oDb597uiEvL4TkvqC
+JB6Y/Tra0Z7EJ8NN7IRJ/eY6gcCYVuQjt/b9i7dy/tXBrWqGX01w7dnKhOrD7VFZ
+Jh/OXA==
+-----END CERTIFICATE-----

tools/generate-secrets.sh

@@ -0,0 +1,3 @@
+#!/bin/bash
+
+