-
Notifications
You must be signed in to change notification settings - Fork 36
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #535 from nextcloud/add/user_saml_shib-idp
standalone shibboleth image
- Loading branch information
Showing
60 changed files
with
278 additions
and
3,171 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,29 @@ | ||
| FROM quay.io/389ds/dirsrv:latest | ||
|
|
||
| ENV DS_DM_PASSWORD admin | ||
| ENV DS_SUFFIX_NAME dc=idptestbed | ||
|
|
||
| ADD conf/* /var/opt/ | ||
|
|
||
| RUN rm -Rf /data/* | ||
| RUN /usr/libexec/dirsrv/dscontainer -r & \ | ||
| sleep 60; \ | ||
| WAIT_TIME=60; \ | ||
| while : ; do \ | ||
| if /usr/libexec/dirsrv/dscontainer -H; then \ | ||
| break; \ | ||
| fi; \ | ||
| sleep 5; \ | ||
| WAIT_TIME=$((WAIT_TIME + 5)); \ | ||
| if [ ${WAIT_TIME} -gt 180 ]; then \ | ||
| echo "dirsrv not ready – giving up checking after 3min"; \ | ||
| exit 3 ;\ | ||
| fi; \ | ||
| done; \ | ||
| dsconf localhost backend create --suffix dc=idptestbed --be-name ci_root; \ | ||
| mv /var/opt/98nextcloud-schema.ldif /etc/dirsrv/slapd-localhost/schema/; \ | ||
| dsconf localhost schema reload; \ | ||
| dsconf localhost backend import "dc=idptestbed" /var/opt/entries.ldif; \ | ||
| rm /var/opt/entries.ldif; | ||
|
|
||
| EXPOSE 3389 |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,13 @@ | ||
| dn: cn=schema | ||
| objectClass: top | ||
| objectClass: ldapSubentry | ||
| objectClass: subschema | ||
| cn: schema | ||
| aci: (target="ldap:///cn=schema")(targetattr !="aci")(version 3.0;acl "anonymous, no acis"; allow (read, search, compare) userdn = "ldap:///anyone";) | ||
| modifiersName: cn=Directory Manager | ||
| modifyTimestamp: 20230412120423Z | ||
| objectClasses: ( 1.3.6.1.4.1.49213.1.2.1 NAME 'nextcloudUser' AUXILIARY MUST cn MAY (nextcloudEnabled $ nextcloudQuota ) X-ORIGIN 'user defined' ) | ||
| objectClasses: ( 1.3.6.1.4.1.49213.1.2.2 NAME 'nextcloudGroup' AUXILIARY MUST cn MAY nextcloudEnabled X-ORIGIN 'user defined' ) | ||
| attributeTypes: ( 1.3.6.1.4.1.49213.1.1.1 NAME 'nextcloudEnabled' DESC 'whether user or group should be available in Nextcloud' SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE X-ORIGIN 'user defined' ) | ||
| attributeTypes: ( 1.3.6.1.4.1.49213.1.1.2 NAME 'nextcloudQuota' DESC 'defines how much disk space is available for the user (e.g. 2 GB)' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'user defined' ) | ||
| nsSchemaCSN: 64369e47000000000000 |
28 changes: 23 additions & 5 deletions
28
user_saml_shibboleth/ldap/users.ldif → user_saml-dirsrv/conf/entries.ldif
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,44 +1,62 @@ | ||
|
|
||
| dn: dc=idptestbed | ||
| objectClass: top | ||
| objectClass: domain | ||
| dc: idptestbed | ||
| description: dc=idptestbed | ||
| aci: (targetattr = *) (targetfilter = "(objectclass=*)") (version 3.0; acl "Any read"; allow (search, read, compare) (userdn = "ldap:///anyone" );) | ||
|
|
||
| dn: cn=admin,dc=idptestbed | ||
| objectClass: simpleSecurityObject | ||
| objectClass: organizationalRole | ||
| cn: admin | ||
| userPassword: password | ||
| description: LDAP administrator | ||
|
|
||
| dn: ou=Groups,dc=idptestbed | ||
| objectClass: top | ||
| objectClass: organizationalunit | ||
| ou: Groups | ||
|
|
||
| dn: ou=People,dc=idptestbed | ||
| objectClass: top | ||
| objectClass: organizationalunit | ||
| ou: People | ||
|
|
||
| dn: uid=student1,ou=People,dc=idptestbed | ||
| objectClass: organizationalPerson | ||
| objectClass: person | ||
| objectClass: top | ||
| objectClass: inetOrgPerson | ||
| objectClass: ownCloud | ||
| objectClass: nextcloudUser | ||
| givenName: Stud | ||
| uid: student1 | ||
| sn: Ent | ||
| cn: Stud Ent | ||
| mail: [email protected] | ||
| userPassword: password | ||
| quota: 200 MB | ||
| nextcloudQuota: 200 MB | ||
|
|
||
| dn: uid=student2,ou=People,dc=idptestbed | ||
| objectClass: organizationalPerson | ||
| objectClass: person | ||
| objectClass: top | ||
| objectClass: inetOrgPerson | ||
| objectClass: ownCloud | ||
| objectClass: nextcloudUser | ||
| givenName: Stud | ||
| uid: student2 | ||
| sn: Ent2 | ||
| cn: Stud Ent2 | ||
| mail: [email protected] | ||
| userPassword: password | ||
| quota: 1 GB | ||
| nextcloudQuota: 1 GB | ||
|
|
||
| dn: uid=staff1,ou=People,dc=idptestbed | ||
| objectClass: organizationalPerson | ||
| objectClass: person | ||
| objectClass: top | ||
| objectClass: inetOrgPerson | ||
| objectClass: ownCloud | ||
| objectClass: nextcloudUser | ||
| givenName: St | ||
| uid: staff1 | ||
| sn: aff | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,8 @@ | ||
| FROM cscfi/shibboleth-idp:release-4.1.4 | ||
|
|
||
| ADD shibboleth-idp/ /opt/shibboleth-idp/ | ||
| ADD start.sh /usr/local/bin/ | ||
|
|
||
| RUN chmod a+x /usr/local/bin/start.sh | ||
|
|
||
| CMD "start.sh" |
44 changes: 44 additions & 0 deletions
44
user_saml_shibboleth-idp/shibboleth-idp/conf/attribute-filter.xml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,44 @@ | ||
| <?xml version="1.0" encoding="UTF-8"?> | ||
| <!-- | ||
| This file is an EXAMPLE policy file. While the policy presented in this | ||
| example file is illustrative of some simple cases, it relies on the names of | ||
| non-existent example services and the example attributes demonstrated in the | ||
| default attribute-resolver.xml file. | ||
| Deployers should refer to the documentation for a complete list of components | ||
| and their options. | ||
| --> | ||
| <AttributeFilterPolicyGroup id="ShibbolethFilterPolicy" | ||
| xmlns="urn:mace:shibboleth:2.0:afp" | ||
| xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" | ||
| xsi:schemaLocation="urn:mace:shibboleth:2.0:afp http://shibboleth.net/schema/idp/shibboleth-afp.xsd"> | ||
|
|
||
| <!-- Release some attributes to an SP. --> | ||
| <AttributeFilterPolicy id="example1"> | ||
| <PolicyRequirementRule xsi:type="Requester" value="http://localhost:8080/index.php/apps/user_saml/saml/metadata" /> | ||
|
|
||
| <AttributeRule attributeID="eduPersonPrincipalName"> | ||
| <PermitValueRule xsi:type="ANY" /> | ||
| </AttributeRule> | ||
|
|
||
| <AttributeRule attributeID="uid"> | ||
| <PermitValueRule xsi:type="ANY" /> | ||
| </AttributeRule> | ||
|
|
||
| <AttributeRule attributeID="mail"> | ||
| <PermitValueRule xsi:type="ANY" /> | ||
| </AttributeRule> | ||
|
|
||
| <AttributeRule attributeID="surname"> | ||
| <PermitValueRule xsi:type="ANY" /> | ||
| </AttributeRule> | ||
|
|
||
| <AttributeRule attributeID="givenName"> | ||
| <PermitValueRule xsi:type="ANY" /> | ||
| </AttributeRule> | ||
|
|
||
| <AttributeRule attributeID="eduPersonPrincipalName"> | ||
| <PermitValueRule xsi:type="ANY" /> | ||
| </AttributeRule> | ||
| </AttributeFilterPolicy> | ||
| </AttributeFilterPolicyGroup> |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
14 changes: 14 additions & 0 deletions
14
user_saml_shibboleth-idp/shibboleth-idp/conf/attributes/default-rules.xml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,14 @@ | ||
| <?xml version="1.0" encoding="UTF-8"?> | ||
| <beans xmlns="http://www.springframework.org/schema/beans" | ||
| xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" | ||
| xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd" | ||
|
|
||
| default-init-method="initialize" | ||
| default-destroy-method="destroy"> | ||
|
|
||
| <!-- | ||
| This file is empty since we stick with the Attribute encoders. Cf: | ||
| - https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1265631499/ReleaseNotes#Attribute-Related-Changes | ||
| --> | ||
|
|
||
| </beans> |
File renamed without changes.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.