Skip to content

Commit cd7c6af

Browse files
bbockelmbbockelm
committed
Create issuer for the CHTC origin
1 parent ed71fe1 commit cd7c6af

24 files changed

+1191
-0
lines changed

‎opensciencegrid/osdf-chtc-issuer/Dockerfile

+104
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,104 @@
1+
FROM hub.opensciencegrid.org/opensciencegrid/software-base:3.6-el8-release
2+
3+
RUN yum install -y curl java-11-openjdk java-11-openjdk-devel
4+
5+
# Download and install tomcat
6+
RUN useradd -r -s /sbin/nologin tomcat ;\
7+
mkdir -p /opt/tomcat ;\
8+
curl -s -L https://archive.apache.org/dist/tomcat/tomcat-9/v9.0.69/bin/apache-tomcat-9.0.69.tar.gz | tar -zxf - -C /opt/tomcat --strip-components=1 ;\
9+
chgrp -R tomcat /opt/tomcat/conf ;\
10+
chmod g+rwx /opt/tomcat/conf ;\
11+
chmod g+r /opt/tomcat/conf/* ;\
12+
chown -R tomcat /opt/tomcat/logs/ /opt/tomcat/temp/ /opt/tomcat/webapps/ /opt/tomcat/work/ ;\
13+
chgrp -R tomcat /opt/tomcat/bin /opt/tomcat/lib ;\
14+
chmod g+rwx /opt/tomcat/bin ;\
15+
chmod g+r /opt/tomcat/bin/*
16+
17+
ADD server.xml /opt/tomcat/conf/server.xml
18+
RUN chgrp -R tomcat /opt/tomcat/conf/server.xml ;\
19+
chmod go+r /opt/tomcat/conf/server.xml
20+
21+
ARG TOMCAT_ADMIN_USERNAME=admin
22+
ARG TOMCAT_ADMIN_PASSWORD=password
23+
ADD tomcat-users.xml.tmpl /opt/tomcat/conf/tomcat-users.xml.tmpl
24+
RUN sed s+TOMCAT_ADMIN_USERNAME+${TOMCAT_ADMIN_USERNAME}+g /opt/tomcat/conf/tomcat-users.xml.tmpl | sed s+TOMCAT_ADMIN_PASSWORD+${TOMCAT_ADMIN_PASSWORD}+g > /opt/tomcat/conf/tomcat-users.xml ;\
25+
chgrp tomcat /opt/tomcat/conf/tomcat-users.xml
26+
27+
ARG TOMCAT_ADMIN_IP=127.0.0.1
28+
ADD manager.xml.tmpl /opt/tomcat/conf/Catalina/localhost/manager.xml.tmpl
29+
RUN sed s+TOMCAT_ADMIN_IP+${TOMCAT_ADMIN_IP}+g /opt/tomcat/conf/Catalina/localhost/manager.xml.tmpl > /opt/tomcat/conf/Catalina/localhost/manager.xml ;\
30+
chgrp -R tomcat /opt/tomcat/conf/Catalina
31+
32+
COPY --chown=tomcat:tomcat scitokens-server /opt
33+
#COPY target/oauth2.war /opt/tomcat/webapps/scitokens-server.war
34+
RUN \
35+
curl -s -L https://github.com/ncsa/OA4MP/releases/download/v5.2.9.0/oauth2.war > /opt/tomcat/webapps/scitokens-server.war ;\
36+
mkdir -p /opt/tomcat/webapps/scitokens-server ;\
37+
cd /opt/tomcat/webapps/scitokens-server ;\
38+
jar -xf ../scitokens-server.war ;\
39+
chgrp -R tomcat /opt/tomcat/webapps/scitokens-server ;\
40+
mkdir -p /opt/tomcat/var/storage/scitokens-server ;\
41+
chown -R tomcat:tomcat /opt/tomcat/var/storage/scitokens-server ;\
42+
rm -rf /opt/tomcat/webapps/ROOT /opt/tomcat/webapps/docs /opt/tomcat/webapps/examples /opt/tomcat/webapps/host-manager /opt/tomcat/webapps/manager
43+
COPY --chown=tomcat:tomcat scitokens-server/web.xml /opt/tomcat/webapps/scitokens-server/WEB-INF/web.xml
44+
RUN chmod 644 /opt/tomcat/webapps/scitokens-server/WEB-INF/web.xml
45+
46+
# need to put the java mail jar into the tomcat lib directory
47+
RUN curl -s -L https://github.com/javaee/javamail/releases/download/JAVAMAIL-1_6_2/javax.mail.jar > /opt/tomcat/lib/javax.mail.jar
48+
49+
# Make JWK a volume mount
50+
RUN mkdir -p /opt/scitokens-server/bin && mkdir -p /opt/scitokens-server/etc && mkdir -p /opt/scitokens-server/etc/templates && mkdir -p /opt/scitokens-server/lib && mkdir -p /opt/scitokens-server/log && mkdir -p /opt/scitokens-server/var/qdl/scitokens && mkdir -p /opt/scitokens-server/var/storage/file_store
51+
52+
# Make server configuration a volume mount
53+
ADD scitokens-server/etc/server-config.xml /opt/scitokens-server/etc/server-config.xml.tmpl
54+
ADD scitokens-server/etc/proxy-config.xml /opt/scitokens-server/etc/proxy-config.xml.tmpl
55+
56+
ADD scitokens-server/bin/scitokens-cli /opt/scitokens-server/bin/scitokens-cli
57+
#COPY target/oa2-cli.jar /opt/scitokens-server/lib/scitokens-cli.jar
58+
RUN \
59+
curl -L -s https://github.com/ncsa/OA4MP/releases/download/v5.2.9.0/oa2-cli.jar >/opt/scitokens-server/lib/scitokens-cli.jar ;\
60+
chmod +x /opt/scitokens-server/bin/scitokens-cli
61+
62+
ADD scitokens-server/etc/templates/client-template.xml /opt/scitokens-server/etc/templates/client-template.xml
63+
ADD scitokens-server/var/qdl/scitokens/ospool.qdl /opt/scitokens-server/var/qdl/scitokens/ospool.qdl
64+
ADD scitokens-server/var/qdl/scitokens/comanage.qdl.tmpl /opt/scitokens-server/var/qdl/scitokens/comanage.qdl.tmpl
65+
RUN chgrp tomcat /opt/scitokens-server/var/qdl/scitokens/ospool.qdl /opt/scitokens-server/var/qdl/scitokens/comanage.qdl.tmpl
66+
RUN ln -s /usr/lib64/libapr-1.so.0 /opt/tomcat/lib/libapr-1.so.0
67+
68+
# QDL support 21-01-2021
69+
RUN curl -L -s https://github.com/ncsa/OA4MP/releases/download/v5.2.9.0/oa2-qdl-installer.jar >/tmp/oa2-qdl-installer.jar ;\
70+
java -jar /tmp/oa2-qdl-installer.jar -dir /opt/qdl
71+
72+
RUN mkdir -p /opt/qdl/var/scripts
73+
74+
ADD qdl/etc/qdl.properties /opt/qdl/etc/qdl.properties
75+
ADD qdl/etc/qdl-cfg.xml /opt/qdl/etc/qdl-cfg.xml
76+
77+
ADD qdl/var/scripts/boot.qdl /opt/qdl/var/scripts/boot.qdl
78+
RUN chmod +x /opt/qdl/var/scripts/boot.qdl
79+
80+
ADD qdl/bin/qdl /opt/qdl/bin/qdl
81+
RUN chmod +x /opt/qdl/bin/qdl
82+
83+
ADD qdl/bin/qdl-run /opt/qdl/bin/qdl-run
84+
RUN chmod +x /opt/qdl/bin/qdl-run
85+
# END QDL support
86+
87+
# Add CHTC custom CA to trust store
88+
COPY tiger-ca.pem /opt/scitokens-server/tiger-ca.pem
89+
RUN keytool -import -alias tigerca -file /opt/scitokens-server/tiger-ca.pem -cacerts -trustcacerts -noprompt -storepass changeit;\
90+
rm /opt/scitokens-server/tiger-ca.pem
91+
92+
ENV JAVA_HOME=/usr/lib/jvm/jre
93+
ENV CATALINA_PID=/opt/tomcat/temp/tomcat.pid
94+
ENV CATALINA_HOME=/opt/tomcat
95+
ENV CATALINA_BASE=/opt/tomcat
96+
ENV CATALINA_OPTS="-Xms512M -Xmx1024M -server -XX:+UseParallelGC"
97+
ENV JAVA_OPTS="-Djava.awt.headless=true -Djava.security.egd=file:/dev/./urandom -Djava.library.path=/opt/tomcat/lib"
98+
ENV ST_HOME="/opt/scitokens-server"
99+
ENV QDL_HOME="/opt/qdl"
100+
ENV PATH="${ST_HOME}/bin:${QDL_HOME}/bin:${PATH}"
101+
102+
#RUN "${QDL_HOME}/var/scripts/boot.qdl"
103+
ADD start.sh /start.sh
104+
CMD ["/start.sh"]

‎opensciencegrid/osdf-chtc-issuer/manager.xml.tmpl

+5
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
<Context privileged="true" antiResourceLocking="false"
2+
docBase="${catalina.home}/webapps/manager">
3+
<Valve className="org.apache.catalina.valves.RemoteAddrValve" allow="127\.\d+\.\d+\.\d+|::1|0:0:0:0:0:0:0:1|TOMCAT_ADMIN_IP" />
4+
</Context>
5+

‎opensciencegrid/osdf-chtc-issuer/qdl/bin/qdl

+9
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
# The script to invoke the QDL interpreter.
2+
CFG_FILE="$QDL_HOME/etc/qdl-cfg.xml"
3+
CFG_NAME="oa2-dev"
4+
QDL_JAR="$QDL_HOME/lib/qdl.jar"
5+
6+
cfgFile=${1:-$CFG_FILE}
7+
cfgName=${2:-$CFG_NAME}
8+
9+
java -cp $QDL_JAR edu.uiuc.ncsa.qdl.workspace.QDLWorkspace -cfg $cfgFile -name $cfgName -home_dir $QDL_HOME

‎opensciencegrid/osdf-chtc-issuer/qdl/bin/qdl-run

+7
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
# The script to invoke the QDL interpreter.
2+
3+
CFG_FILE="$QDL_HOME/etc/qdl-cfg.xml"
4+
CFG_NAME="run-it"
5+
QDL_JAR="$QDL_HOME/lib/qdl.jar"
6+
7+
java -cp $QDL_JAR edu.uiuc.ncsa.qdl.workspace.QDLWorkspace -cfg $CFG_FILE -name $CFG_NAME -home_dir $QDL_HOME -run "$@"

‎opensciencegrid/osdf-chtc-issuer/qdl/etc/qdl-cfg.xml

+109
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,109 @@
1+
<config>
2+
<qdl name="oa2-dev"
3+
enabled="true"
4+
server_mode="false"
5+
numeric_digits="15"
6+
compressOn="false"
7+
script_path="vfs#/scripts/"
8+
module_path="/opt/qdl/var/modules/">
9+
<workspace verbose="true"
10+
echoModeOn="true"
11+
autosaveOn="true"
12+
editor_name="line"
13+
use_editor="true"
14+
save_dir="/opt/qdl/var/ws"
15+
showBanner = "false"
16+
autosaveInterval="300000"
17+
prettyPrint="true">
18+
<home_dir>/opt/qdl</home_dir>
19+
<env>etc/qdl.properties</env>
20+
</workspace>
21+
22+
<editors>
23+
<editor
24+
name="nano"
25+
exec="/bin/nano"/>
26+
<editor
27+
name="vi"
28+
exec="/bin/vi"/>
29+
</editors>
30+
<logging
31+
logFileName="/opt/qdl/log/qdl.log"
32+
logName="qdl"
33+
disableLog4j="true"
34+
logSize="100000"
35+
logFileCount="2"
36+
debug="true"/>
37+
<virtual_file_systems>
38+
<vfs type="pass_through"
39+
access="rw">
40+
<root_dir>/opt/scitokens-server/var/qdl</root_dir>
41+
<scheme><![CDATA[vfs]]></scheme>
42+
<mount_point>/scripts</mount_point>
43+
</vfs>
44+
</virtual_file_systems>
45+
<modules>
46+
<module type="java"
47+
import_on_start="true">
48+
<class_name>edu.uiuc.ncsa.myproxy.oa4mp.qdl.OA2QDLLoader</class_name>
49+
</module>
50+
<module type="java"
51+
import_on_start="true">
52+
<class_name>edu.uiuc.ncsa.oa2.qdl.QDLToolsLoader</class_name>
53+
</module>
54+
<module type="java"
55+
import_on_start="false">
56+
<class_name>edu.uiuc.ncsa.oa2.qdl.storage.StoreAccessLoader</class_name>
57+
</module>
58+
<module type="qdl"
59+
import_on_start="true">
60+
<path>/opt/qdl/etc/modules/math-x.mdl</path>
61+
</module>
62+
<module type="qdl"
63+
import_on_start="true">
64+
<path>/opt/qdl/etc/modules/ext.mdl</path>
65+
</module>
66+
</modules>
67+
68+
</qdl>
69+
<qdl name="run-it"
70+
enabled="true"
71+
server_mode="false">
72+
<workspace verbose="false"
73+
echoModeOn="false"
74+
prettyPrint="false">
75+
<home_dir>/opt/qdl</home_dir>
76+
<env>etc/qdl.properties</env>
77+
</workspace>
78+
79+
<logging
80+
logFileName="/opt/qdl/log/qdl.log"
81+
logName="qdl"
82+
disableLog4j="true"
83+
logSize="100000"
84+
logFileCount="2"
85+
debug="false"/>
86+
<modules>
87+
<module type="java"
88+
import_on_start="true">
89+
<class_name>edu.uiuc.ncsa.myproxy.oa4mp.qdl.OA2QDLLoader</class_name>
90+
</module>
91+
<module type="java"
92+
import_on_start="true">
93+
<class_name>edu.uiuc.ncsa.oa2.qdl.QDLToolsLoader</class_name>
94+
</module>
95+
<module type="java"
96+
import_on_start="false">
97+
<class_name>edu.uiuc.ncsa.oa2.qdl.storage.StoreAccessLoader</class_name>
98+
</module>
99+
<module type="qdl"
100+
import_on_start="true">
101+
<path>/opt/qdl/etc/modules/math-x.mdl</path>
102+
</module>
103+
<module type="qdl"
104+
import_on_start="true">
105+
<path>/opt/qdl/etc/modules/ext.mdl</path>
106+
</module>
107+
</modules>
108+
</qdl>
109+
</config>

‎opensciencegrid/osdf-chtc-issuer/qdl/etc/qdl.properties

+2
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
#Environment saved to "/opt/qdl/etc/qdl.properties"
2+
#Basic properties file. This can be empty

‎opensciencegrid/osdf-chtc-issuer/qdl/nano

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
include /opt/qdl/etc/qdl.nanorc-2.3.1

‎opensciencegrid/osdf-chtc-issuer/qdl/var/scripts/boot.qdl

+59
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
#! /usr/bin/env qdl-run
2+
3+
/*
4+
Boot script in QDL to set up a new OA4MP issuer install. This is run exactly
5+
once before the system is started the first time. This will read in all the
6+
template files for clients in ${ST_HOME}/etc/templates and ingest them into
7+
OA4MP's client store.
8+
*/
9+
10+
assert[is_defined(os_env().'ST_HOME')]['Environment variable ST_HOME is not defined. Exiting...'];
11+
12+
st_home := os_env().'ST_HOME'; // get the scitokens home directory from the environment
13+
// normalize the path. If it ends in a /, drop it for later use in strings.
14+
st_home := '.*/' =~ st_home?substring(st_home,0,size(st_home)-1):st_home;
15+
template_dir := st_home + '/etc/templates';
16+
/*
17+
Set up access to the client store using the current server configuration.
18+
*/
19+
module_import('oa2:/qdl/store', 'clients');
20+
clients#init(st_home+'/etc/server-config.xml', 'scitokens-server', 'client');
21+
22+
23+
files. := dir(template_dir);
24+
if[
25+
size(files.) == 0
26+
][
27+
say('(no templates.)');
28+
return();
29+
];
30+
31+
files. := ~mask(files., '.*xml' =~ files.); // regex match on those that end in .xml
32+
say('processing ' + size(files.) + ' templates from ' + template_dir);
33+
34+
while[
35+
for_next(t, files.)
36+
][
37+
template. := clients#from_xml(file_read(template_dir + '/' + t));
38+
if[
39+
!is_defined(template.'client_id')
40+
][
41+
say('warning -- file "' + t + '" is not a client template. skipping');
42+
]else[
43+
// At this point we don't want to just overwrite an existing template since
44+
// there may be customizations that the admin has added.
45+
if[
46+
size(clients#read(template.'client_id')) == 0
47+
][
48+
clients#save(template.);
49+
]else[
50+
say('Warning, but "' + t + '" already exists in the store. Update it manually. Skipping');
51+
];
52+
];
53+
]; // end while
54+
55+
say('done!');
56+
57+
58+
59+

‎opensciencegrid/osdf-chtc-issuer/scitokens-server/bin/create_keys

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
java -jar /opt/scitokens-server/lib/jwt.jar -batch create_keys -single -o

‎opensciencegrid/osdf-chtc-issuer/scitokens-server/bin/scitokens-cli

+37
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
# Run the OA4MP command processor. This will allow you to edit, create or remove
2+
# clients, approvals, users and archived users. You can also reset the counter and do copy
3+
# operations from one store to another
4+
#
5+
# The next 5 entries completely determine how this operates. Change these to whatever you want if
6+
# different from the standard install.
7+
8+
OA2_ROOT=/opt/scitokens-server
9+
DEFAULT_CONFIG=$OA2_ROOT/etc/server-config.xml
10+
DEFAULT_TARGET=scitokens-server
11+
oa2jar=$OA2_ROOT/lib/scitokens-cli.jar
12+
logFile=$OA2_ROOT/var/log/scitokens--cli.log
13+
DEFAULT_ENV=$OA2_ROOT/etc/cli.properties
14+
15+
# End of user serviceable parts.
16+
17+
if [[ "$1" = "--help" || $# -gt 2 ]];then
18+
echo "scitokens-server-cli [configName configFile environment"]
19+
echo "Start the OA4MP for OAuth2 command line admin tool with the"
20+
echo "given configuration name in the given configuration file (full path)."
21+
echo "No arguments means to use the config named '$DEFAULT_TARGET' in the file '$DEFAULT_CONFIG'"
22+
echo "and to try and load the '$DEFAULT_ENV' as the environment."
23+
echo "One argument is assumed to be the configuration name in the default config file."
24+
exit 1
25+
fi
26+
27+
target=${1:-$DEFAULT_TARGET}
28+
adminCfg=${2:-$DEFAULT_CONFIG}
29+
env=${3:-$DEFAULT_ENV}
30+
31+
java -jar $oa2jar -cfg $adminCfg -name $target -log $logFile -v -set_env $env
32+
33+
if [ $? != 0 ]; then
34+
exit 1
35+
fi
36+
37+
exit 0

‎opensciencegrid/osdf-chtc-issuer/scitokens-server/etc/proxy-config.xml

+24
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
<config>
2+
<client name="proxy-client">
3+
<logging
4+
logFileName="/tmp/oa4mp-oauth2-fs-client.xml"
5+
logName="oa4mp"
6+
logSize="100000"
7+
logFileCount="2"
8+
debug="true"/>
9+
<id>{CLIENT_ID}</id>
10+
<secret>{CLIENT_SECRET}</secret>
11+
<callbackUri>https://{HOSTNAME}/scitokens-server/ready</callbackUri>
12+
<serviceUri>https://cilogon.org/oauth2</serviceUri>
13+
<authorizeUri>https://cilogon.org/authorize</authorizeUri>
14+
<wellKnownUri>https://cilogon.org/oauth2/.well-known/openid-configuration</wellKnownUri>
15+
<scopes>
16+
<scope>email</scope>
17+
<scope>openid</scope>
18+
<scope>profile</scope>
19+
<scope>org.cilogon.userinfo</scope>
20+
</scopes>
21+
<memoryStore><assetStore/></memoryStore>
22+
</client>
23+
24+
</config>

0 commit comments

Comments
 (0)