Skip to content

Commit 4db0cb0

Browse files
bastelfreakbastelfreak
authored
Merge pull request #476 from bwitt/manage-webxml
Allow changing web.xml settings
2 parents db94724 + 8bbcf5a commit 4db0cb0

6 files changed

Lines changed: 277 additions & 0 deletions

File tree

‎.fixtures.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,5 +2,6 @@
22
fixtures:
33
repositories:
44
archive: https://github.com/voxpupuli/puppet-archive.git
5+
augeas_core: https://github.com/puppetlabs/puppetlabs-augeas_core.git
56
stdlib: https://github.com/puppetlabs/puppetlabs-stdlib.git
67
systemd: https://github.com/voxpupuli/puppet-systemd.git

‎REFERENCE.md‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -164,6 +164,8 @@ The following parameters are available in the `jira` class:
164164
* [`tomcat_additional_connectors`](#-jira--tomcat_additional_connectors)
165165
* [`contextpath`](#-jira--contextpath)
166166
* [`resources`](#-jira--resources)
167+
* [`enable_https_redirect`](#-jira--enable_https_redirect)
168+
* [`session_timeout`](#-jira--session_timeout)
167169
* [`enable_sso`](#-jira--enable_sso)
168170
* [`application_name`](#-jira--application_name)
169171
* [`application_password`](#-jira--application_password)
@@ -1049,6 +1051,23 @@ undocumented
10491051

10501052
Default value: `{}`
10511053

1054+
##### <a name="-jira--enable_https_redirect"></a>`enable_https_redirect`
1055+
1056+
Data type: `Boolean`
1057+
1058+
Enable HTTPS redirection in web.xml. When enabled, adds a security constraint that redirects
1059+
certain URL patterns (*.jsp, *.jspa, /browse/*, /issues/*) to HTTPS.
1060+
1061+
Default value: `false`
1062+
1063+
##### <a name="-jira--session_timeout"></a>`session_timeout`
1064+
1065+
Data type: `Integer[1]`
1066+
1067+
Session timeout in minutes in web.xml.
1068+
1069+
Default value: `300`
1070+
10521071
##### <a name="-jira--enable_sso"></a>`enable_sso`
10531072

10541073
Data type: `Boolean`

‎manifests/config.pp‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -203,6 +203,46 @@
203203
mode => '0600',
204204
}
205205

206+
$webxml_path = "${jira::webappdir}/atlassian-jira/WEB-INF/web.xml"
207+
208+
augeas { 'jira-web.xml-session-timeout':
209+
incl => $webxml_path,
210+
lens => 'Xml.lns',
211+
context => "/files${webxml_path}/web-app",
212+
changes => [
213+
"set session-config/session-timeout/#text ${jira::session_timeout}",
214+
],
215+
require => Class['jira::install'],
216+
}
217+
218+
$https_changes = $jira::enable_https_redirect ? {
219+
true => [
220+
'set security-constraint[last()+1]/web-resource-collection/web-resource-name/#text "all-except-attachments"',
221+
'set security-constraint[last()]/web-resource-collection/url-pattern[1]/#text "*.jsp"',
222+
'set security-constraint[last()]/web-resource-collection/url-pattern[2]/#text "*.jspa"',
223+
'set security-constraint[last()]/web-resource-collection/url-pattern[3]/#text "/browse/*"',
224+
'set security-constraint[last()]/web-resource-collection/url-pattern[4]/#text "/issues/*"',
225+
'set security-constraint[last()]/user-data-constraint/transport-guarantee/#text "CONFIDENTIAL"',
226+
],
227+
false => [
228+
'rm security-constraint[user-data-constraint/transport-guarantee/#text="CONFIDENTIAL"]',
229+
],
230+
}
231+
232+
$https_onlyif = $jira::enable_https_redirect ? {
233+
true => 'match security-constraint/user-data-constraint/transport-guarantee[#text="CONFIDENTIAL"] size == 0',
234+
false => 'match security-constraint/user-data-constraint/transport-guarantee[#text="CONFIDENTIAL"] size > 0',
235+
}
236+
237+
augeas { 'jira-web.xml-https-redirect':
238+
incl => $webxml_path,
239+
lens => 'Xml.lns',
240+
context => "/files${webxml_path}/web-app",
241+
changes => $https_changes,
242+
onlyif => $https_onlyif,
243+
require => Class['jira::install'],
244+
}
245+
206246
file { "${jira::homedir}/jira-config.properties":
207247
content => inline_epp(@(EOF)
208248
<% $merged_jira_config_properties.each |$key, $val| { -%>

‎manifests/init.pp‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -249,6 +249,11 @@
249249
# Tomcat context path for the web service
250250
# @param resources
251251
# undocumented
252+
# @param enable_https_redirect
253+
# Enable HTTPS redirection in web.xml. When enabled, adds a security constraint that redirects
254+
# certain URL patterns (*.jsp, *.jspa, /browse/*, /issues/*) to HTTPS.
255+
# @param session_timeout
256+
# Session timeout in minutes in web.xml.
252257
# @param enable_sso
253258
# Enable single sign-on via Crowd
254259
# @param application_name
@@ -413,6 +418,9 @@
413418
Optional[String[1]] $contextpath = undef,
414419
# Resources for context.xml
415420
Hash $resources = {},
421+
# web.xml settings
422+
Boolean $enable_https_redirect = false,
423+
Integer[1] $session_timeout = 300,
416424
# Enable SingleSignOn via Crowd
417425
Boolean $enable_sso = false,
418426
String $application_name = 'crowd',

‎spec/classes/jira_config_spec.rb‎

Lines changed: 208 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -68,6 +68,214 @@ def self.clear_cache
6868

6969
it { is_expected.not_to contain_file(FILENAME_CLUSTER_PROPS) }
7070
it { is_expected.not_to contain_file(FILENAME_CHECK_JAVA_SH) }
71+
72+
# Test web.xml management with default values
73+
it do
74+
is_expected.to contain_augeas('jira-web.xml-session-timeout').
75+
with_changes(['set session-config/session-timeout/#text 300'])
76+
end
77+
78+
it 'removes HTTPS redirect when disabled' do
79+
is_expected.to contain_augeas('jira-web.xml-https-redirect').
80+
with_changes(['rm security-constraint[user-data-constraint/transport-guarantee/#text="CONFIDENTIAL"]']).
81+
with_onlyif('match security-constraint/user-data-constraint/transport-guarantee[#text="CONFIDENTIAL"] size > 0')
82+
end
83+
end
84+
85+
context 'with enable_https_redirect' do
86+
let(:params) do
87+
{
88+
javahome: '/opt/java',
89+
version: DEFAULT_VERSION,
90+
enable_https_redirect: true,
91+
}
92+
end
93+
94+
it { is_expected.to compile.with_all_deps }
95+
96+
it 'configures HTTPS redirect in web.xml' do
97+
is_expected.to contain_augeas('jira-web.xml-https-redirect').
98+
with_onlyif('match security-constraint/user-data-constraint/transport-guarantee[#text="CONFIDENTIAL"] size == 0').
99+
with_changes([
100+
'set security-constraint[last()+1]/web-resource-collection/web-resource-name/#text "all-except-attachments"',
101+
'set security-constraint[last()]/web-resource-collection/url-pattern[1]/#text "*.jsp"',
102+
'set security-constraint[last()]/web-resource-collection/url-pattern[2]/#text "*.jspa"',
103+
'set security-constraint[last()]/web-resource-collection/url-pattern[3]/#text "/browse/*"',
104+
'set security-constraint[last()]/web-resource-collection/url-pattern[4]/#text "/issues/*"',
105+
'set security-constraint[last()]/user-data-constraint/transport-guarantee/#text "CONFIDENTIAL"',
106+
])
107+
end
108+
109+
it 'does not remove HTTPS redirect' do
110+
is_expected.to contain_augeas('jira-web.xml-https-redirect').
111+
with_onlyif('match security-constraint/user-data-constraint/transport-guarantee[#text="CONFIDENTIAL"] size == 0')
112+
end
113+
end
114+
115+
context 'with custom session_timeout' do
116+
let(:params) do
117+
{
118+
javahome: '/opt/java',
119+
version: DEFAULT_VERSION,
120+
session_timeout: 480,
121+
}
122+
end
123+
124+
it { is_expected.to compile.with_all_deps }
125+
126+
it 'sets custom session timeout' do
127+
is_expected.to contain_augeas('jira-web.xml-session-timeout').
128+
with_changes(['set session-config/session-timeout/#text 480'])
129+
end
130+
131+
it 'removes HTTPS redirect when disabled' do
132+
is_expected.to contain_augeas('jira-web.xml-https-redirect').
133+
with_changes(['rm security-constraint[user-data-constraint/transport-guarantee/#text="CONFIDENTIAL"]']).
134+
with_onlyif('match security-constraint/user-data-constraint/transport-guarantee[#text="CONFIDENTIAL"] size > 0')
135+
end
136+
end
137+
138+
context 'with both enable_https_redirect and custom session_timeout' do
139+
let(:params) do
140+
{
141+
javahome: '/opt/java',
142+
version: DEFAULT_VERSION,
143+
enable_https_redirect: true,
144+
session_timeout: 600,
145+
}
146+
end
147+
148+
it { is_expected.to compile.with_all_deps }
149+
150+
it 'sets custom session timeout' do
151+
is_expected.to contain_augeas('jira-web.xml-session-timeout').
152+
with_changes(['set session-config/session-timeout/#text 600'])
153+
end
154+
155+
it 'configures HTTPS redirect' do
156+
is_expected.to contain_augeas('jira-web.xml-https-redirect')
157+
end
158+
end
159+
160+
context 'web.xml augeas resources' do
161+
let(:params) do
162+
{
163+
javahome: '/opt/java',
164+
version: DEFAULT_VERSION,
165+
}
166+
end
167+
168+
it 'manages session timeout with augeas' do
169+
is_expected.to contain_augeas('jira-web.xml-session-timeout').
170+
with_incl("#{PATH_INSTALLATION_BASE}/atlassian-jira/WEB-INF/web.xml").
171+
with_lens('Xml.lns').
172+
with_context("/files#{PATH_INSTALLATION_BASE}/atlassian-jira/WEB-INF/web.xml/web-app")
173+
end
174+
175+
it 'manages https redirect with augeas' do
176+
is_expected.to contain_augeas('jira-web.xml-https-redirect').
177+
with_incl("#{PATH_INSTALLATION_BASE}/atlassian-jira/WEB-INF/web.xml").
178+
with_lens('Xml.lns').
179+
with_onlyif('match security-constraint/user-data-constraint/transport-guarantee[#text="CONFIDENTIAL"] size > 0')
180+
end
181+
end
182+
183+
context 'with web.xml and different JIRA versions' do
184+
let(:params) do
185+
{
186+
javahome: '/opt/java',
187+
version: '9.4.0',
188+
enable_https_redirect: true,
189+
session_timeout: 360,
190+
}
191+
end
192+
193+
it { is_expected.to compile.with_all_deps }
194+
195+
it 'manages custom session timeout' do
196+
is_expected.to contain_augeas('jira-web.xml-session-timeout').
197+
with_changes(['set session-config/session-timeout/#text 360'])
198+
end
199+
200+
it 'enables https redirect' do
201+
is_expected.to contain_augeas('jira-web.xml-https-redirect').
202+
with_onlyif('match security-constraint/user-data-constraint/transport-guarantee[#text="CONFIDENTIAL"] size == 0').
203+
with_changes([
204+
'set security-constraint[last()+1]/web-resource-collection/web-resource-name/#text "all-except-attachments"',
205+
'set security-constraint[last()]/web-resource-collection/url-pattern[1]/#text "*.jsp"',
206+
'set security-constraint[last()]/web-resource-collection/url-pattern[2]/#text "*.jspa"',
207+
'set security-constraint[last()]/web-resource-collection/url-pattern[3]/#text "/browse/*"',
208+
'set security-constraint[last()]/web-resource-collection/url-pattern[4]/#text "/issues/*"',
209+
'set security-constraint[last()]/user-data-constraint/transport-guarantee/#text "CONFIDENTIAL"',
210+
])
211+
end
212+
end
213+
214+
context 'with web.xml and OpenJDK 11' do
215+
let(:params) do
216+
{
217+
javahome: '/usr/lib/jvm/jre-11-openjdk',
218+
java_package: 'java-11-openjdk-headless',
219+
jvm_type: 'openjdk-11',
220+
enable_https_redirect: true,
221+
session_timeout: 420,
222+
}
223+
end
224+
225+
it { is_expected.to compile.with_all_deps }
226+
it { is_expected.to contain_package('java-11-openjdk-headless') }
227+
228+
it 'manages custom session timeout' do
229+
is_expected.to contain_augeas('jira-web.xml-session-timeout').
230+
with_changes(['set session-config/session-timeout/#text 420'])
231+
end
232+
233+
it 'enables https redirect' do
234+
is_expected.to contain_augeas('jira-web.xml-https-redirect').
235+
with_onlyif('match security-constraint/user-data-constraint/transport-guarantee[#text="CONFIDENTIAL"] size == 0').
236+
with_changes([
237+
'set security-constraint[last()+1]/web-resource-collection/web-resource-name/#text "all-except-attachments"',
238+
'set security-constraint[last()]/web-resource-collection/url-pattern[1]/#text "*.jsp"',
239+
'set security-constraint[last()]/web-resource-collection/url-pattern[2]/#text "*.jspa"',
240+
'set security-constraint[last()]/web-resource-collection/url-pattern[3]/#text "/browse/*"',
241+
'set security-constraint[last()]/web-resource-collection/url-pattern[4]/#text "/issues/*"',
242+
'set security-constraint[last()]/user-data-constraint/transport-guarantee/#text "CONFIDENTIAL"',
243+
])
244+
end
245+
end
246+
247+
context 'with minimum session timeout' do
248+
let(:params) do
249+
{
250+
javahome: '/opt/java',
251+
version: DEFAULT_VERSION,
252+
session_timeout: 1,
253+
}
254+
end
255+
256+
it { is_expected.to compile.with_all_deps }
257+
258+
it 'allows minimum valid session timeout' do
259+
is_expected.to contain_augeas('jira-web.xml-session-timeout').
260+
with_changes(['set session-config/session-timeout/#text 1'])
261+
end
262+
end
263+
264+
context 'with large session timeout' do
265+
let(:params) do
266+
{
267+
javahome: '/opt/java',
268+
version: DEFAULT_VERSION,
269+
session_timeout: 1440,
270+
}
271+
end
272+
273+
it { is_expected.to compile.with_all_deps }
274+
275+
it 'allows large session timeout (24 hours)' do
276+
is_expected.to contain_augeas('jira-web.xml-session-timeout').
277+
with_changes(['set session-config/session-timeout/#text 1440'])
278+
end
71279
end
72280

73281
context 'with java install' do

‎spec/support/spec/constants.rb‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@
1313
FILENAME_USER_SH = "#{PATH_INSTALLATION_BASE}/bin/user.sh"
1414
FILENAME_CHECK_JAVA_SH = "#{PATH_INSTALLATION_BASE}/bin/check-java.sh"
1515
FILENAME_SERVER_XML = "#{PATH_INSTALLATION_BASE}/conf/server.xml"
16+
FILENAME_WEB_XML = "#{PATH_INSTALLATION_BASE}/atlassian-jira/WEB-INF/web.xml"
1617
FILENAME_DBCONFIG_XML = '/home/jira/dbconfig.xml'
1718
FILENAME_CLUSTER_PROPS = '/home/jira/cluster.properties'
1819
FILENAME_JIRA_CONFIG_PROPS = '/home/jira/jira-config.properties'

0 commit comments

Comments
 (0)