Allow changing web.xml settings

.fixtures.yml

@@ -2,5 +2,6 @@
 fixtures:
   repositories:
     archive: https://github.com/voxpupuli/puppet-archive.git
+    augeas_core: https://github.com/puppetlabs/puppetlabs-augeas_core.git
     stdlib: https://github.com/puppetlabs/puppetlabs-stdlib.git
     systemd: https://github.com/voxpupuli/puppet-systemd.git

REFERENCE.md

@@ -164,6 +164,8 @@ The following parameters are available in the `jira` class:
 * [`tomcat_additional_connectors`](#-jira--tomcat_additional_connectors)
 * [`contextpath`](#-jira--contextpath)
 * [`resources`](#-jira--resources)
+* [`enable_https_redirect`](#-jira--enable_https_redirect)
+* [`session_timeout`](#-jira--session_timeout)
 * [`enable_sso`](#-jira--enable_sso)
 * [`application_name`](#-jira--application_name)
 * [`application_password`](#-jira--application_password)
@@ -1049,6 +1051,23 @@ undocumented
 
 Default value: `{}`
 
+##### <a name="-jira--enable_https_redirect"></a>`enable_https_redirect`
+
+Data type: `Boolean`
+
+Enable HTTPS redirection in web.xml. When enabled, adds a security constraint that redirects
+certain URL patterns (*.jsp, *.jspa, /browse/*, /issues/*) to HTTPS.
+
+Default value: `false`
+
+##### <a name="-jira--session_timeout"></a>`session_timeout`
+
+Data type: `Integer[1]`
+
+Session timeout in minutes in web.xml.
+
+Default value: `300`
+
 ##### <a name="-jira--enable_sso"></a>`enable_sso`
 
 Data type: `Boolean`

manifests/config.pp

@@ -203,6 +203,46 @@
     mode    => '0600',
   }
 
+  $webxml_path = "${jira::webappdir}/atlassian-jira/WEB-INF/web.xml"
+
+  augeas { 'jira-web.xml-session-timeout':
+    incl    => $webxml_path,
+    lens    => 'Xml.lns',
+    context => "/files${webxml_path}/web-app",
+    changes => [
+      "set session-config/session-timeout/#text ${jira::session_timeout}",
+    ],
+    require => Class['jira::install'],
+  }
+
+  $https_changes = $jira::enable_https_redirect ? {
+    true  => [
+      'set security-constraint[last()+1]/web-resource-collection/web-resource-name/#text "all-except-attachments"',
+      'set security-constraint[last()]/web-resource-collection/url-pattern[1]/#text "*.jsp"',
+      'set security-constraint[last()]/web-resource-collection/url-pattern[2]/#text "*.jspa"',
+      'set security-constraint[last()]/web-resource-collection/url-pattern[3]/#text "/browse/*"',
+      'set security-constraint[last()]/web-resource-collection/url-pattern[4]/#text "/issues/*"',
+      'set security-constraint[last()]/user-data-constraint/transport-guarantee/#text "CONFIDENTIAL"',
+    ],
+    false => [
+      'rm security-constraint[user-data-constraint/transport-guarantee/#text="CONFIDENTIAL"]',
+    ],
+  }
+
+  $https_onlyif = $jira::enable_https_redirect ? {
+    true  => 'match security-constraint/user-data-constraint/transport-guarantee[#text="CONFIDENTIAL"] size == 0',
+    false => 'match security-constraint/user-data-constraint/transport-guarantee[#text="CONFIDENTIAL"] size > 0',
+  }
+
+  augeas { 'jira-web.xml-https-redirect':
+    incl    => $webxml_path,
+    lens    => 'Xml.lns',
+    context => "/files${webxml_path}/web-app",
+    changes => $https_changes,
+    onlyif  => $https_onlyif,
+    require => Class['jira::install'],
+  }
+
   file { "${jira::homedir}/jira-config.properties":
     content => inline_epp(@(EOF)
         <% $merged_jira_config_properties.each |$key, $val| { -%>

manifests/init.pp

@@ -249,6 +249,11 @@
 #   Tomcat context path for the web service
 # @param resources
 #   undocumented
+# @param enable_https_redirect
+#   Enable HTTPS redirection in web.xml. When enabled, adds a security constraint that redirects
+#   certain URL patterns (*.jsp, *.jspa, /browse/*, /issues/*) to HTTPS.
+# @param session_timeout
+#   Session timeout in minutes in web.xml.
 # @param enable_sso
 #   Enable single sign-on via Crowd
 # @param application_name
@@ -413,6 +418,9 @@
   Optional[String[1]] $contextpath                                  = undef,
   # Resources for context.xml
   Hash $resources                                                   = {},
+  # web.xml settings
+  Boolean $enable_https_redirect                                    = false,
+  Integer[1] $session_timeout                                       = 300,
   # Enable SingleSignOn via Crowd
   Boolean $enable_sso                                               = false,
   String $application_name                                          = 'crowd',

spec/classes/jira_config_spec.rb

@@ -68,6 +68,214 @@ def self.clear_cache
 
             it { is_expected.not_to contain_file(FILENAME_CLUSTER_PROPS) }
             it { is_expected.not_to contain_file(FILENAME_CHECK_JAVA_SH) }
+
+            # Test web.xml management with default values
+            it do
+              is_expected.to contain_augeas('jira-web.xml-session-timeout').
+                with_changes(['set session-config/session-timeout/#text 300'])
+            end
+
+            it 'removes HTTPS redirect when disabled' do
+              is_expected.to contain_augeas('jira-web.xml-https-redirect').
+                with_changes(['rm security-constraint[user-data-constraint/transport-guarantee/#text="CONFIDENTIAL"]']).
+                with_onlyif('match security-constraint/user-data-constraint/transport-guarantee[#text="CONFIDENTIAL"] size > 0')
+            end
+          end
+
+          context 'with enable_https_redirect' do
+            let(:params) do
+              {
+                javahome: '/opt/java',
+                version: DEFAULT_VERSION,
+                enable_https_redirect: true,
+              }
+            end
+
+            it { is_expected.to compile.with_all_deps }
+
+            it 'configures HTTPS redirect in web.xml' do
+              is_expected.to contain_augeas('jira-web.xml-https-redirect').
+                with_onlyif('match security-constraint/user-data-constraint/transport-guarantee[#text="CONFIDENTIAL"] size == 0').
+                with_changes([
+                               'set security-constraint[last()+1]/web-resource-collection/web-resource-name/#text "all-except-attachments"',
+                               'set security-constraint[last()]/web-resource-collection/url-pattern[1]/#text "*.jsp"',
+                               'set security-constraint[last()]/web-resource-collection/url-pattern[2]/#text "*.jspa"',
+                               'set security-constraint[last()]/web-resource-collection/url-pattern[3]/#text "/browse/*"',
+                               'set security-constraint[last()]/web-resource-collection/url-pattern[4]/#text "/issues/*"',
+                               'set security-constraint[last()]/user-data-constraint/transport-guarantee/#text "CONFIDENTIAL"',
+                             ])
+            end
+
+            it 'does not remove HTTPS redirect' do
+              is_expected.to contain_augeas('jira-web.xml-https-redirect').
+                with_onlyif('match security-constraint/user-data-constraint/transport-guarantee[#text="CONFIDENTIAL"] size == 0')
+            end
+          end
+
+          context 'with custom session_timeout' do
+            let(:params) do
+              {
+                javahome: '/opt/java',
+                version: DEFAULT_VERSION,
+                session_timeout: 480,
+              }
+            end
+
+            it { is_expected.to compile.with_all_deps }
+
+            it 'sets custom session timeout' do
+              is_expected.to contain_augeas('jira-web.xml-session-timeout').
+                with_changes(['set session-config/session-timeout/#text 480'])
+            end
+
+            it 'removes HTTPS redirect when disabled' do
+              is_expected.to contain_augeas('jira-web.xml-https-redirect').
+                with_changes(['rm security-constraint[user-data-constraint/transport-guarantee/#text="CONFIDENTIAL"]']).
+                with_onlyif('match security-constraint/user-data-constraint/transport-guarantee[#text="CONFIDENTIAL"] size > 0')
+            end
+          end
+
+          context 'with both enable_https_redirect and custom session_timeout' do
+            let(:params) do
+              {
+                javahome: '/opt/java',
+                version: DEFAULT_VERSION,
+                enable_https_redirect: true,
+                session_timeout: 600,
+              }
+            end
+
+            it { is_expected.to compile.with_all_deps }
+
+            it 'sets custom session timeout' do
+              is_expected.to contain_augeas('jira-web.xml-session-timeout').
+                with_changes(['set session-config/session-timeout/#text 600'])
+            end
+
+            it 'configures HTTPS redirect' do
+              is_expected.to contain_augeas('jira-web.xml-https-redirect')
+            end
+          end
+
+          context 'web.xml augeas resources' do
+            let(:params) do
+              {
+                javahome: '/opt/java',
+                version: DEFAULT_VERSION,
+              }
+            end
+
+            it 'manages session timeout with augeas' do
+              is_expected.to contain_augeas('jira-web.xml-session-timeout').
+                with_incl("#{PATH_INSTALLATION_BASE}/atlassian-jira/WEB-INF/web.xml").
+                with_lens('Xml.lns').
+                with_context("/files#{PATH_INSTALLATION_BASE}/atlassian-jira/WEB-INF/web.xml/web-app")
+            end
+
+            it 'manages https redirect with augeas' do
+              is_expected.to contain_augeas('jira-web.xml-https-redirect').
+                with_incl("#{PATH_INSTALLATION_BASE}/atlassian-jira/WEB-INF/web.xml").
+                with_lens('Xml.lns').
+                with_onlyif('match security-constraint/user-data-constraint/transport-guarantee[#text="CONFIDENTIAL"] size > 0')
+            end
+          end
+
+          context 'with web.xml and different JIRA versions' do
+            let(:params) do
+              {
+                javahome: '/opt/java',
+                version: '9.4.0',
+                enable_https_redirect: true,
+                session_timeout: 360,
+              }
+            end
+
+            it { is_expected.to compile.with_all_deps }
+
+            it 'manages custom session timeout' do
+              is_expected.to contain_augeas('jira-web.xml-session-timeout').
+                with_changes(['set session-config/session-timeout/#text 360'])
+            end
+
+            it 'enables https redirect' do
+              is_expected.to contain_augeas('jira-web.xml-https-redirect').
+                with_onlyif('match security-constraint/user-data-constraint/transport-guarantee[#text="CONFIDENTIAL"] size == 0').
+                with_changes([
+                               'set security-constraint[last()+1]/web-resource-collection/web-resource-name/#text "all-except-attachments"',
+                               'set security-constraint[last()]/web-resource-collection/url-pattern[1]/#text "*.jsp"',
+                               'set security-constraint[last()]/web-resource-collection/url-pattern[2]/#text "*.jspa"',
+                               'set security-constraint[last()]/web-resource-collection/url-pattern[3]/#text "/browse/*"',
+                               'set security-constraint[last()]/web-resource-collection/url-pattern[4]/#text "/issues/*"',
+                               'set security-constraint[last()]/user-data-constraint/transport-guarantee/#text "CONFIDENTIAL"',
+                             ])
+            end
+          end
+
+          context 'with web.xml and OpenJDK 11' do
+            let(:params) do
+              {
+                javahome: '/usr/lib/jvm/jre-11-openjdk',
+                java_package: 'java-11-openjdk-headless',
+                jvm_type: 'openjdk-11',
+                enable_https_redirect: true,
+                session_timeout: 420,
+              }
+            end
+
+            it { is_expected.to compile.with_all_deps }
+            it { is_expected.to contain_package('java-11-openjdk-headless') }
+
+            it 'manages custom session timeout' do
+              is_expected.to contain_augeas('jira-web.xml-session-timeout').
+                with_changes(['set session-config/session-timeout/#text 420'])
+            end
+
+            it 'enables https redirect' do
+              is_expected.to contain_augeas('jira-web.xml-https-redirect').
+                with_onlyif('match security-constraint/user-data-constraint/transport-guarantee[#text="CONFIDENTIAL"] size == 0').
+                with_changes([
+                               'set security-constraint[last()+1]/web-resource-collection/web-resource-name/#text "all-except-attachments"',
+                               'set security-constraint[last()]/web-resource-collection/url-pattern[1]/#text "*.jsp"',
+                               'set security-constraint[last()]/web-resource-collection/url-pattern[2]/#text "*.jspa"',
+                               'set security-constraint[last()]/web-resource-collection/url-pattern[3]/#text "/browse/*"',
+                               'set security-constraint[last()]/web-resource-collection/url-pattern[4]/#text "/issues/*"',
+                               'set security-constraint[last()]/user-data-constraint/transport-guarantee/#text "CONFIDENTIAL"',
+                             ])
+            end
+          end
+
+          context 'with minimum session timeout' do
+            let(:params) do
+              {
+                javahome: '/opt/java',
+                version: DEFAULT_VERSION,
+                session_timeout: 1,
+              }
+            end
+
+            it { is_expected.to compile.with_all_deps }
+
+            it 'allows minimum valid session timeout' do
+              is_expected.to contain_augeas('jira-web.xml-session-timeout').
+                with_changes(['set session-config/session-timeout/#text 1'])
+            end
+          end
+
+          context 'with large session timeout' do
+            let(:params) do
+              {
+                javahome: '/opt/java',
+                version: DEFAULT_VERSION,
+                session_timeout: 1440,
+              }
+            end
+
+            it { is_expected.to compile.with_all_deps }
+
+            it 'allows large session timeout (24 hours)' do
+              is_expected.to contain_augeas('jira-web.xml-session-timeout').
+                with_changes(['set session-config/session-timeout/#text 1440'])
+            end
           end
 
           context 'with java install' do

spec/support/spec/constants.rb

@@ -13,6 +13,7 @@
 FILENAME_USER_SH = "#{PATH_INSTALLATION_BASE}/bin/user.sh"
 FILENAME_CHECK_JAVA_SH = "#{PATH_INSTALLATION_BASE}/bin/check-java.sh"
 FILENAME_SERVER_XML = "#{PATH_INSTALLATION_BASE}/conf/server.xml"
+FILENAME_WEB_XML = "#{PATH_INSTALLATION_BASE}/atlassian-jira/WEB-INF/web.xml"
 FILENAME_DBCONFIG_XML = '/home/jira/dbconfig.xml'
 FILENAME_CLUSTER_PROPS = '/home/jira/cluster.properties'
 FILENAME_JIRA_CONFIG_PROPS = '/home/jira/jira-config.properties'