Initial import
This commit is contained in:
Simo Sorce
parent
f110c803eb
commit
5f23c37313
1
.gitignore
vendored
1
.gitignore
vendored
@ -0,0 +1 @@
|
||||
/mod_auth_mellon-0.7.0.tar.gz
|
||||
1
10-auth_mellon.conf
Normal file
1
10-auth_mellon.conf
Normal file
@ -0,0 +1 @@
|
||||
LoadModule auth_mellon_module modules/mod_auth_mellon.so
|
||||
2
auth_mellon.conf
Normal file
2
auth_mellon.conf
Normal file
@ -0,0 +1,2 @@
|
||||
MellonCacheSize 100
|
||||
MellonLockFile "/run/mod_auth_mellon/lock"
|
||||
92
mellon_create_metadata.sh
Normal file
92
mellon_create_metadata.sh
Normal file
@ -0,0 +1,92 @@
|
||||
#!/usr/bin/env bash
|
||||
set -e
|
||||
|
||||
PROG="$(basename "$0")"
|
||||
|
||||
printUsage() {
|
||||
echo "Usage: $PROG ENTITY-ID ENDPOINT-URL"
|
||||
echo ""
|
||||
echo "Example:"
|
||||
echo " $PROG urn:someservice https://sp.example.org/mellon"
|
||||
echo ""
|
||||
}
|
||||
|
||||
if [ "$#" -lt 2 ]; then
|
||||
printUsage
|
||||
exit 1
|
||||
fi
|
||||
|
||||
ENTITYID="$1"
|
||||
if [ -z "$ENTITYID" ]; then
|
||||
echo "$PROG: An entity ID is required." >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
BASEURL="$2"
|
||||
if [ -z "$BASEURL" ]; then
|
||||
echo "$PROG: The URL to the MellonEndpointPath is required." >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if ! echo "$BASEURL" | grep -q '^https\?://'; then
|
||||
echo "$PROG: The URL must start with \"http://\" or \"https://\"." >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
HOST="$(echo "$BASEURL" | sed 's#^[a-z]*://\([^/]*\).*#\1#')"
|
||||
BASEURL="$(echo "$BASEURL" | sed 's#/$##')"
|
||||
|
||||
OUTFILE="$(echo "$ENTITYID" | sed 's/[^A-Za-z.]/_/g' | sed 's/__*/_/g')"
|
||||
echo "Output files:"
|
||||
echo "Private key: $OUTFILE.key"
|
||||
echo "Certificate: $OUTFILE.cert"
|
||||
echo "Metadata: $OUTFILE.xml"
|
||||
echo "Host: $HOST"
|
||||
echo
|
||||
echo "Endpoints:"
|
||||
echo "SingleLogoutService: $BASEURL/logout"
|
||||
echo "AssertionConsumerService: $BASEURL/postResponse"
|
||||
echo
|
||||
|
||||
# No files should not be readable by the rest of the world.
|
||||
umask 0077
|
||||
|
||||
TEMPLATEFILE="$(mktemp -t mellon_create_sp.XXXXXXXXXX)"
|
||||
|
||||
cat >"$TEMPLATEFILE" <<EOF
|
||||
RANDFILE = /dev/urandom
|
||||
[req]
|
||||
default_bits = 2048
|
||||
default_keyfile = privkey.pem
|
||||
distinguished_name = req_distinguished_name
|
||||
prompt = no
|
||||
policy = policy_anything
|
||||
[req_distinguished_name]
|
||||
commonName = $HOST
|
||||
EOF
|
||||
|
||||
openssl req -utf8 -batch -config "$TEMPLATEFILE" -new -x509 -days 3652 -nodes -out "$OUTFILE.cert" -keyout "$OUTFILE.key" 2>/dev/null
|
||||
|
||||
rm -f "$TEMPLATEFILE"
|
||||
|
||||
CERT="$(grep -v '^-----' "$OUTFILE.cert")"
|
||||
|
||||
cat >"$OUTFILE.xml" <<EOF
|
||||
<EntityDescriptor entityID="$ENTITYID" xmlns="urn:oasis:names:tc:SAML:2.0:metadata" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
|
||||
<SPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
|
||||
<KeyDescriptor use="signing">
|
||||
<ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
|
||||
<ds:X509Data>
|
||||
<ds:X509Certificate>$CERT</ds:X509Certificate>
|
||||
</ds:X509Data>
|
||||
</ds:KeyInfo>
|
||||
</KeyDescriptor>
|
||||
<SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="$BASEURL/logout"/>
|
||||
<AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="$BASEURL/postResponse" index="0"/>
|
||||
</SPSSODescriptor>
|
||||
</EntityDescriptor>
|
||||
EOF
|
||||
|
||||
umask 0777
|
||||
chmod go+r "$OUTFILE.xml"
|
||||
chmod go+r "$OUTFILE.cert"
|
||||
2
mod_auth_mellon.conf
Normal file
2
mod_auth_mellon.conf
Normal file
@ -0,0 +1,2 @@
|
||||
# mod_auth_mellon lock file is created in this directory
|
||||
d /run/mod_auth_mellon 0755 apache apache
|
||||
65
mod_auth_mellon.spec
Normal file
65
mod_auth_mellon.spec
Normal file
@ -0,0 +1,65 @@
|
||||
Summary: A SAML 2.0 authentication module for the Apache Httpd Server
|
||||
Name: mod_auth_mellon
|
||||
Version: 0.7.0
|
||||
Release: 1%{?dist}
|
||||
Group: System Environment/Daemons
|
||||
Source0: https://modmellon.googlecode.com/files/%{name}-%{version}.tar.gz
|
||||
Source1: auth_mellon.conf
|
||||
Source2: 10-auth_mellon.conf
|
||||
Source3: mod_auth_mellon.conf
|
||||
Source4: mellon_create_metadata.sh
|
||||
License: GPLv2+
|
||||
BuildRequires: curl-devel, glib2-devel, httpd-devel, lasso-devel, openssl-devel, xmlsec1-devel
|
||||
Requires: httpd-mmn = %{_httpd_mmn}
|
||||
Requires: lasso >= 2.3.6
|
||||
Url: https://code.google.com/p/modmellon/
|
||||
|
||||
%description
|
||||
The mod_auth_mellon module is an authentication service that implements the
|
||||
SAML 2.0 federation protocol. It grants access based on the attributes
|
||||
received in assertions generated by a IdP server.
|
||||
|
||||
%prep
|
||||
%setup -q -n %{name}-%{version}
|
||||
|
||||
%build
|
||||
export APXS=%{_httpd_apxs}
|
||||
%configure
|
||||
make %{?_smp_mflags}
|
||||
|
||||
%install
|
||||
# install module
|
||||
mkdir -p %{buildroot}%{_httpd_moddir}
|
||||
install -m 755 .libs/%{name}.so %{buildroot}%{_httpd_moddir}
|
||||
|
||||
# install module configuration
|
||||
mkdir -p %{buildroot}%{_httpd_confdir}
|
||||
install -m 644 %{SOURCE1} %{buildroot}%{_httpd_confdir}
|
||||
mkdir -p %{buildroot}%{_httpd_modconfdir}
|
||||
install -m 644 %{SOURCE2} %{buildroot}%{_httpd_modconfdir}
|
||||
|
||||
mkdir -p %{buildroot}%{_tmpfilesdir}
|
||||
install -m 644 %{SOURCE3} %{buildroot}%{_tmpfilesdir}
|
||||
mkdir -p %{buildroot}/run/%{name}
|
||||
|
||||
# install script to generate metadata
|
||||
mkdir -p %{buildroot}/%{_libexecdir}/%{name}
|
||||
install -m 755 %{SOURCE4} %{buildroot}/%{_libexecdir}/%{name}
|
||||
|
||||
%files
|
||||
%defattr(-,root,root)
|
||||
%doc README COPYING
|
||||
%config(noreplace) %{_httpd_modconfdir}/10-auth_mellon.conf
|
||||
%config(noreplace) %{_httpd_confdir}/auth_mellon.conf
|
||||
%{_httpd_moddir}/mod_auth_mellon.so
|
||||
%{_tmpfilesdir}/mod_auth_mellon.conf
|
||||
%{_libexecdir}/%{name}
|
||||
%dir /run/%{name}/
|
||||
|
||||
%changelog
|
||||
* Tue Dec 10 2013 Simo Sorce <simo@redhat.com> 0.7.0-1
|
||||
- Fix ownership of /run files
|
||||
|
||||
* Wed Nov 27 2013 Simo Sorce <simo@redhat.com> 0.7.0-0
|
||||
- Initial Fedora release based on version 0.7.0
|
||||
- Based on an old spec file by Jean-Marc Liger <jmliger@siris.sorbonne.fr>
|
||||
Loading…
Reference in New Issue
Block a user