httpd_configmap_generator 0.2.1 → 0.3.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +5 -5
- data/.codeclimate.yml +16 -0
- data/.gitignore +0 -2
- data/.rubocop.yml +4 -0
- data/.rubocop_cc.yml +4 -0
- data/.rubocop_local.yml +0 -0
- data/.travis.yml +11 -4
- data/.yamllint +11 -0
- data/Dockerfile +11 -3
- data/Gemfile.lock +101 -0
- data/README-oidc.md +39 -0
- data/README.md +12 -29
- data/bin/httpd_configmap_generator +5 -5
- data/httpd_configmap_generator.gemspec +2 -2
- data/lib/httpd_configmap_generator/active_directory.rb +2 -2
- data/lib/httpd_configmap_generator/base/config_map.rb +13 -8
- data/lib/httpd_configmap_generator/base.rb +1 -4
- data/lib/httpd_configmap_generator/ipa.rb +11 -0
- data/lib/httpd_configmap_generator/ldap.rb +3 -2
- data/lib/httpd_configmap_generator/oidc.rb +48 -0
- data/lib/httpd_configmap_generator/saml.rb +3 -1
- data/lib/httpd_configmap_generator/version.rb +1 -1
- data/lib/httpd_configmap_generator.rb +1 -0
- metadata +23 -16
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
|
-
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
2
|
+
SHA256:
|
|
3
|
+
metadata.gz: 74ce527f79c3ee674c52b811ae9075dc19eab97f5e5d7fe53e01a01ba95d41d1
|
|
4
|
+
data.tar.gz: e5fa88f3cb90605d125a188f16ab5f98d6ee517c6e42b4d77d573c630ae79a19
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: 7ce0ad42aad3f3b7ba09d1370e0a4efe05c888fa01b7c45bc78da1871802cb515b419c6deed83b8cd8d7a3b329c3d9cf3b9907395ee6f96dbf5c0be983ae2b6d
|
|
7
|
+
data.tar.gz: f6c95ce7d686c3330d06b12cbaf8d8320d769b244320e83973128c45ff55841f7030a7be03b31a039358ca822ed7ae8c85f26bfc8e541b1ea15c75ecd1cc4f2a
|
data/.codeclimate.yml
ADDED
|
@@ -0,0 +1,16 @@
|
|
|
1
|
+
prepare:
|
|
2
|
+
fetch:
|
|
3
|
+
- url: https://raw.githubusercontent.com/ManageIQ/manageiq-style/master/.rubocop_base.yml
|
|
4
|
+
path: ".rubocop_base.yml"
|
|
5
|
+
- url: https://raw.githubusercontent.com/ManageIQ/manageiq-style/master/.rubocop_cc_base.yml
|
|
6
|
+
path: ".rubocop_cc_base.yml"
|
|
7
|
+
- url: https://raw.githubusercontent.com/ManageIQ/manageiq-style/master/styles/base.yml
|
|
8
|
+
path: styles/base.yml
|
|
9
|
+
- url: https://raw.githubusercontent.com/ManageIQ/manageiq-style/master/styles/cc_base.yml
|
|
10
|
+
path: styles/cc_base.yml
|
|
11
|
+
plugins:
|
|
12
|
+
rubocop:
|
|
13
|
+
enabled: true
|
|
14
|
+
config: ".rubocop_cc.yml"
|
|
15
|
+
channel: rubocop-0-82
|
|
16
|
+
version: '2'
|
data/.gitignore
CHANGED
data/.rubocop.yml
ADDED
data/.rubocop_cc.yml
ADDED
data/.rubocop_local.yml
ADDED
|
File without changes
|
data/.travis.yml
CHANGED
|
@@ -1,10 +1,17 @@
|
|
|
1
|
+
---
|
|
1
2
|
language: ruby
|
|
3
|
+
dist: bionic
|
|
2
4
|
rvm:
|
|
3
|
-
-
|
|
4
|
-
-
|
|
5
|
-
sudo: false
|
|
5
|
+
- 2.6.6
|
|
6
|
+
- 2.7.2
|
|
6
7
|
cache: bundler
|
|
7
|
-
|
|
8
|
+
before_script:
|
|
9
|
+
- curl -L https://codeclimate.com/downloads/test-reporter/test-reporter-latest-linux-amd64
|
|
10
|
+
> ./cc-test-reporter
|
|
11
|
+
- chmod +x ./cc-test-reporter
|
|
12
|
+
- "./cc-test-reporter before-build"
|
|
13
|
+
after_script:
|
|
14
|
+
- "./cc-test-reporter after-build --exit-code $TRAVIS_TEST_RESULT"
|
|
8
15
|
notifications:
|
|
9
16
|
webhooks:
|
|
10
17
|
urls:
|
data/.yamllint
ADDED
data/Dockerfile
CHANGED
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
FROM manageiq/httpd:latest
|
|
1
|
+
FROM manageiq/httpd-init:latest
|
|
2
2
|
MAINTAINER ManageIQ https://github.com/ManageIQ
|
|
3
3
|
|
|
4
4
|
LABEL name="httpd-configmap-generator" \
|
|
@@ -11,6 +11,14 @@ ENV HTTPD_AUTH_TYPE=internal \
|
|
|
11
11
|
HTTPD_AUTH_KERBEROS_REALMS=undefined \
|
|
12
12
|
TERM=xterm
|
|
13
13
|
|
|
14
|
-
RUN
|
|
14
|
+
RUN dnf -y --disableplugin=subscription-manager install \
|
|
15
|
+
https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm && \
|
|
16
|
+
dnf -y --disableplugin=subscription-manager install \
|
|
17
|
+
authselect-compat \
|
|
18
|
+
openldap-clients \
|
|
19
|
+
pamtester && \
|
|
20
|
+
dnf clean all && \
|
|
21
|
+
rm -rf /var/cache/dnf
|
|
15
22
|
|
|
16
|
-
RUN
|
|
23
|
+
RUN bundle config --global without development:test
|
|
24
|
+
RUN gem install --no-document httpd_configmap_generator
|
data/Gemfile.lock
ADDED
|
@@ -0,0 +1,101 @@
|
|
|
1
|
+
PATH
|
|
2
|
+
remote: .
|
|
3
|
+
specs:
|
|
4
|
+
httpd_configmap_generator (0.3.2)
|
|
5
|
+
activesupport (>= 5.0)
|
|
6
|
+
awesome_spawn (~> 1.4)
|
|
7
|
+
iniparse (~> 1.4)
|
|
8
|
+
more_core_extensions (~> 3.4)
|
|
9
|
+
optimist (~> 3.0)
|
|
10
|
+
|
|
11
|
+
GEM
|
|
12
|
+
remote: https://rubygems.org/
|
|
13
|
+
specs:
|
|
14
|
+
activesupport (6.1.4.1)
|
|
15
|
+
concurrent-ruby (~> 1.0, >= 1.0.2)
|
|
16
|
+
i18n (>= 1.6, < 2)
|
|
17
|
+
minitest (>= 5.1)
|
|
18
|
+
tzinfo (~> 2.0)
|
|
19
|
+
zeitwerk (~> 2.3)
|
|
20
|
+
ast (2.4.2)
|
|
21
|
+
awesome_spawn (1.5.0)
|
|
22
|
+
concurrent-ruby (1.1.9)
|
|
23
|
+
diff-lcs (1.4.4)
|
|
24
|
+
docile (1.4.0)
|
|
25
|
+
i18n (1.8.10)
|
|
26
|
+
concurrent-ruby (~> 1.0)
|
|
27
|
+
iniparse (1.5.0)
|
|
28
|
+
manageiq-style (1.3.1)
|
|
29
|
+
more_core_extensions
|
|
30
|
+
optimist
|
|
31
|
+
rubocop (~> 1.13)
|
|
32
|
+
rubocop-performance
|
|
33
|
+
rubocop-rails
|
|
34
|
+
minitest (5.14.4)
|
|
35
|
+
more_core_extensions (3.8.0)
|
|
36
|
+
activesupport
|
|
37
|
+
optimist (3.0.1)
|
|
38
|
+
parallel (1.21.0)
|
|
39
|
+
parser (3.0.2.0)
|
|
40
|
+
ast (~> 2.4.1)
|
|
41
|
+
rack (2.2.3)
|
|
42
|
+
rainbow (3.0.0)
|
|
43
|
+
rake (13.0.6)
|
|
44
|
+
regexp_parser (2.1.1)
|
|
45
|
+
rexml (3.2.5)
|
|
46
|
+
rspec (3.10.0)
|
|
47
|
+
rspec-core (~> 3.10.0)
|
|
48
|
+
rspec-expectations (~> 3.10.0)
|
|
49
|
+
rspec-mocks (~> 3.10.0)
|
|
50
|
+
rspec-core (3.10.1)
|
|
51
|
+
rspec-support (~> 3.10.0)
|
|
52
|
+
rspec-expectations (3.10.1)
|
|
53
|
+
diff-lcs (>= 1.2.0, < 2.0)
|
|
54
|
+
rspec-support (~> 3.10.0)
|
|
55
|
+
rspec-mocks (3.10.2)
|
|
56
|
+
diff-lcs (>= 1.2.0, < 2.0)
|
|
57
|
+
rspec-support (~> 3.10.0)
|
|
58
|
+
rspec-support (3.10.2)
|
|
59
|
+
rubocop (1.22.1)
|
|
60
|
+
parallel (~> 1.10)
|
|
61
|
+
parser (>= 3.0.0.0)
|
|
62
|
+
rainbow (>= 2.2.2, < 4.0)
|
|
63
|
+
regexp_parser (>= 1.8, < 3.0)
|
|
64
|
+
rexml
|
|
65
|
+
rubocop-ast (>= 1.12.0, < 2.0)
|
|
66
|
+
ruby-progressbar (~> 1.7)
|
|
67
|
+
unicode-display_width (>= 1.4.0, < 3.0)
|
|
68
|
+
rubocop-ast (1.12.0)
|
|
69
|
+
parser (>= 3.0.1.1)
|
|
70
|
+
rubocop-performance (1.11.5)
|
|
71
|
+
rubocop (>= 1.7.0, < 2.0)
|
|
72
|
+
rubocop-ast (>= 0.4.0)
|
|
73
|
+
rubocop-rails (2.12.2)
|
|
74
|
+
activesupport (>= 4.2.0)
|
|
75
|
+
rack (>= 1.1)
|
|
76
|
+
rubocop (>= 1.7.0, < 2.0)
|
|
77
|
+
ruby-progressbar (1.11.0)
|
|
78
|
+
simplecov (0.21.2)
|
|
79
|
+
docile (~> 1.1)
|
|
80
|
+
simplecov-html (~> 0.11)
|
|
81
|
+
simplecov_json_formatter (~> 0.1)
|
|
82
|
+
simplecov-html (0.12.3)
|
|
83
|
+
simplecov_json_formatter (0.1.3)
|
|
84
|
+
tzinfo (2.0.4)
|
|
85
|
+
concurrent-ruby (~> 1.0)
|
|
86
|
+
unicode-display_width (2.1.0)
|
|
87
|
+
zeitwerk (2.4.2)
|
|
88
|
+
|
|
89
|
+
PLATFORMS
|
|
90
|
+
ruby
|
|
91
|
+
x86_64-darwin-19
|
|
92
|
+
|
|
93
|
+
DEPENDENCIES
|
|
94
|
+
httpd_configmap_generator!
|
|
95
|
+
manageiq-style
|
|
96
|
+
rake
|
|
97
|
+
rspec (~> 3.0)
|
|
98
|
+
simplecov
|
|
99
|
+
|
|
100
|
+
BUNDLED WITH
|
|
101
|
+
2.2.24
|
data/README-oidc.md
ADDED
|
@@ -0,0 +1,39 @@
|
|
|
1
|
+
# Httpd Configmap Generator - OpenID-Connect (OIDC)
|
|
2
|
+
|
|
3
|
+
This documents how to run the httpd\_configmap\_generator tool to configure the container against an OpenID-Connect (OIDC) identity provider.
|
|
4
|
+
|
|
5
|
+
## Usage for the `oidc` auth-type:
|
|
6
|
+
|
|
7
|
+
```
|
|
8
|
+
$ httpd_configmap_generator oidc --help
|
|
9
|
+
Options:
|
|
10
|
+
-o, --output=<s> Configuration map file to create
|
|
11
|
+
-u, --oidc-url=<s> OpenID-Connect Provider URL
|
|
12
|
+
-i, --oidc-client-id=<s> OpenID-Connect Provider Client ID
|
|
13
|
+
-s, --oidc-client-secret=<s> OpenID-Connect Provider Client Secret
|
|
14
|
+
-f, --force Force configuration if configured already
|
|
15
|
+
-d, --debug Enable debugging
|
|
16
|
+
-h, --help Show this message
|
|
17
|
+
|
|
18
|
+
```
|
|
19
|
+
|
|
20
|
+
### Examples:
|
|
21
|
+
|
|
22
|
+
Creates the extra data for the container:
|
|
23
|
+
|
|
24
|
+
```
|
|
25
|
+
$ httpd_configmap_generator oidc \
|
|
26
|
+
--force \
|
|
27
|
+
--oidc-url=http://my-keycloak:8080/auth/realms/miq/.well-known/openid-configuration \
|
|
28
|
+
--oidc-client-id=my-keycloak-oidc-client \
|
|
29
|
+
--oidc-client-secret=99999999-9999-9999-a999-99999a999999 \
|
|
30
|
+
--debug \
|
|
31
|
+
-o /tmp/external-oidc.yaml
|
|
32
|
+
```
|
|
33
|
+
|
|
34
|
+
The auth configmap file for oidc does not include any files. It only includes the following extra data:
|
|
35
|
+
|
|
36
|
+
* auth-oidc-provider-metadata-url
|
|
37
|
+
* auth-oidc-client-id
|
|
38
|
+
* auth-oidc-client-secret
|
|
39
|
+
|
data/README.md
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
# Httpd Configmap Generator
|
|
2
2
|
|
|
3
3
|
[](http://badge.fury.io/rb/httpd_configmap_generator)
|
|
4
|
-
[](https://travis-ci.org/ManageIQ/httpd_configmap_generator)
|
|
4
|
+
[](https://travis-ci.org/ManageIQ/httpd_configmap_generator)
|
|
5
5
|
[](https://codeclimate.com/github/ManageIQ/httpd_configmap_generator)
|
|
6
6
|
[](https://codeclimate.com/github/ManageIQ/httpd_configmap_generator/coverage)
|
|
7
7
|
[](https://gemnasium.com/ManageIQ/httpd_configmap_generator)
|
|
@@ -28,7 +28,7 @@ httpd_configmap_generator 0.1.1 - External Authentication Configuration script
|
|
|
28
28
|
|
|
29
29
|
Usage: httpd_configmap_generator auth_type | update | export [--help | options]
|
|
30
30
|
|
|
31
|
-
supported auth_type: active-directory, ipa, ldap, saml
|
|
31
|
+
supported auth_type: active-directory, ipa, ldap, saml, oidc
|
|
32
32
|
|
|
33
33
|
httpd_configmap_generator options are:
|
|
34
34
|
-V, --version Version of the httpd_configmap_generator command
|
|
@@ -43,12 +43,13 @@ $ httpd_configmap_generator ipa --help
|
|
|
43
43
|
|
|
44
44
|
## Supported Authentication Types
|
|
45
45
|
|
|
46
|
-
|auth-type
|
|
47
|
-
|
|
48
|
-
| active-directory
|
|
49
|
-
| ipa
|
|
50
|
-
| ldap
|
|
51
|
-
| saml
|
|
46
|
+
|auth-type | Identity Provider/Environment | for usage: |
|
|
47
|
+
|-----------------------------------|--------------------------------------------------|-------------------------------------------------------|
|
|
48
|
+
| active-directory | Active Directory domain realm join | [README-active-directory](README-active-directory.md) |
|
|
49
|
+
| ipa | IPA, IPA 2-factor authentication, IPA/AD Trust | [README-ipa](README-ipa.md) |
|
|
50
|
+
| ldap | Ldap directories | [README-ldap](README-ldap.md) |
|
|
51
|
+
| saml | Keycloak, etc. | [README-saml](README-saml.md) |
|
|
52
|
+
| OpenID-Connect (oidc) | Keycloak, etc. | [README-oidc](README-oidc.md) |
|
|
52
53
|
|
|
53
54
|
___
|
|
54
55
|
|
|
@@ -260,8 +261,6 @@ ___
|
|
|
260
261
|
|
|
261
262
|
### Pre-deployment tasks
|
|
262
263
|
|
|
263
|
-
#### If running without OCI systemd hooks (Minishift)
|
|
264
|
-
|
|
265
264
|
The httpd-configmap-generator service account must be added to the httpd-scc-sysadmin SCC before the Httpd Configmap Generator can run.
|
|
266
265
|
|
|
267
266
|
##### As Admin
|
|
@@ -285,22 +284,6 @@ $ oc describe scc httpd-scc-sysadmin | grep Users
|
|
|
285
284
|
Users: system:serviceaccount:<your-namespace>:httpd-configmap-generator
|
|
286
285
|
```
|
|
287
286
|
|
|
288
|
-
#### If running with OCI systemd hooks
|
|
289
|
-
|
|
290
|
-
##### As Admin
|
|
291
|
-
|
|
292
|
-
```
|
|
293
|
-
$ oc adm policy add-scc-to-user anyuid system:serviceaccount:<your-namespace>:httpd-configmap-generator
|
|
294
|
-
```
|
|
295
|
-
|
|
296
|
-
Verify that the httpd-configmap-generator service account is included in the anyuid SCC:
|
|
297
|
-
|
|
298
|
-
```
|
|
299
|
-
$ oc describe scc anyuid | grep Users
|
|
300
|
-
Users: system:serviceaccount:<your-namespace>:httpd-configmap-generator
|
|
301
|
-
```
|
|
302
|
-
|
|
303
|
-
|
|
304
287
|
### Deploy the Httpd Configmap Generator Application
|
|
305
288
|
|
|
306
289
|
As basic user
|
|
@@ -341,20 +324,20 @@ $ CONFIGMAP_GENERATOR_POD=`oc get pods | grep "httpd-configmap-generator" | cut
|
|
|
341
324
|
### Generating a configmap for external authentication against IPA
|
|
342
325
|
|
|
343
326
|
```
|
|
344
|
-
$ oc
|
|
327
|
+
$ oc exec $CONFIGMAP_GENERATOR_POD -- bash -c 'httpd_configmap_generator ipa ...
|
|
345
328
|
```
|
|
346
329
|
|
|
347
330
|
Example configuration:
|
|
348
331
|
|
|
349
332
|
```
|
|
350
|
-
$ oc
|
|
333
|
+
$ oc exec $CONFIGMAP_GENERATOR_POD -- bash -c 'httpd_configmap_generator ipa \
|
|
351
334
|
--host=appliance.example.com \
|
|
352
335
|
--ipa-server=ipaserver.example.com \
|
|
353
336
|
--ipa-domain=example.com \
|
|
354
337
|
--ipa-realm=EXAMPLE.COM \
|
|
355
338
|
--ipa-principal=admin \
|
|
356
339
|
--ipa-password=smartvm1 \
|
|
357
|
-
-o /tmp/external-ipa.yaml
|
|
340
|
+
-o /tmp/external-ipa.yaml'
|
|
358
341
|
```
|
|
359
342
|
|
|
360
343
|
`--host` above must be the DNS of the application exposing the httpd auth pod,
|
|
@@ -8,7 +8,7 @@
|
|
|
8
8
|
#
|
|
9
9
|
|
|
10
10
|
Dir.chdir(__dir__) { require "bundler/setup" }
|
|
11
|
-
require "
|
|
11
|
+
require "optimist"
|
|
12
12
|
require "httpd_configmap_generator"
|
|
13
13
|
|
|
14
14
|
CMD = File.basename($PROGRAM_NAME)
|
|
@@ -23,14 +23,14 @@ module HttpdConfigmapGenerator
|
|
|
23
23
|
SUB_COMMANDS = [HttpdConfigmapGenerator.supported_auth_types] | %w(update export)
|
|
24
24
|
|
|
25
25
|
def run
|
|
26
|
-
|
|
26
|
+
Optimist.options do
|
|
27
27
|
version("#{CMD} #{HttpdConfigmapGenerator::VERSION} - External Authentication Configuration script")
|
|
28
28
|
banner <<-EOS
|
|
29
29
|
#{version}
|
|
30
30
|
|
|
31
31
|
Usage: #{CMD} auth_type | update | export [--help | options]
|
|
32
32
|
|
|
33
|
-
supported auth_type: #{HttpdConfigmapGenerator.supported_auth_types.join(', ')}
|
|
33
|
+
supported auth_type: #{HttpdConfigmapGenerator.supported_auth_types.sort.join(', ')}
|
|
34
34
|
|
|
35
35
|
#{CMD} options are:
|
|
36
36
|
EOS
|
|
@@ -40,7 +40,7 @@ supported auth_type: #{HttpdConfigmapGenerator.supported_auth_types.join(', ')}
|
|
|
40
40
|
end
|
|
41
41
|
|
|
42
42
|
auth_type = ARGV.shift
|
|
43
|
-
|
|
43
|
+
Optimist.die "Must specify an authentication type" if auth_type.nil?
|
|
44
44
|
|
|
45
45
|
begin
|
|
46
46
|
auth_config =
|
|
@@ -53,7 +53,7 @@ supported auth_type: #{HttpdConfigmapGenerator.supported_auth_types.join(', ')}
|
|
|
53
53
|
error_msg(err.to_s)
|
|
54
54
|
end
|
|
55
55
|
|
|
56
|
-
params =
|
|
56
|
+
params = Optimist.options do
|
|
57
57
|
auth_config.required_options.each do |key, key_options|
|
|
58
58
|
opt key, key_options[:description], HttpdConfigmapGenerator::Cli.options_for(key_options, true)
|
|
59
59
|
end
|
|
@@ -23,7 +23,7 @@ Gem::Specification.new do |s|
|
|
|
23
23
|
s.executables = s.files.grep(%r{^bin/}) { |f| File.basename(f) } - %w(console setup)
|
|
24
24
|
s.require_paths = ["lib"]
|
|
25
25
|
|
|
26
|
-
s.add_development_dependency "
|
|
26
|
+
s.add_development_dependency "manageiq-style"
|
|
27
27
|
s.add_development_dependency "rspec", "~> 3.0"
|
|
28
28
|
s.add_development_dependency "rake"
|
|
29
29
|
s.add_development_dependency "simplecov"
|
|
@@ -32,5 +32,5 @@ Gem::Specification.new do |s|
|
|
|
32
32
|
s.add_dependency "awesome_spawn", "~> 1.4"
|
|
33
33
|
s.add_dependency "iniparse", "~> 1.4"
|
|
34
34
|
s.add_dependency "more_core_extensions", "~> 3.4"
|
|
35
|
-
s.add_dependency "
|
|
35
|
+
s.add_dependency "optimist", "~> 3.0"
|
|
36
36
|
end
|
|
@@ -9,6 +9,8 @@ module HttpdConfigmapGenerator
|
|
|
9
9
|
|
|
10
10
|
def required_options
|
|
11
11
|
super.merge(
|
|
12
|
+
:host => { :description => "Application Domain",
|
|
13
|
+
:short => "-h" },
|
|
12
14
|
:ad_domain => { :description => "Active Directory Domain" },
|
|
13
15
|
:ad_user => { :description => "Active Directory User" },
|
|
14
16
|
:ad_password => { :description => "Active Directory Password" }
|
|
@@ -34,10 +36,8 @@ module HttpdConfigmapGenerator
|
|
|
34
36
|
/etc/pam.d/postlogin-ac
|
|
35
37
|
/etc/pam.d/smartcard-auth-ac
|
|
36
38
|
/etc/pam.d/system-auth-ac
|
|
37
|
-
/etc/resolv.conf
|
|
38
39
|
/etc/sssd/sssd.conf
|
|
39
40
|
/etc/sysconfig/authconfig
|
|
40
|
-
/etc/sysconfig/network
|
|
41
41
|
)
|
|
42
42
|
end
|
|
43
43
|
|
|
@@ -16,11 +16,11 @@ module HttpdConfigmapGenerator
|
|
|
16
16
|
@config_map = template
|
|
17
17
|
end
|
|
18
18
|
|
|
19
|
-
def generate(auth_type, realm, file_list)
|
|
19
|
+
def generate(auth_type, realm = "undefined", file_list = nil, metadata = {})
|
|
20
20
|
info_msg("Generating Auth Config-Map for #{auth_type}")
|
|
21
21
|
@config_map = template(auth_type, realm)
|
|
22
22
|
file_specs = gen_filespecs(file_list)
|
|
23
|
-
define_configuration(file_specs)
|
|
23
|
+
define_configuration(file_specs, metadata)
|
|
24
24
|
include_files(file_specs)
|
|
25
25
|
end
|
|
26
26
|
|
|
@@ -71,7 +71,7 @@ module HttpdConfigmapGenerator
|
|
|
71
71
|
file_specs = []
|
|
72
72
|
file_list.each do |file|
|
|
73
73
|
file_specs << file_entry_spec(file.strip)
|
|
74
|
-
end
|
|
74
|
+
end unless file_list.nil?
|
|
75
75
|
file_specs.sort_by { |file_spec| file_spec[:basename] }
|
|
76
76
|
end
|
|
77
77
|
|
|
@@ -135,7 +135,7 @@ module HttpdConfigmapGenerator
|
|
|
135
135
|
}
|
|
136
136
|
end
|
|
137
137
|
|
|
138
|
-
def update_configuration(file_specs)
|
|
138
|
+
def update_configuration(file_specs, metadata={})
|
|
139
139
|
auth_configuration = fetch_auth_configuration
|
|
140
140
|
return define_configuration(file_specs) unless auth_configuration
|
|
141
141
|
# first, remove any file_specs references in the file list, we don't want duplication here.
|
|
@@ -146,7 +146,7 @@ module HttpdConfigmapGenerator
|
|
|
146
146
|
end
|
|
147
147
|
auth_configuration = auth_configuration.join("\n") + "\n"
|
|
148
148
|
# now, append any of the new file_specs at the end of the list.
|
|
149
|
-
append_configuration(auth_configuration, file_specs)
|
|
149
|
+
append_configuration(auth_configuration, file_specs, metadata)
|
|
150
150
|
end
|
|
151
151
|
|
|
152
152
|
def search_file_entry(target_file)
|
|
@@ -157,9 +157,9 @@ module HttpdConfigmapGenerator
|
|
|
157
157
|
entry ? entry.first.split('=')[1].strip.split(' ') : nil
|
|
158
158
|
end
|
|
159
159
|
|
|
160
|
-
def define_configuration(file_specs)
|
|
160
|
+
def define_configuration(file_specs, metadata={})
|
|
161
161
|
auth_configuration = "# External Authentication Configuration File\n#\n"
|
|
162
|
-
append_configuration(auth_configuration, file_specs)
|
|
162
|
+
append_configuration(auth_configuration, file_specs, metadata)
|
|
163
163
|
end
|
|
164
164
|
|
|
165
165
|
def include_files(file_specs)
|
|
@@ -175,12 +175,17 @@ module HttpdConfigmapGenerator
|
|
|
175
175
|
file_spec[:binary] ? "#{file_spec[:basename]}.base64" : file_spec[:basename]
|
|
176
176
|
end
|
|
177
177
|
|
|
178
|
-
def append_configuration(auth_configuration, file_specs)
|
|
178
|
+
def append_configuration(auth_configuration, file_specs, metadata)
|
|
179
179
|
file_specs.each do |file_spec|
|
|
180
180
|
debug_msg("Adding file #{file_spec[:target]} ...")
|
|
181
181
|
auth_configuration += "file = #{file_basename(file_spec)} #{file_spec[:target]} #{file_spec[:mode]}\n"
|
|
182
182
|
end
|
|
183
183
|
config_map[DATA_SECTION] ||= {}
|
|
184
|
+
|
|
185
|
+
metadata.each do |key, value|
|
|
186
|
+
config_map[DATA_SECTION].merge!(key => value)
|
|
187
|
+
end
|
|
188
|
+
|
|
184
189
|
config_map[DATA_SECTION].merge!(AUTH_CONFIGURATION => auth_configuration)
|
|
185
190
|
end
|
|
186
191
|
|
|
@@ -54,10 +54,7 @@ module HttpdConfigmapGenerator
|
|
|
54
54
|
|
|
55
55
|
def required_options
|
|
56
56
|
{
|
|
57
|
-
:
|
|
58
|
-
:short => "-h" },
|
|
59
|
-
:output => { :description => "Configuration map file to create",
|
|
60
|
-
:short => "-o" }
|
|
57
|
+
:output => { :description => "Configuration map file to create", :short => "-o" }
|
|
61
58
|
}
|
|
62
59
|
end
|
|
63
60
|
|
|
@@ -1,3 +1,5 @@
|
|
|
1
|
+
require "socket"
|
|
2
|
+
|
|
1
3
|
module HttpdConfigmapGenerator
|
|
2
4
|
class Ipa < Base
|
|
3
5
|
IPA_INSTALL_COMMAND = "/usr/sbin/ipa-client-install".freeze
|
|
@@ -9,6 +11,8 @@ module HttpdConfigmapGenerator
|
|
|
9
11
|
|
|
10
12
|
def required_options
|
|
11
13
|
super.merge(
|
|
14
|
+
:host => { :description => "Application Domain",
|
|
15
|
+
:short => "-h" },
|
|
12
16
|
:ipa_server => { :description => "IPA Server FQDN" },
|
|
13
17
|
:ipa_password => { :description => "IPA Server Password" }
|
|
14
18
|
)
|
|
@@ -49,6 +53,7 @@ module HttpdConfigmapGenerator
|
|
|
49
53
|
end
|
|
50
54
|
|
|
51
55
|
def configure(opts)
|
|
56
|
+
opts[:host] = get_canonical_hostname(opts[:host])
|
|
52
57
|
update_hostname(opts[:host])
|
|
53
58
|
command_run!(IPA_INSTALL_COMMAND,
|
|
54
59
|
:params => [
|
|
@@ -118,5 +123,11 @@ module HttpdConfigmapGenerator
|
|
|
118
123
|
FileUtils.chown(APACHE_USER, nil, HTTP_KEYTAB)
|
|
119
124
|
FileUtils.chmod(0o600, HTTP_KEYTAB)
|
|
120
125
|
end
|
|
126
|
+
|
|
127
|
+
def get_canonical_hostname(hostname)
|
|
128
|
+
Socket.gethostbyname(hostname)[0]
|
|
129
|
+
rescue SocketError
|
|
130
|
+
hostname
|
|
131
|
+
end
|
|
121
132
|
end
|
|
122
133
|
end
|
|
@@ -10,6 +10,8 @@ module HttpdConfigmapGenerator
|
|
|
10
10
|
|
|
11
11
|
def required_options
|
|
12
12
|
super.merge(
|
|
13
|
+
:host => { :description => "Application Domain",
|
|
14
|
+
:short => "-h" },
|
|
13
15
|
:cert_file => { :description => "Cert File" },
|
|
14
16
|
:ldap_host => { :description => "LDAP Directory Host FQDN" },
|
|
15
17
|
:ldap_mode => { :description => "ldap | ldaps" },
|
|
@@ -55,8 +57,7 @@ module HttpdConfigmapGenerator
|
|
|
55
57
|
/etc/pam.d/smartcard-auth-ac
|
|
56
58
|
/etc/pam.d/system-auth-ac
|
|
57
59
|
/etc/sssd/sssd.conf
|
|
58
|
-
/etc/sysconfig/authconfig
|
|
59
|
-
/etc/sysconfig/network) + [opts[:cert_file]]
|
|
60
|
+
/etc/sysconfig/authconfig) + [opts[:cert_file]]
|
|
60
61
|
end
|
|
61
62
|
|
|
62
63
|
def configure(opts)
|
|
@@ -0,0 +1,48 @@
|
|
|
1
|
+
module HttpdConfigmapGenerator
|
|
2
|
+
class Oidc < Base
|
|
3
|
+
|
|
4
|
+
AUTH = {
|
|
5
|
+
:type => "openid-connect",
|
|
6
|
+
:subtype => "oidc"
|
|
7
|
+
}.freeze
|
|
8
|
+
|
|
9
|
+
def required_options
|
|
10
|
+
super.merge(
|
|
11
|
+
:oidc_url => { :description => "OpenID-Connect Provider URL",
|
|
12
|
+
:short => "-u" },
|
|
13
|
+
:oidc_client_id => { :description => "OpenID-Connect Provider Client ID",
|
|
14
|
+
:short => "-i" },
|
|
15
|
+
:oidc_client_secret => { :description => "OpenID-Connect Provider Client Secret",
|
|
16
|
+
:short => "-s" },
|
|
17
|
+
)
|
|
18
|
+
end
|
|
19
|
+
|
|
20
|
+
def configure(opts)
|
|
21
|
+
auth_oidc_data = {}
|
|
22
|
+
auth_oidc_data["auth-oidc-provider-metadata-url"] = opts[:oidc_url]
|
|
23
|
+
auth_oidc_data["auth-oidc-client-id"] = opts[:oidc_client_id]
|
|
24
|
+
auth_oidc_data["auth-oidc-client-secret"] = opts[:oidc_client_secret]
|
|
25
|
+
|
|
26
|
+
config_map = ConfigMap.new(opts)
|
|
27
|
+
config_map.generate(AUTH[:type], nil, nil, auth_oidc_data )
|
|
28
|
+
config_map.save(opts[:output])
|
|
29
|
+
rescue => err
|
|
30
|
+
log_command_error(err)
|
|
31
|
+
raise err
|
|
32
|
+
end
|
|
33
|
+
|
|
34
|
+
def validate_options(opts)
|
|
35
|
+
super(opts)
|
|
36
|
+
end
|
|
37
|
+
|
|
38
|
+
def configured?
|
|
39
|
+
false
|
|
40
|
+
end
|
|
41
|
+
|
|
42
|
+
def unconfigure
|
|
43
|
+
return unless configured?
|
|
44
|
+
end
|
|
45
|
+
|
|
46
|
+
end
|
|
47
|
+
end
|
|
48
|
+
|
|
@@ -4,6 +4,7 @@ require "httpd_configmap_generator/active_directory"
|
|
|
4
4
|
require "httpd_configmap_generator/ipa"
|
|
5
5
|
require "httpd_configmap_generator/ldap"
|
|
6
6
|
require "httpd_configmap_generator/saml"
|
|
7
|
+
require "httpd_configmap_generator/oidc"
|
|
7
8
|
require "httpd_configmap_generator/update"
|
|
8
9
|
require "httpd_configmap_generator/export"
|
|
9
10
|
require "more_core_extensions/core_ext/hash"
|
metadata
CHANGED
|
@@ -1,29 +1,29 @@
|
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
|
2
2
|
name: httpd_configmap_generator
|
|
3
3
|
version: !ruby/object:Gem::Version
|
|
4
|
-
version: 0.2
|
|
4
|
+
version: 0.3.2
|
|
5
5
|
platform: ruby
|
|
6
6
|
authors:
|
|
7
7
|
- Httpd Auth Config Developers
|
|
8
|
-
autorequire:
|
|
8
|
+
autorequire:
|
|
9
9
|
bindir: bin
|
|
10
10
|
cert_chain: []
|
|
11
|
-
date:
|
|
11
|
+
date: 2021-10-05 00:00:00.000000000 Z
|
|
12
12
|
dependencies:
|
|
13
13
|
- !ruby/object:Gem::Dependency
|
|
14
|
-
name:
|
|
14
|
+
name: manageiq-style
|
|
15
15
|
requirement: !ruby/object:Gem::Requirement
|
|
16
16
|
requirements:
|
|
17
|
-
- - "
|
|
17
|
+
- - ">="
|
|
18
18
|
- !ruby/object:Gem::Version
|
|
19
|
-
version:
|
|
19
|
+
version: '0'
|
|
20
20
|
type: :development
|
|
21
21
|
prerelease: false
|
|
22
22
|
version_requirements: !ruby/object:Gem::Requirement
|
|
23
23
|
requirements:
|
|
24
|
-
- - "
|
|
24
|
+
- - ">="
|
|
25
25
|
- !ruby/object:Gem::Version
|
|
26
|
-
version:
|
|
26
|
+
version: '0'
|
|
27
27
|
- !ruby/object:Gem::Dependency
|
|
28
28
|
name: rspec
|
|
29
29
|
requirement: !ruby/object:Gem::Requirement
|
|
@@ -123,35 +123,42 @@ dependencies:
|
|
|
123
123
|
- !ruby/object:Gem::Version
|
|
124
124
|
version: '3.4'
|
|
125
125
|
- !ruby/object:Gem::Dependency
|
|
126
|
-
name:
|
|
126
|
+
name: optimist
|
|
127
127
|
requirement: !ruby/object:Gem::Requirement
|
|
128
128
|
requirements:
|
|
129
129
|
- - "~>"
|
|
130
130
|
- !ruby/object:Gem::Version
|
|
131
|
-
version: '
|
|
131
|
+
version: '3.0'
|
|
132
132
|
type: :runtime
|
|
133
133
|
prerelease: false
|
|
134
134
|
version_requirements: !ruby/object:Gem::Requirement
|
|
135
135
|
requirements:
|
|
136
136
|
- - "~>"
|
|
137
137
|
- !ruby/object:Gem::Version
|
|
138
|
-
version: '
|
|
138
|
+
version: '3.0'
|
|
139
139
|
description: The Httpd Configmap Generator
|
|
140
|
-
email:
|
|
140
|
+
email:
|
|
141
141
|
executables:
|
|
142
142
|
- httpd_configmap_generator
|
|
143
143
|
extensions: []
|
|
144
144
|
extra_rdoc_files: []
|
|
145
145
|
files:
|
|
146
|
+
- ".codeclimate.yml"
|
|
146
147
|
- ".gitignore"
|
|
147
148
|
- ".rspec"
|
|
149
|
+
- ".rubocop.yml"
|
|
150
|
+
- ".rubocop_cc.yml"
|
|
151
|
+
- ".rubocop_local.yml"
|
|
148
152
|
- ".travis.yml"
|
|
153
|
+
- ".yamllint"
|
|
149
154
|
- Dockerfile
|
|
150
155
|
- Gemfile
|
|
156
|
+
- Gemfile.lock
|
|
151
157
|
- LICENSE
|
|
152
158
|
- README-active-directory.md
|
|
153
159
|
- README-ipa.md
|
|
154
160
|
- README-ldap.md
|
|
161
|
+
- README-oidc.md
|
|
155
162
|
- README-saml.md
|
|
156
163
|
- README.md
|
|
157
164
|
- Rakefile
|
|
@@ -174,6 +181,7 @@ files:
|
|
|
174
181
|
- lib/httpd_configmap_generator/export.rb
|
|
175
182
|
- lib/httpd_configmap_generator/ipa.rb
|
|
176
183
|
- lib/httpd_configmap_generator/ldap.rb
|
|
184
|
+
- lib/httpd_configmap_generator/oidc.rb
|
|
177
185
|
- lib/httpd_configmap_generator/saml.rb
|
|
178
186
|
- lib/httpd_configmap_generator/update.rb
|
|
179
187
|
- lib/httpd_configmap_generator/version.rb
|
|
@@ -184,7 +192,7 @@ homepage: https://github.com/ManageIQ/httpd_configmap_generator
|
|
|
184
192
|
licenses:
|
|
185
193
|
- Apache-2.0
|
|
186
194
|
metadata: {}
|
|
187
|
-
post_install_message:
|
|
195
|
+
post_install_message:
|
|
188
196
|
rdoc_options: []
|
|
189
197
|
require_paths:
|
|
190
198
|
- lib
|
|
@@ -199,9 +207,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
|
|
|
199
207
|
- !ruby/object:Gem::Version
|
|
200
208
|
version: '0'
|
|
201
209
|
requirements: []
|
|
202
|
-
|
|
203
|
-
|
|
204
|
-
signing_key:
|
|
210
|
+
rubygems_version: 3.1.4
|
|
211
|
+
signing_key:
|
|
205
212
|
specification_version: 4
|
|
206
213
|
summary: The Httpd Configmap Generator
|
|
207
214
|
test_files: []
|