ipsilon.git/ipsilon/install/ipsilon-client-install, branch sp_register

Allow SP registration from ipsilon-client-install

2015-04-02T01:17:46+00:00

This optionally allows a SAML SP to be registered with the IDP when
running ipsilon-client-install.  To register an SP, the following
options are used:

  --saml-idp-url   (Ipsilon IDP URL)
  --saml-sp-name   (Name to register the SP as)
  --admin-user     (Ipsilon admin user)
  --admin-password (Ipsilon admin password file)

If the --saml-idp-url option is set, we attempt to register the SP.
The --saml-sp-name option is required if you are registering a SP.
The --admin-user already defaults to admin, so it only needs to be
specified if your admin user has a different username.  If the
--admin-password option is not specified, we prompt for the password.

The --saml-idp-metadata was previously required, but this option is
redundant if the new --saml-idp-url option is specified and you are
not using a local copy of the IDP metadata.  You can now just use
the --saml-idp-url option, and we build the metadata URL from it.
This helps to minimize the number of required options when you are
registering an SP during installation.

https://fedorahosted.org/ipsilon/ticket/101
Signed-off-by: Nathan Kinder

SP uninstall attempts to run install

2015-03-31T04:23:03+00:00

When running 'ipsilon-client-install --uninstall' to uninstall a SP,
we call the install routine again after completing the uninstallation.
This leads to confusing error messages about missing required options.
This patch corrects the uninstallation logic.

https://fedorahosted.org/ipsilon/ticket/100
Signed-off-by: Nathan Kinder

Allow user to specify Name ID format when configuring SP.

2015-03-23T22:00:27+00:00

https://fedorahosted.org/ipsilon/ticket/27

Signed-off-by: Rob Crittenden 
Reviewed-by: Simo Sorce

Allow SP installation to be on non-standard ports

2015-03-18T21:49:43+00:00

When setting up a SP using ipsilon-client-install, there is no
ability to use a non-standard port.  We should allow a port number
to be specified that results in the proper URLs in the SP metadata.

This patch adds a --port option to ipsilon-client-install.  This is
used in the construction of the URLs used in the SP metadata as well
as in the httpd redirect rules if httpd is being configured.

https://fedorahosted.org/ipsilon/ticket/92

Signed-off-by: Nathan Kinder 
Reviewed-by: Rob Crittenden

Validate SP path settings during installation

2015-03-11T13:48:55+00:00

There are a number of URL path options that can be specified as
options when running ipsilon-client-install. There are certain
rules that must be followed to result in a valid mod_auth_mellon
configuration:

 - All path options must be prefixed with '/'.

 - The mellon endpoint path (--saml-sp) must be a subpath of the
   httpd 'Location' element is it contained within (--saml-base).

 - The logout (--saml-sp-logout) and post (--saml-sp-post) paths
   must be subpaths of the mellon endpoint (--saml-sp).

This adds validation for all of the above rules.

https://fedorahosted.org/ipsilon/ticket/82

Signed-off-by: Nathan Kinder 
Reviewed-by: Patrick Uiterwijk

Add Cache-Control header to prevent browser caching of SAML auth location

2015-03-10T22:24:08+00:00

We should prevent browser caching of the SAML auth location that we
configure for an SP. This can be easily done by adding the following
directive to that location in the httpd config:

    Header append Cache-Control "no-cache"

https://fedorahosted.org/ipsilon/ticket/81

Signed-off-by: Nathan Kinder 
Reviewed-by: Rob Crittenden

Require SSL on SP when using --saml-secure-setup

2015-03-10T22:24:01+00:00

If ipsilon-client-install is used with the --saml-secure-setup
option (which is set by default), only https connections will
work for authentication.  We are not setting the SSLRequireSSL
directive though, so we set mellon up to fail.

This patch adds the SSLRequireSSL directive to the SP config
when --saml-secure-setup is specified.  In addition, we add a
rewrite rule to rewrite http requests to https for the SP.

https://fedorahosted.org/ipsilon/ticket/80

Signed-off-by: Nathan Kinder 
Reviewed-by: Rob Crittenden

Add support for passing configuration profile

2014-06-04T14:26:34+00:00

The new option --config-profile accepts a INI style file, so that
installation options are passed in via a file. this is useful for
testing and automated installs.

This file can have 2 sections: globals, arguments.

The globals section can change global variable in the install script
like: TEMPLATES, CONFDIR, DATADIR, HTTPDCONFD and so on, so that an
installation can use non-standad directories.

The argumets section accepts any argument option.
The config profile file is parsed after all arguments have parsed and
can override any plugin argument.

Signed-off-by: Simo Sorce

Allow turning off security at install time

2014-06-04T14:26:34+00:00

This should be used only for testing purposes

Signed-off-by: Simo Sorce

Always use saml by default

2014-05-02T01:05:47+00:00

Signed-off-by: Simo Sorce