-
Notifications
You must be signed in to change notification settings - Fork 3
/
Dockerfile
89 lines (73 loc) · 3.82 KB
/
Dockerfile
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
FROM centos:centos7
MAINTAINER Unicon, Inc.
LABEL idp.java.version="8.0.72" \
idp.jetty.version="9.3.7.v20160115" \
idp.version="3.2.1"
ENV JETTY_HOME=/opt/jetty-home \
JETTY_BASE=/opt/shib-jetty-base \
JETTY_MAX_HEAP=2048m \
JETTY_BROWSER_SSL_KEYSTORE_PASSWORD=changeme \
JETTY_BACKCHANNEL_SSL_KEYSTORE_PASSWORD=changeme \
PATH=$PATH:$JRE_HOME/bin
RUN yum -y update \
&& yum -y install wget tar which \
&& yum -y clean all
RUN set -x; \
java_version=8.0.72; \
zulu_version=8.13.0.5; \
java_hash=50b95832b1d072afc178d820e5680687; \
jetty_version=9.3.7.v20160115; \
jetty_hash=8d957f7223a3f3b795a79952f8e8081e93cf06b0; \
idp_version=3.3.0; \
idp_hash=558c6b71e6eba8fbdff19ee8857368d1a6facdfe2c703afc70d5b1655411f552; \
dta_hash=2f547074b06952b94c35631398f36746820a7697; \
useradd jetty -U -s /bin/false \
# Download Java, verify the hash, and install \
&& cd / \
&& wget http://cdn.azul.com/zulu/bin/zulu$zulu_version-jdk$java_version-linux_x64.tar.gz \
&& echo "$java_hash zulu$zulu_version-jdk$java_version-linux_x64.tar.gz" | md5sum -c - \
&& tar -zxvf zulu$zulu_version-jdk$java_version-linux_x64.tar.gz -C /opt \
&& rm zulu$zulu_version-jdk$java_version-linux_x64.tar.gz \
&& ln -s /opt/zulu$zulu_version-jdk$java_version-linux_x64/jre/ /opt/jre-home \
# Download Jetty, verify the hash, and install, initialize a new base \
&& cd / \
&& wget -O jetty-distribution-$jetty_version.tar.gz "https://eclipse.org/downloads/download.php?file=/jetty/$jetty_version/dist/jetty-distribution-$jetty_version.tar.gz&r=1" \
&& echo "$jetty_hash jetty-distribution-$jetty_version.tar.gz" | sha1sum -c - \
&& tar -zxvf jetty-distribution-$jetty_version.tar.gz -C /opt \
&& rm jetty-distribution-$jetty_version.tar.gz \
&& ln -s /opt/jetty-distribution-$jetty_version/ /opt/jetty-home \
# Config Jetty \
&& cd / \
&& cp /opt/jetty-home/bin/jetty.sh /etc/init.d/jetty \
&& mkdir -p /opt/shib-jetty-base/modules /opt/shib-jetty-base/lib/ext /opt/shib-jetty-base/resources \
&& cd /opt/shib-jetty-base \
&& touch start.ini \
&& /opt/jre-home/bin/java -jar ../jetty-home/start.jar --add-to-startd=http,https,deploy,ext,annotations,jstl \
# Download Shibboleth IdP, verify the hash, and install \
&& cd / \
&& wget https://shibboleth.net/downloads/identity-provider/$idp_version/shibboleth-identity-provider-$idp_version.tar.gz \
&& echo "$idp_hash shibboleth-identity-provider-$idp_version.tar.gz" | sha256sum -c - \
&& tar -zxvf shibboleth-identity-provider-$idp_version.tar.gz -C /opt \
&& rm /shibboleth-identity-provider-$idp_version.tar.gz \
&& ln -s /opt/shibboleth-identity-provider-$idp_version/ /opt/shibboleth-idp \
# Download the library to allow SOAP Endpoints, verify the hash, and place \
&& cd / \
&& wget https://build.shibboleth.net/nexus/content/repositories/releases/net/shibboleth/utilities/jetty9/jetty9-dta-ssl/1.0.0/jetty9-dta-ssl-1.0.0.jar \
&& echo "$dta_hash jetty9-dta-ssl-1.0.0.jar" | sha1sum -c - \
&& mv jetty9-dta-ssl-1.0.0.jar /opt/shib-jetty-base/lib/ext/ \
# Setting owner ownership and permissions on new items in this command
&& chown -R root:jetty /opt \
&& chmod -R 640 /opt \
&& chmod 750 /opt/jre-home/bin/java
COPY bin/ /usr/local/bin/
COPY opt/shib-jetty-base/ /opt/shib-jetty-base/
COPY build/tmp/unpackShibboleth/shibboleth-idp/ /opt/shibboleth-idp/
# Setting owner ownership and permissions on new items from the COPY command
RUN mkdir /opt/shib-jetty-base/logs \
&& chown -R root:jetty /opt/shib-jetty-base \
&& chmod -R 640 /opt/shib-jetty-base \
&& chmod -R 750 /opt/shibboleth-idp/bin \
&& chmod 750 /usr/local/bin/run-jetty.sh /usr/local/bin/init-idp.sh
# Opening 4443 (browser TLS), 8443 (mutual auth TLS)
EXPOSE 4443 8443
CMD ["run-jetty.sh"]