You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@dlab.apache.org by my...@apache.org on 2020/02/20 10:52:01 UTC
[incubator-dlab] 01/01: [DLAB-37]: SSO supporting for RedHat
implemented
This is an automated email from the ASF dual-hosted git repository.
mykolabodnar pushed a commit to branch DLAB-37
in repository https://gitbox.apache.org/repos/asf/incubator-dlab.git
commit 33cdf54055be1a091a9d63f9975d943902fea94c
Author: Mykola_Bodnar1 <bo...@gmail.com>
AuthorDate: Thu Feb 20 12:51:42 2020 +0200
[DLAB-37]: SSO supporting for RedHat implemented
---
.../src/general/lib/os/redhat/edge_lib.py | 67 ++++++++++++++++------
.../src/general/lib/os/redhat/ssn_lib.py | 13 ++---
2 files changed, 55 insertions(+), 25 deletions(-)
diff --git a/infrastructure-provisioning/src/general/lib/os/redhat/edge_lib.py b/infrastructure-provisioning/src/general/lib/os/redhat/edge_lib.py
index 4aa4002..966bae2 100644
--- a/infrastructure-provisioning/src/general/lib/os/redhat/edge_lib.py
+++ b/infrastructure-provisioning/src/general/lib/os/redhat/edge_lib.py
@@ -59,8 +59,8 @@ def configure_http_proxy_server(config):
sys.exit(1)
-def install_nginx_ldap(edge_ip, nginx_version, ldap_ip, ldap_dn, ldap_ou, ldap_service_pass, ldap_service_username,
- user, hostname, step_cert_sans):
+def install_nginx_lua(edge_ip, nginx_version, keycloak_auth_server_url, keycloak_realm_name, keycloak_client_id,
+ keycloak_client_secret, user, hostname, step_cert_sans):
try:
if not os.path.exists('/tmp/nginx_installed'):
manage_pkg('-y install', 'remote', 'wget')
@@ -113,34 +113,65 @@ def install_nginx_ldap(edge_ip, nginx_version, ldap_ip, ldap_dn, ldap_ou, ldap_s
else:
sudo('openssl req -x509 -nodes -days 3650 -newkey rsa:2048 -keyout /etc/ssl/certs/dlab.key \
-out /etc/ssl/certs/dlab.crt -subj "/C=US/ST=US/L=US/O=dlab/CN={}"'.format(hostname))
- sudo('mkdir -p /tmp/nginx_auth_ldap')
- with cd('/tmp/nginx_auth_ldap'):
- sudo('git clone https://github.com/kvspb/nginx-auth-ldap.git')
+ sudo('mkdir -p /tmp/lua')
sudo('mkdir -p /tmp/src')
with cd('/tmp/src/'):
sudo('wget http://nginx.org/download/nginx-{}.tar.gz'.format(nginx_version))
sudo('tar -xzf nginx-{}.tar.gz'.format(nginx_version))
+
+ sudo('wget https://github.com/openresty/lua-nginx-module/archive/v0.10.15.tar.gz')
+ sudo('tar -xzf v0.10.15.tar.gz')
+
+ sudo('wget https://github.com/simplresty/ngx_devel_kit/archive/v0.3.1.tar.gz')
+ sudo('tar -xzf v0.3.1.tar.gz')
+
+ sudo('wget http://luajit.org/download/LuaJIT-2.0.5.tar.gz')
+ sudo('tar -xzf LuaJIT-2.0.5.tar.gz')
+
+ sudo('wget http://keplerproject.github.io/luarocks/releases/luarocks-2.2.2.tar.gz')
+ sudo('tar -xzf luarocks-2.2.2.tar.gz')
+
sudo('ln -sf nginx-{} nginx'.format(nginx_version))
- with cd('/tmp/src/nginx/'):
- sudo('./configure --user=nginx --group=nginx --prefix=/etc/nginx --sbin-path=/usr/sbin/nginx \
- --conf-path=/etc/nginx/nginx.conf --pid-path=/run/nginx.pid --lock-path=/run/lock/subsys/nginx \
- --error-log-path=/var/log/nginx/error.log --http-log-path=/var/log/nginx/access.log \
- --with-http_gzip_static_module --with-http_stub_status_module --with-http_ssl_module --with-pcre \
- --with-http_realip_module --with-file-aio --with-ipv6 --with-http_v2_module --with-debug \
- --without-http_scgi_module --without-http_uwsgi_module --without-http_fastcgi_module --with-http_sub_module \
- --add-module=/tmp/nginx_auth_ldap/nginx-auth-ldap/')
+
+ with cd('/tmp/src/LuaJIT-2.0.5/'):
sudo('make')
sudo('make install')
+
+ with cd('/tmp/src/nginx/'), shell_env(LUAJIT_LIB='/usr/local/lib/', LUAJIT_INC='/usr/local/include/luajit-2.0')::
+ sudo('./configure --user=nginx --group=nginx --prefix=/etc/nginx --sbin-path=/usr/sbin/nginx \
+ --conf-path=/etc/nginx/nginx.conf --pid-path=/run/nginx.pid --lock-path=/run/lock/subsys/nginx \
+ --error-log-path=/var/log/nginx/error.log --http-log-path=/var/log/nginx/access.log \
+ --with-http_gzip_static_module --with-http_stub_status_module --with-http_ssl_module --with-pcre \
+ --with-http_realip_module --with-file-aio --with-ipv6 --with-http_v2_module --with-ld-opt="-Wl,-rpath,$LUAJIT_LIB" \
+ --without-http_scgi_module --without-http_uwsgi_module --without-http_fastcgi_module --with-http_sub_module \
+ --add-dynamic-module=/tmp/src/ngx_devel_kit-0.3.1 --add-dynamic-module=/tmp/src/lua-nginx-module-0.10.15')
+ sudo('make')
+ sudo('make install')
+
+ with cd('/tmp/src/luarocks-2.2.2/'):
+ sudo('./configure')
+ sudo('make build')
+ sudo('make install')
+ sudo('luarocks install lua-resty-jwt')
+ sudo('luarocks install lua-resty-session')
+ sudo('luarocks install lua-resty-http')
+ sudo('luarocks install lua-resty-openidc')
+ sudo('luarocks install luacrypto')
+ sudo('luarocks install lua-cjson')
+ sudo('luarocks install lua-resty-core')
+ sudo('luarocks install random')
+ sudo('luarocks install lua-resty-string')
+
sudo('useradd -r nginx')
sudo('rm -f /etc/nginx/nginx.conf')
sudo('mkdir -p /opt/dlab/templates')
put('/root/templates', '/opt/dlab', use_sudo=True)
- sudo('sed -i \'s/LDAP_IP/{}/g\' /opt/dlab/templates/nginx.conf'.format(ldap_ip))
- sudo('sed -i \'s/LDAP_DN/{}/g\' /opt/dlab/templates/nginx.conf'.format(ldap_dn))
- sudo('sed -i \'s/LDAP_OU/{}/g\' /opt/dlab/templates/nginx.conf'.format(ldap_ou))
- sudo('sed -i \'s/LDAP_SERVICE_PASSWORD/{}/g\' /opt/dlab/templates/nginx.conf'.format(ldap_service_pass))
- sudo('sed -i \'s/LDAP_SERVICE_USERNAME/{}/g\' /opt/dlab/templates/nginx.conf'.format(ldap_service_username))
sudo('sed -i \'s/EDGE_IP/{}/g\' /opt/dlab/templates/conf.d/proxy.conf'.format(edge_ip))
+ sudo('sed -i \'s|KEYCLOAK_AUTH_URL|{}|g\' /opt/dlab/templates/conf.d/proxy.conf'.format(keycloak_auth_server_url))
+ sudo('sed -i \'s/KEYCLOAK_REALM_NAME/{}/g\' /opt/dlab/templates/conf.d/proxy.conf'.format(keycloak_realm_name))
+ sudo('sed -i \'s/KEYCLOAK_CLIENT_ID/{}/g\' /opt/dlab/templates/conf.d/proxy.conf'.format(keycloak_client_id))
+ sudo('sed -i \'s/KEYCLOAK_CLIENT_SECRET/{}/g\' /opt/dlab/templates/conf.d/proxy.conf'.format(keycloak_client_secret))
+
sudo('cp /opt/dlab/templates/nginx.conf /etc/nginx/')
sudo('mkdir /etc/nginx/conf.d')
sudo('cp /opt/dlab/templates/conf.d/proxy.conf /etc/nginx/conf.d/')
diff --git a/infrastructure-provisioning/src/general/lib/os/redhat/ssn_lib.py b/infrastructure-provisioning/src/general/lib/os/redhat/ssn_lib.py
index 085658c..83fd2ca 100644
--- a/infrastructure-provisioning/src/general/lib/os/redhat/ssn_lib.py
+++ b/infrastructure-provisioning/src/general/lib/os/redhat/ssn_lib.py
@@ -340,22 +340,21 @@ def start_ss(keyfile, host_string, dlab_conf_dir, web_path,
'-out ssn.p12 -password pass:{0}'.format(keystore_passwd))
sudo('keytool -importkeystore -srckeystore ssn.p12 -srcstoretype PKCS12 -alias ssn -destkeystore '
'/home/{0}/keys/ssn.keystore.jks -deststorepass "{1}" -srcstorepass "{1}"'.format(
- os_user, keystore_passwd))
+ os_user, keystore_passwd))
sudo('keytool -keystore /home/{0}/keys/ssn.keystore.jks -alias step-ca -import -file '
- '/home/{0}/keys/root_ca.crt -deststorepass "{1}" -srcstorepass "{1}" -noprompt'.format(
- os_user, keystore_passwd))
- sudo('keytool -importcert -trustcacerts -alias step-ca -file /home/{0}/keys/root_ca.crt '
+ '/etc/ssl/certs/root_ca.crt -deststorepass "{1}" -srcstorepass "{1}" -noprompt'.format(
+ os_user, keystore_passwd))
+ sudo('keytool -importcert -trustcacerts -alias step-ca -file /etc/ssl/certs/root_ca.crt '
'-noprompt -storepass changeit -keystore {1}/lib/security/cacerts'.format(os_user, java_path))
sudo('keytool -importcert -trustcacerts -alias ssn -file /etc/ssl/certs/dlab.crt -noprompt '
'-storepass changeit -keystore {0}/lib/security/cacerts'.format(java_path))
-
else:
sudo('keytool -genkeypair -alias ssn -keyalg RSA -validity 730 -storepass {1} -keypass {1} \
-keystore /home/{0}/keys/ssn.keystore.jks -keysize 2048 -dname "CN=localhost"'.format(
os_user, keystore_passwd))
- sudo('keytool -exportcert -alias ssn -storepass {1} -file /home/{0}/keys/dlab.crt \
+ sudo('keytool -exportcert -alias ssn -storepass {1} -file /etc/ssl/certs/dlab.crt \
-keystore /home/{0}/keys/ssn.keystore.jks'.format(os_user, keystore_passwd))
- sudo('keytool -importcert -trustcacerts -alias ssn -file /home/{0}/keys/dlab.crt -noprompt \
+ sudo('keytool -importcert -trustcacerts -alias ssn -file /etc/ssl/certs/dlab.crt -noprompt \
-storepass changeit -keystore {1}/lib/security/cacerts'.format(os_user, java_path))
except:
append_result("Unable to generate cert and copy to java keystore")
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@dlab.apache.org
For additional commands, e-mail: commits-help@dlab.apache.org