Menu ▾ ▴

NTER Entitlement Service

Robert Rowse

Related

Wiki: NTER Registry Service

Discussion

  • Robert Rowse

    Robert Rowse - 2013-09-12

    Word Document
    Note: This sis an older document but still a good read. See below for more updated information.

     

    Last edit: Jeff Masiello 2014-08-25
    NTER Entitlement Service.docx

  • Jeff Masiello

    Jeff Masiello - 2014-08-25

    This is actually Registry and Entitlement. They seem very tightly coupled and I't not sure why they are separate entities.

    Recommend Ubuntu 12.04 LTS 64-bit EBS backed

    During this process you will be prompted to enter the MySQL server password twice. Choose a secure password and enter it when prompted.

    sudo apt-get update
sudo apt-get install -y openjdk-7-jdk tomcat7 mysql-server-5.5 libapache2-mod-jk libmysql-java apache2 libapache2-mod-shib2 tomcat7-admin
sudo apt-get dist-upgrade -y

    all the apps are installed, now we need to configure things...
    Always good to set Environment Variables...

    CATALINA_HOME="/usr/share/tomcat7"
CATALINA_BASE="/var/lib/tomcat7"
JAVA_HOME="/usr/lib/jvm/java-7-openjdk-amd64/"
PATH="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games"
PATH=$PATH:$JAVA_HOME
export $PATH

    lets set up some tomcat stuff
    The manager tool allows us to deploy packages but we want ot lock it down a bit...
    first we set who has access...
    locate the tomcat-users.xml usually located in /etc/tomcat7/tomcat-users.xml
    add...

    <role username="manager-gui">
<user username="&lt;PICKAUSERNAME&gt;" password="&lt;PASSWORD&gt;" roles="manager-gui">
</user></role>

    just before the closing tag
    You can go to <your url="">:8080/manager/html and log in using this info to manage tomcat apps thopugh we aren't ready for that yet.</your>

    Set up the apache elements as we are hosting SSH through apache.
    edit /etc/libapache2-mod-jk/workers.properties

    --workers.tomcat_home=/usr/share/tomcat6
++workers.tomcat_home=/usr/share/tomcat7
--workers.java_home=/usr/lib/jvm/default-java
++workers.java_home=$JAVA_HOME

    Now edit the site configuration for the jktomcat site on apache. You can name htis file anything but locations are important.
    create a file in /etc/apache2/sites-available
    we will call ours jktomcat
    paste in

    NameVirtualHost *:80
NameVirtualHost *:443
<ifmodule worker.c="">
StartServers 2
MaxClients 150
MinSpareThreads 25
MaxSpareThreads 75
ThreadsPerChild 25
MaxRequestsPerChild 0
</ifmodule>
<virtualhost *:80="">
ServerName <your server="" name="">
RewriteEngine On
RewriteRule ^(.*)$ https://%{SERVER_NAME}$1 [R,L]
UseCanonicalName Off
ServerAdmin webmaster@localhost
DocumentRoot /var/www/
</your></virtualhost>

<virtualhost *:443="">
ServerName ec2-54-208-211-204.compute-1.amazonaws.com
DocumentRoot /var/www
UseCanonicalName Off
<locationmatch "="" *="" *\.xhtml"="">
AuthType shibboleth
ShibRequireSession On
require shibboleth
</locationmatch>
RedirectMatch ^/manager[/]$ /manager/html/
JkMount /manager ajp13_worker
JkMount /manager/* ajp13_worker
RedirectMatch ^/host-manager[/]$ /host-manager/html
JkMount /host-manager ajp13_worker
JkMount /host-manager/* ajp13_worker
JkMount /entitlement-service-* ajp13_worker
JkMount /entitlement-service-*/* ajp13_worker
JkMount /registry-service-* ajp13_worker
JkMount /registry-service-*/* ajp13_worker
JkMount /registry-service-*/*/* ajp13_worker
JkUnMount /shibboleth-sp* ajp13_worker
JkUnMount /Shibboleth.sso* ajp13_worker
JkUnMount /SSORedirect* ajp13_worker
JkUnMount /xml* ajp13_worker
JkEnvVar Shib-Identity-Provider
JkEnvVar uid
JkEnvVar givenName
JkEnvVar sn
JkEnvVar mail
SSLEngine On
SSLCertificateFile /etc/ssl/certs/ssl-cert-snakeoil.pem
SSLCertificateKeyFile /etc/ssl/private/ssl-cert-snakeoil.key
# SSLCertificateChainFile /etc/ssl/certs/sf_bundle.crt
</virtualhost>
<location server-status="">
SetHandler server-status
Order Deny,Allow
Deny from all
#edit the line below to where you want access to the server-status from
Allow from compute-1.amazonaws.com
</location>

<directory var="" www="">
Options +FollowSymLinks
AllowOverride All
order allow,deny
allow from all
</directory>

    You will want to update to actual certs when you get them.
    Now we set up the shibboleth file. In /etc/shibboleth/shibboleth2.xml alter and paste the following.
    In general the IDPID for NTER will be
    https://login.nterlearning.org/idp/shibboleth
    if you are on the NTER team obviously this sentence will be omitted from public documentation and the IDPID will be https://login.ntersupport.com/idp/shibboleth

    <spconfig xmlns="urn:mace:shibboleth:2.0:native:sp:config" xmlns:conf="urn:mace:shibboleth:2.0:native:sp:config" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" clockskew="180">
<applicationdefaults entityid="https://&lt;YOUR SERVER&gt;/shibboleth" remote_user="eppn persistent-id targeted-id">
<sessions lifetime="120" timeout="60" checkaddress="false" relaystate="ss:mem" handlerssl="true">
<sso entityid="&lt;IPID&gt;">
SAML2 SAML1
</sso>
<logout>SAML2 Local</logout>
<handler type="MetadataGenerator" location="/Metadata" signing="false">
<handler type="Status" location="/Status" acl="*">
<handler type="Session" location="/Session" showattributevalues="false">
<handler type="DiscoveryFeed" location="/DiscoFeed">
</handler></handler></handler></handler></sessions>
<errors supportcontact="root@localhost" logolocation="/shibboleth-sp/logo.jpg" stylesheet="/shibboleth-sp/main.css">
<metadataprovider type="XML" file="partner-metadata.xml">
<attributeextractor type="XML" validate="true" path="attribute-map.xml">
<attributeresolver type="Query" subjectmatch="true">
<attributefilter type="XML" validate="true" path="attribute-policy.xml">
<credentialresolver type="File" key="/etc/ssl/private/ssl-cert-snakeoil.key" certificate="/etc/ssl/certs/ssl-cert-snakeoil.pem">
</credentialresolver></attributefilter></attributeresolver></attributeextractor></metadataprovider></errors></applicationdefaults>
<securitypolicyprovider type="XML" validate="true" path="security-policy.xml">
<protocolprovider type="XML" validate="true" reloadchanges="false" path="protocols.xml">
</protocolprovider></securitypolicyprovider></spconfig>

    alter the attribute-map.xml in the same directory and either uncomment or add

    <attribute name="urn:oid:2.5.4.3" id="user-content-cn">
<attribute name="urn:oid:2.5.4.4" id="user-content-sn">
<attribute name="urn:oid:2.5.4.42" id="user-content-givenName">
<attribute name="urn:oid:0.9.2342.19200300.100.1.3" id="user-content-mail">
<attribute name="urn:oid:2.5.4.20" id="user-content-telephoneNumber">
<attribute name="urn:oid:0.9.2342.19200300.100.1.1" id="user-content-uid">
</attribute></attribute></attribute></attribute></attribute></attribute>

    then run

    sudo shib-metagen -c /etc/ssl/certs/ssl-cert-snakeoil.pem -h <yourdomain> > ./<yourdomain>-metadata.xml
</yourdomain></yourdomain>

    You will need to change the snakeoil to yoru own cert. our host is registry.ntersupport.com or registry.nterlearning.org
    this is the file you will give to the IdP to add to it's federation data set
    then copy the idp-metadata-public.xml from login.ntersupport.com /opt/shibboleth-idp/metada to the /etc/shibboleth/partner-metadata.xml in registry.ntersupport.com (or whatever your machine is, the one we've been working on)
    More tomcat config
    get the registry and entitlement applications

    cd /tmp
wget http://repository.ntersupport.com/libs-release-local/org/nterlearning/registry-service/1.1.4/registry-service-1.1.4.war
wget http://repository.nterlearning.org/libs-release-local/org/nterlearning/entitlement-service/1.1.8/entitlement-service-1.1.8.war
sudo mkdir /var/lib/tomcat7/ext-webapps/
sudo cp registry-service-1.1.4.war /var/lib/tomcat7/ext-webapps/
sudo cp entitlement-service-1.1.8.war /var/lib/tomcat7/ext-webapps/

    In /var/lib/tomcat7/conf/Catalina/localhost/
    create two files...
    registry-service-1.1.xml
    and
    entitlement-service-1.1.xml
    then in those files place the following, respectively.

    <context docbase="/var/lib/tomcat7/ext-webapps/registry-service-1.1.4.war">
</context>
<context docbase="/var/lib/tomcat7/ext-webapps/entitlement-service-1.1.8.war">
</context>

    THis tells the system to grab the registry service 1.1.4 from ext-webapps and move it to webapps called registry1.1 when you start the app from the manager (configured above)
    Note becasue these apps are very memory intensive we need to alter the startup for tomcat7.
    in
    /etc/init.d/tomcat7/
    just after t he line "set -e"
    add the following...

    export NTER_PROPS=/var/lib/tomcat7/conf/nter.properties
export JAVA_OPTS="-Djava.awt.headless=true -Xms512M -Xmx1204M -XX:MaxPermSize=512M"

    There are a bunch of configuration elements which are required for these two WARs to run. Also, they can be moved to a generic location so they are not overwritten on build.
    in /var/lib/tomcat7/conf/nter.properties modify and add the following

    #
# Entitlement Service
#
entitlement.db.user=<user>
entitlement.db.password=<password>
entitlement.db.driver=com.mysql.jdbc.Driver
entitlement.db.url=jdbc:mysql://localhost/ENTITLEMENT_DB?useUnicode=true
entitlement.db.validation=select 1 from mysql.user
#entitlement.idp.wsdl.url=https://login.nterlearning.org/nter-user-mgmt-service-1.7/service s/IdentityService?wsdl
entitlement.idp.wsdl.url=https://login.ntersupport.com/nter-user-mgmt-service-1.7/services/ IdentityService?wsdl
entitlement.idp.email=admin@nterlearning.org
entitlement.idp.password=<password>
# Default ADMIN user - Create an 'Admin' entitlement for realm '/'
entitlement.admin.email=admin@nterlearning.org
#
# Service Registry
#
registry.db.user=<user>
registry.db.password=<password>
registry.db.driver=com.mysql.jdbc.Driver
registry.db.url=jdbc:mysql://localhost/REGISTRY_DB?useUnicode=true
registry.db.validation=select 1 from mysql.user
registry.idp.wsdl.url=https://login.ntersupport.com/nter-user-mgmt-service-1.7/services/Ide ntityService?wsdl
registry.idp.email=admin@nterlearning.org
registry.idp.password=<password>
# Default Admin user for realm NTER_REGISTRY
registry.admin.email=admin@nterlearning.org
# Default blacklist status {"Unspecified", "Active", "Inactive", "Blacklist"}
registry.default.blacklist.status=Blacklist
# Connect to Entitlement Service
registry.realm=NTER_REGISTRY
# Entitlement service calls
# WARNING!!!
# Do not use the localhost:8086 version of registry.entitlement.wsdl.url.
# It causes very slow page loads on the order of minutes for the wep app.
# this evidently bypasses Shibboleth and results in numerous retries to validate
#registry.entitlement.wsdl.url=https://localhost:8086/entitlement-service-1.1/se tlementAPI?wsdl
registry.entitlement.wsdl.url=https://registry.ntersupport.com/entitlement-servi ices/EntitlementAPI?wsdl
registry.entitlement.email=admin@nterlearning.org
registry.entitlement.password=<password>
# Commerce entitlement for new institution, leave empty to disable commerce
#registry.commerce.realm=NTER_COMMERCE#commented out by JAM june 16, 2014
</password></password></password></user></password></password></user>

    then

    sudo chown :tomcat7 nter.properties

    we need to create some database elements as the script doesn;t do it automaticatlly.
    log into mysql in the console and paste in the following:

    CREATE DATABASE REGISTRY_DB;
CREATE DATABASE ENTITLEMENT_DB;
CREATE TABLE `ACTIVE_STATUS` (
`ACTIVE_STATUS_ID` bigint(20) NOT NULL AUTO_INCREMENT,
`VALUE` varchar(50) NOT NULL,
PRIMARY KEY (`ACTIVE_STATUS_ID`),
UNIQUE KEY `VALUE` (`VALUE`)
) ENGINE=InnoDB AUTO_INCREMENT=4 DEFAULT CHARSET=utf8
;
CREATE TABLE `BLACK_LIST` (
`BLACK_LIST_ID` bigint(20) NOT NULL AUTO_INCREMENT,
`INSTITUTION` varchar(100) NOT NULL,
`SERVICE` varchar(100) DEFAULT NULL,
`ACTIVE_STATUS_ID` bigint(20) NOT NULL,
PRIMARY KEY (`BLACK_LIST_ID`),
UNIQUE KEY `INSTITUTION` (`INSTITUTION`,`SERVICE`),
KEY `FKBD07DCFE49AD62E7` (`ACTIVE_STATUS_ID`),
CONSTRAINT `FKBD07DCFE49AD62E7` FOREIGN KEY (`ACTIVE_STATUS_ID`) REFERENCES `ACTIVE_STATUS` (`ACTIVE_STATUS_ID`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8
;
CREATE TABLE `BINDING_TYPE` (
`BINDING_TYPE_ID` bigint(20) NOT NULL AUTO_INCREMENT,
`VALUE` varchar(100) NOT NULL,
PRIMARY KEY (`BINDING_TYPE_ID`),
UNIQUE KEY `VALUE` (`VALUE`)
) ENGINE=InnoDB AUTO_INCREMENT=9 DEFAULT CHARSET=utf8
;
CREATE TABLE `SERVICE_TYPE` (
`SERVICE_TYPE_ID` bigint(20) NOT NULL AUTO_INCREMENT,
`VALUE` varchar(100) NOT NULL,
PRIMARY KEY (`SERVICE_TYPE_ID`),
UNIQUE KEY `VALUE` (`VALUE`)
) ENGINE=InnoDB AUTO_INCREMENT=7 DEFAULT CHARSET=utf8
;
CREATE TABLE `CONTACT_INFO` (
`CONTACT_INFO_ID` bigint(20) NOT NULL AUTO_INCREMENT,
`ADDRESS` varchar(255) DEFAULT NULL,
`DESCRIPTION` varchar(255) DEFAULT NULL,
`EMAIL` varchar(255) DEFAULT NULL,
`PERSON_NAME` varchar(100) NOT NULL,
`PHONE` varchar(255) DEFAULT NULL,
PRIMARY KEY (`CONTACT_INFO_ID`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8
;
CREATE TABLE `INSTITUTION` (
`INSTITUTION_ID` bigint(20) NOT NULL AUTO_INCREMENT,
`DESCRIPTION` varchar(255) DEFAULT NULL,
`INSTITUTION_NAME` varchar(75) NOT NULL,
`CONTACT_INFO_ID` bigint(20) DEFAULT NULL,
PRIMARY KEY (`INSTITUTION_ID`),
UNIQUE KEY `INSTITUTION_NAME` (`INSTITUTION_NAME`),
UNIQUE KEY `CONTACT_INFO_ID` (`CONTACT_INFO_ID`),
KEY `FKB57D3998F674B373` (`CONTACT_INFO_ID`),
CONSTRAINT `FKB57D3998F674B373` FOREIGN KEY (`CONTACT_INFO_ID`) REFERENCES `CONTACT_INFO` (`CONTACT_INFO_ID`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8
;
CREATE TABLE `SERVICE` (
`SERVICE_ID` bigint(20) NOT NULL AUTO_INCREMENT,
`DESCRIPTION` varchar(255) DEFAULT NULL,
`SERVICE_NAME` varchar(50) NOT NULL,
`SERVICE_TYPE_ID` bigint(20) NOT NULL,
`INSTITUTION_ID` bigint(20) NOT NULL,
PRIMARY KEY (`SERVICE_ID`),
UNIQUE KEY `SERVICE_NAME` (`SERVICE_NAME`,`INSTITUTION_ID`),
KEY `FKA10F52959317D960` (`INSTITUTION_ID`),
KEY `FKA10F5295B0EE15AB` (`SERVICE_TYPE_ID`),
CONSTRAINT `FKA10F5295B0EE15AB` FOREIGN KEY (`SERVICE_TYPE_ID`) REFERENCES `SERVICE_TYPE` (`SERVICE_TYPE_ID`),
CONSTRAINT `FKA10F52959317D960` FOREIGN KEY (`INSTITUTION_ID`) REFERENCES `INSTITUTION` (`INSTITUTION_ID`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8
;
CREATE TABLE `BINDING` (
`BINDING_ID` bigint(20) NOT NULL AUTO_INCREMENT,
`END_POINT` varchar(255) NOT NULL,
`DESCRIPTION` varchar(255) DEFAULT NULL,
`BINDING_TYPE_ID` bigint(20) NOT NULL,
`SERVICE_ID` bigint(20) NOT NULL,
PRIMARY KEY (`BINDING_ID`),
KEY `FK24583A65354D3400` (`SERVICE_ID`),
KEY `FK24583A6545F914B` (`BINDING_TYPE_ID`),
CONSTRAINT `FK24583A6545F914B` FOREIGN KEY (`BINDING_TYPE_ID`) REFERENCES `BINDING_TYPE` (`BINDING_TYPE_ID`),
CONSTRAINT `FK24583A65354D3400` FOREIGN KEY (`SERVICE_ID`) REFERENCES `SERVICE` (`SERVICE_ID`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8
;
DROP TABLE IF EXISTS `ACTION`;
CREATE TABLE `ACTION` (
`ACTION_ID` bigint(20) NOT NULL AUTO_INCREMENT,
`VALUE` varchar(50) NOT NULL,
PRIMARY KEY (`ACTION_ID`),
UNIQUE KEY `VALUE` (`VALUE`)
) ENGINE=InnoDB AUTO_INCREMENT=6 DEFAULT CHARSET=utf8;
DROP TABLE IF EXISTS `ENTITLEMENT_POLICY`;
CREATE TABLE `ENTITLEMENT_POLICY` (
`POLICY_ID` bigint(20) NOT NULL AUTO_INCREMENT,
`ACTION_ID` bigint(20) NOT NULL,
`RESOURCE` varchar(255) NOT NULL,
`SUBJECT` varchar(255) NOT NULL,
`REALM` varchar(255) DEFAULT NULL,
PRIMARY KEY (`POLICY_ID`),
UNIQUE KEY `UK_SUBJECT_RESOURCE` (`SUBJECT`,`REALM`,`RESOURCE`),
UNIQUE KEY `SUBJECT` (`SUBJECT`,`REALM`,`RESOURCE`),
KEY `FK_ACTION` (`ACTION_ID`),
CONSTRAINT `FK_ACTION` FOREIGN KEY (`ACTION_ID`) REFERENCES `ACTION` (`ACTION_ID`)
) ENGINE=InnoDB AUTO_INCREMENT=91 DEFAULT CHARSET=utf8;

    now we remove the default apache site, enable our and enable required mosd then rewstart everything...

    sudo a2dissite 000-default
sudo a2enmod ssl shibd2
sudo a2ensite jktomcat
sudo service shibd restart
sudo service apache2 restart
sudo service shibd restart
sudo service apache2 tomcat7

    You will then go to the url for the tomcat managetr
    http://registry.ntersupport.com/manager/
    login using the data specified in tomcat-users.xml above.
    you should see entries for the two services.
    click start on the registry then the entitlement.
    test

     

    Last edit: Jeff Masiello 2014-08-25

  • Jeff Masiello

    Jeff Masiello - 2014-08-25

    Note: there are some discrepancies between the earlier version and this one. the login IDP and wsurl and such. We are still figuring out how the system works so feel free to comment.

     

  • Jeff Masiello

    Jeff Masiello - 2014-08-25

    further, a lot of the original documentation refers to dev servers, bad. They no longer exist and shouldn't be used in production anyway. (ok they exist in a completely different location but still...)

     
MongoDB Logo MongoDB