SUNET/soc-ops
9
0
Fork 1
Code Activity

Setting up SSO proxy.

Browse source
This commit is contained in:
Johan Björklund 2024-10-31 15:34:41 +01:00
parent e6294af8e3
commit 6c14e444b2
Signed by: bjorklund
GPG key ID: 5E8401339C7F5037
4 changed files with 116 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
test-sso-proxy1.cert.sunet.se/overlay/etc/hiera/data/local.yaml
View file

@ -97,6 +97,9 @@ saml2_frontend:
key_file: frontend.key
cert_file: frontend.crt
accepted_time_diff: 180
metadata:
local:
- metadata/vul-dashboard-test.xml
entityid: https://test-sso-proxy1.cert.sunet.se/idp
service:
idp:

83
test-sso-proxy1.cert.sunet.se/overlay/etc/satosa/metadata/vul-dashboard-test.xml Normal file
View file

@ -0,0 +1,83 @@
<!--
This is example metadata only. Do *NOT* supply it as is without review,
and do *NOT* provide it in real time to your partners.
-->
<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" ID="_b9264b2e3d6680f462ef39d42527705201c2b2eb" entityID="https://vul-dashboard-test.cert.sunet.se">
<md:Extensions xmlns:alg="urn:oasis:names:tc:SAML:metadata:algsupport">
<alg:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha512"/>
<alg:DigestMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#sha384"/>
<alg:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
<alg:DigestMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#sha224"/>
<alg:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
<alg:SigningMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha512"/>
<alg:SigningMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha384"/>
<alg:SigningMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha256"/>
<alg:SigningMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha224"/>
<alg:SigningMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha512"/>
<alg:SigningMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha384"/>
<alg:SigningMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/>
<alg:SigningMethod Algorithm="http://www.w3.org/2009/xmldsig11#dsa-sha256"/>
<alg:SigningMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha1"/>
<alg:SigningMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
<alg:SigningMethod Algorithm="http://www.w3.org/2000/09/xmldsig#dsa-sha1"/>
</md:Extensions>
<md:SPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
<md:Extensions>
<init:RequestInitiator xmlns:init="urn:oasis:names:tc:SAML:profiles:SSO:request-init" Binding="urn:oasis:names:tc:SAML:profiles:SSO:request-init" Location="https://vul-dashboard-test.cert.sunet.se/Shibboleth.sso/satosa"/>
</md:Extensions>
<md:KeyDescriptor>
<ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<ds:KeyName>shib_cert</ds:KeyName>
<ds:X509Data>
<ds:X509SubjectName>CN=shib_cert</ds:X509SubjectName>
<ds:X509Certificate>MIIFCTCCAvGgAwIBAgIUTn9FwwBXdqWBK4Z8hPR1H/LXuyIwDQYJKoZIhvcNAQEL
BQAwFDESMBAGA1UEAwwJc2hpYl9jZXJ0MB4XDTI0MTAzMTEzMTMzN1oXDTM0MTAy
OTEzMTMzN1owFDESMBAGA1UEAwwJc2hpYl9jZXJ0MIICIjANBgkqhkiG9w0BAQEF
AAOCAg8AMIICCgKCAgEAremSsbo8HAHuCW/duCW5TncbYsih28WAFYSmU+NSRM7M
9E0TRcLK3kbayuN2sLZ+VOx2VlTaWvna9akSkzxx63jcTSr0eC8SOJdWepB7rDP8
18oe4MYj5uSa1ejVkFh1GhtRhUSnnQZEuQ9JVfLbsfhFRTmelDcZkDQlBv7Fu8co
818O/fby8Swg7Gqdmk/dVaAZXGZh8I8pA68OSoL9+F7F/saWKU4GwHu9Y9WEFG3A
hKaAfEU49TFnG3ZQUiUpUi0EI06mx9iykUNCM/47LSBuR23wgXLi13o7aRiSnDue
+C/s8IWTRVReFnc5nY6tBXD2cDJE/aCAzMAqLLBIs57DrRywpfneM3tWVpOx90Vj
yBGTZ5LagGL/ekVc0y/qfOQfN4Hf7VCv7nYP2bVAkwh7GFdjFKK6YSzK63xSab9a
teZlFBWLUYrFnLh0gmCN0k9lr//Hmuw7NwicAr/UOy8+sAddpmQbdhMMZiIc2hd+
2SD0hKOTCx6MKjIOf7Dszs71xgJbXKSQD2DlGG9+RyuCvZfV7Ssx7/ERiLql3gY4
7+8Nh1xRwxg7dX3wNbTt39KnaTuTWD9eEJGkkKubjmGf6WTvCryPFVG2tbF+pBuX
FATRKuHNQ0bx+gJdKUDK9dnsWXbESbeMWlzzgB9EPXwUkC8pKY/+//wWboTDVEEC
AwEAAaNTMFEwHQYDVR0OBBYEFDlrJ8Q0tuYBdI4V8lmjvFBVCtTRMB8GA1UdIwQY
MBaAFDlrJ8Q0tuYBdI4V8lmjvFBVCtTRMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZI
hvcNAQELBQADggIBABPTIu5KLo7rh6kUxZzHkrUjf/RixyqyOi6K+T+VOjumkaFY
Lxe7PELGuawt1ceLH2C1RM53tSX70vbatXj2Oc1WRjV4VyJQBDghN+5wVf/kcnq6
9kFHxJfqXa8Y8CTX4BqjsUG4x5dt1LB91Ygt2CUz2y1fDTsGTjkCoehCGqNMBMJB
xttUB/uxuNmBDFSY7ekH9SnmYDqjWPnbErrObm12HFqNe3T3SVixzU8GTveMPVLI
MEVjyhRaIGKuReruv6cqJTiBjF/L9oVSUNrBUbvp4ACBnL7oSKeZjwPT4/If08Rf
Us35guNEZObGG3Hr6Hsv590LXCuY8MURy23sJqkI//jtDf7LxWUHWPLQbh7k98HM
mSPJImtICzomYtFA/dlPwBittVHEfEbqSKT2xP4AvDRVyzY0RK5lIHuitS7gyUKF
PHVDNqTpdicHMGjFTwOep3MDnbR/1B96Tub9JI3GU9Ryj6upe9GUChdYBRG0x7Ss
Ya0xS3b5D6Y2AvZXJMwMxXNgFkMUgo4oZWTC0PpDf/VIctpmD2lxGQuRsmNrzxQd
JE1bGiFC09VpLobOhoGU6CO/5vPHVEx15YHrItUuyEVlm69uTALfwgKQcnBUeAjq
bk3tV/Aa+xIfD64R3WXvwYLgol+4jsuctIAljh89g5UboUx9NPkr7FTWc2vd
</ds:X509Certificate>
</ds:X509Data>
</ds:KeyInfo>
<md:EncryptionMethod Algorithm="http://www.w3.org/2009/xmlenc11#aes128-gcm"/>
<md:EncryptionMethod Algorithm="http://www.w3.org/2009/xmlenc11#aes192-gcm"/>
<md:EncryptionMethod Algorithm="http://www.w3.org/2009/xmlenc11#aes256-gcm"/>
<md:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes128-cbc"/>
<md:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes192-cbc"/>
<md:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes256-cbc"/>
<md:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#tripledes-cbc"/>
<md:EncryptionMethod Algorithm="http://www.w3.org/2009/xmlenc11#rsa-oaep"/>
<md:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p"/>
</md:KeyDescriptor>
<md:ArtifactResolutionService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" Location="https://vul-dashboard-test.cert.sunet.se/Shibboleth.sso/Artifact/SOAP" index="1"/>
<md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" Location="https://vul-dashboard-test.cert.sunet.se/Shibboleth.sso/SLO/SOAP"/>
<md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://vul-dashboard-test.cert.sunet.se/Shibboleth.sso/SLO/Redirect"/>
<md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://vul-dashboard-test.cert.sunet.se/Shibboleth.sso/SLO/POST"/>
<md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact" Location="https://vul-dashboard-test.cert.sunet.se/Shibboleth.sso/SLO/Artifact"/>
<md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://vul-dashboard-test.cert.sunet.se/Shibboleth.sso/SAML2/POST" index="1"/>
</md:SPSSODescriptor>
</md:EntityDescriptor>

1
vul-dashboard-test.cert.sunet.se/overlay/etc/hiera/data/local.eyaml
View file

File diff suppressed because one or more lines are too long

29
vul-dashboard-test.cert.sunet.se/overlay/opt/sso/shibboleth/sp-cert.pem Normal file
View file

@ -0,0 +1,29 @@
-----BEGIN CERTIFICATE-----
MIIFCTCCAvGgAwIBAgIUTn9FwwBXdqWBK4Z8hPR1H/LXuyIwDQYJKoZIhvcNAQEL
BQAwFDESMBAGA1UEAwwJc2hpYl9jZXJ0MB4XDTI0MTAzMTEzMTMzN1oXDTM0MTAy
OTEzMTMzN1owFDESMBAGA1UEAwwJc2hpYl9jZXJ0MIICIjANBgkqhkiG9w0BAQEF
AAOCAg8AMIICCgKCAgEAremSsbo8HAHuCW/duCW5TncbYsih28WAFYSmU+NSRM7M
9E0TRcLK3kbayuN2sLZ+VOx2VlTaWvna9akSkzxx63jcTSr0eC8SOJdWepB7rDP8
18oe4MYj5uSa1ejVkFh1GhtRhUSnnQZEuQ9JVfLbsfhFRTmelDcZkDQlBv7Fu8co
818O/fby8Swg7Gqdmk/dVaAZXGZh8I8pA68OSoL9+F7F/saWKU4GwHu9Y9WEFG3A
hKaAfEU49TFnG3ZQUiUpUi0EI06mx9iykUNCM/47LSBuR23wgXLi13o7aRiSnDue
+C/s8IWTRVReFnc5nY6tBXD2cDJE/aCAzMAqLLBIs57DrRywpfneM3tWVpOx90Vj
yBGTZ5LagGL/ekVc0y/qfOQfN4Hf7VCv7nYP2bVAkwh7GFdjFKK6YSzK63xSab9a
teZlFBWLUYrFnLh0gmCN0k9lr//Hmuw7NwicAr/UOy8+sAddpmQbdhMMZiIc2hd+
2SD0hKOTCx6MKjIOf7Dszs71xgJbXKSQD2DlGG9+RyuCvZfV7Ssx7/ERiLql3gY4
7+8Nh1xRwxg7dX3wNbTt39KnaTuTWD9eEJGkkKubjmGf6WTvCryPFVG2tbF+pBuX
FATRKuHNQ0bx+gJdKUDK9dnsWXbESbeMWlzzgB9EPXwUkC8pKY/+//wWboTDVEEC
AwEAAaNTMFEwHQYDVR0OBBYEFDlrJ8Q0tuYBdI4V8lmjvFBVCtTRMB8GA1UdIwQY
MBaAFDlrJ8Q0tuYBdI4V8lmjvFBVCtTRMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZI
hvcNAQELBQADggIBABPTIu5KLo7rh6kUxZzHkrUjf/RixyqyOi6K+T+VOjumkaFY
Lxe7PELGuawt1ceLH2C1RM53tSX70vbatXj2Oc1WRjV4VyJQBDghN+5wVf/kcnq6
9kFHxJfqXa8Y8CTX4BqjsUG4x5dt1LB91Ygt2CUz2y1fDTsGTjkCoehCGqNMBMJB
xttUB/uxuNmBDFSY7ekH9SnmYDqjWPnbErrObm12HFqNe3T3SVixzU8GTveMPVLI
MEVjyhRaIGKuReruv6cqJTiBjF/L9oVSUNrBUbvp4ACBnL7oSKeZjwPT4/If08Rf
Us35guNEZObGG3Hr6Hsv590LXCuY8MURy23sJqkI//jtDf7LxWUHWPLQbh7k98HM
mSPJImtICzomYtFA/dlPwBittVHEfEbqSKT2xP4AvDRVyzY0RK5lIHuitS7gyUKF
PHVDNqTpdicHMGjFTwOep3MDnbR/1B96Tub9JI3GU9Ryj6upe9GUChdYBRG0x7Ss
Ya0xS3b5D6Y2AvZXJMwMxXNgFkMUgo4oZWTC0PpDf/VIctpmD2lxGQuRsmNrzxQd
JE1bGiFC09VpLobOhoGU6CO/5vPHVEx15YHrItUuyEVlm69uTALfwgKQcnBUeAjq
bk3tV/Aa+xIfD64R3WXvwYLgol+4jsuctIAljh89g5UboUx9NPkr7FTWc2vd
-----END CERTIFICATE-----