internet2/tier-idp

tier-idp's Issues

Copyright and Licensing information

The tier-idp project appears to be lacking copyright and licensing information. Presumably the copyright is Internet2? But what license are the files distributed under?

Thanks.

Christopher Hoskin

Inappropriate privilege escalation

The build and run scripts make unnecessary use of sudo.

I can see no reason why sudo is used to build the Docker file.

Presumably sudo was used to run the container because of systemd. However, it is possible to run systemd in a docker container without needing root privileges e.g.

docker run -it --stop-signal=RTMIN+3 -e "container=docker"  --tmpfs /run --tmpfs /tmp -v /sys/fs/cgroup:/sys/fs/cgroup:ro --cap-add=SYS_ADMIN -p 0.0.0.0:8080:8080  shibboleth-idp

See e.g.:
https://developers.redhat.com/blog/2016/09/13/running-systemd-in-a-non-privileged-container/
moby/moby#28614 (comment)

Fragie shibboleth-identity-provider download URL

Currently the Dockerfile attempts to wget the IdP software from:

http://shibboleth.net/downloads/identity-provider/latest/shibboleth-identity-provider-3.2.1.tar.gz

However, this is not a stable URL, as the name of the tar.gz file changes with each release of Shibboleth IdP.

A less fragile solution would be to either use the URL of a fixed version e.g.:

http://shibboleth.net/downloads/identity-provider/3.2.1/shibboleth-identity-provider-3.2.1.tar.gz

or to use something like

wget -P download -A "shibboleth-identity-provider-*.tar.gz" -e robots=off -r  -nd -np https://shibboleth.net/downloads/identity-provider/latest/