Skip to content

Commit 1129902

Browse files
Patrick TöllePatrick Tölle
Patrick Tölle
authored and
Patrick Tölle
committed
Add crowd single sign-on functions as described by atlassian wiki
You are now able to activate SSO via Atlassian Crowd per parameter. Just input your crowd credentials and SSO should work. See README for more details.
1 parent c4ae5f2 commit 1129902

File tree

6 files changed

+270
-4
lines changed

6 files changed

+270
-4
lines changed

‎README.md

+23-2
Original file line numberDiff line numberDiff line change
@@ -374,6 +374,28 @@ Password to access java keystore. Defaults to 'changeit'
374374

375375
Defaults to 'JKS'. Valid options are 'JKS', 'PKCS12', 'JCEKS'.
376376

377+
####Crowd single sign on parameters####
378+
####`enable_sso`
379+
Enable crowd single sign on configuration as described in https://confluence.atlassian.com/display/CROWD/Integrating+Crowd+with+Atlassian+Confluence#IntegratingCrowdwithAtlassianConfluence-2.2EnableSSOintegrationwithCrowd(Optional)
380+
####`application_name`
381+
Set crowd application name
382+
####`application_password`
383+
Set crowd application password
384+
####`application_login_url`
385+
Set crowd application login url, where to login into crowd (e.g. https://crowd.example.com/console/)
386+
####`crowd_server_url`
387+
Set crowd application services url, e.g. https://crowd.example.com/services/
388+
####`crowd_base_url`
389+
Set crowd base url, e.g. https://crowd.example.com/
390+
####`session_isauthenticated`
391+
Some more crowd.properties for SSO, see atlassian documentation for details
392+
####`session_tokenkey`
393+
Some more crowd.properties for SSO, see atlassian documentation for details
394+
####`session_validationinterval`
395+
Some more crowd.properties for SSO, see atlassian documentation for details
396+
####`session_lastvalidation`
397+
Some more crowd.properties for SSO, see atlassian documentation for details
398+
377399
##Usage
378400

379401
####A more complex example
@@ -391,7 +413,7 @@ Defaults to 'JKS'. Valid options are 'JKS', 'PKCS12', 'JCEKS'.
391413
}
392414
```
393415

394-
### A Hiera example
416+
### A Hiera example
395417

396418
This example is used in production for 2000 users in an traditional enterprise environment. Your mileage may vary. The dbpassword can be stored using eyaml hiera extension.
397419

@@ -509,4 +531,3 @@ export download_url="'http://my.local.server/'"
509531
##Contributors
510532

511533
The list of contributors can be found [here](https://github.com/brycejohnson/puppet-jira/graphs/contributors)
512-

‎files/seraph-config_withSSO.xml

+122
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,122 @@
1+
<security-config>
2+
<parameters>
3+
<init-param>
4+
<!--
5+
The login URL to redirect to when the user tries to access a protected resource (rather than clicking on
6+
an explicit login link). Most of the time, this will be the same value as 'link.login.url'.
7+
- if the URL is absolute (contains '://'), then redirect that URL (for SSO applications)
8+
- else the context path will be prepended to this URL
9+
10+
If '${originalurl}' is present in the URL, it will be replaced with the URL that the user requested.
11+
This gives SSO login pages the chance to redirect to the original page
12+
13+
'${pageCaps}' should be supported accordingly to com.atlassian.sal.api.page.PageCapability
14+
15+
'${userRole}' when specified, should cause logout after login to an user with privileges lesser than requested
16+
-->
17+
<param-name>login.url</param-name>
18+
<param-value>/login.jsp?permissionViolation=true&amp;os_destination=${originalurl}&amp;page_caps=${pageCaps}&amp;user_role=${userRole}</param-value>
19+
<!--<param-value>http://sso.mycompany.com/login?redirectTo=${originalurl}</param-value>-->
20+
</init-param>
21+
<init-param>
22+
<!--
23+
the URL to redirect to when the user explicitly clicks on a login link (rather than being redirected after
24+
trying to access a protected resource). Most of the time, this will be the same value as 'login.url'.
25+
- same properties as login.url above
26+
-->
27+
<param-name>link.login.url</param-name>
28+
<param-value>/login.jsp?os_destination=${originalurl}</param-value>
29+
<!--<param-value>/secure/Dashboard.jspa?os_destination=${originalurl}</param-value>-->
30+
<!--<param-value>http://sso.mycompany.com/login?redirectTo=${originalurl}</param-value>-->
31+
</init-param>
32+
<init-param>
33+
<!-- URL for logging out.
34+
- If relative, Seraph just redirects to this URL, which is responsible for calling Authenticator.logout().
35+
- If absolute (eg. SSO applications), Seraph calls Authenticator.logout() and redirects to the URL
36+
-->
37+
<param-name>logout.url</param-name>
38+
<param-value>/secure/Logout!default.jspa</param-value>
39+
<!--<param-value>http://sso.mycompany.com/logout</param-value>-->
40+
</init-param>
41+
<!--
42+
The path to *forward* to when the user tries to POST to a protected resource (rather than clicking on
43+
an explicit login link). Note that this is done using a servlet FORWARD, not a redirect. Information
44+
about the original request can be gotten from the javax.servlet.forward.* request attributes.
45+
46+
At this point you will probably want to save the user's POST params so he can log in again and retry
47+
the POST.
48+
49+
Defaults to undefined, in which case Seraph will just do a redirect instead of a FORWARD.
50+
-->
51+
<init-param>
52+
<param-name>login.forward.path</param-name>
53+
<param-value>/secure/XsrfErrorAction.jspa</param-value>
54+
</init-param>
55+
<!-- The key that the original URL is stored with in the session -->
56+
<init-param>
57+
<param-name>original.url.key</param-name>
58+
<param-value>os_security_originalurl</param-value>
59+
</init-param>
60+
<init-param>
61+
<param-name>login.cookie.key</param-name>
62+
<param-value>seraph.rememberme.cookie</param-value>
63+
</init-param>
64+
<!-- This property sets the default remember me cookie max age in seconds. It is currently set to 2 weeks -->
65+
<init-param>
66+
<param-name>autologin.cookie.age</param-name>
67+
<param-value>1209600</param-value>
68+
</init-param>
69+
<!-- Basic Authentication can be enabled by passing the authentication type as a configurable url parameter.
70+
With this example, you will need to pass http://mycompany.com/anypage?os_authType=basic in the url to enable Basic Authentication -->
71+
<init-param>
72+
<param-name>authentication.type</param-name>
73+
<param-value>os_authType</param-value>
74+
</init-param>
75+
<!-- If this parameter is set to true, the cookie will never be set secure. This is useful if you're logging
76+
into JIRA via https, but want to browse JIRA over http. This flag will ensure that the remember me option
77+
works correctly.
78+
<init-param>
79+
<param-name>insecure.cookie</param-name>
80+
<param-value>true</param-value>
81+
</init-param> -->
82+
83+
<init-param>
84+
<param-name>invalidate.session.on.login</param-name>
85+
<param-value>true</param-value>
86+
</init-param>
87+
<init-param>
88+
<param-name>invalidate.session.exclude.list</param-name>
89+
<param-value>ASESSIONID,jira.websudo.timestamp,jira.user.project.admin</param-value>
90+
</init-param>
91+
</parameters>
92+
93+
<!-- CROWD:START - If enabling Crowd SSO integration uncomment the following SSOSeraphAuthenticator and comment out the JiraSeraphAuthenticator below -->
94+
<authenticator class="com.atlassian.jira.security.login.SSOSeraphAuthenticator"/>
95+
<!-- CROWD:END -->
96+
97+
<!-- CROWD:START - The authenticator below here will need to be commented out for Crowd SSO integration -->
98+
<!-- <authenticator class="com.atlassian.jira.security.login.JiraSeraphAuthenticator"/> -->
99+
<!-- CROWD:END -->
100+
101+
<!-- NB: the URL to redirect to is now specified by login.url above -->
102+
<services>
103+
<service class="com.atlassian.jira.security.JiraPathService" />
104+
105+
<service class="com.atlassian.seraph.service.WebworkService">
106+
<init-param>
107+
<param-name>action.extension</param-name>
108+
<param-value>jspa</param-value>
109+
</init-param>
110+
</service>
111+
112+
<service class="com.atlassian.jira.plugin.webwork.JiraSeraphSecurityService" />
113+
</services>
114+
115+
<rolemapper class="com.atlassian.jira.security.JiraRoleMapper"/>
116+
117+
<elevatedsecurityguard class="com.atlassian.jira.security.login.JiraElevatedSecurityGuard"/>
118+
119+
<interceptors>
120+
<interceptor class="com.atlassian.jira.web.filters.JiraLoginInterceptor" />
121+
</interceptors>
122+
</security-config>

‎manifests/init.pp

+19-2
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@
1818
# This module is used to install Jira.
1919
#
2020
# See README.md for more details
21-
#
21+
#
2222
# === Authors
2323
#
2424
# Bryce Johnson
@@ -118,7 +118,7 @@
118118
# Tomcat Tunables
119119
$tomcatMaxThreads = '150',
120120
$tomcatAcceptCount = '100',
121-
121+
122122
# Reverse https proxy
123123
$proxy = {},
124124
# Options for the AJP connector
@@ -129,6 +129,19 @@
129129
# Resources for context.xml
130130
$resources = {},
131131

132+
# Enable SingleSignOn via Crowd
133+
134+
$enable_sso = false,
135+
$application_name = 'crowd',
136+
$application_password = '1234',
137+
$application_login_url = 'https://crowd.example.com/console/',
138+
$crowd_server_url = 'https://crowd.example.com/services/',
139+
$crowd_base_url = 'https://crowd.example.com/',
140+
$session_isauthenticated = 'session.isauthenticated',
141+
$session_tokenkey = 'session.tokenkey',
142+
$session_validationinterval = 5,
143+
$session_lastvalidation = 'session.lastvalidation',
144+
132145
) inherits jira::params {
133146

134147
# Parameter validations
@@ -186,4 +199,8 @@
186199
} ->
187200
anchor { 'jira::end': }
188201

202+
if ($enable_sso) {
203+
class { 'jira::sso':
204+
}
205+
}
189206
}

‎manifests/sso.pp

+38
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
# == Class: confluence::sso
2+
#
3+
# Install confluence SSO via crowd, See README.md for more.
4+
#
5+
class jira::sso(
6+
$application_name = $::jira::application_name,
7+
$application_password = $::jira::application_password,
8+
$application_login_url = $::jira::application_login_url,
9+
$crowd_server_url = $::jira::crowd_server_url,
10+
$crowd_base_url = $::jira::crowd_base_url,
11+
$session_isauthenticated = $::jira::session_isauthenticated,
12+
$session_tokenkey = $::jira::session_tokenkey,
13+
$session_validationinterval = $::jira::session_validationinterval,
14+
$session_lastvalidation = $::jira::session_lastvalidation,
15+
) {
16+
17+
validate_re($application_login_url,'^https?\://[a-zA-Z0-9\-\.]+\.[a-zA-Z]{2,3}(/\S*)?$')
18+
validate_re($crowd_server_url,'^https?\://[a-zA-Z0-9\-\.]+\.[a-zA-Z]{2,3}(/\S*)?$')
19+
validate_re($crowd_base_url,'^https?\://[a-zA-Z0-9\-\.]+\.[a-zA-Z]{2,3}(/\S*)?$')
20+
21+
file { "${jira::webappdir}/atlassian-jira/WEB-INF/classes/crowd.properties":
22+
ensure => present,
23+
content => template('jira/crowd.properties'),
24+
mode => '0660',
25+
owner => $::jira::user,
26+
group => $::jira::group,
27+
require => Class['jira::install'],
28+
notify => Class['jira::service'],
29+
}
30+
file { "${jira::webappdir}/atlassian-jira/WEB-INF/classes/seraph-config.xml":
31+
source => 'puppet:///modules/jira/seraph-config_withSSO.xml',
32+
mode => '0660',
33+
owner => $::jira::user,
34+
group => $::jira::group,
35+
require => Class['jira::install'],
36+
notify => Class['jira::service'],
37+
}
38+
}

‎spec/classes/jira_sso_spec.rb

+57
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
require 'spec_helper.rb'
2+
3+
describe 'jira' do
4+
describe 'jira::sso' do
5+
context 'default params' do
6+
let(:params) {{
7+
:javahome => '/opt/java',
8+
:version => '6.3.4a',
9+
:enable_sso => true,
10+
}}
11+
it { should contain_file('/opt/jira/atlassian-jira-6.3.4a-standalone/atlassian-jira/WEB-INF/classes/seraph-config.xml')}
12+
it { should contain_file('/opt/jira/atlassian-jira-6.3.4a-standalone/atlassian-jira/WEB-INF/classes/crowd.properties')}
13+
end
14+
context 'with param application_name set to appname' do
15+
let(:params) {{
16+
:javahome => '/opt/java',
17+
:version => '6.3.4a',
18+
:enable_sso => true,
19+
:application_name => 'appname',
20+
}}
21+
it { should contain_file('/opt/jira/atlassian-jira-6.3.4a-standalone/atlassian-jira/WEB-INF/classes/crowd.properties')
22+
.with_content(/application.name appname/)
23+
}
24+
end
25+
context 'with param application_login_url set to ERROR' do
26+
let(:params) {{
27+
:javahome => '/opt/java',
28+
:version => '6.3.4a',
29+
:enable_sso => true,
30+
:application_login_url => 'ERROR',
31+
}}
32+
it('should fail') {
33+
should raise_error(Puppet::Error, /does not match/)
34+
}
35+
end
36+
context 'with non default params' do
37+
let(:params) {{
38+
:javahome => '/opt/java',
39+
:version => '6.3.4a',
40+
:enable_sso => true,
41+
:application_name => 'app',
42+
:application_password => 'password',
43+
:application_login_url => 'https://login.url/',
44+
:crowd_server_url => 'https://crowd.url/',
45+
:crowd_base_url => 'http://crowdbase.url',
46+
}}
47+
it { should contain_file('/opt/jira/atlassian-jira-6.3.4a-standalone/atlassian-jira/WEB-INF/classes/seraph-config.xml')}
48+
it { should contain_file('/opt/jira/atlassian-jira-6.3.4a-standalone/atlassian-jira/WEB-INF/classes/crowd.properties')
49+
.with_content(/application.name app/)
50+
.with_content(/application.password password/)
51+
.with_content(/application.login.url https:\/\/login.url\//)
52+
.with_content(/crowd.server.url https:\/\/crowd.url\//)
53+
.with_content(/crowd.base.url http:\/\/crowdbase.url/)
54+
}
55+
end
56+
end
57+
end

‎templates/crowd.properties

+11
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
application.name <%= @application_name %>
2+
application.password <%= @application_password %>
3+
application.login.url <%= @application_login_url %>
4+
5+
crowd.server.url <%= @crowd_server_url %>
6+
crowd.base.url <%= @crowd_base_url %>
7+
8+
session.isauthenticated <%= @session_isauthenticated %>
9+
session.tokenkey <%= @session_tokenkey %>
10+
session.validationinterval <%= @session_validationinterval %>
11+
session.lastvalidation <%= @session_lastvalidation %>

0 commit comments

Comments
 (0)