docker: adds IA2 security params (AUTH_GMS/RAP/CLIENT/SECRET)

docker/Dockerfile.soda

@@ -57,6 +57,8 @@ RUN chmod -R a+rwX conf
 
 # enable SKA IAM token filter update
 RUN chmod a+rw ${WEBAPP_DIR}/WEB-INF/web.xml \
+ && touch  ${WEBAPP_DIR}/WEB-INF/classes/ia2token.properties \
+ && touch  ${WEBAPP_DIR}/WEB-INF/classes/iamtoken.properties \
  && chmod a+rw ${WEBAPP_DIR}/WEB-INF/classes/*.properties
 
 env ACCESS_CONTEXT_ROOT=datasets

docker/start-soda.sh.soda

@@ -9,11 +9,18 @@ env
 # set optional
 ACCESS_CONTEXT_ROOT=${ACCESS_CONTEXT_ROOT:-datasets}
 SECURITY=${SECURITY:-}
+
 KEYSTORE_ALIAS=${KEYSTORE_ALIAS:-}
 SKAIAM_INTROSPECT=${SKAIAM_INTROSPECT:-}
 SKAIAM_CLIENT=${SKAIAM_CLIENT:-}
 SKAIAM_PASSWORD=${SKAIAM_PASSWORD:-}
 
+AUTH_RAP_URL=${AUTH_RAP_URL:-}
+AUTH_GMS_URL=${AUTH_GMS_URL:-}
+AUTH_CLIENT=${AUTH_CLIENT:-}
+AUTH_SECRET=${AUTH_SECRET:-}
+
+
 # configure CONTEXT_ROOT
 
 mkdir -p $CATALINA_BASE/conf/Catalina/localhost
@@ -66,6 +73,31 @@ else
    cp $WEBAPP_DIR/WEB-INF/web-cutout-iamtoken.xml $WEBAPP_DIR/WEB-INF/web.xml
 fi
 
+# configure IA2 security
+
+if [ -z "$AUTH_RAP_URL" ] || [ -z "$AUTH_GMS_URL" ] || [ -z "$AUTH_CLIENT" ] || [ -z "$AUTH_SECRET" ];
+then
+   echo "Some of AUTH_ is not set."
+   echo "rap: "$AUTH_RAP_URL
+   echo "gms: "$AUTH_GMS_URL
+   echo "cli: "$AUTH_CLIENT
+   echo "pwd: "$AUTH_SECRET
+else
+   echo "Config SKA IAM ..."
+   {
+      echo "rap_uri=$AUTH_RAP_URL"
+      echo "gms_uri=$AUTH_GMS_URL"
+      echo "client_id=$AUTH_CLIENT"
+      echo "client_secret=$AUTH_SECRET"
+      echo "groups_autoload=true"
+      echo "store_state_on_login_endpoint=true"
+      echo "scope=openid email profile read:rap"
+      echo "allow_anonymous_access=true"
+   } > $WEBAPP_DIR/WEB-INF/classes/ia2token.properties
+   cp $WEBAPP_DIR/WEB-INF/web-cutout-ia2token.xml $WEBAPP_DIR/WEB-INF/web.xml
+fi
+
+
 # config debug
 DBG_LEVEL=${DEBUG_LEVEL:-CONFIG}
 sed -i "s/.*ServletCutout\.level.*=.*/ServletCutout.level = $DBG_LEVEL/g" $CATALINA_BASE/conf/soda.logging.properties