search

UWIT-IAM / uw-idp-custom

Local IdP configuration and etc customizations
0 stars 0 forks source link

Restore logging for authz failures and fix Shibboleth update process #8

Closed mar235av closed 1 year ago

mar235av commented 1 year ago

Last year we added logging to the custom IdP component (uw-slack-intercept) to provide additional information on conditional access failures. However, that update was dropped when later Shibboleth updates rolled back the version of uw-slack-intercept included in the IdP war. There are three actions here:

  1. Build and deploy a new IdP war including the latest Shibboleth version and the latest version of uw-slack-intercept.
  2. Revise our Shibboleth upgrade process document to include a step to push our reference build of the IdP war (built on dev using the correct versions of custom components) to the eval and prod servers (replacing the war auto-built locally by Shibboleth during the upgrade process).
  3. Remove the contents of /data/local/idp/edit-webapp from servers other than dev. By doing this, when Shibboleth automatically builds a new war on a non-dev server during the upgrade process, that auto-built war will be non-functional (missing all our custom components) so we won't accidentally put the wrong IdP war version into production.
mar235av commented 1 year ago

Resolved via RFC-0763. The previously built version from dev was pushed to eval and prod and validated. The contents of edit-webapp/ on eval/prod were moved to edit-webapp.BAK/. I updated my local copy of the Shibboleth update process and will use this version for the next Shibboleth upgrade.