search

italia / Satosa-Saml2Spid

SATOSA SAML-to-SAML proxy with Spid compliances
Apache License 2.0
41 stars 25 forks source link

example with only local mount #152

Open MdreW opened 3 weeks ago

MdreW commented 3 weeks ago

This is an example for a docker compose without static volumes, has only example scope

run-docker-compose.sh

initialize and start Satosa-Saml2Spid

Option -f Force clean and reinitialize data for Satosa, MongoDB and Djangosaml2_SP -h Print this help

gitguardian[bot] commented 3 weeks ago

⚠️ GitGuardian has uncovered 9 secrets following the scan of your pull request.

Please consider investigating the findings and remediating the incidents. Failure to do so may lead to compromising the associated services or software components.

🔎 Detected hardcoded secrets in your pull request
| GitGuardian id | GitGuardian status | Secret | Commit | Filename | | | -------------- | ------------------ | ------------------------------ | ---------------- | --------------- | -------------------- | | [3369235](https://dashboard.gitguardian.com/workspace/244649/incidents/3369235?occurrence=163752757) | Triggered | Generic High Entropy Secret | 3c4c1d661201f5aab1cae5cbdda247a59569d986 | Docker-compose/mongo/db/.mongodb/mongosh/66c8648753e2f14983a26a12_log | [View secret](https://github.com/italia/Satosa-Saml2Spid/commit/3c4c1d661201f5aab1cae5cbdda247a59569d986#diff-a3a90a7fe11299c572a91551d98327daee584c8374600fec71513a80e6afb756R50) | | [3369235](https://dashboard.gitguardian.com/workspace/244649/incidents/3369235?occurrence=163752760) | Triggered | Generic High Entropy Secret | 3c4c1d661201f5aab1cae5cbdda247a59569d986 | Docker-compose/mongo/db/.mongodb/mongosh/66c8776831e5574dd75e739b_log | [View secret](https://github.com/italia/Satosa-Saml2Spid/commit/3c4c1d661201f5aab1cae5cbdda247a59569d986#diff-9405fb929f6ca3244a576b730acf2d1853bbf994fa759a4d9f9e265b24f7dd4cR52) | | [3369235](https://dashboard.gitguardian.com/workspace/244649/incidents/3369235?occurrence=163755647) | Triggered | Generic High Entropy Secret | 6c693af5c7e9512203a03063eed1a04de779b05c | Docker-compose/mongo/db/.mongodb/mongosh/66c8648753e2f14983a26a12_log | [View secret](https://github.com/italia/Satosa-Saml2Spid/commit/6c693af5c7e9512203a03063eed1a04de779b05c#diff-a3a90a7fe11299c572a91551d98327daee584c8374600fec71513a80e6afb756L50) | | [3369235](https://dashboard.gitguardian.com/workspace/244649/incidents/3369235?occurrence=163755648) | Triggered | Generic High Entropy Secret | 6c693af5c7e9512203a03063eed1a04de779b05c | Docker-compose/mongo/db/.mongodb/mongosh/66c8776831e5574dd75e739b_log | [View secret](https://github.com/italia/Satosa-Saml2Spid/commit/6c693af5c7e9512203a03063eed1a04de779b05c#diff-9405fb929f6ca3244a576b730acf2d1853bbf994fa759a4d9f9e265b24f7dd4cL52) | | [5632966](https://dashboard.gitguardian.com/workspace/244649/incidents/5632966?occurrence=164912069) | Triggered | Username Password | 87c7f908fef444c1c99bd335d0d652f7fb33c2ea | Docker-compose/docker-compose.yml | [View secret](https://github.com/italia/Satosa-Saml2Spid/commit/87c7f908fef444c1c99bd335d0d652f7fb33c2ea#diff-3e2ad9b100dbd04e686e7a75a67c01e379fb9e71d5b93781b90cdb4ceef16b25L28) | | [5632967](https://dashboard.gitguardian.com/workspace/244649/incidents/5632967?occurrence=163752758) | Triggered | Generic High Entropy Secret | 3c4c1d661201f5aab1cae5cbdda247a59569d986 | Docker-compose/mongo/db/.mongodb/mongosh/66c8776831e5574dd75e739b_log | [View secret](https://github.com/italia/Satosa-Saml2Spid/commit/3c4c1d661201f5aab1cae5cbdda247a59569d986#diff-9405fb929f6ca3244a576b730acf2d1853bbf994fa759a4d9f9e265b24f7dd4cR52) | | [5632967](https://dashboard.gitguardian.com/workspace/244649/incidents/5632967?occurrence=163752759) | Triggered | Generic High Entropy Secret | 3c4c1d661201f5aab1cae5cbdda247a59569d986 | Docker-compose/mongo/db/.mongodb/mongosh/66c8648753e2f14983a26a12_log | [View secret](https://github.com/italia/Satosa-Saml2Spid/commit/3c4c1d661201f5aab1cae5cbdda247a59569d986#diff-a3a90a7fe11299c572a91551d98327daee584c8374600fec71513a80e6afb756R50) | | [5632967](https://dashboard.gitguardian.com/workspace/244649/incidents/5632967?occurrence=163755646) | Triggered | Generic High Entropy Secret | 6c693af5c7e9512203a03063eed1a04de779b05c | Docker-compose/mongo/db/.mongodb/mongosh/66c8776831e5574dd75e739b_log | [View secret](https://github.com/italia/Satosa-Saml2Spid/commit/6c693af5c7e9512203a03063eed1a04de779b05c#diff-9405fb929f6ca3244a576b730acf2d1853bbf994fa759a4d9f9e265b24f7dd4cL52) | | [5632967](https://dashboard.gitguardian.com/workspace/244649/incidents/5632967?occurrence=163755649) | Triggered | Generic High Entropy Secret | 6c693af5c7e9512203a03063eed1a04de779b05c | Docker-compose/mongo/db/.mongodb/mongosh/66c8648753e2f14983a26a12_log | [View secret](https://github.com/italia/Satosa-Saml2Spid/commit/6c693af5c7e9512203a03063eed1a04de779b05c#diff-a3a90a7fe11299c572a91551d98327daee584c8374600fec71513a80e6afb756L50) |
🛠 Guidelines to remediate hardcoded secrets
1. Understand the implications of revoking this secret by investigating where it is used in your code. 2. Replace and store your secrets safely. [Learn here](https://blog.gitguardian.com/secrets-api-management?utm_source=product&utm_medium=GitHub_checks&utm_campaign=check_run_comment) the best practices. 3. Revoke and [rotate these secrets](https://docs.gitguardian.com/secrets-detection/secrets-detection-engine/detectors/generics/generic_high_entropy_secret#revoke-the-secret?utm_source=product&utm_medium=GitHub_checks&utm_campaign=check_run_comment). 4. If possible, [rewrite git history](https://blog.gitguardian.com/rewriting-git-history-cheatsheet?utm_source=product&utm_medium=GitHub_checks&utm_campaign=check_run_comment). Rewriting git history is not a trivial act. You might completely break other contributing developers' workflow and you risk accidentally deleting legitimate data. To avoid such incidents in the future consider - following these [best practices](https://blog.gitguardian.com/secrets-api-management/?utm_source=product&utm_medium=GitHub_checks&utm_campaign=check_run_comment) for managing and storing secrets including API keys and other credentials - install [secret detection on pre-commit](https://docs.gitguardian.com/ggshield-docs/integrations/git-hooks/pre-commit?utm_source=product&utm_medium=GitHub_checks&utm_campaign=check_run_comment) to catch secret before it leaves your machine and ease remediation.

🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.

MdreW commented 2 weeks ago

Added TZ in docker compose, update satosa Dockerfile to support this. a little optimization of Dockerfile RUN

[ranaldi@andrea-ranaldi-p Satosa-Saml2Spid]$ docker run -tie TZ=Europe/Berlin satosa bash
126b80233e9b:/satosa_proxy# date
Wed Aug 28 17:05:22 CEST 2024

[ranaldi@andrea-ranaldi-p Satosa-Saml2Spid]$ docker run -tie TZ=Australia/Melbourne satosa bash
7c1efed81ada:/satosa_proxy# date
Thu Aug 29 01:05:39 AEST 2024
MdreW commented 5 days ago

I have added profiles demo to start all services and dataentry for add mongo-express service. Nginx, satosa and mongo are every started for production.

I have update update run-docker-compose.sh to start demo profile as default, dataentry and production profiles are optional. I have added also an option to skip docker image update and compile -s.

### run-docker-compose.sh ###

initialize check update and start Satosa-Saml2Spid

Option
-f Force clean and reinitialize data for Satosa, MongoDB and Djangosaml2_SP
-h Print this help
-p Set production profile: start satosa, nginx, mongo
-s Skip docker image update
-d Set data entry profile: start satosa, nginx, mongo, mongo-express
   if isn't set -d or -p defatult demo profile is started
   default demo profile start: satosa, nginx, mongo, mongo-express, django-sp, spid-saml-check

At last I have update ./stop-docker-compose.sh to stop all profiles and remove orphan containers, but we can add an option to stop also only specific profiles.

@Zicchio you can try this on windows?