Introduction

Here we describe Docker image for midPoint that is to be used within the TIER IdM environment.

The image can be found in the TIER/midPoint_container GitHub project.

Besides the image itself, the project contains a couple of demonstrations of its usage:

Prerequisites

In order to set up and run this container and associated demonstrations, you need a Linux machine with a reasonably recent Docker and docker-compose installation. The most advanced demo/grouper optionally uses an LDAP browser, e.g. Apache Directory Studio that itself requires Java.

This container and demos were tested on Ubuntu 18.04.1 LTS with

• Docker 18.06.1-ce,
• docker-compose 1.17.1 (and 1.22.0),
• libxml2-utils package (in order to have xmllint command available),
• Apache Directory Studio 2.0.0.v20170904-M13 with OpenJDK 8.

The LDAP browser is really optional. It is used only to check that LDAP objects are created correctly. You can safely proceed without it.

It seems that the usual way of installation via e.g. apt-get does not always guarantee sufficiently recent versions of Docker and docker-compose. To have the latest stable versions you can use procedures described here:

• https://docs.docker.com/install/linux/docker-ce/ubuntu/#install-docker-ce
• https://docs.docker.com/compose/install/

Also, make sure appropriate ports are available on the host machine. They are listed in the documentation to individual demonstrations; usually they are 8443 and 3306, sometimes 389, 443, or 5432. The demo/grouper needs even more free ports, please see the description.

Getting started (simple demo)

The image cannot be "run" by itself as it requires a midPoint repository - i.e. an SQL database - to execute. So the easiest way how to start dockerized midPoint is to use one of the provided demonstrations. The most logical choice for the first run is demo/simple.

$ git clone --branch v1.3 https://github.internet2.edu/TIER/midPoint_container.git
$ cd midPoint_container/demo/simple
$ docker-compose up

Building own images

The above commands download tier/midpoint image from the Docker hub. Alternatively, you can build this image yourself. Here is how:

$ git clone --branch v1.3 https://github.internet2.edu/TIER/midPoint_container.git
$ cd midPoint_container
$ ./build.sh
$ cd demo/simple
$ docker-compose up

(Note the build.sh has a -n switch that skips downloading the midPoint distribution archive, saving some time during repeated builds.)

After starting

After docker-compose up command successfully finishes you should see something like this on the console:

midpoint_server_1  | midpoint;midpoint.log;demo;;2018-09-20 16:25:22,191 [] [main] INFO (org.springframework.boot.web.embedded.tomcat.TomcatWebServer): Tomcat started on port(s): 8080 (http) 9090 (http) with context path '/midpoint'
midpoint_server_1  | midpoint;midpoint.log;demo;;2018-09-20 16:25:22,209 [] [main] INFO (com.evolveum.midpoint.web.boot.MidPointSpringApplication): Started MidPointSpringApplication in 60.512 seconds (JVM running for 61.688)

Now you can log into midPoint using https://localhost:8443/midpoint URL, with an user of administrator and a password of 5ecr3t.

Configuring the container (general information)

The lowest level of configuration of the midPoint container is during its inclusion into a Docker composition. There is the full set of environment properties and other configurable items (e.g. Docker secrets and configs) available.

During the composition some of the environment properties can be made accessible from the outside. This depends strictly on the compositor. The demonstrations here show some of the options.

How to set environment variables after composition is done

After the composition is done, you can set the environment variables like this:

$ export ENV="test" USERTOKEN="4.0.1" MP_MEM="4096m"
$ docker-compose up

Or like this:

$ env ENV="test" USERTOKEN="4.0.1" MP_MEM="4096m" docker-compose up

How to set Docker secrets and configs

The way of accessing secrets and configs is specific to the composition. In our demonstrations these are stored in the configs-and-secrets directory. They are provided to midPoint containers in appropriate ways. (Currently, secrets are passed as Docker secrets, configs are mounted as volumes. This might be changed in the future.) For detailed information on individual items please see the following sections.

Configuring specific container features

In this section we describe how to configure and use specific features of this midPoint dockerization.

Repository

Repository configuration is done via the following environment variables.

For automatic schema creation and upgrade options please see Schema creation and updating section in midPoint documentation.

Note that in order to connect to the database you have to provide the password. For security reasons, we use the indirect way through file access. So, typically you provide the following Docker secret:

Of course, you can provide the password file in any other way, assuming you correctly set REPO_PASSWORD_FILE environment variable.

Logging

Logging is configured by setting the following environment variables:

According to the specification, semicolons and spaces in these fields are eliminated. We decided to replace them by underscores.

Authentication

This midPoint dockerization supports two authentication mechanisms.

Authentication configuration is done using the following environment variables.

Note that besides these variables you have to provide the following files. They are necessary for the Shibboleth service provider module.

And the following Docker secrets are to be provided:

Other

Other aspects can be configured using the following variables and Docker secrets or configs.

Other files that are necessary for this midPoint container to function are:

And the following Docker secrets are to be provided: