1.  Environment Variables

Most container configuration can be accomplished by setting environment variables for the instantiated container. The details for how to set environment variables for a container depend on the orchestration engine you use (e.g. docker run, Docker Compose, Docker Swarm, Kubernetes, ...) and full details are beyond the scope of this documentation.

1.1.  Secrets

Registry containers support the convention of an associated environment variable ending with _FILE to indicate a path relative to the container from which the value for an environment variable should be read.

For example if the environment variable COMANAGE_REGISTRY_DATABASE_USER_PASSWORD_FILE exists and its value is the path to a readable file, then the contents of the file will be read into the environment variable COMANAGE_REGISTRY_DATABASE_USER_PASSWORD.

If both an environment variable and the associated _FILE environment variable are defined the associated _FILE environment variable takes precedence, provided that the file it points to exists and is readable.

1.2.  Shibboleth SP Configuration

Most Registry deployers using SAML SSO for authentication do so in a multi-lateral federated identity context. A production-ready Shibboleth SP configuration for multi-lateral federation requires many edits to the default template files provided by the Shibboleth SP software.

For this reason, while the image allows some Shibboleth SP configurations to be directly injected using environment variables (see the table below), most deployers prepare production-ready Shibboleth SP configuration files and then either bind mount the files into the container at run time using the slashRoot mechanism, or build a custom container image using the project image as a base and COPY the necessary Shibboleth SP configuration files with local deployment details into the directory /etc/shibboleth/.

To facilitate this approach the image includes the standard example and template configuration files experienced Shibboleth SP deployers expect to find.

1.3.  mod_auth_openidc Configuration

Most configuration details for the mod_auth_openidc module may be configured using environment variables (see below). Deployers that require additional configuration flexibility must bind mount the files into the container at run time using the slashRoot mechanism, or build a custom container image using the project image as a base and COPY the necessary file into place. See the mod_auth_openidc example for the full set of configuration options.

1.4.  Table of All Environment Variables

Variable Description Required Default Example Notes
COMANAGE_REGISTRY_ADMIN_GIVEN_NAME Given name for first platform administrator Yes Registry Julia The environment variable is read the first time the container is started and saved to the COmanage Registry database. Later changes to the environment variable are not reflected in the database state.
COMANAGE_REGISTRY_ADMIN_FAMILY_NAME Family name for first platform administrator Yes Admin Janssen The environment variable is read the first time the container is started and saved to the COmanage Registry database. Later changes to the environment variable are not reflected in the database state.
COMANAGE_REGISTRY_ADMIN_USERNAME Username name for first platform administrator Yes registry.admin julia.janseen@my.org When integrating with a single sign-on (SSO) system, this is the value the SSO infrastructure (SAML or OIDC) will set for the Apache REMOTE_USER CGI environment variable for the first platform administrator. The value is often an eduPersonPrincipalName (ePPN) or OIDC sub claim.

The environment variable is read the first time the container is started and saved to the COmanage Registry database. Later changes to the environment variable are not reflected in the database state.
COMANAGE_REGISTRY_CRON_USER User that runs the cron job when using the cron image No www-data someuid Used by the cron container only.

The crontab file is installed using the command /usr/bin/crontab and the -u flag with the value for this environment variable or the default value if not defined.
COMANAGE_REGISTRY_CRONTAB Full path to the crontab file No /srv/comanage-registry/local/crontab /opt/crontab Used by the cron container only.

See this example crontab file.
COMANAGE_REGISTRY_DATASOURCE Database type, one of Database/Postgres or Database/Mysql Yes Database/Postgres Database/Mysql MariaDB users should use Database/Mysql.

The environment variable is read when the container starts and written to the configuration file database.php inside the container only if the file does not already exist, either because it has been mounted using a persistent volume (or bind mount) or has been added when using the image as a base to build a new image. 
COMANAGE_REGISTRY_DATABASE Database name Yes registry comanage_registry The environment variable is read when the container starts and written to the configuration file database.php inside the container only if the file does not already exist, either because it has been mounted using a persistent volume (or bind mount) or has been added when using the image as a base to build a new image. 
COMANAGE_REGISTRY_DATABASE_HOST Database server host Yes comanage-registry-database database-server.my.org The environment variable is read when the container starts and written to the configuration file database.php inside the container only if the file does not already exist, either because it has been mounted using a persistent volume (or bind mount) or has been added when using the image as a base to build a new image. 
COMANAGE_REGISTRY_DATABASE_PORT Database server port No unset 5433 If unset the container uses the default port for the database type (5432 for Postgres and 3306 for MySQL/MariaDB).

The environment variable is read when the container starts and written to the configuration file database.php inside the container only if the file does not already exist, either because it has been mounted using a persistent volume (or bind mount) or has been added when using the image as a base to build a new image. 


COMANAGE_REGISTRY_DATABASE_POSTGRES_SSLMODE sslmode configuration for PostgreSQL No unset require

One of disable, allow, prefer, require, verify-ca, verify-full. See the PostgreSQL Database Connection Control Functions . When set to one of the strings noted above the database configuration file will include 'sslmode' => '<value>'. The CakePHP ORM layer will in turn include this in the PDO_PGSQL DSN.

Only used with PostgreSQL.

You probably want "require".
COMANAGE_REGISTRY_DATABASE_USER Database username Yes registry_user comanage-user The environment variable is read when the container starts and written to the configuration file database.php inside the container only if the file does not already exist, either because it has been mounted using a persistent volume (or bind mount) or has been added when using the image as a base to build a new image. 
COMANAGE_REGISTRY_DATABASE_USER_PASSWORD Database user password Yes password O5Yhtt6TLOxNjo93fmB9 The environment variable is read when the container starts and written to the configuration file database.php inside the container only if the file does not already exist, either because it has been mounted using a persistent volume (or bind mount) or has been added when using the image as a base to build a new image. 
COMANAGE_REGISTRY_EMAIL_FROM_EMAIL Default email "From" for emails sent by Registry. This is the email part of the sender array. Yes you@localhost registry@my.org The name part of the sender array is specified using COMANAGE_REGISTRY_EMAIL_FROM_NAME. When used together the resulting PHP is 
'${COMANAGE_REGISTRY_EMAIL_FROM_EMAIL}' => '${COMANAGE_REGISTRY_EMAIL_FROM_NAME}'

The environment variable is read when the container starts and written to the configuration file email.php if the file does not already exist, either because it has been mounted using a persistent volume (or bind mount) or has been added when using the image as a base to build a new image.

This is a CakePHP email configuration value.
COMANAGE_REGISTRY_EMAIL_FROM_NAME Default email "From" for emails sent by COmanage Registry. This is the name part of the sender array. Yes unset Registry The email part of the sender array is specified using COMANAGE_REGISTRY_EMAIL_FROM_EMAIL. When used together the resulting PHP is 
'${COMANAGE_REGISTRY_EMAIL_FROM_EMAIL}' => '${COMANAGE_REGISTRY_EMAIL_FROM_NAME}'

The environment variable is read when the container starts and written to the configuration file email.php if the file does not already exist, either because it has been mounted using a persistent volume (or bind mount) or has been added when using the image as a base to build a new image.

This is a CakePHP email configuration value.
COMANAGE_REGISTRY_EMAIL_TRANSPORT Email transport No unset Smtp The environment variable is read when the container starts and written to the configuration file email.php if the file does not already exist, either because it has been mounted using a persistent volume (or bind mount) or has been added when using the image as a base to build a new image.

This is a CakePHP email configuration value.
COMANAGE_REGISTRY_EMAIL_HOST Email server host No unset tls://smtp.gmail.com The environment variable is read when the container starts and written to the configuration file email.php if the file does not already exist, either because it has been mounted using a persistent volume (or bind mount) or has been added when using the image as a base to build a new image.

This is a CakePHP email configuration value.
COMANAGE_REGISTRY_EMAIL_PORT Email server port No unset 465 The environment variable is read when the container starts and written to the configuration file email.php if the file does not already exist, either because it has been mounted using a persistent volume (or bind mount) or has been added when using the image as a base to build a new image.

This is a CakePHP email configuration value.
COMANAGE_REGISTRY_EMAIL_ACCOUNT Email server account No unset registry-smtp@my.org The environment variable is read when the container starts and written to the configuration file email.php if the file does not already exist, either because it has been mounted using a persistent volume (or bind mount) or has been added when using the image as a base to build a new image.

This is a CakePHP email configuration value.
COMANAGE_REGISTRY_EMAIL_ACCOUNT_PASSWORD Email server account password No unset Sw5x71ToBHBEr4VqpRxD The environment variable is read when the container starts and written to the configuration file email.php if the file does not already exist, either because it has been mounted using a persistent volume (or bind mount) or has been added when using the image as a base to build a new image.

This is a CakePHP email configuration value.
COMANAGE_REGISTRY_ENABLE_PLUGIN Comma separated list of non-core plugins to enable No unset IdentifierEnroller,LdapIdentifierValidator,
LdapSource
COMANAGE_REGISTRY_HTTP_LISTEN_PORT Apache HTTP Server listening port for HTTP (no TLS) traffic No 80 8080 This environment variable only configures the listening port for HTTP (no TLS) traffic. See COMANAGE_REGISTRY_HTTPS_LISTEN_PORT for configuring HTTPS (with TLS) traffic.
COMANAGE_REGISTRY_HTTP_NO Do not listen for HTTP (no TLS) traffic No unset 1 When set to any value the Apache HTTP Server will not listen for HTTP (no TLS) traffic.
COMANAGE_REGISTRY_HTTPS_LISTEN_PORT Apache HTTP Server listening port for HTTPS (with TLS) traffic No 443 8443 This environment variable only configures the listening port for HTTPS (with TLS) traffic. See COMANAGE_REGISTRY_HTTP_LISTEN_PORT for configuring HTTPS (no TLS) traffic.
COMANAGE_REGISTRY_HTTPS_NO Do not listen for HTTPS (with TLS) traffic No unset 1 When set to any value the Apache HTTP Server will not listen for HTTPS (with TLS) traffic.
COMANAGE_REGISTRY_OIDC_AUTH_REQUEST_PARAMS Add additional query string parameters to the OIDC authentication request to the OP No unset idphint=http%3A%2F%2Forcid.org%2Foauth%2Fauthorize The value is used with the mod_auth_openidc configuration parameter OIDCAuthRequestParams.
COMANAGE_REGISTRY_OIDC_CLIENT_ID OIDC client ID Yes when using mod_auth_openidc authentication, No otherwise unset cilogon:/client_id/7c1f02f06ab959a9400ecd1e907173 The value is used with the mod_auth_openidc configuration parameter OIDCClientID.
COMANAGE_REGISTRY_OIDC_CLIENT_SECRET OIDC client secret Yes when using mod_auth_openidc authentication, No otherwise unset PuE4eIqsvIZ66vt The value is used with the mod_auth_openidc configuration parameter OIDCClientSecret.
COMANAGE_REGISTRY_OIDC_CRYPTO_PASSPHRASE Password to use when encrypting OIDC state cookie Yes when using mod_auth_openidc authentication, No otherwise unset s6r9GfwAXV00a2TKMaV2 The value is used with the mod_auth_openidc configuration parameter OIDCCryptoPassphrase.
COMANAGE_REGISTRY_OIDC_FORWARD_HEADERS Forward standard proxy headers when using OIDC No unset 1 When set the mod_auth_openidc configuration parameter OIDCXForwardedHeaders is set to X-Forwarded-Host X-Forwarded-Port X-Forwarded-Proto.
COMANAGE_REGISTRY_OIDC_PROVIDER_METADATA_URL OIDC OP metadata URL No, but if not set all other OP configuration must be injected using other mechanisms unset https://cilogon.org/.well-known/openid-configuration The value is used with the mod_auth_openidc configuration parameter OIDCProviderMetadataURL.
COMANAGE_REGISTRY_OIDC_REMOTE_USER_CLAIM OIDC claim to write into REMOTE_USER No sub eppn The value is used with the mod_auth_openidc configuration parameter OIDCRemoteUserClaim.
COMANAGE_REGISTRY_OIDC_SCOPES OIDC scopes to request No openid openid email profile The list of scopes should be space delimited. The value is used with the mod_auth_openidc configuration parameter OIDCScope.
COMANAGE_REGISTRY_OIDC_SESSION_INACTIVITY_TIMEOUT OIDC session inactivity timeout in seconds No unset 3600 The value is used with the mod_auth_openidc configuration parameter OIDCSessionInactivityTimeout.
COMANAGE_REGISTRY_OIDC_SESSION_MAX_DURATION OIDC session maximum duration in seconds No unset 28800 The value is used with the mod_auth_openidc configuration parameter OIDCSessionMaxDuration.
COMANAGE_REGISTRY_NO_DATABASE_CONFIG Do not write a database configuration file No unset 1 If the environment variable is set to any value then the entrypoint script will not attempt to write the database configuration file database.php. This environment variable is often used with the comanage-registry-cron image when it shares a bind mounted directory with the COmanage Registry image.
COMANAGE_REGISTRY_NO_EMAIL_CONFIG Do not write an email configuration file No unset 1 If the environment variable is set to any value then the entrypoint script will not attempt to write the email configuration file email.php. This environment variable is often used with the comanage-registry-cron image when it shares a bind mounted directory with the COmanage Registry image.
COMANAGE_REGISTRY_REMOTE_IP Enable the Apache HTTP Server mod_remoteip module No unset 1 When set the mod_remoteip module is enabled and the configuration parameter RemoteIPHeader is set to X-Forwarded-For unless otherwise overridden using COMANAGE_REGISTRY_REMOTE_IP_HEADER. This is often used when proxying the container so that the actual client IP address is logged.
COMANAGE_REGISTRY_REMOTE_IP_HEADER Declare the header field which should be parsed for useragent IP addresses No X-Forwarded-For 
X-Client-IP
 The value is used with the mod_remoteip module configuration parameter RemoteIPHeader.
COMANAGE_REGISTRY_REMOTE_IP_INTERNAL_PROXY Declare client intranet IP addresses trusted to present the RemoteIPHeader value No unset 
10.0.2.0/24
 The value is used with the mod_remoteip module configuration parameter RemoteIPInternalProxy.
COMANAGE_REGISTRY_REMOTE_IP_INTERNAL_PROXY_LIST Declare client intranet IP addresses trusted to present the RemoteIPHeader value from a file No unset /etc/apache2/my_proxy_list The value is used with the mod_remoteip module configuration parameter RemoteIPInternalProxyList. The file must be injected into the container using some mechanism.
COMANAGE_REGISTRY_REMOTE_IP_PROXIES_HEADER Declare the header field which will record all intermediate IP addresses No unset 
X-Forwarded-By
 The value is used with the mod_remoteip module configuration parameter RemoteIPProxiesHeader.
COMANAGE_REGISTRY_REMOTE_IP_PROXY_PROTOCOL Enable or disable PROXY protocol handling No unset On The value is used with the mod_remoteip module configuration parameter RemoteIPProxyProtocol.
COMANAGE_REGISTRY_REMOTE_IP_PROXY_PROTOCOL_EXCEPTIONS Disable processing of PROXY header for certain hosts or networks No unset 10.0.2.1/32 The value is used with the mod_remoteip module configuration parameter RemoteIPProxyProtocolExceptions.
COMANAGE_REGISTRY_REMOTE_IP_TRUSTED_PROXY Declare client intranet IP addresses trusted to present the RemoteIPHeader value No unset 
proxy.example.com
 The value is used with the mod_remoteip module configuration parameter RemoteIPTrustedProxy.
COMANAGE_REGISTRY_REMOTE_IP_TRUSTED_PROXY_LIST Declare client intranet IP addresses trusted to present the RemoteIPHeader value from a file No unset /etc/apache2/my_proxy_list The value is used with the mod_remoteip module configuration parameter RemoteIPTrustedProxyList. The file must be injected into the container using some mechanism.
COMANAGE_REGISTRY_SECURITY_SALT Security salt used when hashing. Must be 40 or more characters from the set [0-9a-zA-Z] No automatically generated if not provided VuUq2mnXC0Cco8uKcjO1rDdP2lVC3lgP970QP2XY If present the environment variable is read the first time the container is started and written to the persistent volume (or bind mount) in the configuration file security.salt. Later changes to the environment variable are not reflected in the file which must be edited directly. If not using a persistent volume or bind mount or otherwise providing the file security.salt then you must configure this environment variable in order that the same value persists between container restarts.
COMANAGE_REGISTRY_SECURITY_SEED Security seed used for encrypt/decrypt. Must be 30 or more numerical digits No automatically generated if not provided 47072649794709969916818407654 If present the environment variable is read the first time the container is started and written to the persistent volume (or bind mount) in the configuration file security.seed. Later changes to the environment variable are not reflected in the file which must be edited directly. If not using a persistent volume or bind mount or otherwise providing the file security.seed then you must configure this environment variable in order that the same value persists between container restarts.
COMANAGE_REGISTRY_PHP_SESSION_REDIS_URL URL for Redis server to use for storing PHP sessions No unset 
tcp://host1:6379
 The value is set in the php.ini file for the configuration parameter session.save_path. The value for the configuration parameter save_handler is set to redis. See the PhpRedis extension documentation for details.
COMANAGE_REGISTRY_SKIP_SETUP Do not run the database setup command No unset 1 When set the container will not execute the database setup command.
COMANAGE_REGISTRY_SKIP_UPGRADE Do not run the upgrade command No unset 1 When set the container will not execute the upgrade command. This can aid in faster container start times.
COMANAGE_REGISTRY_SLASH_ROOT_DIRECTORY Directory to use for copying configuration files into the container based on a "root like" directory structure No /opt/registry/slashRoot /srv/root When set and the directory exists files will be copied from the directory into the image using the GNU cp command with the --preserve=all and --parents options.
COMANAGE_REGISTRY_VIRTUAL_HOST_FQDN Apache HTTP Server virtual host name No Obtained from inspecting HTTPS x509 certificate file if present, otherwise "unknown" registry.my.org
COMANAGE_REGISTRY_VIRTUAL_HOST_REDIRECT_HTTP_NO Do not redirect HTTP to HTTPS No unset 1 When set the Apache HTTP Server will not be configured to redirect HTTP traffic to HTTPS.
COMANAGE_REGISTRY_VIRTUAL_HOST_PORT Apache HTTP Server virtual host port No 80 for HTTP and 443 for HTTPS 443 Used to construct the Apache HTTP Server ServerName configuration parameter. This is most often used when proxying the container in order to override the actual port used behind the proxy. This does not set the actual listening port and is only used to configure ServerName, which is used by the Apache HTTP Server and its modules to construct self-referential URLs. To configure the actual listening ports see COMANAGE_REGISTRY_HTTP_LISTEN_PORT and COMANAGE_REGISTRY_HTTPS_LISTEN_PORT.
COMANAGE_REGISTRY_VIRTUAL_HOST_SCHEME Apache HTTP Server virtual host scheme No http for HTTP listening port and https for HTTPS listening port https Used to construct the Apache HTTP Server ServerName configuration parameter. This is most often used when proxying the container in order to override the actual scheme used behind the proxy. 
HTTPS_CERT_FILE path to file containing x509 certificate for HTTPS No automatically generated self-signed certificate /run/secrets/https_cert_file The path is relative to the running container.

The file should include the PEM format X.509 certificate and any intermediate signing CA certificates.
HTTPS_PRIVKEY_FILE path to file containing x509 private key for HTTPS No automatically generated private key /run/secrets/https_privkey_file

The path is relative to the running container.
PHP_IMAGE_VERSION




SHIBBOLETH_SP_ENCRYPT_CERT PEM encoded X.509 certificate used for encrypting assertions to be sent to and consumed by the SP Yes when using Shibboleth SP authentication, No otherwise image default not suitable for production use sp-encrypt-cert.pem Many deployers start a container without specifying the variable and then break into the running container and use the /etc/shibboleth/keygen.sh script to generate the persistent cert and private key pair and copy them out of the container. Later after escrowing the cert and private key they are injected into the container using the variable(s).
SHIBBOLETH_SP_ENCRYPT_PRIVKEY Private key associated with the PEM encoded X.509 certificate used for encrypting assertions to be sent to and consumed by the SP Yes when using Shibboleth SP authentication, No otherwise image default not suitable for production use sp-encrypt-key.pem Many deployers start a container without specifying the variable and then break into the running container and use the /etc/shibboleth/keygen.sh script to generate the persistent cert and private key pair and copy them out of the container. Later after escrowing the cert and private key they are injected into the container using the variable(s).
SHIBBOLETH_SP_ENTITY_ID SAML entityID for the SP Yes when using Shibboleth SP authentication, No otherwise image default not suitable for production use https://myapp.my.org/shibboleth/sp
SHIBBOLETH_SP_METADATA_PROVIDER_XML XML stanza for configuring Shibboleth SP metadata consumption Yes when using Shibboleth SP authentication, No otherwise image default not suitable for production use See the Shibboleth SP documentation on Metadata configuration. Due to the complex syntax which makes escaping some characters tedious, most deployers write the configuration into a file, bind mount or COPY the file into the image, and specify the variable SHIBBOLETH_SP_METADATA_PROVIDER_XML_FILE to point to the location of the file relative to the running container.
SHIBBOLETH_SP_SAMLDS_URL URL for SAML IdP Discovery Service Yes when using Shibboleth SP authentication, No otherwise image default not suitable for production use https://login-chooser.my.org/
SHIBBOLETH_SP_SIGNING_CERT PEM encoded X.509 certificate used by the SP for signing authentication requests Yes when using Shibboleth SP authentication, No otherwise image default not suitable for production use sp-signing-cert.pem Many deployers start a container without specifying the variable and then break into the running container and use the /etc/shibboleth/keygen.sh script to generate the persistent cert and private key pair and copy them out of the container. Later after escrowing the cert and private key they are injected into the container using the variable(s).
SHIBBOLETH_SP_SIGNING_PRIVKEY Private key associated with the PEM encoded X.509 certificate used by the SP for signing authentication requests Yes when using Shibboleth SP authentication, No otherwise image default not suitable for production use sp-signing-key.pem Many deployers start a container without specifying the variable and then break into the running container and use the /etc/shibboleth/keygen.sh script to generate the persistent cert and private key pair and copy them out of the container. Later after escrowing the cert and private key they are injected into the container using the variable(s).

2.  

The Environmental Variables listed above are also supported by the InCommon TAP images

3. Overlaying Files

Most container configuration can be accomplished by setting environment variables for the instantiated container. See the sections above for details.

When a configuration environment variable is not available or more flexibility is needed to support advanced configurations, files may be overlayed in one of three different ways:

3.1. slashRoot mechanism

When the image is instantiated as a container the entrypoint script inspects the container's file system for the presence of a directory colloquially known as "slash Root" or slashRoot. The default directory is /opt/registry/slashRoot.

If the entrypoint script finds the slashRoot directory it copies the files found under that directory to the location in the image indicated by the path of the file relative to the slashRoot directory.

For example, if the file /opt/registry/slashRoot/etc/shibboleth/shibboleth2.xml exists then the entrypoint script will copy that file to /etc/shibboleth/shibboleth2.xml. Likewise, if the file /opt/registry/slashRoot/etc/apache2/ports.conf exists then the entrypoint script will copy that file to /etc/apache2/ports.conf.

The location of the slashRoot directory may be configured using the COMANAGE_REGISTRY_SLASH_ROOT_DIRECTORY environment variable. See above.

The entrypoint script copies files from slashRoot before most other environment variables are processed, so any configuration details set using environment variables will override those in files copied using this mechanism.

Deployers must take care to set both the file ownership and permissions correctly. See below details on the expected ownership and permissions for commonly overlaid files.

Also supported by the InCommon TAP images

The precise mechanism used by the entrypoint script to copy the files is a combination of the GNU xargs and cp commands with the --preserve=all, --parents, and --no-dereference options.

3.2. Bind mounting  individual files

Deployers may wish to overlay individual files by bind mounting rather than using the slashRoot mechanism. See below for an incomplete list of files in the image that may be overlayed. 

Deployers must take care to set both the file ownership and permissions correctly. See below details on the expected ownership and permissions for commonly overlaid files.

3.3. Build a new image and COPYing in the configuration files

The images are designed so that each may be used as the base for a new image with necessary customizations provided by using a customized Dockerfile (or similar) and the COPY command to overlay specific files.

Image builders must take care to set both the file ownership and permissions correctly. See below details on the expected ownership and permissions for commonly overlaid files.


3.4. Configuration file paths

3.4.1. Registry

Path Description UID Permission
Octal		 Example
/srv/comanage-registry/ Registry PHP application top-level directory 33 0755
/srv/comanage-registry/local/Config/database.php Database connection configuration 33 0600 Example
/srv/comanage-registry/local/Config/email.php Email configuration 33 0600 Example
/srv/comanage-registry/local/Config/security.salt Security salt file 33 0600 6fHzSa2ps1bzyseXbJ7TKcHowXsR9dyIUV0XSuA4
/srv/comanage-registry/local/Config/security.seed Security seed file 33 0600 694812053204336881869880217405
/srv/comanage-registry/local/Plugin/ Registry custom plugin directory 33 0755 /srv/comanage-registry/local/Plugin/FooEnroller
/srv/comanage-registry/local/webroot/ Registry webroot directory for additional css, images, and other web file injection 33 0755 /srv/comanage-registry/local/webroot/img/mylogo.png

3.4.2.  Apache HTTP Server

Path Description UID Permission
Octal		 Example Notes
/etc/apache2/cert.pem X.509 certificate for HTTPS 33 0644
PEM format including all intermediate CA certificates
/etc/apache2/privkey.pem matching private key for HTTPS 33 0600
PEM format
/etc/apache2/sites-available/000-comanage.conf HTTP Server virtual host configuration 33 0644
Details differ depending on authentication mechanism. See below.
/etc/apache2/ports.conf HTTP Server listening port configuration 33 0644
Default are ports 80 and 443

3.4.3.  Authentication

3.4.3.1. Basic Authentication

Path Description UID Permission
Octal		 Example Notes
/etc/apache2/basic-auth basic authentication password file 33 0600 Example
/etc/apache2/sites-available/000-comanage.conf HTTP Server virtual host configuration 33 0644

3.4.3.2. mod_auth_openidc

Path Description UID Permission
Octal		 Example Notes
/etc/apache2/sites-available/000-comanage.conf HTTP Server virtual host configuration 33 0644

3.4.3.3. Shibboleth SP

Path Description UID Permission
Octal		 Example Notes
/etc/apache2/sites-available/000-comanage.conf HTTP Server virtual host configuration 33 0644

/etc/shibboleth/ Shibboleth SP top level configuration directory 0 0755
The configuration file layout is the same as would be found in a default stand-alone configuration of the Shibboleth SP software. Please refer to the Shibboleth Project SP Documentation for details.
/etc/shibboleth/shibboleth2.xml Primary Shibboleth SP configuration file 0 0644
Shibboleth Project SP Documentation
/etc/shibboleth/attribute-map.xml Attribute extraction/mapping configuration file 0 0644
Shibboleth Project SP Documentation
/etc/shibboleth/sp-encrypt-cert.pem SAML X.509 certificate for encrypting messages sent to the SP 999 0644

/etc/shibboleth/sp-encrypt-key.pem Matching private key file 999 0600

/etc/shibboleth/sp-signing-cert.pem SAML X.509 certificate used by the SP for signing outgoing messages 999 0644

/etc/shibboleth/sp-signing-key.pem Matching private key file 999 0600

3.4.3.4. cron

Path Description UID Permission
Octal		 Example Notes
/srv/comanage-registry/local/crontab Crontab file configuring crond 0 0644 Example

4. Example Deployment Files and Configurations

Click here for a list of example deployment files and configurations.

  • No labels