Skip to content

Commit fc81cf6

Browse files
committed
- Fixed READMEs, Debian packaging and Dockerfile due to change of Tomcat version (9->10) and JRE version (11->17)
- webapp: added dependency cxf-rt-features-logging for logging HTTP requests/responses
1 parent 18c64eb commit fc81cf6

14 files changed

Lines changed: 121 additions & 89 deletions

File tree

README.md

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -202,7 +202,7 @@ Every release is packaged in various types of distribution and the installation
202202

203203
- Ubuntu/Debian package (recommended option): `.deb`. Use your usual Ubuntu/Debian APT to install the package;
204204
- Other Linux distributions: `.tar.gz` for any Linux distribution. More info in the [documentation](#documentation);
205-
- Docker image, installed/deployed with the usual docker container commands.
205+
- Docker image, installed/deployed with the usual docker container commands. See [dist/src/docker/README.md](dist/src/docker/README.md) for more info.
206206

207207
For download links, please go to the specific
208208
[release page](https://github.com/authzforce/server/releases).
@@ -330,7 +330,8 @@ $ mvn -Dhttps.proxyHost=proxyhostname -Dhttps.proxyPort=8080 jgitflow:release-st
330330
```shell
331331
$ git checkout master
332332
$ mvn clean package
333-
$ cd dist/target/classes/docker
333+
$ cd dist/target
334+
$ chmod +x release-docker.sh
334335
$ ./release.sh
335336
```
336337
10. Update the versions in badges at the top of this file.

dist/pom.xml

Lines changed: 27 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -87,8 +87,10 @@
8787
<include>debian/changelog</include>
8888
<include>debian/changes.jdeb.txt</include>
8989
<include>tar/README.md</include>
90+
<!--
9091
<include>docker/Dockerfile.tmpl</include>
9192
<include>docker/release.sh.tmpl</include>
93+
-->
9294
</includes>
9395
</resource>
9496
</resources>
@@ -102,25 +104,39 @@
102104
<version>1.0.1</version>
103105
<executions>
104106
<execution>
105-
<id>copy-and-rename-dockerfile</id>
107+
<id>copy-dockerfile-and-release-script</id>
106108
<phase>process-resources</phase>
107109
<goals>
108-
<goal>rename</goal>
110+
<goal>copy</goal>
109111
</goals>
110112
<configuration>
111-
<sourceFile>${project.build.outputDirectory}/docker/Dockerfile.tmpl</sourceFile>
112-
<destinationFile>${project.build.outputDirectory}/docker/Dockerfile</destinationFile>
113+
<!-- project.build.directory: target
114+
project.build.outputDirectory: target/classes
115+
-->
116+
<fileSets>
117+
<fileSet>
118+
<!--<sourceFile>${project.build.outputDirectory}/docker/Dockerfile.tmpl</sourceFile>-->
119+
<sourceFile>src/docker/Dockerfile</sourceFile>
120+
<destinationFile>${project.build.directory}/Dockerfile</destinationFile>
121+
</fileSet>
122+
<fileSet>
123+
<!--<sourceFile>${project.build.outputDirectory}/docker/release.sh.tmpl</sourceFile>-->
124+
<sourceFile>src/docker/release.sh</sourceFile>
125+
<destinationFile>${project.build.directory}/release.sh</destinationFile>
126+
</fileSet>
127+
</fileSets>
128+
113129
</configuration>
114130
</execution>
115131
<execution>
116-
<id>copy-and-rename-release-script</id>
132+
<id>rename-release-script</id>
117133
<phase>process-resources</phase>
118134
<goals>
119135
<goal>rename</goal>
120136
</goals>
121137
<configuration>
122-
<sourceFile>${project.build.outputDirectory}/docker/release.sh.tmpl</sourceFile>
123-
<destinationFile>${project.build.outputDirectory}/docker/release.sh</destinationFile>
138+
<sourceFile>${project.build.directory}/release.sh</sourceFile>
139+
<destinationFile>${project.build.directory}/release-docker.sh</destinationFile>
124140
</configuration>
125141
</execution>
126142
</executions>
@@ -215,7 +231,7 @@
215231
<data>
216232
<!-- Webapp-specific context for Tomcat, after replacing 'productId' (see previous <resources> tag), therefore take it from target/classes, i.e. ${project.build.outputDirectory} -->
217233
<src>${project.build.outputDirectory}/webapp-context.xml</src>
218-
<dst>/etc/tomcat9/Catalina/localhost/authzforce-ce.xml</dst>
234+
<dst>/etc/tomcat10/Catalina/localhost/authzforce-ce.xml</dst>
219235
<type>file</type>
220236
<conffile>true</conffile>
221237
</data>
@@ -237,9 +253,9 @@
237253
</mapper>
238254
</data>
239255
<data>
240-
<!-- Systemd config override to allow writing to other non-official Tomcat directories. More info: https://salsa.debian.org/java-team/tomcat9/blob/master/debian/README.Debian -->
241-
<src>${project.basedir}/src/debian/systemd-tomcat9-override.conf</src>
242-
<dst>/etc/systemd/system/tomcat9.service.d/override.conf</dst>
256+
<!-- Systemd config override to allow writing to other non-official Tomcat directories. More info: https://salsa.debian.org/java-team/tomcat10/blob/master/debian/README.Debian -->
257+
<src>${project.basedir}/src/debian/systemd-tomcat10-override.conf</src>
258+
<dst>/etc/systemd/system/tomcat10.service.d/override.conf</dst>
243259
<type>file</type>
244260
<conffile>true</conffile>
245261
</data>

dist/src/debian/changelog

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,3 @@
1-
authzforce-ce-server (${project.version}) xenial; urgency=low
1+
authzforce-ce-server (${project.version}) lunar; urgency=low
22
* See https://github.com/authzforce/server/blob/release-${project.version}/CHANGELOG.md
33
-- Thales <http://www.thalesgroup.com> ${debian.changelog.timestamp}

dist/src/debian/control/control

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ Version: [[version]]
33
Section: web
44
Priority: optional
55
Architecture: all
6-
Depends: debconf (>= 0.2.26), openjdk-11-jre | oracle-java11-installer, tomcat9
6+
Depends: debconf (>= 0.2.26), openjdk-17-jre | oracle-java17-installer, tomcat10
77
Maintainer: [[productMaintainer]]
88
Description: AuthzForce CE Server.
99
Reference Implementation of FIWARE Authorization PDP Generic Enabler

dist/src/debian/control/postinst

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -18,22 +18,22 @@ systemctl daemon-reload
1818
db_get [[productId]]/restartTomcat
1919
if [ "$RET" = true ]; then
2020
export JAVA_OPTS='"-Djava.awt.headless=true -Djavax.xml.accessExternalSchema=all -Xms1024m -Xmx1024m -server"'
21-
sed -i 's|^\(JAVA_OPTS\s*=\s*\).*$|\1'"$JAVA_OPTS"'|' /etc/default/tomcat9
22-
systemctl stop tomcat9
23-
rm -rf /var/log/tomcat9/*
24-
systemctl start tomcat9
21+
sed -i 's|^\(JAVA_OPTS\s*=\s*\).*$|\1'"$JAVA_OPTS"'|' /etc/default/tomcat10
22+
systemctl stop tomcat10
23+
rm -rf /var/log/tomcat10/*
24+
systemctl start tomcat10
2525
fi
2626

27-
echo "If you answered 'No' to the second question, you need to set the JAVA_OPTS in '/etc/default/tomcat9' by yourself before restarting Tomcat:"
27+
echo "If you answered 'No' to the second question, you need to set the JAVA_OPTS in '/etc/default/tomcat10' by yourself before restarting Tomcat:"
2828
echo " JAVA_OPTS=\"-Djava.awt.headless=true -Djavax.xml.accessExternalSchema=all -Xms1024m -Xmx1024m -server\""
2929
echo
30-
echo "If Tomcat fails to restart, check for any Tomcat high-level error in Tomcat log directory: /var/log/tomcat9"
31-
echo "Then fix it, in particular check the settings in Tomcat init script /etc/default/tomcat9 and restart Tomcat as follows:"
32-
echo " $ systemctl restart tomcat9"
30+
echo "If Tomcat fails to restart, check for any Tomcat high-level error in Tomcat log directory: /var/log/tomcat10"
31+
echo "Then fix it, in particular check the settings in Tomcat init script /etc/default/tomcat10 and restart Tomcat as follows:"
32+
echo " $ systemctl restart tomcat10"
3333
echo
34-
echo "If Tomcat is started but AuthzForce webapp deployment fails, check for any webapp-specific error in file: /var/log/tomcat9/authzforce-ce/error.log"
34+
echo "If Tomcat is started but AuthzForce webapp deployment fails, check for any webapp-specific error in file: /var/log/tomcat10/authzforce-ce/error.log"
3535
echo
36-
echo "If Tomcat takes too long to start, especially to load the AuthzForce webapp, it is very likely caused by lack of entropy on your host for secure random number generation. Having enough entropy is critical for security reasons, especially in production. If and only if you are using this AuthzForce instance for testing only, you may speed up Tomcat startup by adding this JVM argument to the JAVA_OPTS variable in Tomcat service configuration file '/etc/default/tomcat9': '-Djava.security.egd=file:/dev/./urandom'"
36+
echo "If Tomcat takes too long to start, especially to load the AuthzForce webapp, it is very likely caused by lack of entropy on your host for secure random number generation. Having enough entropy is critical for security reasons, especially in production. If and only if you are using this AuthzForce instance for testing only, you may speed up Tomcat startup by adding this JVM argument to the JAVA_OPTS variable in Tomcat service configuration file '/etc/default/tomcat10': '-Djava.security.egd=file:/dev/./urandom'"
3737
echo
3838
echo "When the webapp is up and running, you should get a HTTP response with status code 200 to this HTTP request with curl tool, after replacing 8080 with the port Tomcat is listening to if different:"
3939
printf "$ curl --verbose --show-error --write-out '%b\\%bn' --request GET http://localhost:8080/authzforce-ce/domains\n"

dist/src/debian/copyright

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ Format: http://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
22
Upstream-Name: authzforce-ce-server-dist
33

44
Files: *
5-
Copyright: Copyright (C) 2012-2021 Thales. All rights reserved.
5+
Copyright: Copyright (C) 2012-2024 Thales. All rights reserved.
66
Licence: GPL-3.0
77
The full text of the GNU General Public
88
License version 3 can be found in the file
File renamed without changes.

dist/src/docker/.gitignore

Lines changed: 0 additions & 1 deletion
This file was deleted.
Lines changed: 19 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
# Copyright (C) 2012-2021 Thales.
1+
# Copyright (C) 2012-2024 Thales.
22
#
33
# This file is part of AuthzForce CE.
44
#
@@ -18,15 +18,14 @@
1818
# Best practices for writing Dockerfiles:
1919
# https://docs.docker.com/engine/userguide/eng-image/dockerfile_best-practices/
2020

21-
# Tips to do an unattended installation on Debian/Ubuntu:
22-
# http://www.microhowto.info/howto/perform_an_unattended_installation_of_a_debian_package.html
23-
2421
# The alternative is to use FROM ubuntu:* then install tomcat ubuntu package and use upstart/sysctl init script but this is not the way to go:
2522
# https://github.com/docker/docker/issues/6800
26-
FROM tomcat:9-jre11-temurin-focal
27-
MAINTAINER AuthzForce Team
28-
29-
ENV DEBIAN_FRONTEND noninteractive
23+
FROM tomcat:10-jre17-temurin-jammy
24+
LABEL maintainer="AuthzForce Team"
25+
LABEL org.label-schema.schema-version="1.0"
26+
# LABEL org.label-schema.vendor=""
27+
LABEL org.label-schema.name="AuthzForce Server"
28+
# LABEL org.label-schema.description=""
3029

3130
# Proxy configuration (if you are building from behind a proxy)
3231
# Next release of docker 1.9.0 should allow you to configure these by passing build-time arguments
@@ -39,38 +38,29 @@ ENV DEBIAN_FRONTEND noninteractive
3938

4039
ENV JAVA_OPTS="-Djava.security.egd=file:/dev/./urandom -Djava.awt.headless=true -Djavax.xml.accessExternalSchema=all -Xms1024m -Xmx1024m -server"
4140

42-
# Version replaced by maven resources plugin during Maven package/install build
43-
ENV AUTHZFORCE_SERVER_VERSION=${project.version}
44-
ENV AUTHZFORCE_SERVER_DOWNLOAD_URL="https://repo1.maven.org/maven2/org/ow2/authzforce/authzforce-ce-server-dist/$AUTHZFORCE_SERVER_VERSION/authzforce-ce-server-dist-$AUTHZFORCE_SERVER_VERSION.deb"
41+
COPY authzforce-ce-server-*.tar.gz /opt/authzforce-ce-server.tar.gz
4542

46-
# Download and install Authzforce Server (service starts automatically)
43+
# Download and install Authzforce Server
4744
# Where there is a command with a pipe, we need to put in between quotes and make it an argument to bash -c command
4845
RUN apt-get update --assume-yes -qq && \
49-
apt-get install --assume-yes -qq \
50-
locales-all \
51-
locales \
52-
less \
53-
apt-utils \
54-
debconf-utils \
55-
gdebi \
56-
curl && \
46+
apt-get install --assume-yes -qq locales-all locales less && \
5747
rm -rf /var/lib/apt/lists/*
5848

59-
RUN locale-gen en_US en_US.UTF-8
60-
RUN dpkg-reconfigure locales
49+
RUN locale-gen en_US en_US.UTF-8 && \
50+
dpkg-reconfigure locales
6151
ENV LANG en_US.UTF-8
6252
ENV LANGUAGE en_US:en
6353
ENV LC_ALL en_US.UTF-8
6454

65-
RUN curl --silent --output authzforce-ce-server.deb --location $AUTHZFORCE_SERVER_DOWNLOAD_URL && \
66-
dpkg --extract authzforce-ce-server.deb /root/authzforce/ && \
67-
mv /root/authzforce/etc/tomcat9/Catalina /usr/local/tomcat/conf/ && \
68-
mv /root/authzforce/opt/* /opt/ && \
55+
RUN cd /opt && \
56+
tar xvzf authzforce-ce-server.tar.gz && \
57+
ln -s $(ls -d authzforce-ce-server-*) authzforce-ce-server && \
58+
mkdir -p /usr/local/tomcat/conf/Catalina/localhost && \
59+
cp /opt/authzforce-ce-server/conf/context.xml.sample /usr/local/tomcat/conf/Catalina/localhost/authzforce-ce.xml && \
6960
rm -rf /opt/authzforce-ce-server/data/domains/* && \
70-
rm -rf /root/authzforce && \
71-
rm -f authzforce-ce-server.deb
61+
rm -f authzforce-ce-server.tar.gz
7262

73-
VOLUME /opt/authzforce-ce-server/data
63+
VOLUME /opt/authzforce-ce-server
7464
VOLUME /usr/local/tomcat/conf
7565

7666
CMD ["catalina.sh", "run"]

dist/src/docker/README.md

Lines changed: 24 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -3,26 +3,42 @@
33
This image of a minimal AuthzForce Server runtime is intended to work together with [Identity Manager - Keyrock](http://catalogue.fiware.org/enablers/identity-management-keyrock) and [PEP Proxy Wilma](http://catalogue.fiware.org/enablers/pep-proxy-wilma) generic enabler.
44

55
## Image contents
6-
- OpenJDK JRE 11;
7-
- Tomcat 9 (since AuthzForce Server v9.0.1, else Tomcat 8 for older versions);
6+
- OpenJDK JRE 17 (since AuthzForce Server v12.0.0);
7+
- Tomcat 10 (since AuthzForce Server v12.0.0);
88
- AuthzForce Server CE (version matching the Docker image tag).
99

1010
## Usage
1111

1212
This image gives you a minimal installation for testing purposes. The AuthzForce Installation and Administration guide on [readthedocs.org](https://readthedocs.org/projects/authzforce-ce-fiware/versions/) (select the version matching the Docker image tag, then **AuthzForce - Installation and Administration Guide**) provides you a better approach for using it in a production environment. This installation guide also gives instructions to install from .deb package (instead of Docker), which is the recommended way for Ubuntu hosts.
1313

14-
Create a container using `authzforce/server` image by doing (replace the first *8080* after *-p* with whatever network port you want to use on the host to access the AuthzForce Server, e.g. 80; and *release-9.0.1* with the current Docker image tag that you are using):
14+
Create a container using `authzforce/server` image by doing (replace the first *8080* after *-p* with whatever network port you want to use on the host to access the AuthzForce Server, e.g. 80; and *release-12.0.1* with the current Docker image tag that you are using):
1515

1616
```
1717
docker run -d -p 8080:8080 --name <container-name> authzforce/server
1818
```
1919

2020
As stands in the AuthzForce Installation and administration guide on [readthedocs.org](https://readthedocs.org/projects/authzforce-ce-fiware/versions/) (select the version matching the Docker image tag, then **AuthzForce - Installation and Administration Guide**) you can:
2121

22+
* **Get the API description (WADL)**
23+
24+
This is good way to test the app is up and running.
25+
26+
```shell
27+
$ curl --verbose http://<authzforce-container-ip>:8080/authzforce-ce/?_wadl
28+
```
29+
30+
* **List domains**
31+
32+
Should return an empty list initially.
33+
34+
```shell
35+
$ curl --verbose --show-error --write-out '\n' http://<authzforce-container-ip>:8080/authzforce-ce/domains
36+
```
37+
2238
* **Create a domain**
2339

2440
```
25-
curl -s --request POST \
41+
$ curl --request POST \
2642
--header "Accept: application/xml" \
2743
--header "Content-Type: application/xml;charset=UTF-8" \
2844
--data '<?xml version="1.0" encoding="UTF-8"?><taz:domainProperties xmlns:taz="http://authzforce.github.io/rest-api-model/xmlns/authz/5" />' \
@@ -32,13 +48,13 @@ curl -s --request POST \
3248
* **Retrieve the domain ID**
3349

3450
```
35-
curl -s --request GET http://<authzforce-container-ip>:8080/authzforce-ce/domains
51+
$ curl -s --request GET http://<authzforce-container-ip>:8080/authzforce-ce/domains
3652
```
3753

3854
* **Domain removal**
3955

4056
```
41-
curl --verbose --request DELETE \
57+
$ curl --verbose --request DELETE \
4258
--header "Content-Type: application/xml;charset=UTF-8" \
4359
--header "Accept: application/xml" \
4460
http://<authzforce-container-ip>:8080/authzforce-ce/domains/<domain-id>
@@ -48,11 +64,9 @@ http://<authzforce-container-ip>:8080/authzforce-ce/domains/<domain-id>
4864

4965
These tasks are now delegated to the [Identity Manager - Keyrock](http://catalogue.fiware.org/enablers/identity-management-keyrock) enabler. Here you can find how to use the interface for that purpose: [How to manage AuthzForce in Fiware](https://www.fiware.org/devguides/handling-authorization-and-access-control-to-apis/how-to-manage-access-control-in-fiware/).
5066

51-
## User feedback
52-
53-
### Documentation
67+
* **Other operations**
5468

55-
All the information regarding the Dockerfile is hosted publicly on [Github](https://github.com/authzforce/server/tree/master/src/docker).
69+
For other operations, see the Administration, and User and Programmers guides on [readthedocs.org](https://readthedocs.org/projects/authzforce-ce-fiware/versions/) (select the version matching the Docker image tag, then **AuthzForce - Installation and Administration Guide** or **User and Programmers Guide**).
5670

5771
### Issues
5872

0 commit comments

Comments
 (0)