diff options
Diffstat (limited to 'metadata/Makefile')
| -rw-r--r-- | metadata/Makefile | 257 |
1 files changed, 257 insertions, 0 deletions
diff --git a/metadata/Makefile b/metadata/Makefile new file mode 100644 index 00000000..8149bdd6 --- /dev/null +++ b/metadata/Makefile @@ -0,0 +1,257 @@ + +KEY := /opt/swamid-credentials/swamid-signer.key +CERT := /opt/swamid-credentials/swamid-signer.crt +PASS := $(shell test -f /opt/swamid-credentials/swamid-signer-pass.txt && cat /opt/swamid-credentials/swamid-signer-pass.txt) +DEST := /opt/published-metadata +SRCDIRS=swamid-2.0 swamid-edugain swamid-testing + +DAYS:=15 +DATE=$(shell perl scripts/expiration_date.pl $(DAYS)) +NOW=$(shell perl scripts/now_date.pl) +RPI=false +CONTACTS=false +TOU=true +ORG=true +TRANSFORM=xslt/normalize.xsl +ID=$(shell perl scripts/unique_id.pl) +XSLTDEFS := --stringparam org $(ORG) --stringparam ID $(ID) --stringparam tou $(TOU) --stringparam rpi $(RPI) --stringparam defaultContact $(CONTACTS) --stringparam date $(DATE) --stringparam now $(NOW) +SIGNER := xmlsec1 --sign --privkey-pem $(KEY),$(CERT) --pwd $(PASS) --id-attr:ID urn:oasis:names:tc:SAML:2.0:metadata:EntitiesDescriptor +BASEURL := http://md.swamid.se/md +SIGN := xslt/sign.xsl +SITE := site/md.swamid.se +TOU := swamid-tou-en.txt swamid-tou-sv.txt + +-include $(SWAMID_MK_CONFIG) + +all: clean dependencies signtest sign clean web + +MXML=$(shell echo *.mxml) +EDUGAINXML=$(patsubst swamid-edugain/%.xml,.time/%.time,$(wildcard swamid-edugain/*.xml)) +SWAMID20XML=$(patsubst swamid-2.0/%.xml,.time/%.time,$(wildcard swamid-2.0/*.xml)) +TESTINGXML=$(patsubst swamid-testing/%.xml,.time/%.time,$(wildcard swamid-testing/*.xml)) + +sign: swamid upstream + +%.sig: %.mxml + xsltproc $(XSLTDEFS) --stringparam target "$(BASEURL)/$*.xml" --xinclude $(TRANSFORM) $< > $*.n + xsltproc $(XSLTDEFS) --xinclude $(SIGN) $*.n > $*.tbs + $(SIGNER) --output $@ $*.tbs + xmllint --xinclude --nowarning --noout --path schema --schema schema.xsd $@ + rm -f $*.tbs $*.n + +%.pub: %.sig + mkdir -p $(DEST) && xmllint --nowarning --noout --path schema --schema schema.xsd $< && mv $< $(DEST)/$*.xml + +dependencies: swamid-interfederations-idp-2.0.xml swamid-interfederations-sp-2.0.xml + +upstream: edugain + +edugain: + env SWAMID_MK_CONFIG=$(SWAMID_MK_CONFIG) $(MAKE) RPI=true CONTACTS=true swamid-edugain-testing-1.0.pub swamid-edugain-1.0.pub + +aggregate: swamid-interfederations + +swamid-interfederations: swamid-interfederations2 + +swamid-interfederations2: + scripts/aggregate.sh swamid-interfederations-2.0 + @# Blocked by SWAMID-OPS 2021-04-21 + @sed -i '/services.sheerid.com-Shibboleth-UK/d' swamid-interfederations-2.0.mxml + @# Blocked by SWAMID-OPS 2021-12-10 SWAMID-550 + @sed -i '/verify-a.myunidays.com-shibboleth/d' swamid-interfederations-2.0.mxml + @sed -i '/verify-l.myunidays.com-shibboleth/d' swamid-interfederations-2.0.mxml + @sed -i '/mecenat.com-sp/d' swamid-interfederations-2.0.mxml + @sed -i '/connect.mecenat.com-shibboleth/d' swamid-interfederations-2.0.mxml + @sed -i '/verify.studentbeans.com-shibboleth/d' swamid-interfederations-2.0.mxml + @sed -i '/federation.proxi.id-samlbridge-module.php-saml-sp-metadata.php-cyclone-saml-bridge/d' swamid-interfederations-2.0.mxml + @# Blocked by SWAMID-OPS 2022-04-14 SWAMID-837 + @sed -i '/access-check.edugain.org-simplesaml-saml2-idp-metadata.php/d' swamid-interfederations-2.0.mxml + @# Blocked by SWAMID-OPS 2022-04-25 SWAMID-854 + @sed -i '/potential.ly/d' swamid-interfederations-2.0.mxml + @# Blocked 2022-09-23 , Invalid XML, Unlocked 2022-09-27 // Bjorn + @#sed -i '/idp.ici.ro-idp-shibboleth.xml/d' swamid-interfederations-2.0.mxml + +swamid: swamid-2.0.pub swamid-discovery.pub swamid-idp.pub swamid-idp-transitive.pub swamid-sp-transitive.pub swamid-registered.pub swamid-testing-1.0.pub swamid-testing-idp-1.0.pub + +web: $(SITE) $(TOU) + rsync -avz $(TOU) $(SITE)/ $(DEST) + +swamid-interfederations-idp-2.0.xml: swamid-interfederations-2.0.mxml + @xsltproc --xinclude xslt/extract-idp.xslt swamid-interfederations-2.0.mxml > swamid-interfederations-idp-2.0.xml + @# Empty PrivacyStatementURL 2020-12-09 + @#sed -i '/sso.irc.ugent.be-auth-realms-irc/d' swamid-interfederations-idp-2.0.xml + @# Empty ds:KeyName 2021-03-26 + @#sed -i '/idp.kre.hu-simplesaml-saml2-idp-metadata/d' swamid-interfederations-idp-2.0.xml + @#sed -i '/idp.kre.hu-simplesaml-saml2-idp-metadata/d' swamid-interfederations-2.0.mxml + +swamid-interfederations-sp-2.0.xml: swamid-interfederations-2.0.mxml + @xsltproc --xinclude xslt/extract-sp.xslt swamid-interfederations-2.0.mxml > swamid-interfederations-sp-2.0.xml + +syntaxtest: clean dependencies schematest + +pedantic: clean dependencies schematest testRefedsRnS testEduGAINchecks + +schematest: + @fail=false ; for x in $(MXML); do test=`xmllint --xinclude --nowarning --noout --path schema --schema schema.xsd $$x 2>&1`; rc=$$?; echo $$test | sed 's/fails to validate/[1;31m&[0m/;s/validates/[1;32m&[0m/'; if [ $$rc -gt 0 ]; then fail=true ; fi; done ; if $$fail ; then exit 1 ; fi + +clean: + @rm -f *.xml *.tbs *.n *.sig + +tidy: + @for x in `find $(SRCDIRS) -name \*.xml`; do xsltproc --stringparam regDate $(NOW) xslt/add-rpi.xsl $$x > $$x.c && mv $$x.c $$x; done + @for x in `find $(SRCDIRS) -name \*.xml`; do xsltproc xslt/clean-entitydescriptor.xsl $$x > $$x.c && mv $$x.c $$x; done + +testRefedsRnS: + @echo "Checking for refeds R&S compatibillity for entities exported to eduGAIN" + @for x in `cat swamid-edugain-*.mxml | grep -v "\.mxml$$" | grep "xi:include" | awk -F\" '{print $$2}' | xargs grep -l SPSSODescriptor` ; do \ + got_refeds_RnS=`cat $$x | sed 's;\(</*\)[a-z0-9]*:;\1;g' | sed 's/xmlns="[^"]*"//' | xmllint --xpath "/EntityDescriptor/Extensions/EntityAttributes/Attribute[@Name='http://macedir.org/entity-category']/AttributeValue" - 2>/dev/null | grep 'http://refeds.org/category/research-and-scholarship'` ; \ + if [ -n "$$got_refeds_RnS" ] ; then \ + http_post=`cat $$x | sed 's;\(</*\)[a-z0-9]*:;\1;g' | sed 's/xmlns="[^"]*"//' | xmllint --xpath "/EntityDescriptor/SPSSODescriptor/AssertionConsumerService" - 2>/dev/null | grep 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST'` ; \ + if [ -z "$$http_post" ] ; then echo " $$x: Missing HTTP-POST binding." | sed 's/.*/[1;31m&[0m/' ; fi ; \ + mdui_DisplayName=`cat $$x | sed 's;\(</*\)[a-z0-9]*:;\1;g' | sed 's/xmlns="[^"]*"//' | xmllint --xpath "/EntityDescriptor/SPSSODescriptor/Extensions/UIInfo/DisplayName" - 2>/dev/null | grep 'DisplayName'` ; \ + if [ -z "$$mdui_DisplayName" ] ; then echo " $$x: Missing mdui:DisplayName." | sed 's/.*/[1;31m&[0m/' ; fi ; \ + mdui_InformationURL=`cat $$x | sed 's;\(</*\)[a-z0-9]*:;\1;g' | sed 's/xmlns="[^"]*"//' | xmllint --xpath "/EntityDescriptor/SPSSODescriptor/Extensions/UIInfo/InformationURL" - 2>/dev/null | grep 'InformationURL'` ; \ + if [ -z "$$mdui_InformationURL" ] ; then echo " $$x: Missing mdui:InformationURL." | sed 's/.*/[1;31m&[0m/' ; fi ; \ + tech_contact=`cat $$x | sed 's;\(</*\)[a-z0-9]*:;\1;g' | sed 's/xmlns="[^"]*"//' | xmllint --xpath "/EntityDescriptor/ContactPerson[@contactType='technical']" - 2>/dev/null | grep 'EmailAddress'` ; \ + if [ -z "$$tech_contact" ] ; then echo " $$x: Missing ContactPerson contactType='technical'." | sed 's/.*/[1;31m&[0m/' ; fi ; \ + fi ; \ + done + +testEduGAINchecks: + @echo "Checking for attributes not allowed in entities exported to eduGAIN" + @for x in `cat swamid-edugain-*.mxml | grep -v "\.mxml$$" | grep "xi:include" | awk -F\" '{print $$2}' | xargs grep -l SPSSODescriptor` ; do \ + if ( grep -q "AssertionConsumerService Binding=\"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" $$x ); then \ + echo " $$x: AssertionConsumerService Binding=\"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect\" not allowed"; \ + fi ; \ + done + @for x in `cat swamid-edugain-idp-1.0.mxml swamid-edugain-sp-1.0.mxml | grep -v "\.mxml$$" | grep "xi:include" | awk -F\" '{print $$2}'` ; do \ + sed 's;\(</*\)[a-z0-9]*:;\1;g' $$x | sed 's/xmlns="[^"]*"//' | xmllint --xpath '/EntityDescriptor/Organization/OrganizationName' - 2>/dev/null | grep -vq "^$$" || echo " $$x missing OrganizationName" | sed 's/.*/[1;31m&[0m/' ; \ + sed 's;\(</*\)[a-z0-9]*:;\1;g' $$x | sed 's/xmlns="[^"]*"//' | xmllint --xpath '/EntityDescriptor/Organization/OrganizationDisplayName' - 2>/dev/null | grep -vq "^$$" || echo " $$x missing OrganizationDisplayName" | sed 's/.*/[1;31m&[0m/' ; \ + sed 's;\(</*\)[a-z0-9]*:;\1;g' $$x | sed 's/xmlns="[^"]*"//' | xmllint --xpath '/EntityDescriptor/Organization/OrganizationURL' - 2>/dev/null | grep -vq "^$$" || echo " $$x missing OrganizationURL" | sed 's/.*/[1;31m&[0m/' ; \ + done + + +testMDUI: + @echo "Checking for uniq IdP MDUI DisplayName" + @for lang in `find $(SRCDIRS) -name \*.xml -exec cat {} \; | sed -n 's/.*xml:lang="\([^"]*\)".*/\1/p' | sort -u` ; do for x in `find $(SRCDIRS) -name \*.xml | xargs grep -l IDPSSODescriptor` ; do cat $$x | sed 's;\(</*\)[a-z0-9]*:;\1;g' | sed 's/xmlns="[^"]*"//' | xmllint --xpath "/EntityDescriptor/IDPSSODescriptor/Extensions/UIInfo/DisplayName[@xml:lang='$$lang']" - 2>/dev/null | sed 's/^[ ]*//;s/[ ]*$$//' | tr -d '\n' | sed 's;<[^>]*>\([^<]*\)</[^>]*>;\1\n;g' | sed "s;^; $$x $$lang ;" | sed 's/.*/[1;31m&[0m/' ; done | sort -k 3 | uniq -d -f 2 ; done | grep . && exit 1 || true + +testIdPinSP: + @echo "Check that SP:s does not define IDPSSODescriptor" + @for spfile in `cat swamid-sp-2.0.mxml | grep -v "\.mxml$$" | grep "xi:include" | awk -F\" '{print $$2}'` ; do grep -q IDPSSODescriptor $$spfile && echo " $$spfile" | sed 's/.*/[1;31m&[0m/' ; done | grep . && exit 1 || exit 0 + +testMDUIreach: + @echo "Check that MDUI URLs are reachable" + @cat swamid-idp-2.0.mxml swamid-sp-2.0.mxml | grep -v "\.mxml$$" | grep "xi:include" | awk -F\" '{print $$2}' | \ + xargs -n1 -P 10 scripts/verify-uiinfo-urls.sh + +testALlevel: + @echo Fixa så att vi kollar!!!!! + @echo "Check for IdP:s with AL3 without AL2" + @for x in `find $(SRCDIRS) -name \*.xml`; do if grep -q http://www.swamid.se/policy/assurance/al3 $$x && ! grep -q http://www.swamid.se/policy/assurance/al2 $$x ; then echo " $$x" | sed 's/.*/[1;31m&[0m/' ; fi ; done + @echo "Check for IdP:s with AL2 without AL1" + @for x in `find $(SRCDIRS) -name \*.xml`; do if grep -q http://www.swamid.se/policy/assurance/al2 $$x && ! grep -q http://www.swamid.se/policy/assurance/al1 $$x ; then echo " $$x" | sed 's/.*/[1;31m&[0m/' ; fi ; done + +testBadStrings: + @echo "Check for bad strings in metadata" + @for x in `find $(SRCDIRS) -name \*.xml`; do grep -E 'ServiceName xml:lang="[^"]*"/>' $$x | sed 's/^/ /' ; done | grep . && exit 1 || exit 0 + +testRoleDescriptor: + +testRegistrationAuthority: + @echo "Check for registrationAuthority="http://www.swamid.se/" in EntityDescriptor/Extensions" + @for x in `find $(SRCDIRS) -name \*.xml`; do \ + if ! cat $$x | sed 's;\(</*\)[a-z0-9]*:;\1;g' | sed 's/xmlns="[^"]*"//' | xmllint --xpath "/EntityDescriptor/Extensions" - 2>/dev/null | grep -qE 'registrationAuthority="http://www.swamid.se/"|registrationAuthority="http://www.swamid.se/loop"' ; then \ + echo " $$x" | sed 's/.*/[1;31m&[0m/' ;\ + fi;\ + done | grep . && exit 1 || exit 0 + +checkInvalidChars: + @echo "Check for invalid characters" + @for x in `find $(SRCDIRS) -name \*.xml`; do \ + if grep -q " " $$x ; then \ + echo " $$x" | sed 's/.*/[1;31m&[0m/' ;\ + fi;\ + done | grep . && exit 1 || exit 0 + +checkUKalgorithms: + @echo "Check for invalid algorithms in swamid-edugain" + @xsltproc --xinclude xslt/check_uk_algorithms.xsl swamid-edugain-1.0.mxml 2>&1 | sed 's/.*/[1;31m&[0m/' | grep . && exit 1 || exit 0 + +createMXMLfiles: + @echo Recreating MXML files + @scripts/create_mxml.sh | sed 's/.*/[1;31m&[0m/' | grep . && exit 1 || exit 0 + +signtest: syntaxtest testMDUI testALlevel testEduGAINchecks testRefedsRnS testBadStrings testIdPinSP testRegistrationAuthority checkInvalidChars checkUKalgorithms +test: $(EDUGAINXML) $(SWAMID20XML) $(TESTINGXML) createMXMLfiles signtest + +.time/%.time: swamid-edugain/%.xml + @# make tidy + @xsltproc --stringparam regDate $(NOW) xslt/add-rpi.xsl $< > $<.c && mv $<.c $< + @xsltproc xslt/clean-entitydescriptor.xsl $< > $<.c && mv $<.c $< + + @# make schematest + @xmllint --xinclude --nowarning --noout --path schema --schema schema.xsd $< 2>&1 + + @echo $< done + @touch -r $< $@ + +.time/%.time: swamid-2.0/%.xml + @# make tidy + @xsltproc --stringparam regDate $(NOW) xslt/add-rpi.xsl $< > $<.c && mv $<.c $< + @xsltproc xslt/clean-entitydescriptor.xsl $< > $<.c && mv $<.c $< + + @# make schematest + @xmllint --xinclude --nowarning --noout --path schema --schema schema.xsd $< 2>&1 + + @echo $< done + @touch -r $< $@ + +.time/%.time: swamid-testing/%.xml + @# make tidy + @xsltproc --stringparam regDate $(NOW) xslt/add-rpi.xsl $< > $<.c && mv $<.c $< + @xsltproc xslt/clean-entitydescriptor.xsl $< > $<.c && mv $<.c $< + + @# make schematest + @xmllint --xinclude --nowarning --noout --path schema --schema schema.xsd $< 2>&1 + + @echo $< done + @touch -r $< $@ + +old_check: + @# make testMDUI + @#echo "Checking for bad lang codes" + @# Lang = ISO_639-1 + @#cat $< | sed -n 's/.*xml:lang="\([^"]*\)".*/\1/p' | sort -u | grep -vxE 'cs|da|de|en|fi|fr|it|sv|no|nn|nb|is' | sed 's/.*/[1;31mBad lang code : &[0m/' | grep . && exit 1 || true + @#if [ `grep EntityAttributes $< | wc -l ` -gt 2 ]; then echo "Multiple EntityAttributes" | sed 's/.*/[1;31m&[0m/' ; exit 1; fi + @#if ( grep -q IDPSSODescriptor $< ) ; then \ + #echo "Do IdP checks" ; \ + #echo ">Checking for uniq IdP MDUI DisplayName"; \ + #for lang in `cat $< | sed -n 's/.*xml:lang="\(..\)".*/\1/p' | sort -u` ; do \ + #mdui_displayname=`cat $< | sed 's;\(</*\)[a-z0-9]*:;\1;g' | sed 's/xmlns="[^"]*"//' | xmllint --xpath "/EntityDescriptor/IDPSSODescriptor/Extensions/UIInfo/DisplayName[@xml:lang='$$lang']" - 2>/dev/null | sed 's/^[ ]*//;s/[ ]*$$//' | tr -d '\n' | sed 's;<[^>]*>\([^<]*\)</[^>]*>;\1\n;g'`;\ + #organizationdisplayname=`cat $< | sed 's;\(</*\)[a-z0-9]*:;\1;g' | sed 's/xmlns="[^"]*"//' | xmllint --xpath "/EntityDescriptor/Organization/OrganizationDisplayName[@xml:lang='$$lang']" - 2>/dev/null | sed 's/^[ ]*//;s/[ ]*$$//' | tr -d '\n' | sed 's;<[^>]*>\([^<]*\)</[^>]*>;\1\n;g'` ;\ + #for x in `find $(SRCDIRS) -name \*.xml | xargs grep -l IDPSSODescriptor | egrep -v $<` ; do cat $$x | sed 's;\(</*\)[a-z0-9]*:;\1;g' | sed 's/xmlns="[^"]*"//' | xmllint --xpath "/EntityDescriptor/IDPSSODescriptor/Extensions/UIInfo/DisplayName[@xml:lang='$$lang']" - 2>/dev/null | tr -d '\n' | sed 's;<[^>]*>\([^<]*\)</[^>]*>;\1\n;g' | egrep "^$$mdui_displayname$$" | sed "s;^;Duplicate DisplayName in $$x for lang = $$lang\n;" | sed 's/.*/[1;31m&[0m/' ; done | grep . && exit 1 || true;\ + #done; \ + #echo ">Checking for invalid IPHint"; \ + #cat $< | sed -n 's;.*<[a-z0-9:]*IPHint>\(.*\)</[a-z0-9:]*IPHint>;\1;p' | grep -vE '^$$|^[0-9./a-fA-F:]*$$' | sed 's/.*/[1;31m&[0m/'; \ + #echo ">Checking for invalid geodata (syntax is geo:xx.yy,zz.vv)";\ + #cat $< | sed -n 's;.*<[a-z0-9:]*GeolocationHint>\(.*\)</[a-z0-9:]*GeolocationHint>;\1;p' | grep -vE '^$$|^geo:[0-9][0-9][0-9.]*,[0-9][0-9][0-9.]*$$' | sed 's/.*/[1;31m&[0m/' ; \ + #echo ">Check for IdP:s with Logos over http";\ + #cat $< | grep 'Logo .*http://' | sed 's/.*>\(.*\)<.*/[1;31m\1[0m/' | grep . && exit 1 || exit 0 ; \ + #fi + + +deeptest: test testMDUIreach + +commit: test + @git diff --color || true + @echo ; echo -n "Run 'git commit -av'? [Y/n/skip] " ; read x ; case $$x in "Y"|"y"|"") git commit -av ;; s|skip) ;; *) exit 1 ;; esac + @git status -u + @echo "Checking for not committed files in swamid-*/" ; if git status --porcelain --ignored | awk '{print $$2}' | egrep "^swamid-edugain|^swamid-2.0/|^swamid-testing/" | sed 's/^/ /' | grep . ; then echo "Not committed files in swamid-*/, aborting" ; exit 1 ; fi + +commitold: tidy test + @git diff --color || true + @echo ; echo -n "Run 'git commit -av'? [Y/n/skip] " ; read x ; case $$x in "Y"|"y"|"") git commit -av ;; s|skip) ;; *) exit 1 ;; esac + @git status -u + @echo "Checking for not committed files in swamid-*/" ; if git status --porcelain --ignored | awk '{print $$2}' | egrep "^swamid-edugain|^swamid-2.0/|^swamid-testing/" | sed 's/^/ /' | grep . ; then echo "Not committed files in swamid-*/, aborting" ; exit 1 ; fi + @echo ; echo -n "Run 'git push'? [Y/n] " ; read x ; case $$x in "Y"|"y"|"") ;; *) exit 1 ;; esac + @git push |