Adding feature to enable SP/idP certificates and keys
diff --git a/shibboleth/files/shibboleth2.xml b/shibboleth/files/shibboleth2.xml
index 7f0482b..0ec230e 100644
--- a/shibboleth/files/shibboleth2.xml
+++ b/shibboleth/files/shibboleth2.xml
@@ -71,7 +71,9 @@
<MetadataProvider type="XML" uri="{{ server.idp_metadata_url }}"
backingFilePath="/etc/shibboleth/metadata.xml" reloadInterval="180000">
- <!-- <MetadataFilter type="Signature" certificate="fedsigner.pem"/> -->
+ {%- if server.idp_certificate is defined %}
+ <MetadataFilter type="Signature" certificate="/etc/shibboleth/fedsigner.pem"/>
+ {%- endif %}
</MetadataProvider>
<!-- Example of locally maintained metadata. -->
@@ -88,8 +90,10 @@
<!-- Default filtering policy for recognized attributes, lets other data pass. -->
<AttributeFilter type="XML" validate="true" path="attribute-policy.xml"/>
+ {%- if server.sp_key_cert is defined %}
<!-- Simple file-based resolver for using a single keypair. -->
<CredentialResolver type="File" key="sp-key.pem" certificate="sp-cert.pem"/>
+ {%- endif %}
<!--
The default settings can be overridden by creating ApplicationOverride elements (see
diff --git a/shibboleth/server.sls b/shibboleth/server.sls
index 7a4bf7b..6da6460 100644
--- a/shibboleth/server.sls
+++ b/shibboleth/server.sls
@@ -15,6 +15,38 @@
- service: apache_service
- service: shibboleth_service
+{%- if server.idp_certificate is defined %}
+/etc/shibboleth/fedsigner.pem:
+ file.managed:
+ - contents_pillar: shibboleth:server:idp_certificate
+ - require:
+ - pkg: apache_packages
+ - watch_in:
+ - service: apache_service
+ - service: shibboleth_service
+{%- endif %}
+
+{%- if server.sp_key_cert is defined %}
+/etc/shibboleth/sp-key.pem:
+ file.managed:
+ - contents_pillar: shibboleth:server:sp_key_cert:key
+ - mode: 600
+ - require:
+ - pkg: apache_packages
+ - watch_in:
+ - service: apache_service
+ - service: shibboleth_service
+
+/etc/shibboleth/sp-cert.pem:
+ file.managed:
+ - contents_pillar: shibboleth:server:sp_key_cert:cert
+ - require:
+ - pkg: apache_packages
+ - watch_in:
+ - service: apache_service
+ - service: shibboleth_service
+{%- endif %}
+
/etc/shibboleth/attribute-map.xml:
file.managed:
- source: salt://shibboleth/files/attribute-map.xml