Blame SOURCES/mellon_create_metadata.sh

182345
#!/usr/bin/env bash
182345
set -e
182345
182345
PROG="$(basename "$0")"
182345
182345
printUsage() {
182345
    echo "Usage: $PROG ENTITY-ID ENDPOINT-URL"
182345
    echo ""
182345
    echo "Example:"
182345
    echo "  $PROG urn:someservice https://sp.example.org/mellon"
182345
    echo ""
182345
}
182345
182345
if [ "$#" -lt 2 ]; then
182345
    printUsage
182345
    exit 1
182345
fi
182345
182345
ENTITYID="$1"
182345
if [ -z "$ENTITYID" ]; then
182345
    echo "$PROG: An entity ID is required." >&2
182345
    exit 1
182345
fi
182345
182345
BASEURL="$2"
182345
if [ -z "$BASEURL" ]; then
182345
    echo "$PROG: The URL to the MellonEndpointPath is required." >&2
182345
    exit 1
182345
fi
182345
182345
if ! echo "$BASEURL" | grep -q '^https\?://'; then
182345
    echo "$PROG: The URL must start with \"http://\" or \"https://\"." >&2
182345
    exit 1
182345
fi
182345
182345
HOST="$(echo "$BASEURL" | sed 's#^[a-z]*://\([^/]*\).*#\1#')"
182345
BASEURL="$(echo "$BASEURL" | sed 's#/$##')"
182345
182345
OUTFILE="$(echo "$ENTITYID" | sed 's/[^0-9A-Za-z.]/_/g' | sed 's/__*/_/g')"
182345
echo "Output files:"
182345
echo "Private key:                              $OUTFILE.key"
182345
echo "Certificate:                              $OUTFILE.cert"
182345
echo "Metadata:                                 $OUTFILE.xml"
182345
echo "Host:                                     $HOST"
182345
echo
182345
echo "Endpoints:"
182345
echo "SingleLogoutService (SOAP):               $BASEURL/logout"
182345
echo "SingleLogoutService (HTTP-Redirect):      $BASEURL/logout"
182345
echo "AssertionConsumerService (HTTP-POST):     $BASEURL/postResponse"
182345
echo "AssertionConsumerService (HTTP-Artifact): $BASEURL/artifactResponse"
182345
echo "AssertionConsumerService (PAOS):          $BASEURL/paosResponse"
182345
echo
182345
182345
# No files should not be readable by the rest of the world.
182345
umask 0077
182345
182345
TEMPLATEFILE="$(mktemp -t mellon_create_sp.XXXXXXXXXX)"
182345
182345
cat >"$TEMPLATEFILE" <
182345
RANDFILE           = /dev/urandom
182345
[req]
182345
default_bits       = 2048
182345
default_keyfile    = privkey.pem
182345
distinguished_name = req_distinguished_name
182345
prompt             = no
182345
policy             = policy_anything
182345
[req_distinguished_name]
182345
commonName         = $HOST
182345
EOF
182345
182345
openssl req -utf8 -batch -config "$TEMPLATEFILE" -new -x509 -days 3652 -nodes -out "$OUTFILE.cert" -keyout "$OUTFILE.key" 2>/dev/null
182345
182345
rm -f "$TEMPLATEFILE"
182345
182345
CERT="$(grep -v '^-----' "$OUTFILE.cert")"
182345
182345
cat >"$OUTFILE.xml" <
182345
182345
182345
 entityID="$ENTITYID"
182345
 xmlns="urn:oasis:names:tc:SAML:2.0:metadata">
182345
 
182345
   AuthnRequestsSigned="true"
182345
   WantAssertionsSigned="true"
182345
   protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
182345
   <KeyDescriptor use="signing">
182345
     <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
182345
       <ds:X509Data>
182345
         <ds:X509Certificate>$CERT</ds:X509Certificate>
182345
       </ds:X509Data>
182345
     </ds:KeyInfo>
182345
   </KeyDescriptor>
182345
   <KeyDescriptor use="encryption">
182345
     <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
182345
       <ds:X509Data>
182345
         <ds:X509Certificate>$CERT</ds:X509Certificate>
182345
       </ds:X509Data>
182345
     </ds:KeyInfo>
182345
   </KeyDescriptor>
182345
   
182345
     Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP"
182345
     Location="$BASEURL/logout" />
182345
   
182345
     Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
182345
     Location="$BASEURL/logout" />
182345
   <NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</NameIDFormat>
182345
   
182345
     index="0"
182345
     isDefault="true"
182345
     Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
182345
     Location="$BASEURL/postResponse" />
182345
   
182345
     index="1"
182345
     Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact"
182345
     Location="$BASEURL/artifactResponse" />
182345
   
182345
     index="2"
182345
     Binding="urn:oasis:names:tc:SAML:2.0:bindings:PAOS"
182345
     Location="$BASEURL/paosResponse" />
182345
 </SPSSODescriptor>
182345
</EntityDescriptor>
182345
EOF
182345
182345
umask 0777
182345
chmod go+r "$OUTFILE.xml"
182345
chmod go+r "$OUTFILE.cert"