159 changed files with 6944 additions and 0 deletions
@ -0,0 +1,21 @@ |
|||||
|
The MIT License (MIT) |
||||
|
|
||||
|
Copyright (c) 2016 Nicolas MASSE |
||||
|
|
||||
|
Permission is hereby granted, free of charge, to any person obtaining a copy |
||||
|
of this software and associated documentation files (the "Software"), to deal |
||||
|
in the Software without restriction, including without limitation the rights |
||||
|
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell |
||||
|
copies of the Software, and to permit persons to whom the Software is |
||||
|
furnished to do so, subject to the following conditions: |
||||
|
|
||||
|
The above copyright notice and this permission notice shall be included in all |
||||
|
copies or substantial portions of the Software. |
||||
|
|
||||
|
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR |
||||
|
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, |
||||
|
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE |
||||
|
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER |
||||
|
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, |
||||
|
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE |
||||
|
SOFTWARE. |
||||
@ -0,0 +1,12 @@ |
|||||
|
# OneAccess-Ansible-Playbook |
||||
|
This project is the Ansible Playbook to install CA OneAccess |
||||
|
|
||||
|
## Preparation work |
||||
|
|
||||
|
1. Edit group_vars/sm and change all passwords and DNS names (search for "changeme") |
||||
|
2. Edit hosts-sm to target your Virtual Machine |
||||
|
|
||||
|
## Installation |
||||
|
|
||||
|
1. run {{./aw bootstrap your.vm.hostname}} |
||||
|
2. run {{./aw sm}} |
||||
@ -0,0 +1,4 @@ |
|||||
|
[defaults] |
||||
|
log_path = ./logs/ansible.log |
||||
|
filter_plugins = ./local_plugins/filter_plugins |
||||
|
# ask_sudo_pass = yes |
||||
@ -0,0 +1,54 @@ |
|||||
|
#!/bin/bash |
||||
|
|
||||
|
# Set environment variables |
||||
|
export ANSIBLE_CONFIG="./ansible.cfg" |
||||
|
|
||||
|
options="" |
||||
|
target="$1" |
||||
|
ssh_key="$HOME/.ssh/id_rsa" |
||||
|
user="root" |
||||
|
|
||||
|
if [ -z "$target" ]; then |
||||
|
echo "No target specified. Please specify an inventory or 'bootstrap' !" |
||||
|
exit 1 |
||||
|
fi |
||||
|
|
||||
|
if [ "$target" == "bootstrap" -o "$target" == "bootstrap-minimal" ]; then |
||||
|
if [ -z "$2" ]; then |
||||
|
echo "Please specify the target host !" |
||||
|
exit 1 |
||||
|
fi |
||||
|
host="$2" |
||||
|
echo "Starting $target..." |
||||
|
echo |
||||
|
echo -n "Please enter the initial $user password: " |
||||
|
read -s password |
||||
|
echo |
||||
|
echo |
||||
|
echo "Connecting to $host to register the SSH Host Key !" |
||||
|
sshpass -p "$password" ssh -i $ssh_key -o StrictHostKeyChecking=no "$user@$host" /bin/true |
||||
|
auth="" |
||||
|
if [ -n "$password" ]; then |
||||
|
auth="ansible_ssh_pass=$password" |
||||
|
else |
||||
|
auth="ansible_ssh_private_key_file=$ssh_key" |
||||
|
fi |
||||
|
echo -e "[$target]\n$2 ansible_ssh_user=$user $auth\n" > "./hosts-$target" |
||||
|
else |
||||
|
shift |
||||
|
options="$@" |
||||
|
fi |
||||
|
|
||||
|
if [ ! -f "./hosts-$target" ]; then |
||||
|
echo "Invalid target '$target' !" |
||||
|
exit 1 |
||||
|
fi |
||||
|
|
||||
|
# Export our base directory so that any script launched localy can refer to it |
||||
|
BASEDIR="$(dirname $0)" |
||||
|
BASEDIR="$(python -c 'import os.path; import sys; print os.path.abspath(sys.argv[1])' "$BASEDIR")" |
||||
|
export BASEDIR |
||||
|
|
||||
|
ansible-playbook -i "./hosts-$target" $options site.yml |
||||
|
|
||||
|
rm -f hosts-bootstrap hosts-bootstrap-minimal # temporary file |
||||
@ -0,0 +1,7 @@ |
|||||
|
--- |
||||
|
timezone: Europe/Paris |
||||
|
ansible_python_interpreter: /usr/bin/python2 |
||||
|
ansible_ssh_user: oneaccess |
||||
|
ansible_ssh_private_key_file: "{{ lookup('env','HOME') }}/.ssh/id_rsa" |
||||
|
ansible_ssh_public_key: "{{ lookup('file', ansible_ssh_private_key_file + '.pub' ) }}" |
||||
|
sources_dir: /opt/sources |
||||
@ -0,0 +1,89 @@ |
|||||
|
--- |
||||
|
# Console Accounts : root and oneaccess (password = M0g0L1ch) |
||||
|
|
||||
|
# JDK |
||||
|
java_home: /opt/jdk7 |
||||
|
java_release: 79 |
||||
|
|
||||
|
# CA SiteMinder |
||||
|
sm_user: smuser |
||||
|
sm_home: /home/smuser/CA |
||||
|
sm_admin_user: siteminder |
||||
|
sm_admin_password: changeme |
||||
|
sm_policy_store_port: 40389 |
||||
|
sm_encryption_key: changeme |
||||
|
apache_home: /home/www/httpd |
||||
|
wa_user: www |
||||
|
wa_home: /home/www/CA |
||||
|
wa_public_hostname: idp.apim.ca |
||||
|
sm_wamui_hostname: wamui.apim.ca |
||||
|
sm_session_store_port: 41389 |
||||
|
|
||||
|
# CA Directory |
||||
|
dx_home: /home/dsa/CA/Directory |
||||
|
dx_user: dsa |
||||
|
dx_group: etrdir |
||||
|
dx_acme_dsa_port: 1389 |
||||
|
|
||||
|
# Temp dir (used by Arcot products) |
||||
|
temp_dir: /root/tmp |
||||
|
|
||||
|
# Tomcat |
||||
|
tomcat_home: /home/www/tomcat |
||||
|
tomcat_user: www |
||||
|
tomcat_group: www |
||||
|
tomcat_port_prefix: 3 |
||||
|
tomcat_version: 7.0.64 |
||||
|
|
||||
|
# Apache |
||||
|
httpd_home: /home/www/httpd |
||||
|
httpd_user: www |
||||
|
httpd_group: www |
||||
|
httpd_https_port: 30443 |
||||
|
httpd_http_port: 30080 |
||||
|
httpd_certificate_cn: "*.apim.ca" |
||||
|
httpd_certificate_password: changeme |
||||
|
|
||||
|
# MySQL |
||||
|
mysql_root_password: changeme |
||||
|
mysql_version: 5.6.27 |
||||
|
|
||||
|
# SSG |
||||
|
ssg_user: layer7 |
||||
|
ssg_runtime_user: gateway |
||||
|
ssg_group: gateway |
||||
|
ssg_admin_user: admin |
||||
|
ssg_admin_password: changeme |
||||
|
ssg_db_user: gateway |
||||
|
ssg_db_password: changeme |
||||
|
ssg_db_name: ssg |
||||
|
ssg_hostname: mag.apim.ca |
||||
|
ssg_public_port: 58443 |
||||
|
ssg_passphrase: changeme |
||||
|
ssg_admin_port: 59443 |
||||
|
ssg_service_port: 58443 |
||||
|
ssg_mag_port: 50443 |
||||
|
ssg_ssl_certificate_cn: mag.apim.ca |
||||
|
ssg_ssl_certificate_password: changeme |
||||
|
ssg_otk_db_name: otk_db |
||||
|
ssg_otk_db_user: otk_user |
||||
|
ssg_otk_db_password: changeme |
||||
|
ssg_mag_public_port: 587 |
||||
|
|
||||
|
# One Access |
||||
|
oneaccess_db_name: oneaccess |
||||
|
oneaccess_db_username: oneaccess |
||||
|
oneaccess_db_password: changeme |
||||
|
oneaccess_static_hostname: static.apim.ca |
||||
|
oneaccess_intranet_hostname: intranet.apim.ca |
||||
|
oneaccess_public_hostname: oneaccess.apim.ca |
||||
|
salesforce_certificate_cn: Salesforce SP Signing Cert |
||||
|
salesforce_certificate_password: changeme |
||||
|
siteminder_certificate_cn: SiteMinder SAML Signing Cert |
||||
|
siteminder_certificate_password: changeme |
||||
|
layer7_saml_certificate_cn: Layer7 SAML Signing Cert |
||||
|
layer7_saml_certificate_password: changeme |
||||
|
|
||||
|
# PKI |
||||
|
pki_truststore_password: changeme |
||||
|
httpd_pki_hostname: pki.apim.ca |
||||
@ -0,0 +1,2 @@ |
|||||
|
[sm] |
||||
|
changeme.apim.ca |
||||
@ -0,0 +1,2 @@ |
|||||
|
*.pyc |
||||
|
|
||||
@ -0,0 +1,18 @@ |
|||||
|
# (c) 2014, Nicolas MASSE |
||||
|
# |
||||
|
|
||||
|
import re |
||||
|
from ansible import errors |
||||
|
|
||||
|
def regex_replace(s, find, replace): |
||||
|
return re.sub(find, replace, s) |
||||
|
|
||||
|
class FilterModule(object): |
||||
|
''' Custom Filters ''' |
||||
|
|
||||
|
def filters(self): |
||||
|
return { |
||||
|
# regex |
||||
|
'regex_replace': regex_replace, |
||||
|
} |
||||
|
|
||||
@ -0,0 +1 @@ |
|||||
|
*.log |
||||
@ -0,0 +1 @@ |
|||||
|
*.jks |
||||
@ -0,0 +1,7 @@ |
|||||
|
index.txt* |
||||
|
crlnumber* |
||||
|
newcerts |
||||
|
serial* |
||||
|
*.crl |
||||
|
*.crt |
||||
|
*.key |
||||
@ -0,0 +1,56 @@ |
|||||
|
HOME = . |
||||
|
RANDFILE = $ENV::HOME/.rnd |
||||
|
|
||||
|
[ ca ] |
||||
|
default_ca = RootCA |
||||
|
|
||||
|
[ RootCA ] |
||||
|
x509_extensions = ca_ext |
||||
|
policy = policy_anything |
||||
|
dir = ./ca # Where everything is kept |
||||
|
certs = $dir/certs # Where the issued certs are kept |
||||
|
crl_dir = $dir/crl # Where the issued crl are kept |
||||
|
crlnumber = $dir/crlnumber # The current CRL serial number |
||||
|
database = $dir/index.txt # database index file. |
||||
|
new_certs_dir = $dir/newcerts # default place for new certs. |
||||
|
|
||||
|
certificate = $dir/root_ca.crt # The CA certificate |
||||
|
serial = $dir/serial # The current serial number |
||||
|
crl = $dir/crl.pem # The current CRL |
||||
|
private_key = $dir/root_ca.key # The private key |
||||
|
default_md = sha256 |
||||
|
|
||||
|
|
||||
|
[ policy_anything ] |
||||
|
countryName = optional |
||||
|
stateOrProvinceName = optional |
||||
|
localityName = optional |
||||
|
organizationName = optional |
||||
|
organizationalUnitName = optional |
||||
|
commonName = supplied |
||||
|
emailAddress = optional |
||||
|
|
||||
|
[ ca_ext ] |
||||
|
subjectKeyIdentifier=hash |
||||
|
authorityKeyIdentifier=keyid:always |
||||
|
basicConstraints = critical,CA:true |
||||
|
keyUsage = cRLSign, keyCertSign |
||||
|
|
||||
|
[ server_ext ] |
||||
|
subjectKeyIdentifier=hash |
||||
|
authorityKeyIdentifier=keyid:always |
||||
|
basicConstraints = critical,CA:false |
||||
|
keyUsage = critical, digitalSignature, keyEncipherment |
||||
|
extendedKeyUsage = serverAuth,clientAuth |
||||
|
crlDistributionPoints=URI:http://pki.sp0t.xyz/oneaccess_ca.crl |
||||
|
|
||||
|
[ req ] |
||||
|
x509_extensions = ca_ext |
||||
|
distinguished_name = req_distinguished_name |
||||
|
prompt = no |
||||
|
|
||||
|
[ req_distinguished_name ] |
||||
|
C = FR |
||||
|
O = CA Technologies |
||||
|
OU = Pre Sales |
||||
|
CN = OneAccess CA |
||||
@ -0,0 +1,12 @@ |
|||||
|
#!/bin/bash |
||||
|
|
||||
|
set -e # Exit immediately if a command exits with a non-zero status. |
||||
|
|
||||
|
MYDIR="$(dirname $0)" |
||||
|
cd "$MYDIR" |
||||
|
|
||||
|
rm -rf ca/newcerts/* |
||||
|
echo "01" > ca/serial |
||||
|
echo "01" > ca/crlnumber |
||||
|
echo -n > ca/index.txt |
||||
|
rm -f ca/root_ca.crt ca/root_ca.crl ca/root_ca.key truststore.jks |
||||
@ -0,0 +1,22 @@ |
|||||
|
#!/bin/bash |
||||
|
|
||||
|
SERVER_KEYSIZE="2048" |
||||
|
SERVER_VALIDITY="740" |
||||
|
|
||||
|
set -e # Exit immediately if a command exits with a non-zero status. |
||||
|
|
||||
|
MYDIR="$(dirname $0)" |
||||
|
cd "$MYDIR" |
||||
|
|
||||
|
# Parameter validation |
||||
|
test -n "$BASENAME" |
||||
|
test -n "$CERT_CN" |
||||
|
test -n "$OUTDIR" |
||||
|
test -n "$PASSWORD" |
||||
|
|
||||
|
openssl req -new -newkey "rsa:$SERVER_KEYSIZE" -keyout "$OUTDIR/$BASENAME.key" -nodes -out "$OUTDIR/$BASENAME.csr" -subj "/CN=$CERT_CN" |
||||
|
openssl ca -batch -in "$OUTDIR/$BASENAME.csr" -out "$OUTDIR/$BASENAME.crt" -notext -days "$SERVER_VALIDITY" -config ca/openssl.cnf -name "RootCA" -extensions server_ext |
||||
|
cat "$OUTDIR/$BASENAME.key" "$OUTDIR/$BASENAME.crt" | openssl pkcs12 -export -out "$OUTDIR/$BASENAME.p12" -passout "pass:$PASSWORD" |
||||
|
keytool -importkeystore -noprompt -srcalias 1 -srcstorepass "$PASSWORD" -srcstoretype PKCS12 -srckeystore "$OUTDIR/$BASENAME.p12" -destalias "$BASENAME" -deststoretype JKS -deststorepass "$PASSWORD" -destkeystore "$OUTDIR/$BASENAME.jks" |
||||
|
cp truststore.jks "$OUTDIR/$BASENAME-trust.jks" |
||||
|
cp ca/root_ca.crt "$OUTDIR/$BASENAME-ca.crt" |
||||
@ -0,0 +1,17 @@ |
|||||
|
#!/bin/bash |
||||
|
|
||||
|
set -e # Exit immediately if a command exits with a non-zero status. |
||||
|
|
||||
|
ROOTCA_KEYSIZE="2048" |
||||
|
ROOTCA_VALIDITY="7400" |
||||
|
ROOTCA_CRLVALIDITY="740" |
||||
|
|
||||
|
MYDIR="$(dirname $0)" |
||||
|
cd "$MYDIR" |
||||
|
|
||||
|
rm -rf ca/newcerts/* |
||||
|
echo "01" > ca/serial |
||||
|
echo "01" > ca/crlnumber |
||||
|
echo -n > ca/index.txt |
||||
|
openssl req -new -sha256 -newkey "rsa:$ROOTCA_KEYSIZE" -keyout "ca/root_ca.key" -nodes -out "ca/root_ca.crt" -x509 -days "$ROOTCA_VALIDITY" -set_serial 0 -config ca/openssl.cnf |
||||
|
openssl ca -batch -md sha256 -gencrl -crldays "$ROOTCA_CRLVALIDITY" -out "ca/root_ca.crl" -config ca/openssl.cnf |
||||
@ -0,0 +1,38 @@ |
|||||
|
#!/bin/bash |
||||
|
|
||||
|
SERVER_KEYSIZE="2048" |
||||
|
SERVER_VALIDITY="740" |
||||
|
|
||||
|
set -e # Exit immediately if a command exits with a non-zero status. |
||||
|
|
||||
|
MYDIR="$(dirname $0)" |
||||
|
cd "$MYDIR" |
||||
|
|
||||
|
# Parameter validation |
||||
|
test -n "$BASENAME" |
||||
|
test -n "$CERT_CN" |
||||
|
test -n "$OUTDIR" |
||||
|
test -n "$PASSWORD" |
||||
|
|
||||
|
openssl req -new -newkey "rsa:$SERVER_KEYSIZE" -keyout "$OUTDIR/$BASENAME.key" -nodes -sha256 -out "$OUTDIR/$BASENAME.crt" -subj "/CN=$CERT_CN" -x509 -set_serial 1 -days 3650 -extensions v3_req -config <(cat <<EOF |
||||
|
req_extensions = v3_req # The extensions to add to a certificate request |
||||
|
distinguished_name = req_distinguished_name |
||||
|
|
||||
|
[ v3_req ] |
||||
|
subjectKeyIdentifier=hash |
||||
|
authorityKeyIdentifier=keyid:always |
||||
|
basicConstraints = critical,CA:false |
||||
|
keyUsage = critical, digitalSignature, keyEncipherment |
||||
|
|
||||
|
[ req_distinguished_name ] |
||||
|
CN = supplied |
||||
|
|
||||
|
EOF) && openssl x509 -noout -text -in "$OUTDIR/$BASENAME.crt" |
||||
|
|
||||
|
|
||||
|
cat "$OUTDIR/$BASENAME.key" "$OUTDIR/$BASENAME.crt" | openssl pkcs12 -export -out "$OUTDIR/$BASENAME.p12" -passout "pass:$PASSWORD" |
||||
|
|
||||
|
keytool -importcert -noprompt -trustcacerts -storepass "$PASSWORD" -storetype JKS -keystore "$OUTDIR/$BASENAME-trust.jks" -file "$OUTDIR/$BASENAME.crt" -alias "$BASENAME" |
||||
|
keytool -list -storetype JKS -storepass "$PASSWORD" -keystore "$OUTDIR/$BASENAME-trust.jks" -rfc |
||||
|
keytool -importkeystore -noprompt -srcalias 1 -srcstorepass "$PASSWORD" -srcstoretype PKCS12 -srckeystore "$OUTDIR/$BASENAME.p12" -destalias "$BASENAME" -deststoretype JKS -deststorepass "$PASSWORD" -destkeystore "$OUTDIR/$BASENAME.jks" |
||||
|
keytool -list -storetype JKS -storepass "$OUTDIR/$PASSWORD" -keystore "$OUTDIR/$BASENAME.jks" -rfc |
||||
@ -0,0 +1,3 @@ |
|||||
|
*.tar.gz |
||||
|
*.zip |
||||
|
server* |
||||
@ -0,0 +1,141 @@ |
|||||
|
--- |
||||
|
|
||||
|
- name: This module only works on CentOS 6 |
||||
|
assert: |
||||
|
that: |
||||
|
- "ansible_os_family == 'RedHat'" |
||||
|
|
||||
|
- name: Create the 'httpd' user |
||||
|
user: name={{ httpd_user }} comment="WWW User" |
||||
|
tags: user |
||||
|
|
||||
|
- name: Set SSH key for the 'httpd' user |
||||
|
authorized_key: user={{ httpd_user }} key="{{ ansible_ssh_public_key }}" manage_dir=yes |
||||
|
tags: user |
||||
|
|
||||
|
- name: Install GCC |
||||
|
yum: name=gcc state=installed |
||||
|
tags: compile |
||||
|
|
||||
|
- name: Install Lynx (used by the apache startup script) |
||||
|
yum: name=lynx state=installed |
||||
|
|
||||
|
- name: Install the 64 bits version of glibc-devel |
||||
|
yum: name=glibc-devel.x86_64 state=latest |
||||
|
tags: compile |
||||
|
|
||||
|
- name: Install the 32 bits version of glibc-devel |
||||
|
yum: name=glibc-devel.i686 state=latest |
||||
|
tags: compile |
||||
|
|
||||
|
- name: Try to update the 64 bits version of openssl |
||||
|
yum: name=openssl.x86_64 state=latest |
||||
|
when: "ansible_architecture == 'x86_64'" |
||||
|
tags: compile |
||||
|
|
||||
|
- name: Install the 32 bits version of openssl |
||||
|
yum: name=openssl.i686 state=installed |
||||
|
tags: compile |
||||
|
|
||||
|
- name: Install the 32 bits version of openssl-devel |
||||
|
yum: name=openssl-devel.i686 state=installed |
||||
|
tags: compile |
||||
|
|
||||
|
- name: Create the home dir for Apache |
||||
|
file: path={{ httpd_home }} state=directory |
||||
|
sudo_user: "{{ httpd_user }}" |
||||
|
|
||||
|
- name: Create the sources dir for Apache |
||||
|
file: path={{ httpd_home }}/src state=directory |
||||
|
sudo_user: "{{ httpd_user }}" |
||||
|
|
||||
|
- name: Unarchive the apache distribution |
||||
|
unarchive: creates={{ httpd_home }}/src/httpd-2.2.29 src=httpd-2.2.29.tar.gz dest={{ httpd_home }}/src |
||||
|
sudo_user: "{{ httpd_user }}" |
||||
|
|
||||
|
- name: ./configure Apache |
||||
|
shell: chdir={{ httpd_home }}/src/httpd-2.2.29 LIBS=-lpthread ./configure CFLAGS="-m32" --enable-modules="proxy proxy-http proxy-connect headers rewrite ssl" --prefix={{ httpd_home }} |
||||
|
sudo_user: "{{ httpd_user }}" |
||||
|
tags: compile |
||||
|
|
||||
|
- name: make && make install Apache |
||||
|
shell: chdir={{ httpd_home }}/src/httpd-2.2.29 LIBS=-lpthread make clean && make && make install |
||||
|
sudo_user: "{{ httpd_user }}" |
||||
|
tags: compile |
||||
|
|
||||
|
- name: Disable the Apache default port |
||||
|
lineinfile: dest={{ httpd_home }}/conf/httpd.conf regexp="^Listen " state=absent |
||||
|
sudo_user: "{{ httpd_user }}" |
||||
|
|
||||
|
- name: Install the headers CGI |
||||
|
template: src=headers dest={{ httpd_home }}/cgi-bin/headers mode=0755 |
||||
|
sudo_user: "{{ httpd_user }}" |
||||
|
tags: www-content |
||||
|
|
||||
|
- name: Install the helloworld CGI |
||||
|
template: src=helloworld dest={{ httpd_home }}/cgi-bin/helloworld mode=0755 |
||||
|
sudo_user: "{{ httpd_user }}" |
||||
|
tags: www-content |
||||
|
|
||||
|
- name: Install perl-CGI |
||||
|
yum: name=perl-CGI state=installed |
||||
|
|
||||
|
- name: Install perl-libwww-perl |
||||
|
yum: name=perl-libwww-perl state=installed |
||||
|
|
||||
|
- name: Install the custom.conf |
||||
|
template: src=custom.conf dest={{ httpd_home }}/conf/custom.conf mode=644 |
||||
|
sudo_user: "{{ httpd_user }}" |
||||
|
tags: |
||||
|
- config |
||||
|
- new |
||||
|
|
||||
|
- name: Source the custom.conf |
||||
|
lineinfile: dest={{ httpd_home }}/conf/httpd.conf line="Include {{ httpd_home }}/conf/custom.conf" insertafter="EOF" state=present |
||||
|
sudo_user: "{{ httpd_user }}" |
||||
|
|
||||
|
- name: Create the static file structure |
||||
|
file: path={{ httpd_home }}/htdocs/{{ item }} state=directory |
||||
|
with_items: [ "static", "default", "intranet", "pki" ] |
||||
|
sudo_user: "{{ httpd_user }}" |
||||
|
tags: www-content |
||||
|
|
||||
|
- name: Install the go-away web page |
||||
|
template: src=go-away.html dest={{ httpd_home }}/htdocs/default/index.html |
||||
|
sudo_user: "{{ httpd_user }}" |
||||
|
tags: www-content |
||||
|
|
||||
|
- name: Run the Certificate Generation script (if requested) |
||||
|
local_action: command creates={{ lookup('ENV', 'BASEDIR') }}/roles/apache-2.2/files/server.crt {{ lookup('ENV', 'BASEDIR') }}/pki/gen_certs.sh |
||||
|
sudo: false |
||||
|
tags: certificate |
||||
|
environment: |
||||
|
CERT_CN: "{{ httpd_certificate_cn }}" |
||||
|
PASSWORD: "{{ httpd_certificate_password }}" |
||||
|
BASENAME: "server" |
||||
|
OUTDIR: "{{ lookup('ENV', 'BASEDIR') }}/roles/apache-2.2/files/" |
||||
|
tags: certificate |
||||
|
when: httpd_certificate_cn is defined |
||||
|
|
||||
|
- name: Install the new certificate and private key |
||||
|
copy: src={{ item }} dest={{ httpd_home }}/conf/{{ item }} |
||||
|
sudo_user: "{{ httpd_user }}" |
||||
|
with_items: [ "server.key", "server.crt", "server-ca.crt" ] |
||||
|
tags: certificate |
||||
|
|
||||
|
- name: Copy the PKI stuffs - CRL |
||||
|
copy: src={{ lookup('ENV', 'BASEDIR') }}/pki/ca/root_ca.crl dest={{ httpd_home }}/htdocs/pki/oneaccess_ca.crl |
||||
|
sudo_user: "{{ httpd_user }}" |
||||
|
tags: www-content |
||||
|
|
||||
|
- name: Copy the PKI stuffs - RootCA |
||||
|
copy: src={{ lookup('ENV', 'BASEDIR') }}/pki/ca/root_ca.crt dest={{ httpd_home }}/htdocs/pki/oneaccess_ca.crt |
||||
|
sudo_user: "{{ httpd_user }}" |
||||
|
tags: www-content |
||||
|
|
||||
|
- name: Copy the favicon.ico |
||||
|
copy: src=favicon.ico dest={{ httpd_home }}/htdocs/static/favicon.ico |
||||
|
sudo_user: "{{ httpd_user }}" |
||||
|
tags: |
||||
|
- www-content |
||||
|
|
||||
@ -0,0 +1,144 @@ |
|||||
|
Listen {{ httpd_http_port }} |
||||
|
Listen {{ httpd_https_port }} |
||||
|
|
||||
|
NameVirtualHost *:{{ httpd_http_port }} |
||||
|
NameVirtualHost *:{{ httpd_https_port }} |
||||
|
|
||||
|
ServerAdmin none.of@your.business |
||||
|
ServerTokens prod |
||||
|
ServerSignature Off |
||||
|
|
||||
|
SSLPassPhraseDialog builtin |
||||
|
SSLSessionCache "shmcb:{{ httpd_home }}/logs/ssl_scache(512000)" |
||||
|
SSLSessionCacheTimeout 300 |
||||
|
SSLMutex "file:{{ httpd_home }}/logs/ssl_mutex" |
||||
|
SSLProtocol all -SSLv2 -SSLv3 |
||||
|
SSLCipherSuite ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA |
||||
|
SSLHonorCipherOrder on |
||||
|
SSLCertificateFile "{{ httpd_home }}/conf/server.crt" |
||||
|
SSLCertificateKeyFile "{{ httpd_home }}/conf/server.key" |
||||
|
SSLCertificateChainFile "{{ httpd_home }}/conf/server-ca.crt" |
||||
|
|
||||
|
CustomLog "{{ httpd_home }}/logs/ssl_request_log" "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b" |
||||
|
CustomLog "/home/www/httpd/logs/access_full_log" "%t %v %h %u \"%r\" %>s %b (origin=%{HTTP_SM_ORIGIN}e)" |
||||
|
|
||||
|
# The favicon is available on all Virtual Hosts |
||||
|
Alias /favicon.ico {{ httpd_home }}/htdocs/static/favicon.ico |
||||
|
|
||||
|
# The default virtual hosts have to be declared first when using Named VirtualHosts |
||||
|
<VirtualHost *:{{ httpd_https_port }}> |
||||
|
ServerName dummyhost.dummydomain |
||||
|
DocumentRoot {{ httpd_home }}/htdocs/default/ |
||||
|
SSLEngine on |
||||
|
</VirtualHost> |
||||
|
|
||||
|
<VirtualHost *:{{ httpd_http_port }}> |
||||
|
ServerName dummyhost.dummydomain |
||||
|
DocumentRoot {{ httpd_home }}/htdocs/default/ |
||||
|
</VirtualHost> |
||||
|
|
||||
|
|
||||
|
# Reverse Proxy the WAM UI |
||||
|
<VirtualHost *:{{ httpd_https_port }}> |
||||
|
ServerName {{ sm_wamui_hostname }} |
||||
|
SSLEngine on |
||||
|
|
||||
|
# Proxy all requests under / to the WAMUI |
||||
|
ProxyPreserveHost On |
||||
|
ProxyRequests off |
||||
|
SSLProxyEngine on |
||||
|
SSLProxyVerify none |
||||
|
ProxyPass / https://localhost:48443/ |
||||
|
ProxyPassReverse / https://localhost:48443/ |
||||
|
|
||||
|
# Redirect the root url to the WAMUI Login Page |
||||
|
RewriteEngine On |
||||
|
RewriteRule ^/$ /iam/siteminder/adminui/ [R=301] |
||||
|
</VirtualHost> |
||||
|
|
||||
|
# Reverse Proxy the Layer7 Web Pages |
||||
|
<VirtualHost *:{{ httpd_https_port }}> |
||||
|
ServerName {{ ssg_hostname }} |
||||
|
SSLEngine on |
||||
|
|
||||
|
# Proxy all requests under / to Layer7 |
||||
|
ProxyPreserveHost On |
||||
|
ProxyRequests off |
||||
|
SSLProxyEngine on |
||||
|
SSLProxyVerify none |
||||
|
ProxyPass / https://localhost:{{ ssg_service_port }}/ |
||||
|
</VirtualHost> |
||||
|
|
||||
|
# Reverse Proxy the SiteMinder Federation |
||||
|
<VirtualHost *:{{ httpd_https_port }}> |
||||
|
ServerName {{ wa_public_hostname }} |
||||
|
SSLEngine on |
||||
|
|
||||
|
# Proxy all requests under /affwebservices to Tomcat |
||||
|
ProxyPreserveHost On |
||||
|
ProxyRequests off |
||||
|
ProxyPass /affwebservices http://localhost:{{ tomcat_port_prefix }}8080/affwebservices |
||||
|
ProxyPassReverse /affwebservices http://localhost:{{ tomcat_port_prefix }}8080/affwebservices |
||||
|
</VirtualHost> |
||||
|
|
||||
|
# Reverse Proxy OneAccess personalization engine |
||||
|
<VirtualHost *:{{ httpd_https_port }}> |
||||
|
ServerName {{ oneaccess_public_hostname }} |
||||
|
SSLEngine on |
||||
|
|
||||
|
# Proxy all requests under /oneaccess to Tomcat |
||||
|
ProxyPreserveHost On |
||||
|
ProxyRequests off |
||||
|
ProxyPass /oneaccess/ http://localhost:{{ tomcat_port_prefix }}8080/oneaccess/ |
||||
|
ProxyPassReverse /oneaccess/ http://localhost:{{ tomcat_port_prefix }}8080/oneaccess/ |
||||
|
|
||||
|
# Handle Redirections / Proxy |
||||
|
SSLProxyEngine on |
||||
|
SSLProxyVerify none |
||||
|
RewriteEngine on |
||||
|
|
||||
|
# Proxy the /userinfo requests to Layer7 |
||||
|
RewriteRule ^/userinfo$ https://{{ ssg_hostname }}:{{ ssg_service_port }}/oneaccessweb/userinfo [P] |
||||
|
|
||||
|
# If the sm_origin header is not present, loopback the request so that we can have it |
||||
|
RewriteCond %{HTTP:OneAccess-Origin} ^$ |
||||
|
RewriteRule ^/oneaccess/personalization/(env=.*)?$ https://{{ oneaccess_public_hostname }}:{{ httpd_https_port }}/oneaccess/personalization/ [P] |
||||
|
|
||||
|
# Once we have the sm_origin header, proxy the request to the correct location |
||||
|
RewriteCond %{HTTP:OneAccess-Origin} ^external$ |
||||
|
RewriteRule ^/oneaccess/personalization/$ https://{{ oneaccess_public_hostname }}:{{ httpd_https_port }}/oneaccess/personalization/env=ex [P] |
||||
|
RewriteCond %{HTTP:OneAccess-Origin} ^internal$ |
||||
|
RewriteRule ^/oneaccess/personalization/$ https://{{ oneaccess_public_hostname }}:{{ httpd_https_port }}/oneaccess/personalization/env=in [P] |
||||
|
|
||||
|
# Redirect the root url to the Personalization WebApp |
||||
|
RewriteRule ^/$ /oneaccess/personalization/ [R=301] |
||||
|
</VirtualHost> |
||||
|
|
||||
|
# Static files |
||||
|
<VirtualHost *:{{ httpd_https_port }} *:{{ httpd_http_port }}> |
||||
|
ServerName {{ oneaccess_static_hostname }} |
||||
|
DocumentRoot {{ httpd_home }}/htdocs/static/ |
||||
|
|
||||
|
# The static files can be accessed from any location |
||||
|
Header set Access-Control-Allow-Origin "*" |
||||
|
</VirtualHost> |
||||
|
|
||||
|
# Intranet |
||||
|
<VirtualHost *:{{ httpd_https_port }}> |
||||
|
ServerName {{ oneaccess_intranet_hostname }} |
||||
|
DocumentRoot {{ httpd_home }}/htdocs/intranet/ |
||||
|
|
||||
|
# Redirect every url to the Hello World CGI |
||||
|
RewriteEngine On |
||||
|
RewriteRule ^/$ https://{{ oneaccess_intranet_hostname }}/cgi-bin/helloworld [R=301,L] |
||||
|
</VirtualHost> |
||||
|
|
||||
|
# PKI stuff |
||||
|
<VirtualHost *:{{ httpd_https_port }} *:{{ httpd_http_port }}> |
||||
|
ServerName {{ httpd_pki_hostname }} |
||||
|
DocumentRoot {{ httpd_home }}/htdocs/pki/ |
||||
|
|
||||
|
AddType application/x-x509-ca-cert .crt |
||||
|
AddType application/x-pkcs7-crl .crl |
||||
|
AddType application/x-apple-aspen-config .mobileconfig |
||||
|
</VirtualHost> |
||||
@ -0,0 +1,9 @@ |
|||||
|
<!DOCTYPE html> |
||||
|
<html> |
||||
|
<head> |
||||
|
<title>Go Away !</title> |
||||
|
</head> |
||||
|
<body> |
||||
|
<h1>Go Away !</h1> |
||||
|
</body> |
||||
|
</html> |
||||
@ -0,0 +1,14 @@ |
|||||
|
#!/usr/bin/perl -- |
||||
|
use strict; |
||||
|
use warnings; |
||||
|
use CGI; |
||||
|
|
||||
|
my $q = CGI->new; |
||||
|
my %headers = map { $_ => $q->http($_) } $q->http(); |
||||
|
|
||||
|
print $q->header('text/html'); |
||||
|
print "<html><body><pre>\n"; |
||||
|
for my $header ( sort keys %headers ) { |
||||
|
print "$header: $headers{$header}\n"; |
||||
|
} |
||||
|
print "</pre></body></html>\n"; |
||||
@ -0,0 +1,12 @@ |
|||||
|
#!/usr/bin/perl -- |
||||
|
use strict; |
||||
|
use warnings; |
||||
|
use CGI; |
||||
|
|
||||
|
my $q = CGI->new; |
||||
|
my %headers = map { $_ => $q->http($_) } $q->http(); |
||||
|
|
||||
|
print $q->header('text/html; charset=UTF-8'); |
||||
|
print "<html><head><title>SiteMinder Hello World</title></head><body><h1>\n"; |
||||
|
print "Welcome " . ($headers{'HTTP_SM_USER_COMMON_NAME'} || "unknown user") . " !"; |
||||
|
print "</h1></body></html>\n"; |
||||
@ -0,0 +1,27 @@ |
|||||
|
--- |
||||
|
|
||||
|
- name: Export the MySQL databases |
||||
|
mysql_db: state=dump name="{{ item }}" target="/tmp/{{ item }}.sql.bz2" login_password="{{ mysql_root_password }}" login_user=root |
||||
|
with_items: [ "{{ ssg_db_name }}", "{{ ssg_otk_db_name }}", "{{ oneaccess_db_name }}" ] |
||||
|
tags: backup |
||||
|
|
||||
|
- name: Dump all DSA |
||||
|
command: /bin/sh -l -c 'dxserver stop {{ item }} && dxdumpdb -f /tmp/{{ item }}.ldif {{ item }}; rc="$?"; dxserver start {{ item }}; exit "$rc"' |
||||
|
sudo_user: "{{ dx_user }}" |
||||
|
with_items: [ "ACMEUsers", "SiteMinderPS", "SiteMinderSS" ] |
||||
|
tags: backup |
||||
|
|
||||
|
- name: Compress ldif files |
||||
|
command: bzip2 -f /tmp/{{ item }}.ldif |
||||
|
with_items: [ "ACMEUsers", "SiteMinderPS", "SiteMinderSS" ] |
||||
|
tags: backup |
||||
|
|
||||
|
- name: Retrieve backups |
||||
|
fetch: src=/tmp/{{ item }} flat=yes dest={{ lookup('env', 'BASEDIR') + "/backup/" + ansible_date_time.date }}/ fail_on_missing=yes |
||||
|
with_items: [ "{{ ssg_db_name }}.sql.bz2", "{{ ssg_otk_db_name }}.sql.bz2", "{{ oneaccess_db_name }}.sql.bz2", "ACMEUsers.ldif.bz2", "SiteMinderPS.ldif.bz2", "SiteMinderSS.ldif.bz2" ] |
||||
|
tags: backup |
||||
|
|
||||
|
- name: Remove temporary files |
||||
|
file: path="/tmp/{{ item }}" state=absent |
||||
|
with_items: [ "{{ ssg_db_name }}.sql.bz2", "{{ ssg_otk_db_name }}.sql.bz2", "{{ oneaccess_db_name }}.sql.bz2", "ACMEUsers.ldif.bz2", "SiteMinderPS.ldif.bz2", "SiteMinderSS.ldif.bz2" ] |
||||
|
tags: backup |
||||
@ -0,0 +1,9 @@ |
|||||
|
--- |
||||
|
|
||||
|
- name: restart sshd |
||||
|
service: name=sshd state=reloaded |
||||
|
|
||||
|
- name: update hostname |
||||
|
command: hostname {{ shortname }} |
||||
|
|
||||
|
|
||||
@ -0,0 +1,124 @@ |
|||||
|
--- |
||||
|
- name: Disable SELinux |
||||
|
lineinfile: dest="/etc/selinux/config" line="SELINUX=disabled" regexp="^SELINUX=.*" state=present |
||||
|
register: selinux |
||||
|
tags: selinux |
||||
|
|
||||
|
- name: Reboot is needed to effectively disable SELinux ! |
||||
|
command: /bin/false |
||||
|
when: selinux.changed |
||||
|
tags: selinux |
||||
|
|
||||
|
- name: Install the 32 bits library (if needed) |
||||
|
yum: name=glibc.i686 state=installed |
||||
|
when: "ansible_architecture == 'x86_64'" |
||||
|
|
||||
|
- name: Tell SSHD not to use DNS |
||||
|
lineinfile: dest=/etc/ssh/sshd_config regexp="^#* *UseDNS +" line="UseDNS no" |
||||
|
notify: restart sshd |
||||
|
tags: config |
||||
|
|
||||
|
- name: Tell SSHD to forbid root accesses |
||||
|
lineinfile: dest=/etc/ssh/sshd_config regexp="^#* *PermitRootLogin +" line="PermitRootLogin no" |
||||
|
notify: restart sshd |
||||
|
tags: config |
||||
|
|
||||
|
- name: Tell SSHD to forbid password accesses |
||||
|
lineinfile: dest=/etc/ssh/sshd_config regexp="^#* *PasswordAuthentication +" line="PasswordAuthentication no" |
||||
|
notify: restart sshd |
||||
|
tags: config |
||||
|
|
||||
|
- name: Install VIM |
||||
|
yum: name=vim-enhanced state=installed |
||||
|
|
||||
|
- name: Install Screen |
||||
|
yum: name=screen state=installed |
||||
|
|
||||
|
- name: Install OpenLDAP clients |
||||
|
yum: name=openldap-clients state=installed |
||||
|
|
||||
|
- name: Install unzip |
||||
|
yum: name=unzip state=installed |
||||
|
|
||||
|
- name: Install tcpdump |
||||
|
yum: name=tcpdump state=installed |
||||
|
|
||||
|
- name: Install telnet |
||||
|
yum: name=telnet state=installed |
||||
|
|
||||
|
- name: Install strace |
||||
|
yum: name=strace state=installed |
||||
|
|
||||
|
- name: Install man-pages |
||||
|
yum: name=man-pages state=installed |
||||
|
|
||||
|
- name: Install man |
||||
|
yum: name=man state=installed |
||||
|
|
||||
|
- name: Install iptraf |
||||
|
yum: name=iptraf state=installed |
||||
|
|
||||
|
- name: Install wget |
||||
|
yum: name=wget state=installed |
||||
|
|
||||
|
- name: Compute short hostname |
||||
|
set_fact: |
||||
|
shortname: "{{ inventory_hostname | regex_replace('([^.]+)\\..*', '\\\\1') }}" |
||||
|
tags: config |
||||
|
|
||||
|
- name: Persist the hostname |
||||
|
lineinfile: dest=/etc/sysconfig/network regexp="^HOSTNAME=" line="HOSTNAME={{ shortname }}" |
||||
|
notify: update hostname |
||||
|
tags: config |
||||
|
|
||||
|
- name: Edit /etc/hosts |
||||
|
template: src=etc_hosts dest=/etc/hosts owner=root group=root mode=0644 |
||||
|
tags: config |
||||
|
|
||||
|
- name: Ensure consistent locale across systems (1/2) |
||||
|
lineinfile: dest=/etc/sysconfig/i18n regexp="^LANG=" line="LANG=en_US.utf8" |
||||
|
|
||||
|
- name: Ensure consistent locale across systems (2/2) |
||||
|
lineinfile: dest=/etc/sysconfig/i18n line="LC_CTYPE=en_US.utf8" |
||||
|
|
||||
|
- name: Install createrepo |
||||
|
yum: name=createrepo state=installed |
||||
|
|
||||
|
- name: Create the "sources" dir in /opt |
||||
|
file: dest={{ sources_dir }} state=directory |
||||
|
|
||||
|
- name: Create the "rpms" dir in /opt/sources |
||||
|
file: dest={{ sources_dir }}/rpms state=directory |
||||
|
register: rpmsdir |
||||
|
|
||||
|
- name: Initialize the RPM repository |
||||
|
command: createrepo {{ sources_dir }}/rpms |
||||
|
when: rpmsdir.changed |
||||
|
|
||||
|
- name: Install the RPM repository in yum config |
||||
|
template: src=local.repo dest=/etc/yum.repos.d/local.repo |
||||
|
|
||||
|
- name: Install the OpenSSH clients |
||||
|
yum: name=openssh-clients state=installed |
||||
|
|
||||
|
- name: Configure all network interfaces with the same config |
||||
|
template: src=ifcfg-ethX dest=/etc/sysconfig/network-scripts/ifcfg-{{ item }} |
||||
|
with_items: |
||||
|
- eth0 |
||||
|
- eth1 |
||||
|
- eth2 |
||||
|
- eth3 |
||||
|
- eth4 |
||||
|
- eth5 |
||||
|
- eth6 |
||||
|
- eth7 |
||||
|
- eth8 |
||||
|
- eth9 |
||||
|
tags: config |
||||
|
|
||||
|
- name: Install the custom banner script |
||||
|
template: src=rc.local dest=/usr/local/etc/rc.local mode=0755 |
||||
|
tags: config |
||||
|
|
||||
|
- name: Run the custom banner script at startup |
||||
|
lineinfile: dest=/etc/rc.d/rc.local line="/usr/local/etc/rc.local" state=present insertafter=EOF |
||||
@ -0,0 +1 @@ |
|||||
|
{{ shortname }} |
||||
@ -0,0 +1,10 @@ |
|||||
|
# {{ ansible_managed }} |
||||
|
# |
||||
|
# /etc/hosts: static lookup table for host names |
||||
|
# |
||||
|
|
||||
|
#<ip-address> <hostname.domain.org> <hostname> |
||||
|
127.0.0.1 {{ inventory_hostname }} {{ shortname }} localhost.localdomain localhost {{ oneaccess_static_hostname }} {{ ssg_hostname }} {{ oneaccess_public_hostname }} {{ wa_public_hostname }} {{ sm_wamui_hostname }} |
||||
|
::1 localhost.localdomain localhost |
||||
|
|
||||
|
# End of file |
||||
@ -0,0 +1,15 @@ |
|||||
|
DEVICE={{ item }} |
||||
|
TYPE=Ethernet |
||||
|
ONBOOT=yes |
||||
|
BOOTPROTO=dhcp |
||||
|
USERCTL=no |
||||
|
PEERDNS=yes |
||||
|
IPV6INIT=no |
||||
|
DHCP_HOSTNAME={{ shortname }} |
||||
|
|
||||
|
## Static configuration sample. |
||||
|
## Gateway to be configured in /etc/sysconfig/network. |
||||
|
## |
||||
|
# BOOTPROTO=static |
||||
|
# IPADDR=192.168.38.179 |
||||
|
# NETMASK=255.255.255.0 |
||||
@ -0,0 +1,5 @@ |
|||||
|
[localrepo] |
||||
|
name=Demo Local Repository |
||||
|
baseurl=file://{{ sources_dir }}/rpms |
||||
|
enabled=1 |
||||
|
gpgcheck=0 |
||||
@ -0,0 +1,6 @@ |
|||||
|
#!/bin/bash |
||||
|
|
||||
|
sed -ri 's/^(eth[0-9]: .*|)$//g; T; d' /etc/issue |
||||
|
echo >> /etc/issue |
||||
|
ip addr show scope global |sed -r 's/^.*inet ([0-9]+\.[0-9]+\.[0-9]+\.[0-9]+)\/[0-9]+ brd .* (eth[0-9])$/\2: \1/g; t; d' >> /etc/issue |
||||
|
echo >> /etc/issue |
||||
@ -0,0 +1,28 @@ |
|||||
|
--- |
||||
|
|
||||
|
- name: Create user OneAccess |
||||
|
user: name=oneaccess group=users groups=users,wheel state=present comment="OneAccess privileged user" password="*" |
||||
|
sudo_user: root |
||||
|
tags: |
||||
|
- bootstrap |
||||
|
- user |
||||
|
|
||||
|
- name: Set SSH key for root |
||||
|
authorized_key: user=root key="{{ ansible_ssh_public_key }}" manage_dir=yes |
||||
|
sudo_user: root |
||||
|
tags: |
||||
|
- bootstrap |
||||
|
- user |
||||
|
|
||||
|
- name: Set SSH key for user OneAccess |
||||
|
authorized_key: user=oneaccess key="{{ ansible_ssh_public_key }}" manage_dir=yes |
||||
|
sudo_user: root |
||||
|
tags: |
||||
|
- bootstrap |
||||
|
- user |
||||
|
|
||||
|
- name: Configure SUDO |
||||
|
template: src=sudoers dest=/etc/sudoers owner=root group=root mode=0440 validate="/usr/sbin/visudo -cf %s" |
||||
|
tags: |
||||
|
- bootstrap |
||||
|
- config |
||||
@ -0,0 +1,3 @@ |
|||||
|
# {{ ansible_managed }} |
||||
|
%wheel ALL=(ALL) NOPASSWD: ALL |
||||
|
root ALL=(ALL) NOPASSWD: ALL |
||||
@ -0,0 +1 @@ |
|||||
|
*.tgz |
||||
@ -0,0 +1,47 @@ |
|||||
|
dn: o=OneAccess |
||||
|
objectClass: organization |
||||
|
objectClass: top |
||||
|
description: OneAccess |
||||
|
o: OneAccess |
||||
|
|
||||
|
dn: ou=Groups,o=OneAccess |
||||
|
objectClass: organizationalUnit |
||||
|
ou: Groups |
||||
|
description: OneAccess Groups |
||||
|
|
||||
|
dn: ou=Users,o=OneAccess |
||||
|
objectClass: organizationalUnit |
||||
|
ou: Users |
||||
|
description: OneAccess Users |
||||
|
|
||||
|
dn: uid=nmasse,ou=Users,o=OneAccess |
||||
|
objectClass: person |
||||
|
objectClass: inetOrgPerson |
||||
|
objectClass: top |
||||
|
uid: nmasse |
||||
|
userpassword: changeme |
||||
|
givenname: Nicolas |
||||
|
cn: Nicolas Massé |
||||
|
sn: Massé |
||||
|
mail: nmasse@changeme.test |
||||
|
title: Sr Consultant, Presales |
||||
|
jpegPhoto;binary:: /9j/4AAQSkZJRgABAQEAyADIAAD/2wBDAAgGBgcGBQgHBwcJCQgKDBQNDAsLDBkSEw8UHRofHh0aHBwgJC4nICIsIxwcKDcpLDAxNDQ0Hyc5PTgyPC4zNDL/2wBDAQkJCQwLDBgNDRgyIRwhMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjL/wAARCABgAEADASIAAhEBAxEB/8QAHwAAAQUBAQEBAQEAAAAAAAAAAAECAwQFBgcICQoL/8QAtRAAAgEDAwIEAwUFBAQAAAF9AQIDAAQRBRIhMUEGE1FhByJxFDKBkaEII0KxwRVS0fAkM2JyggkKFhcYGRolJicoKSo0NTY3ODk6Q0RFRkdISUpTVFVWV1hZWmNkZWZnaGlqc3R1dnd4eXqDhIWGh4iJipKTlJWWl5iZmqKjpKWmp6ipqrKztLW2t7i5usLDxMXGx8jJytLT1NXW19jZ2uHi4+Tl5ufo6erx8vP09fb3+Pn6/8QAHwEAAwEBAQEBAQEBAQAAAAAAAAECAwQFBgcICQoL/8QAtREAAgECBAQDBAcFBAQAAQJ3AAECAxEEBSExBhJBUQdhcRMiMoEIFEKRobHBCSMzUvAVYnLRChYkNOEl8RcYGRomJygpKjU2Nzg5OkNERUZHSElKU1RVVldYWVpjZGVmZ2hpanN0dXZ3eHl6goOEhYaHiImKkpOUlZaXmJmaoqOkpaanqKmqsrO0tba3uLm6wsPExcbHyMnK0tPU1dbX2Nna4uPk5ebn6Onq8vP09fb3+Pn6/9oADAMBAAIRAxEAPwD3+iiigApKp6tqtro2my314zCGPsoyzE9AB3NcbH8W/D+H8+K6iZT93arfyPFK6Q0mzvqK47TPid4a1GQRm5ktmY4HnpgH8RkD8a6+ORJo1kidXRhlWU5BHsaLg00OoopaYgqC9vIbCxnu522xQoXY+wqeuL+Js6r4bitixBubhY8A43Dmk3ZXHFXdjzzxPP4r8WQRX8MEi2crkxW4b7qdjjvn1rmU+H3iNkEjQsDnON4z/OvXY5FHlovypGAgHYADFWml4JDCub2jPRVCNlc8QHgvxBBcI0u5VBxksOK7LwX4pvvCOtR6XqsudNn5UA5WMk8svcc9RW/fvvcgtx7V5x4xuEDxynO6KT5cUQqNyJq0YRjdH00rK6BlIKsMgjoRS1y3w71c6z4KsZ2B3RqYSezbeAfyxXU11HnsK4b4hRefeeHoWI8trtiwPfAz/Su5rE8Taf8AbLOCdRl7SXzR9MEH+efwpS2Lh8SPHfEWp6+LmWGxhnRM4QrtUYz1y3X8Kv2s+uweHLme6I+0RqNgJ5atmTWIYkxKgdwcKMd6wdV8T29pbXVvcWt35jc7hGdpPse9ce+h63Jy6tnKzXfiW3lEty0zRuM/I6nb+B5NVtft7i60uWS5G2VCHDYwD+Fdvpeu28mmoJIwXX7pdefrWReTx6s9xFMcIIm5HY44qo7mVSnaLdzvfgtcmTwjNbEn9xPgLjplQetek1yPw40CXQPCUKXKbLq5Y3Eq/wB3IAC/goH45rrq6lsebNJSsgproskbIwyrDBHtTqKZJ41eac8OqXVsXEVzE5VXZdwx2OPyrH1Br9UaN9QiJIwMw9/zr0jx3YQhIdQiIS6HyMf7y9s1wL67cbCn2aMnu2a5ZRcXoelSrKUdTGtILkNJNe3ETwgfKqx7ST9a1/BFtby+K7cXKgxM5IBHBxzz7ZwPxrDvrxncSXUoznCxoOSfQe9dL4f06aE+e42zvjgfwDsP61VOLbuZVqitZHtlFZ+m34ubaMSnEwXDZGNx9av10HEDMFXJOAKrm4LsVQYx3NRajN5apGDgsck+1Z9z5giLRN8xH5U0MzPFbC50qQq+75lwR3H+TXkGoW08LssW7LHAA5ya9Wmmmt4ltrlPMtnO1iB8yA96y0tUsHmnKATo5XzO4x/d+vXNZTjdm0JJRZy3hbwPcxXA1LVQTcY/dQt/yz9z7/yru44YLKWGFgHuJD8kQ6/7x9BVAeIdQggZm0+NyT8shzn8QOtXNCa5vb97+8jxMVCAhNowOnFXFJaIzd27s6eG3VUG3ketXYZmVgjfMCcD2qiGKncDj3qxFIHkTs2RVk2KesB5rpUjzlVFRRu8aeXLgntVm4dhqM4Ckj5RkD2qnKH3Y2tx7UCE2+Y3ABJ9aonTZDc+bdSK/dVUYArSt0c7m2Nxx0prK7yE7G/KgCJYkxyowKsIABnoopqxSE/cb8qNrufusI19utAx5kwN56DoKkglG4Of4SPzqk8jTSKiowA5xilj3gISrDJ3dKAZ/9k= |
||||
|
telephoneNumber: +33123456789 |
||||
|
|
||||
|
dn: cn=Admins,ou=Groups,o=OneAccess |
||||
|
objectclass: groupofnames |
||||
|
cn: Admins |
||||
|
description: IT Admins group |
||||
|
member: uid=nmasse,ou=Users,o=OneAccess |
||||
|
|
||||
|
dn: cn=Salesforce Users,ou=Groups,o=OneAccess |
||||
|
objectclass: groupofnames |
||||
|
cn: Salesforce Users |
||||
|
description: Salesforce Users |
||||
|
member: uid=nmasse,ou=Users,o=OneAccess |
||||
|
|
||||
|
dn: cn=Intranet Users,ou=Groups,o=OneAccess |
||||
|
objectclass: groupofnames |
||||
|
cn: Intranet Users |
||||
|
description: Intranet Users |
||||
|
member: uid=nmasse,ou=Users,o=OneAccess |
||||
@ -0,0 +1,74 @@ |
|||||
|
--- |
||||
|
|
||||
|
- name: Install TCSH |
||||
|
yum: name=tcsh state=installed |
||||
|
|
||||
|
- name: Install AT |
||||
|
yum: name=at state=installed |
||||
|
|
||||
|
- name: Create the CA Directory source folder |
||||
|
file: path={{ sources_dir }}/ca-directory state=directory |
||||
|
|
||||
|
- name: Extract the installation materials |
||||
|
unarchive: creates={{ sources_dir }}/ca-directory/linux_x86 src=cadir-12.0sp4.tgz dest={{ sources_dir }}/ca-directory |
||||
|
|
||||
|
- name: Copy the unattended response file |
||||
|
template: src=ca-dir.resp dest={{ sources_dir }}/ca-directory/responsefile.txt |
||||
|
|
||||
|
- name: Install CA Directory |
||||
|
command: chdir={{ sources_dir }}/ca-directory/linux_x86/dxserver/install creates={{ dx_home }}/dxserver {{ sources_dir }}/ca-directory/linux_x86/dxserver/install/dxsetup.sh -responsefile {{ sources_dir }}/ca-directory/responsefile.txt -silent |
||||
|
|
||||
|
- name: Copy missing .dxcshrc file (TODO why is it missing ?) |
||||
|
template: src=dxcshrc dest={{ dx_home }}/dxserver/install/.dxcshrc |
||||
|
sudo_user: "{{ dx_user }}" |
||||
|
|
||||
|
- name: Copy missing .dxprofile file (TODO why is it missing ?) |
||||
|
template: src=dxprofile dest={{ dx_home }}/dxserver/install/.dxprofile |
||||
|
sudo_user: "{{ dx_user }}" |
||||
|
|
||||
|
- name: Fix symlinks in dxserver/bin (TODO why ?) |
||||
|
file: path={{ dx_home }}/dxserver/bin/{{ item }} src={{ item }}64 |
||||
|
sudo_user: "{{ dx_user }}" |
||||
|
with_items: [ "dxserver", "dxloaddb", "dxdumpdb" ] |
||||
|
|
||||
|
- name: Set SSH key for dxuser |
||||
|
authorized_key: user={{ dx_user }} key="{{ ansible_ssh_public_key }}" manage_dir=yes |
||||
|
tags: user |
||||
|
|
||||
|
- name: Create the ACME datastore |
||||
|
command: creates="{{ dx_home }}/dxserver/config/servers/ACMEUsers.dxi" /bin/sh -l -c "dxnewdsa ACMEUsers {{ dx_acme_dsa_port }}" |
||||
|
sudo_user: "{{ dx_user }}" |
||||
|
|
||||
|
- name: Copy the LDIF file into the sources dir |
||||
|
copy: src=sample.ldif dest={{ sources_dir }}/sample.ldif |
||||
|
tags: userstore |
||||
|
|
||||
|
- name: Bind ACME DSA on 127.0.0.1 only |
||||
|
lineinfile: dest="{{ dx_home }}/dxserver/config/knowledge/ACMEUsers.dxc" line=' address = tcp "127.0.0.1" port \1' regexp='^\s*address\s*=\s*tcp\s*"[^"]*"\s*port\s*([0-9]+)' backrefs=yes |
||||
|
sudo_user: "{{ dx_user }}" |
||||
|
tags: config |
||||
|
|
||||
|
- name: Bind ACME DSA on 127.0.0.1 only |
||||
|
lineinfile: dest="{{ dx_home }}/dxserver/config/knowledge/ACMEUsers.dxc" line=' bind-address = "127.0.0.1"' insertafter="^\s*address\s*=" regexp='^\s*bind-address\s*=' |
||||
|
sudo_user: "{{ dx_user }}" |
||||
|
tags: config |
||||
|
|
||||
|
- name: Stop the ACME DSA |
||||
|
command: /bin/sh -l -c "dxserver stop ACMEUsers" |
||||
|
sudo_user: "{{ dx_user }}" |
||||
|
tags: userstore |
||||
|
|
||||
|
- name: Load the LDIF into the ACME datastore |
||||
|
command: /bin/sh -l -c "dxloaddb ACMEUsers {{ sources_dir }}/sample.ldif" |
||||
|
sudo_user: "{{ dx_user }}" |
||||
|
tags: userstore |
||||
|
|
||||
|
- name: Flag the ACME DSA as "autostart" |
||||
|
file: path={{ dx_home }}/dxserver/config/autostart/ACMEUsers state=touch |
||||
|
sudo_user: "{{ dx_user }}" |
||||
|
tags: config |
||||
|
|
||||
|
- name: Start the ACME DSA |
||||
|
command: /bin/sh -l -c "dxserver start ACMEUsers" |
||||
|
sudo_user: "{{ dx_user }}" |
||||
|
tags: userstore |
||||
@ -0,0 +1,35 @@ |
|||||
|
# ================================== |
||||
|
# CA Directory Response File |
||||
|
# ================================== |
||||
|
# This response file is used to provide the default responses to dxsetup |
||||
|
# for all installations. |
||||
|
# |
||||
|
# The current defaults conform to CA installation standards so these should |
||||
|
# be taken into account when making modifications. |
||||
|
# |
||||
|
# Ensure the variable names being set are not changed and that this file |
||||
|
# is Bourne Shell compatible. |
||||
|
# |
||||
|
|
||||
|
INSTUSER=root |
||||
|
ETDIRHOME="{{ dx_home }}" |
||||
|
|
||||
|
INSTALLDXWEBSERVER=y |
||||
|
INSTALLDXMANAGER=y |
||||
|
INSTALLDOC=y |
||||
|
|
||||
|
DXHOME="{{ dx_home }}/dxserver" |
||||
|
DXWEBHOME="{{ dx_home }}/dxwebserver" |
||||
|
JAVA_LOC="{{ java_home }}/jre/bin/java" |
||||
|
|
||||
|
DEFAULT_DXUSER={{ dx_user }} |
||||
|
DXSHELL=/bin/csh |
||||
|
DXGROUP={{ dx_group }} |
||||
|
|
||||
|
DXWEBSERVER_CONNECT_PORT=8080 |
||||
|
DXWEBSERVER_SECURE_PORT=8443 |
||||
|
DXWEBSERVER_SHUTDOWN_PORT=8005 |
||||
|
|
||||
|
# This one seems to be hardcoded |
||||
|
DXMANAGERUSER={{ dxmanager_user }} |
||||
|
DXMANAGERPASS={{ dxmanager_password }} |
||||
@ -0,0 +1,38 @@ |
|||||
|
# ============================== |
||||
|
# CA Directory Response File |
||||
|
# ============================== |
||||
|
# r12 build 9119 |
||||
|
# Thu Jul 17 17:14:09 CEST 2014 |
||||
|
|
||||
|
# User parameters |
||||
|
INSTUSER=root |
||||
|
DXUSER={{ dx_user }} |
||||
|
DXSHELL=/bin/csh |
||||
|
DXUID= |
||||
|
DXGROUP={{ dx_group }} |
||||
|
DXGID= |
||||
|
|
||||
|
# Install parameters |
||||
|
INSTALLDX=y |
||||
|
INSTALLDOC=y |
||||
|
INSTALLDXA=n |
||||
|
RUN64BIT=n |
||||
|
SETUID=n |
||||
|
|
||||
|
# Location parameters |
||||
|
ETDIRHOME={{ dx_home }} |
||||
|
DXHOME={{ dx_home }}/dxserver |
||||
|
DXGRIDLOC= |
||||
|
DOCHOME={{ dx_home }}/doc |
||||
|
|
||||
|
# DXadmind parameters |
||||
|
DXMANAGERHOST= |
||||
|
DXADMINDPORT= |
||||
|
DXADMINDPASS= |
||||
|
|
||||
|
# Upgrade parameters |
||||
|
BACKUPBIN= |
||||
|
BACKUPLOC= |
||||
|
BACKUPDBS= |
||||
|
RESTARTDSAS= |
||||
|
LDIFLOC= |
||||
@ -0,0 +1,18 @@ |
|||||
|
umask 027 |
||||
|
setenv DXHOME {{ dx_home }}/dxserver |
||||
|
set path = ( $DXHOME/bin $path ) |
||||
|
if ( ! $?LD_LIBRARY_PATH ) then |
||||
|
setenv LD_LIBRARY_PATH $DXHOME/bin |
||||
|
else |
||||
|
setenv LD_LIBRARY_PATH $DXHOME/bin:${LD_LIBRARY_PATH} |
||||
|
endif |
||||
|
set filec |
||||
|
|
||||
|
if !($?LD_LIBRARY_PATH) then |
||||
|
setenv LD_LIBRARY_PATH {{ java_home }}/lib/i386/native_threads |
||||
|
else |
||||
|
if ( "`echo LD_LIBRARY_PATH | grep {{ java_home }}`" == "" ) then |
||||
|
setenv LD_LIBRARY_PATH ${LD_LIBRARY_PATH}:{{ java_home }}/lib/i386/native_threads |
||||
|
endif |
||||
|
endif |
||||
|
setenv POSIXLY_CORRECT 1 |
||||
@ -0,0 +1,23 @@ |
|||||
|
umask 027 |
||||
|
DXHOME={{ dx_home }}/dxserver |
||||
|
PATH=$DXHOME/bin:${PATH} |
||||
|
LD_LIBRARY_PATH=$DXHOME/bin:$LD_LIBRARY_PATH |
||||
|
export DXHOME PATH LD_LIBRARY_PATH |
||||
|
|
||||
|
if [ -z "$LD_LIBRARY_PATH" ]; then |
||||
|
LD_LIBRARY_PATH={{ java_home }}/lib/i386/native_threads |
||||
|
else |
||||
|
LD_LIBRARY_PATH=${LD_LIBRARY_PATH}:{{ java_home }}/lib/i386/native_threads |
||||
|
fi |
||||
|
export LD_LIBRARY_PATH |
||||
|
POSIXLY_CORRECT=1 |
||||
|
export POSIXLY_CORRECT |
||||
|
|
||||
|
# CA Shared Components |
||||
|
if [ -f /etc/profile.CA ]; then |
||||
|
. /etc/profile.CA |
||||
|
if [ ! -z $CALIB ]; then |
||||
|
LD_LIBRARY_PATH=${LD_LIBRARY_PATH}:${CALIB} |
||||
|
export LD_LIBRARY_PATH |
||||
|
fi |
||||
|
fi |
||||
@ -0,0 +1,15 @@ |
|||||
|
--- |
||||
|
|
||||
|
- name: This module only works on CentOS 6 x86 |
||||
|
assert: |
||||
|
that: |
||||
|
- "ansible_os_family == 'RedHat'" |
||||
|
|
||||
|
- name: Set the iptables rules |
||||
|
template: dest=/etc/sysconfig/iptables src=iptables-rules |
||||
|
tags: iptables |
||||
|
|
||||
|
- name: Make sure iptables is enabled |
||||
|
service: name=iptables state=restarted enabled=yes |
||||
|
tags: iptables |
||||
|
|
||||
@ -0,0 +1,24 @@ |
|||||
|
*nat |
||||
|
:PREROUTING ACCEPT [0:0] |
||||
|
:POSTROUTING ACCEPT [0:0] |
||||
|
:OUTPUT ACCEPT [0:0] |
||||
|
-A PREROUTING -p tcp -m tcp --dport 443 -j REDIRECT --to-ports {{ httpd_https_port }} |
||||
|
-A PREROUTING -p tcp -m tcp --dport 80 -j REDIRECT --to-ports {{ httpd_http_port }} |
||||
|
-A PREROUTING -p tcp -m tcp --dport {{ ssg_mag_public_port }} -j REDIRECT --to-ports {{ ssg_mag_port }} |
||||
|
COMMIT |
||||
|
*filter |
||||
|
:INPUT ACCEPT [0:0] |
||||
|
:FORWARD ACCEPT [0:0] |
||||
|
:OUTPUT ACCEPT [0:0] |
||||
|
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT |
||||
|
-A INPUT -p icmp -j ACCEPT |
||||
|
-A INPUT -i lo -j ACCEPT |
||||
|
-A INPUT -p tcp -m state --state NEW -m tcp --dport {{ httpd_https_port }} -j ACCEPT |
||||
|
-A INPUT -p tcp -m state --state NEW -m tcp --dport {{ httpd_http_port }} -j ACCEPT |
||||
|
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT |
||||
|
-A INPUT -p tcp -m state --state NEW -m tcp --dport {{ ssg_admin_port }} -j ACCEPT |
||||
|
-A INPUT -p tcp -m state --state NEW -m tcp --dport {{ ssg_service_port }} -j ACCEPT |
||||
|
-A INPUT -p tcp -m state --state NEW -m tcp --dport {{ ssg_mag_port }} -j ACCEPT |
||||
|
-A INPUT -j REJECT --reject-with icmp-host-prohibited |
||||
|
-A FORWARD -j REJECT --reject-with icmp-host-prohibited |
||||
|
COMMIT |
||||
@ -0,0 +1,4 @@ |
|||||
|
*.rpm |
||||
|
*.tar.gz |
||||
|
*.jar |
||||
|
|
||||
@ -0,0 +1,30 @@ |
|||||
|
--- |
||||
|
|
||||
|
- name: This module only works on RHEL/CentOS |
||||
|
assert: |
||||
|
that: |
||||
|
- "ansible_os_family == 'RedHat'" |
||||
|
|
||||
|
- name: Download the Oracle JDK 7 archive |
||||
|
command: creates={{ sources_dir }}/jdk-7u{{ java_release }}-linux-i586.tar.gz wget -c --no-check-certificate --no-cookies --header "Cookie:oraclelicense=accept-securebackup-cookie" http://download.oracle.com/otn-pub/java/jdk/7u{{ java_release }}-b15/jdk-7u{{ java_release }}-linux-i586.tar.gz -O {{ sources_dir }}/jdk-7u{{ java_release }}-linux-i586.tar.gz |
||||
|
|
||||
|
- name: Extract the Oracle JDK 7 archive |
||||
|
unarchive: creates=/opt/jdk1.7.0_{{ java_release }} src={{ sources_dir }}/jdk-7u{{ java_release }}-linux-i586.tar.gz dest=/opt copy=no |
||||
|
register: java |
||||
|
|
||||
|
- name: Link it to $JAVA_HOME |
||||
|
file: dest={{ java_home }} src=/opt/jdk1.7.0_{{ java_release }} state=link |
||||
|
|
||||
|
- name: Update alternatives |
||||
|
command: /usr/sbin/update-alternatives --install /usr/bin/java java {{ java_home }}/bin/java 9999 --slave /usr/bin/keytool keytool {{ java_home }}/bin/keytool --slave /usr/bin/rmiregistry rmiregistry {{ java_home }}/bin/rmiregistry |
||||
|
when: java.changed |
||||
|
|
||||
|
- name: Set JAVA_HOME |
||||
|
lineinfile: line="JAVA_HOME={{ java_home }}" state=present dest=/etc/profile.d/jdk7.sh create=yes |
||||
|
|
||||
|
- name: Set /opt/jdk7 into PATH |
||||
|
lineinfile: line='PATH="{{ java_home }}/bin:$PATH"' dest=/etc/profile.d/jdk7.sh state=present |
||||
|
|
||||
|
- name: Install JCE Unlimited strength policy files |
||||
|
copy: src={{ item }} dest={{ java_home }}/jre/lib/security/{{ item }} |
||||
|
with_items: [ 'local_policy.jar', 'US_export_policy.jar' ] |
||||
@ -0,0 +1,2 @@ |
|||||
|
*.rpm |
||||
|
*.jar |
||||
@ -0,0 +1,64 @@ |
|||||
|
--- |
||||
|
|
||||
|
- name: This module only works on CentOS 6 |
||||
|
assert: |
||||
|
that: |
||||
|
- "ansible_os_family == 'RedHat'" |
||||
|
|
||||
|
- name: Install libaio |
||||
|
yum: name=libaio state=installed |
||||
|
|
||||
|
- name: Be sure to remove any conflicting RPM before installing MySQL |
||||
|
yum: name=mysql-libs state=absent |
||||
|
|
||||
|
- name: Copy the MySQL Enterprise Edition 5.6 installation package |
||||
|
copy: src={{ item }} dest={{ sources_dir }}/rpms |
||||
|
with_items: [ 'MySQL-server-advanced-{{ mysql_version }}-1.el6.i686.rpm', 'MySQL-shared-advanced-{{ mysql_version }}-1.el6.i686.rpm', 'MySQL-shared-compat-advanced-{{ mysql_version }}-1.el6.i686.rpm', 'MySQL-client-advanced-{{ mysql_version }}-1.el6.i686.rpm' ] |
||||
|
register: rpmsdir |
||||
|
when: ansible_architecture == 'i386' |
||||
|
|
||||
|
- name: Copy the MySQL Enterprise Edition 5.6 installation package |
||||
|
copy: src={{ item }} dest={{ sources_dir }}/rpms |
||||
|
with_items: [ 'MySQL-server-advanced-{{ mysql_version }}-1.el6.x86_64.rpm', 'MySQL-shared-advanced-{{ mysql_version }}-1.el6.x86_64.rpm', 'MySQL-shared-compat-advanced-{{ mysql_version }}-1.el6.x86_64.rpm', 'MySQL-client-advanced-{{ mysql_version }}-1.el6.x86_64.rpm' ] |
||||
|
register: rpmsdir |
||||
|
when: ansible_architecture == 'x86_64' |
||||
|
|
||||
|
- name: Update the RPM local repository |
||||
|
command: createrepo {{ sources_dir }}/rpms |
||||
|
when: rpmsdir.changed |
||||
|
|
||||
|
- name: Flush the yum caches |
||||
|
command: yum clean all |
||||
|
when: rpmsdir.changed |
||||
|
|
||||
|
- name: Set the default MySQL server configuration (yes, before installation) |
||||
|
template: src=my.cnf dest=/etc/my.cnf owner=root group=root mode=0755 |
||||
|
tags: config |
||||
|
|
||||
|
- name: Create the MySQL data directory |
||||
|
file: path=/home/mysql state=directory mode=777 |
||||
|
|
||||
|
- name: Install MySQL Enterprise Edition 5.6 |
||||
|
yum: name={{ item }} state=installed |
||||
|
with_items: [ 'MySQL-server-advanced', 'MySQL-shared-advanced', 'MySQL-shared-compat-advanced', 'MySQL-client-advanced' ] |
||||
|
|
||||
|
- name: Update the MySQL data directory |
||||
|
file: path=/home/mysql state=directory mode=0750 owner=mysql group=mysql |
||||
|
|
||||
|
- name: Install the MySQL-python package (needed by ansible) |
||||
|
yum: name=MySQL-python state=installed |
||||
|
|
||||
|
- name: Fix permissions on /var/lib/mysql |
||||
|
file: path=/var/lib/mysql state=directory mode=0750 owner=mysql group=mysql |
||||
|
|
||||
|
- name: Ensure the MySQL service is started |
||||
|
service: name=mysql state=started enabled=on |
||||
|
|
||||
|
- name: Copy the MySQL script to init the root password |
||||
|
template: src=mysql_set_root_password.sh dest={{ sources_dir }} mode=0755 |
||||
|
|
||||
|
- name: Reset the MySQL root password |
||||
|
command: "{{ sources_dir }}/mysql_set_root_password.sh" |
||||
|
|
||||
|
- name: Remove the MySQL script |
||||
|
file: path={{ sources_dir }}/mysql_set_root_password.sh state=absent |
||||
@ -0,0 +1,51 @@ |
|||||
|
[mysqld] |
||||
|
lower_case_table_names = 1 |
||||
|
character-set-server = utf8 |
||||
|
bind-address = 127.0.0.1 |
||||
|
datadir = /home/mysql |
||||
|
pid-file = /var/lib/mysql/mysqld.pid |
||||
|
socket = /var/lib/mysql/mysql.sock |
||||
|
basedir = /usr |
||||
|
|
||||
|
skip-partition |
||||
|
|
||||
|
bulk_insert_buffer_size=0 |
||||
|
# using the defaults for the hardware appliance / x86_64 build |
||||
|
innodb_data_file_path=ibdata:100M:autoextend:max:9216M |
||||
|
innodb_additional_mem_pool_size=2M |
||||
|
innodb_log_buffer_size=1M |
||||
|
innodb_buffer_pool_size=64M |
||||
|
# only need this buffer for the |
||||
|
# mysql tablespace for authentication |
||||
|
key_buffer_size=64M |
||||
|
query_cache_size=32M |
||||
|
query_cache_limit=8M |
||||
|
innodb_log_file_size=16M |
||||
|
lower_case_table_names=1 |
||||
|
|
||||
|
# flush binary logs on commits. |
||||
|
innodb_flush_log_at_trx_commit=1 |
||||
|
binlog_format=MIXED |
||||
|
max_binlog_size=500M |
||||
|
expire_logs_days=10 |
||||
|
# 5 gigs of binary logs, at most. Probably less. |
||||
|
# And sync it too, so that the logs and the files and any remote systems are all |
||||
|
# in agreement. Its a performance hit for reliability. |
||||
|
sync_binlog=16 |
||||
|
# set larger connection limit |
||||
|
max_connections=2625 |
||||
|
# increase timeout |
||||
|
net_write_timeout=120 |
||||
|
|
||||
|
low-priority-updates=0 |
||||
|
transaction-isolation=READ-COMMITTED |
||||
|
# and ignore connect errors so it retries a lot |
||||
|
max_connect_errors=2000000 |
||||
|
max_allowed_packet=32M |
||||
|
interactive_timeout=864000 |
||||
|
slow_query_log=1 |
||||
|
|
||||
|
[mysql] |
||||
|
# command line imports of audit data can fail with max allowed packet size |
||||
|
# This will help |
||||
|
max_allowed_packet=32M |
||||
@ -0,0 +1,11 @@ |
|||||
|
#!/bin/bash |
||||
|
|
||||
|
# Very insecure, but anyway it's a demo ! |
||||
|
NEWPASS={{ mysql_root_password }} |
||||
|
|
||||
|
test -f /root/.mysql_secret || exit 0 |
||||
|
sed -r 's/^#.*: (.*)$/[client]\npassword=\1/' /root/.mysql_secret > /root/.my.cnf |
||||
|
chmod 600 /root/.my.cnf |
||||
|
echo "SET PASSWORD FOR 'root'@'localhost' = PASSWORD('$NEWPASS'); SET PASSWORD FOR 'root'@'127.0.0.1' = PASSWORD('$NEWPASS'); FLUSH PRIVILEGES;" |mysql --connect-expired-password && rm -f /root/.mysql_secret |
||||
|
echo -e "[client]\npassword=$NEWPASS\n" > /root/.my.cnf |
||||
|
echo "UPDATE mysql.user SET Password = PASSWORD('$NEWPASS') WHERE User = 'root'; FLUSH PRIVILEGES;" |mysql |
||||
@ -0,0 +1,8 @@ |
|||||
|
layer7* |
||||
|
salesforce* |
||||
|
siteminder* |
||||
|
oneaccess.war |
||||
|
circles.tgz |
||||
|
*.sql |
||||
|
*.ddl |
||||
|
|
||||
@ -0,0 +1,114 @@ |
|||||
|
--- |
||||
|
|
||||
|
- name: This module only works on CentOS 6 |
||||
|
assert: |
||||
|
that: |
||||
|
- "ansible_os_family == 'RedHat'" |
||||
|
|
||||
|
- name: Create a oneaccess directory at the root filesystem |
||||
|
file: state=directory path=/oneaccess owner={{ tomcat_user }} group={{ tomcat_group }} mode=0755 |
||||
|
|
||||
|
- name: Create subdirectory beneath oneaccess |
||||
|
file: state=directory path=/oneaccess/{{ item }} owner={{ tomcat_user }} group={{ tomcat_group }} mode=0755 |
||||
|
with_items: [ 'conf', 'logs' ] |
||||
|
|
||||
|
- name: Install the One Access configuration file |
||||
|
template: src=personalization.properties dest=/oneaccess/conf/personalization.properties |
||||
|
tags: config |
||||
|
|
||||
|
- name: Install the One Access configuration file |
||||
|
template: src=log4j.properties dest=/oneaccess/conf/log4j.properties |
||||
|
tags: config |
||||
|
|
||||
|
- name: Create the One Access database |
||||
|
mysql_db: login_user=root login_password={{ mysql_root_password }} name={{ oneaccess_db_name }} state=present |
||||
|
|
||||
|
- name: Create the One Access database user |
||||
|
mysql_user: login_user=root login_password={{ mysql_root_password }} name={{ oneaccess_db_username }} password={{ oneaccess_db_password }} priv="{{ oneaccess_db_name }}.*:ALL" state=present |
||||
|
|
||||
|
- name: Copy the database schema to the sources directory |
||||
|
copy: src=Personalization_V1-0_BASE.ddl dest={{ sources_dir }}/Personalization_V1-0_BASE.ddl |
||||
|
|
||||
|
- name: Import the database schema |
||||
|
mysql_db: login_user=root login_password={{ mysql_root_password }} name={{ oneaccess_db_name }} state=import target={{ sources_dir }}/Personalization_V1-0_BASE.ddl |
||||
|
tags: |
||||
|
- db |
||||
|
- db-schema |
||||
|
# - name: Copy the database initial data to the sources directory |
||||
|
# copy: src=InitialDataLoad.sql dest={{ sources_dir }}/InitialDataLoad.sql |
||||
|
|
||||
|
# - name: Import the database initial data |
||||
|
# mysql_db: login_user=root login_password={{ mysql_root_password }} name={{ oneaccess_db_name }} state=import target={{ sources_dir }}/InitialDataLoad.sql |
||||
|
|
||||
|
- name: Copy the WAR file to tomcat |
||||
|
copy: src=oneaccess.war dest={{ tomcat_home }}/webapps/oneaccess.war |
||||
|
|
||||
|
- name: Create a "tiles" directory under "htdocs/static" |
||||
|
file: path="{{ httpd_home }}/htdocs/static/tiles/" state=directory owner={{ httpd_user }} group={{ httpd_group }} mode=755 |
||||
|
|
||||
|
- name: Copy the static files |
||||
|
unarchive: src=circles.tgz dest="{{ httpd_home }}/htdocs/static/tiles/" |
||||
|
sudo_user: "{{ httpd_user }}" |
||||
|
|
||||
|
- name: Ugly search & replace in the javascript code |
||||
|
replace: regexp="https://msso.ca.com/userinfo.php" replace="/userinfo" backup=yes dest={{ tomcat_home }}/webapps/oneaccess/resources/100/scripts/scripts.js |
||||
|
sudo_user: "{{ tomcat_user }}" |
||||
|
tags: ugly |
||||
|
|
||||
|
- name: Ugly search & replace in the javascript code |
||||
|
replace: regexp='[,]secret:"[^"]+"' replace="" backup=no dest={{ tomcat_home }}/webapps/oneaccess/resources/100/scripts/scripts.js |
||||
|
sudo_user: "{{ tomcat_user }}" |
||||
|
tags: ugly |
||||
|
|
||||
|
- name: Generate certificates for SFDC |
||||
|
local_action: command creates="{{ lookup('env', 'BASEDIR') }}/roles/oneaccess/files/salesforce.jks" "{{ lookup('env', 'BASEDIR') }}/pki/new_selfsigned_cert.sh" |
||||
|
sudo: false |
||||
|
environment: |
||||
|
CERT_CN: "{{ salesforce_certificate_cn }}" |
||||
|
PASSWORD: "{{ salesforce_certificate_password }}" |
||||
|
BASENAME: "salesforce" |
||||
|
OUTDIR: "{{ lookup('ENV', 'BASEDIR') }}/roles/oneaccess/files/" |
||||
|
tags: certificate |
||||
|
when: salesforce_certificate_cn is defined |
||||
|
|
||||
|
- name: Generate certificates for SiteMinder |
||||
|
local_action: command creates="{{ lookup('env', 'BASEDIR') }}/roles/oneaccess/files/siteminder.jks" "{{ lookup('env', 'BASEDIR') }}/pki/new_selfsigned_cert.sh" |
||||
|
sudo: false |
||||
|
environment: |
||||
|
CERT_CN: "{{ siteminder_certificate_cn }}" |
||||
|
PASSWORD: "{{ siteminder_certificate_password }}" |
||||
|
BASENAME: "siteminder" |
||||
|
OUTDIR: "{{ lookup('ENV', 'BASEDIR') }}/roles/oneaccess/files/" |
||||
|
tags: certificate |
||||
|
when: siteminder_certificate_cn is defined |
||||
|
|
||||
|
- name: Generate a SAML Signing certificate for Layer7 |
||||
|
local_action: command creates="{{ lookup('env', 'BASEDIR') }}/roles/oneaccess/files/layer7.jks" "{{ lookup('env', 'BASEDIR') }}/pki/new_selfsigned_cert.sh" |
||||
|
sudo: false |
||||
|
environment: |
||||
|
CERT_CN: "{{ layer7_saml_certificate_cn }}" |
||||
|
PASSWORD: "{{ layer7_saml_certificate_password }}" |
||||
|
BASENAME: "layer7" |
||||
|
OUTDIR: "{{ lookup('ENV', 'BASEDIR') }}/roles/oneaccess/files/" |
||||
|
tags: certificate |
||||
|
when: layer7_saml_certificate_cn is defined |
||||
|
|
||||
|
- name: Copy the Customer Logo |
||||
|
copy: src=CHANGEME-customer-logo.png dest={{ tomcat_home }}/webapps/oneaccess/resources/100/images/CHANGEME-customer-logo.png |
||||
|
sudo_user: "{{ tomcat_user }}" |
||||
|
tags: new |
||||
|
|
||||
|
- name: Customize the OneAccess header |
||||
|
template: src=header.html dest={{ tomcat_home }}/webapps/oneaccess/resources/100/views/header.html |
||||
|
sudo_user: "{{ tomcat_user }}" |
||||
|
tags: new |
||||
|
|
||||
|
- name: Source our custom.css |
||||
|
lineinfile: dest={{ tomcat_home }}/webapps/oneaccess/resources/100/styles/main.css backup=yes line='@charset "UTF-8";@import url("custom.css");\2' regexp='^@charset "UTF-8";(@import url\("custom.css"\);)?(.*)$' backrefs=yes state=present |
||||
|
sudo_user: "{{ tomcat_user }}" |
||||
|
tags: new |
||||
|
|
||||
|
- name: Create our custom.css |
||||
|
template: src=custom.css dest={{ tomcat_home }}/webapps/oneaccess/resources/100/styles/custom.css |
||||
|
sudo_user: "{{ tomcat_user }}" |
||||
|
tags: new |
||||
@ -0,0 +1,30 @@ |
|||||
|
.profile { |
||||
|
background-color: #CHANGEME !important; |
||||
|
} |
||||
|
.applications, .content { |
||||
|
background-color: #CHANGEME !important; |
||||
|
} |
||||
|
.profile__title, .profile__name { |
||||
|
color: #CHANGEME !important; |
||||
|
} |
||||
|
.profile__picture { |
||||
|
border: 2px solid #CHANGEME !important; |
||||
|
} |
||||
|
.mask { |
||||
|
background: rgba(0, 0, 0, 0.8) none repeat scroll 0% 0% !important; |
||||
|
} |
||||
|
|
||||
|
.off-canvas__nav { |
||||
|
background-color: #CHANGEME !important; |
||||
|
color: #CHANGEME !important; |
||||
|
} |
||||
|
.off-canvas-list li ul { |
||||
|
background-color: #CHANGEME !important; |
||||
|
} |
||||
|
|
||||
|
/* reduce the one access logo in case the customer logo is too big */ |
||||
|
@media screen and (max-width:767px) { |
||||
|
.header__logo-oa { |
||||
|
height: 20px !important; |
||||
|
} |
||||
|
} |
||||
@ -0,0 +1,8 @@ |
|||||
|
<div class="container-fixed"> |
||||
|
<img src="images/icn-menu.png" class="header__menu-icon" alt="menu" ng-click="toggleMenu(app.menuActive)"> |
||||
|
<img src="images/CHANGEME-customer-logo.png" class="header__logo-ca" /> |
||||
|
<img src="images/logo-oneaccess.png" class="header__logo-oa" /> |
||||
|
<a href="/fixme/help" target="_new"> |
||||
|
<img src="images/icn-help.png" alt="help" class="header__help"> |
||||
|
</a> |
||||
|
</div> |
||||
@ -0,0 +1,18 @@ |
|||||
|
# This file is a template for creating customized versions of the |
||||
|
# 'log4j.properties' configuration file. |
||||
|
|
||||
|
log4j.rootLogger=INFO, stdout |
||||
|
log4j.additivity.com.ca.oneaccess=false |
||||
|
|
||||
|
log4j.logger.com.ca.oneaccess=DEBUG, rollingFile |
||||
|
|
||||
|
log4j.appender.stdout=org.apache.log4j.ConsoleAppender |
||||
|
log4j.appender.stdout.layout=org.apache.log4j.PatternLayout |
||||
|
log4j.appender.stdout.layout.ConversionPattern=%d{ABSOLUTE} %5p %40.40c:%4L - %m%n |
||||
|
|
||||
|
log4j.appender.rollingFile=org.apache.log4j.RollingFileAppender |
||||
|
log4j.appender.rollingFile.File=/oneaccess/logs/personalization.log |
||||
|
log4j.appender.rollingFile.MaxFileSize=4MB |
||||
|
log4j.appender.rollingFile.MaxBackupIndex=8 |
||||
|
log4j.appender.rollingFile.layout=org.apache.log4j.PatternLayout |
||||
|
log4j.appender.rollingFile.layout.ConversionPattern=%d{dd MMM yyyy HH:mm:ss,SSS} %p %t %c - %m%n |
||||
@ -0,0 +1,39 @@ |
|||||
|
# This file is a template for creating customized versions of the |
||||
|
# 'personalization.properties' configuration file. |
||||
|
|
||||
|
# MySQL JDBC connection properties |
||||
|
db.driver=com.mysql.jdbc.Driver |
||||
|
db.jdbcurl=jdbc:mysql://localhost:3306/{{ oneaccess_db_name }} |
||||
|
db.username={{ oneaccess_db_username }} |
||||
|
db.password={{ oneaccess_db_password }} |
||||
|
db.initial.cp.size=3 |
||||
|
|
||||
|
# Security properties |
||||
|
security.pmfkey.header.name=sm_user |
||||
|
security.token.header.name=unknown |
||||
|
security.token.cookie.name=unknown |
||||
|
security.sps.host=unknown |
||||
|
|
||||
|
# Web Application properties |
||||
|
image.url=https://{{ oneaccess_static_hostname }}/tiles/circles/ |
||||
|
mobile.launch.url=websso://{{ ssg_hostname }}:{{ ssg_service_port }}/ |
||||
|
|
||||
|
# Layer 7 connection properties |
||||
|
layer7.androidpush.url=https://{{ ssg_hostname }}:{{ ssg_service_port }}/android/push/notify |
||||
|
layer7.applepush.url=https://{{ ssg_hostname }}:{{ ssg_service_port }}/apple/push/notify |
||||
|
layer7.otp.validation=http://{{ ssg_hostname }}:{{ ssg_service_port }}/caworld/siteminderauth |
||||
|
|
||||
|
# This one goes through the Apache Reverse proxy because Java cannot handle TLS > 1.0 |
||||
|
# (and we must configure TLS > 1.0 in Layer7 to accomodate Browsers new security measures) |
||||
|
layer7.userauth.url=https://{{ ssg_hostname }}:{{ httpd_https_port }}/oneaccessweb/pullappaccessinfo |
||||
|
|
||||
|
# One Access plugin properties |
||||
|
plugin.logo.url=http://localhost:8080/oneaccess/personalization/env=in |
||||
|
|
||||
|
# Log4j properties file location |
||||
|
log4j.config.location=/oneaccess/conf/log4j.properties |
||||
|
|
||||
|
sender.api.key=AIzaSyDY-rvi5YrXySoRrpT8V7Lav1RcC3q5vK0 |
||||
|
|
||||
|
# This id must be defined for test servers only!! |
||||
|
# test.userid=masni02 |
||||
@ -0,0 +1,11 @@ |
|||||
|
--- |
||||
|
|
||||
|
- name: Initialize the PKI |
||||
|
sudo: no |
||||
|
local_action: command creates={{ lookup('ENV', 'BASEDIR') }}/pki/ca/root_ca.crl {{ lookup('ENV', 'BASEDIR') }}/pki/init.sh |
||||
|
tags: certificate |
||||
|
|
||||
|
- name: Generate a truststore |
||||
|
sudo: no |
||||
|
local_action: command creates={{ lookup('ENV', 'BASEDIR') }}/pki/truststore.jks keytool -importcert -noprompt -alias ca -keystore {{ lookup('ENV', 'BASEDIR') }}/pki/truststore.jks -storetype JKS -storepass {{ pki_truststore_password }} -file {{ lookup('ENV', 'BASEDIR') }}/pki/ca/root_ca.crt |
||||
|
tags: certificate |
||||
@ -0,0 +1,47 @@ |
|||||
|
--- |
||||
|
|
||||
|
- name: This module only works on CentOS 6 x86 |
||||
|
assert: |
||||
|
that: |
||||
|
- "ansible_userspace_bits == '32'" |
||||
|
- "ansible_os_family == 'RedHat'" |
||||
|
|
||||
|
- name: Delete existing SSH Keys |
||||
|
file: path=/etc/ssh/{{ item }} state=absent |
||||
|
with_items: |
||||
|
- ssh_host_dsa_key |
||||
|
- ssh_host_dsa_key.pub |
||||
|
- ssh_host_key |
||||
|
- ssh_host_key.pub |
||||
|
- ssh_host_rsa_key |
||||
|
- ssh_host_rsa_key.pub |
||||
|
tags: prepare-to-export |
||||
|
|
||||
|
- name: Stop the SiteMinder WAMUI |
||||
|
command: /bin/ksh -l -c "{{ sm_home }}/siteminder/adminui/bin/shutdown.sh" |
||||
|
sudo_user: "{{ sm_user }}" |
||||
|
ignore_errors: yes |
||||
|
tags: |
||||
|
- prepare-to-export |
||||
|
- wamui-cleanup |
||||
|
|
||||
|
- name: Wait for the WAMUI to Stop (5 seconds) |
||||
|
local_action: command sleep 5 |
||||
|
sudo: false |
||||
|
tags: |
||||
|
- prepare-to-export |
||||
|
- wamui-cleanup |
||||
|
|
||||
|
- name: Make sure the WAMUI forgets his public hostname |
||||
|
command: rm -rf "{{ sm_home }}/siteminder/adminui/server/default/data/derby" |
||||
|
tags: |
||||
|
- prepare-to-export |
||||
|
- wamui-cleanup |
||||
|
|
||||
|
- name: Stop the SSHD service |
||||
|
service: name=sshd state=stopped enabled=yes |
||||
|
tags: prepare-to-export |
||||
|
|
||||
|
- name: Halt the Virtual Machine |
||||
|
command: /sbin/halt |
||||
|
tags: prepare-to-export |
||||
@ -0,0 +1,63 @@ |
|||||
|
--- |
||||
|
|
||||
|
- name: This module only works on CentOS 6 x86 |
||||
|
assert: |
||||
|
that: |
||||
|
- "ansible_userspace_bits == '32'" |
||||
|
- "ansible_os_family == 'RedHat'" |
||||
|
|
||||
|
- name: Ensure the RNGD service is started ! Otherwise, the SiteMinder server will be very slow... |
||||
|
service: name=rngd state=started enabled=yes |
||||
|
tags: start |
||||
|
|
||||
|
- name: Start the SiteMinder Policy Server |
||||
|
command: /bin/ksh -l -c "start-ps" |
||||
|
sudo_user: "{{ sm_user }}" |
||||
|
tags: start |
||||
|
|
||||
|
- name: Start the SiteMinder WAMUI |
||||
|
command: /bin/ksh -l -c "nohup {{ sm_home }}/siteminder/adminui/bin/run.sh &" |
||||
|
sudo_user: "{{ sm_user }}" |
||||
|
tags: start |
||||
|
|
||||
|
- name: Start Tomcat |
||||
|
shell: cd {{ tomcat_home }} && nohup ./bin/startup.sh & |
||||
|
sudo_user: "{{ tomcat_user }}" |
||||
|
tags: start |
||||
|
|
||||
|
- name: Start Apache |
||||
|
shell: /bin/bash -l -c "{{ httpd_home }}/bin/apachectl start" |
||||
|
sudo_user: "{{ httpd_user }}" |
||||
|
tags: start |
||||
|
|
||||
|
- name: Start SSG |
||||
|
command: /opt/SecureSpan/Gateway/runtime/bin/gateway.sh start |
||||
|
sudo_user: "{{ ssg_runtime_user }}" |
||||
|
tags: start |
||||
|
|
||||
|
- name: Stop SSG |
||||
|
command: /opt/SecureSpan/Gateway/runtime/bin/gateway.sh stop |
||||
|
sudo_user: "{{ ssg_runtime_user }}" |
||||
|
tags: stop |
||||
|
|
||||
|
- name: Stop Apache |
||||
|
command: /bin/bash -l -c "{{ httpd_home }}/bin/apachectl stop" |
||||
|
sudo_user: "{{ httpd_user }}" |
||||
|
tags: stop |
||||
|
|
||||
|
- name: Stop Tomcat |
||||
|
shell: cd {{ tomcat_home }} && ./bin/shutdown.sh |
||||
|
sudo_user: "{{ tomcat_user }}" |
||||
|
tags: stop |
||||
|
|
||||
|
- name: Stop the SiteMinder WAMUI |
||||
|
command: /bin/ksh -l -c "{{ sm_home }}/siteminder/adminui/bin/shutdown.sh" |
||||
|
sudo_user: "{{ sm_user }}" |
||||
|
tags: stop |
||||
|
|
||||
|
- name: Stop the SiteMinder Policy Server |
||||
|
command: /bin/ksh -l -c "stop-ps" |
||||
|
sudo_user: "{{ sm_user }}" |
||||
|
register: stop_ps |
||||
|
failed_when: "stop_ps.rc != 1" |
||||
|
tags: stop |
||||
@ -0,0 +1 @@ |
|||||
|
*.zip |
||||
@ -0,0 +1,51 @@ |
|||||
|
--- |
||||
|
|
||||
|
- name: This module only works on CentOS 6 x86 |
||||
|
assert: |
||||
|
that: |
||||
|
- "ansible_os_family == 'RedHat'" |
||||
|
|
||||
|
- name: Copy the SiteMinder AdminUI files to sources_dir |
||||
|
unarchive: creates={{ sources_dir }}/ca-adminui-12.52-sp01-linux.bin src=GEN08164535E-AdminUiLinux.zip dest={{ sources_dir }} |
||||
|
|
||||
|
- name: Copy the SiteMinder AdminUI PreReq files to sources_dir |
||||
|
unarchive: creates={{ sources_dir }}/adminui-pre-req-12.52-sp01-linux.bin src=GEN08163628E-PreReq.zip dest={{ sources_dir }} |
||||
|
|
||||
|
- name: Fix access rights on installation files (pre-req) |
||||
|
file: path={{ sources_dir }}/adminui-pre-req-12.52-sp01-linux.bin mode=0755 state=file |
||||
|
|
||||
|
- name: Fix access rights on installation files (ui) |
||||
|
file: path={{ sources_dir }}/ca-adminui-12.52-sp01-linux.bin mode=0755 state=file |
||||
|
|
||||
|
- name: Copy the unattended installation response file (pre-req) |
||||
|
template: src=prereq-unattended.properties dest={{ sources_dir }}/prereq-unattended.properties |
||||
|
|
||||
|
- name: Copy the unattended installation response file (ui) |
||||
|
template: src=adminui-unattended.properties dest={{ sources_dir }}/adminui-unattended.properties |
||||
|
|
||||
|
- name: Run XPSRegClient |
||||
|
command: /bin/ksh -l -c 'XPSRegClient "{{ sm_admin_user }}:{{ sm_admin_password }}" -adminui-setup -vI' |
||||
|
sudo_user: "{{ sm_user }}" |
||||
|
tags: wamui-register |
||||
|
|
||||
|
- name: Install AdminUI Pre-requisites (warning, no check !) |
||||
|
command: creates={{ sm_home }}/siteminder/adminui {{ sources_dir }}/adminui-pre-req-12.52-sp01-linux.bin -f {{ sources_dir }}/prereq-unattended.properties -i silent |
||||
|
sudo_user: "{{ sm_user }}" |
||||
|
ignore_errors: yes |
||||
|
|
||||
|
- name: Install AdminUI (warning, no check !) |
||||
|
command: creates={{ sm_home }}/siteminder/adminui/SiteMinder {{ sources_dir }}/ca-adminui-12.52-sp01-linux.bin -f {{ sources_dir }}/adminui-unattended.properties -i silent |
||||
|
sudo_user: "{{ sm_user }}" |
||||
|
ignore_errors: yes |
||||
|
|
||||
|
- name: Change the AdminUI SSL port of the built-in JBOSS |
||||
|
template: src=bindings-jboss-beans.xml dest={{ sm_home }}/siteminder/adminui/server/default/conf/bindingservice.beans/META-INF/bindings-jboss-beans.xml |
||||
|
tags: config |
||||
|
|
||||
|
- name: Change the log config of the built-in JBOSS |
||||
|
template: src=jboss-log4j.xml dest={{ sm_home }}/siteminder/adminui/server/default/conf/jboss-log4j.xml |
||||
|
tags: config |
||||
|
|
||||
|
- name: Flush the WAMUI Cache (do not forget to re-run XPSRegClient) |
||||
|
shell: rm -rf {{ sm_home }}/siteminder/adminui/server/default/data/derby/siteminder/* |
||||
|
tags: flushcache |
||||
@ -0,0 +1,43 @@ |
|||||
|
############################################### |
||||
|
##### Please do not delete this file ########## |
||||
|
############################################### |
||||
|
|
||||
|
### General Information |
||||
|
# Install folder |
||||
|
# All products are installed in subfolders under this folder |
||||
|
# This is parent product root selected by the user |
||||
|
# For e.g. C:\\Program Files\\CA |
||||
|
DEFAULT_INSTALL_FOLDER={{ sm_home }} |
||||
|
|
||||
|
# Application Server Information. |
||||
|
# Valid values for DEFAULT_APP_SERVER are JBoss, WebLogic, WebLogic9, WebSphere |
||||
|
# Versions Supported are JBoss 5.1.0 ,Web Logic 10.3, WebSphere 7.0 |
||||
|
DEFAULT_APP_SERVER=JBoss |
||||
|
|
||||
|
# Path to JDK/JRE for the Application Server |
||||
|
# For JBoss this has to be path to JDK and for WebLogic, Websphere it is path to JRE or JDK |
||||
|
DEFAULT_NETE_JAVA_HOME= |
||||
|
DEFAULT_APP_SERVER_URL= |
||||
|
|
||||
|
# JBoss Information |
||||
|
DEFAULT_JBOSS_FOLDER= |
||||
|
|
||||
|
# Weblogic Information |
||||
|
|
||||
|
DEFAULT_BINARY_FOLDER= |
||||
|
DEFAULT_DOMAIN_FOLDER= |
||||
|
DEFAULT_SERVER_NAME= |
||||
|
|
||||
|
# WebSphere Information |
||||
|
DEFAULT_WEBSPHERE_FOLDER= |
||||
|
|
||||
|
#WAS_NODE Location: \\installedApps\\ |
||||
|
# and directory \\config\\cells\\\\nodes\\ |
||||
|
DEFAULT_WAS_NODE= |
||||
|
#WAS_SERVER Value: \\config\\cells\\\\nodes\\\\servers\\ |
||||
|
DEFAULT_WAS_SERVER= |
||||
|
#WAS_CELL: \\config\\cells\\ |
||||
|
DEFAULT_WAS_CELL= |
||||
|
|
||||
|
#WAS_PROFILE = \\profiles\\ |
||||
|
WAS_PROFILE= |
||||
@ -0,0 +1,146 @@ |
|||||
|
<?xml version="1.0" encoding="UTF-8"?> |
||||
|
<deployment xmlns="urn:jboss:bean-deployer:2.0"> |
||||
|
|
||||
|
<bean name="ServiceBindingManager" |
||||
|
class="org.jboss.services.binding.ServiceBindingManager"> |
||||
|
<annotation>@org.jboss.aop.microcontainer.aspects.jmx.JMX(name="jboss.system:service=ServiceBindingManager", exposedInterface=org.jboss.services.binding.ServiceBindingManagerMBean.class, registerDirectly=true)</annotation> |
||||
|
<constructor factoryMethod="getServiceBindingManager"> |
||||
|
<factory bean="ServiceBindingManagementObject"/> |
||||
|
</constructor> |
||||
|
</bean> |
||||
|
|
||||
|
<bean name="ServiceBindingManagementObject" |
||||
|
class="org.jboss.services.binding.managed.ServiceBindingManagementObject"> |
||||
|
<constructor> |
||||
|
<parameter>ports-default</parameter> |
||||
|
<parameter> |
||||
|
<set> |
||||
|
<bean class="org.jboss.services.binding.impl.ServiceBindingSet"> |
||||
|
<constructor> |
||||
|
<parameter>ports-default</parameter> |
||||
|
<parameter>${jboss.bind.address}</parameter> |
||||
|
<parameter>0</parameter> |
||||
|
<parameter><null/></parameter> |
||||
|
</constructor> |
||||
|
</bean> |
||||
|
</set> |
||||
|
</parameter> |
||||
|
<parameter> |
||||
|
<set> |
||||
|
<bean class="org.jboss.services.binding.ServiceBindingMetadata"> |
||||
|
<property name="serviceName">jboss.web:service=WebServer</property> |
||||
|
<!-- HTTPS address and port are defined below --> |
||||
|
<property name="hostName">127.0.0.1</property> |
||||
|
<property name="port">48080</property> |
||||
|
<property name="fixedHostName">false</property> |
||||
|
<property name="description">JBoss Web HTTP connector socket</property> |
||||
|
<property name="serviceBindingValueSourceConfig"> |
||||
|
<bean class="org.jboss.services.binding.impl.XSLTServiceBindingValueSourceConfig"> |
||||
|
<constructor> |
||||
|
<parameter><![CDATA[ |
||||
|
<xsl:stylesheet xmlns:xsl='http://www.w3.org/1999/XSL/Transform' version='1.0'> |
||||
|
<xsl:output method="xml" /> |
||||
|
<xsl:param name="host"/> |
||||
|
<xsl:param name="port"/> |
||||
|
<xsl:param name="httpsHost"/> |
||||
|
<xsl:param name="httpsPort"/> |
||||
|
<xsl:param name="keyStore"/> |
||||
|
<xsl:param name="keyStoreType"/> |
||||
|
<xsl:param name="keyStorePassword"/> |
||||
|
|
||||
|
<xsl:template match="/"> |
||||
|
<xsl:apply-templates/> |
||||
|
</xsl:template> |
||||
|
|
||||
|
<xsl:template match="Connector[(not(@SSLEnabled) or @SSLEnabled='false') and @port = '8080']"> |
||||
|
<Connector> |
||||
|
<xsl:for-each select="@*"> |
||||
|
<xsl:choose> |
||||
|
<xsl:when test="(name() = 'address')"> |
||||
|
<xsl:attribute name="address"><xsl:value-of select="$host" /></xsl:attribute> |
||||
|
</xsl:when> |
||||
|
<xsl:when test="(name() = 'port')"> |
||||
|
<xsl:attribute name="port"><xsl:value-of select="$port" /></xsl:attribute> |
||||
|
</xsl:when> |
||||
|
<xsl:when test="(name() = 'redirectPort')"> |
||||
|
<xsl:attribute name="redirectPort"><xsl:value-of select="$httpsPort" /></xsl:attribute> |
||||
|
</xsl:when> |
||||
|
<xsl:otherwise> |
||||
|
<xsl:attribute name="{name()}"><xsl:value-of select="." /></xsl:attribute> |
||||
|
</xsl:otherwise> |
||||
|
</xsl:choose> |
||||
|
</xsl:for-each> |
||||
|
<xsl:apply-templates/> |
||||
|
</Connector> |
||||
|
</xsl:template> |
||||
|
|
||||
|
<xsl:template match="Connector[@SSLEnabled='true' and @port = '8443']"> |
||||
|
<Connector> |
||||
|
<xsl:for-each select="@*"> |
||||
|
<xsl:choose> |
||||
|
<xsl:when test="(name() = 'address')"> |
||||
|
<xsl:attribute name="address"><xsl:value-of select="$httpsHost" /></xsl:attribute> |
||||
|
</xsl:when> |
||||
|
<xsl:when test="(name() = 'port')"> |
||||
|
<xsl:attribute name="port"><xsl:value-of select="$httpsPort" /></xsl:attribute> |
||||
|
</xsl:when> |
||||
|
<xsl:when test="(name() = 'keystoreFile')"> |
||||
|
<xsl:attribute name="keystoreFile"><xsl:value-of select="$keyStore" /></xsl:attribute> |
||||
|
</xsl:when> |
||||
|
<xsl:when test="(name() = 'keystoreType')"> |
||||
|
<xsl:attribute name="keystoreType"><xsl:value-of select="$keyStoreType" /></xsl:attribute> |
||||
|
</xsl:when> |
||||
|
<xsl:when test="(name() = 'keystorePass')"> |
||||
|
<xsl:attribute name="keystorePass"><xsl:value-of select="$keyStorePassword" /></xsl:attribute> |
||||
|
</xsl:when> |
||||
|
<xsl:otherwise> |
||||
|
<xsl:attribute name="{name()}"><xsl:value-of select="." /></xsl:attribute> |
||||
|
</xsl:otherwise> |
||||
|
</xsl:choose> |
||||
|
</xsl:for-each> |
||||
|
<xsl:apply-templates/> |
||||
|
</Connector> |
||||
|
</xsl:template> |
||||
|
|
||||
|
<xsl:template match="*|@*"> |
||||
|
<xsl:copy> |
||||
|
<xsl:apply-templates select="@*|node()"/> |
||||
|
</xsl:copy> |
||||
|
</xsl:template> |
||||
|
</xsl:stylesheet>]]> |
||||
|
</parameter> |
||||
|
<parameter> |
||||
|
<!-- No clean way to apply two bindings to one resource --> |
||||
|
<map keyClass="java.lang.String" valueClass="java.lang.String"> |
||||
|
<entry> |
||||
|
<key>httpsHost</key> |
||||
|
<value>127.0.0.1</value> |
||||
|
</entry> |
||||
|
<entry> |
||||
|
<key>httpsPort</key> |
||||
|
<value>48443</value> |
||||
|
</entry> |
||||
|
<entry> |
||||
|
<key>keyStore</key> |
||||
|
<value>${javax.net.ssl.keyStore}</value> |
||||
|
</entry> |
||||
|
<entry> |
||||
|
<key>keyStoreType</key> |
||||
|
<value>${javax.net.ssl.keyStoreType}</value> |
||||
|
</entry> |
||||
|
<entry> |
||||
|
<key>keyStorePassword</key> |
||||
|
<value>${javax.net.ssl.keyStorePassword}</value> |
||||
|
</entry> |
||||
|
</map> |
||||
|
</parameter> |
||||
|
</constructor> |
||||
|
</bean> |
||||
|
</property> |
||||
|
</bean> |
||||
|
</set> |
||||
|
</parameter> |
||||
|
</constructor> |
||||
|
</bean> |
||||
|
|
||||
|
</deployment> |
||||
@ -0,0 +1,390 @@ |
|||||
|
<?xml version="1.0" encoding="UTF-8"?> |
||||
|
<!DOCTYPE log4j:configuration SYSTEM "log4j.dtd"> |
||||
|
|
||||
|
<!-- ===================================================================== --> |
||||
|
<!-- --> |
||||
|
<!-- Log4j Configuration --> |
||||
|
<!-- --> |
||||
|
<!-- ===================================================================== --> |
||||
|
|
||||
|
<!-- $Id: jboss-log4j.xml 87678 2009-04-22 16:47:08Z bstansberry@jboss.com $ --> |
||||
|
|
||||
|
<!-- |
||||
|
| For more configuration information and examples see the Jakarta Log4j |
||||
|
| owebsite: http://jakarta.apache.org/log4j |
||||
|
--> |
||||
|
|
||||
|
<log4j:configuration xmlns:log4j="http://jakarta.apache.org/log4j/" debug="false"> |
||||
|
|
||||
|
<!-- ================================= --> |
||||
|
<!-- Preserve messages in a local file --> |
||||
|
<!-- ================================= --> |
||||
|
|
||||
|
<!-- A time/date based rolling appender --> |
||||
|
<appender name="FILE" class="org.jboss.logging.appender.DailyRollingFileAppender"> |
||||
|
<errorHandler class="org.jboss.logging.util.OnlyOnceErrorHandler"/> |
||||
|
<param name="File" value="${jboss.server.log.dir}/server.log"/> |
||||
|
<param name="Append" value="true"/> |
||||
|
<!-- In AS 5.0.x the server log threshold was set by a system |
||||
|
property. In 5.1 and later we are instead using the system |
||||
|
property to set the priority on the root logger (see <root/> below) |
||||
|
<param name="Threshold" value="${jboss.server.log.threshold}"/> |
||||
|
--> |
||||
|
|
||||
|
<!-- Rollover at midnight each day --> |
||||
|
<!-- <param name="DatePattern" value="'.'yyyy-MM-dd"/> --> |
||||
|
|
||||
|
<!-- Rollover at the top of each hour |
||||
|
<param name="DatePattern" value="'.'yyyy-MM-dd-HH"/> |
||||
|
--> |
||||
|
|
||||
|
<layout class="org.apache.log4j.PatternLayout"> |
||||
|
<!-- The default pattern: Date Priority [Category] (Thread) Message\n --> |
||||
|
<param name="ConversionPattern" value="%d %-5p [%c] (%t) %m%n"/> |
||||
|
|
||||
|
<!-- The full pattern: Date MS Priority [Category] (Thread:NDC) Message\n |
||||
|
<param name="ConversionPattern" value="%d %-5r %-5p [%c] (%t:%x) %m%n"/> |
||||
|
--> |
||||
|
</layout> |
||||
|
</appender> |
||||
|
|
||||
|
<!-- A size based file rolling appender |
||||
|
<appender name="FILE" class="org.jboss.logging.appender.RollingFileAppender"> |
||||
|
<errorHandler class="org.jboss.logging.util.OnlyOnceErrorHandler"/> |
||||
|
<param name="File" value="${jboss.server.log.dir}/server.log"/> |
||||
|
<param name="Append" value="false"/> |
||||
|
<param name="MaxFileSize" value="500KB"/> |
||||
|
<param name="MaxBackupIndex" value="1"/> |
||||
|
|
||||
|
<layout class="org.apache.log4j.PatternLayout"> |
||||
|
<param name="ConversionPattern" value="%d %-5p [%c] %m%n"/> |
||||
|
</layout> |
||||
|
</appender> |
||||
|
--> |
||||
|
|
||||
|
<!-- ============================== --> |
||||
|
<!-- Append messages to the console --> |
||||
|
<!-- ============================== --> |
||||
|
|
||||
|
<appender name="CONSOLE" class="org.apache.log4j.ConsoleAppender"> |
||||
|
<errorHandler class="org.jboss.logging.util.OnlyOnceErrorHandler"/> |
||||
|
<param name="Target" value="System.out"/> |
||||
|
<param name="Threshold" value="ERROR"/> |
||||
|
|
||||
|
<layout class="org.apache.log4j.PatternLayout"> |
||||
|
<param name="ConversionPattern" value="%d{ABSOLUTE} %-5p [%c{1}] %m%n"/> |
||||
|
</layout> |
||||
|
</appender> |
||||
|
|
||||
|
<!-- ====================== --> |
||||
|
<!-- More Appender examples --> |
||||
|
<!-- ====================== --> |
||||
|
|
||||
|
<!-- Buffer events and log them asynchronously |
||||
|
<appender name="ASYNC" class="org.apache.log4j.AsyncAppender"> |
||||
|
<errorHandler class="org.jboss.logging.util.OnlyOnceErrorHandler"/> |
||||
|
<appender-ref ref="FILE"/> |
||||
|
<appender-ref ref="CONSOLE"/> |
||||
|
<appender-ref ref="SMTP"/> |
||||
|
</appender> |
||||
|
--> |
||||
|
|
||||
|
<!-- EMail events to an administrator |
||||
|
<appender name="SMTP" class="org.apache.log4j.net.SMTPAppender"> |
||||
|
<errorHandler class="org.jboss.logging.util.OnlyOnceErrorHandler"/> |
||||
|
<param name="Threshold" value="ERROR"/> |
||||
|
<param name="To" value="admin@myhost.domain.com"/> |
||||
|
<param name="From" value="nobody@myhost.domain.com"/> |
||||
|
<param name="Subject" value="JBoss Sever Errors"/> |
||||
|
<param name="SMTPHost" value="localhost"/> |
||||
|
<param name="BufferSize" value="10"/> |
||||
|
<layout class="org.apache.log4j.PatternLayout"> |
||||
|
<param name="ConversionPattern" value="[%d{ABSOLUTE},%c{1}] %m%n"/> |
||||
|
</layout> |
||||
|
</appender> |
||||
|
--> |
||||
|
|
||||
|
<!-- Syslog events |
||||
|
<appender name="SYSLOG" class="org.apache.log4j.net.SyslogAppender"> |
||||
|
<errorHandler class="org.jboss.logging.util.OnlyOnceErrorHandler"/> |
||||
|
<param name="Facility" value="LOCAL7"/> |
||||
|
<param name="FacilityPrinting" value="true"/> |
||||
|
<param name="SyslogHost" value="localhost"/> |
||||
|
<layout class="org.apache.log4j.PatternLayout"> |
||||
|
<param name="ConversionPattern" value="[%d{ABSOLUTE},%c{1}] %m%n"/> |
||||
|
</layout> |
||||
|
</appender> |
||||
|
--> |
||||
|
|
||||
|
<!-- Log events to JMS (requires a topic to be created) |
||||
|
<appender name="JMS" class="org.apache.log4j.net.JMSAppender"> |
||||
|
<errorHandler class="org.jboss.logging.util.OnlyOnceErrorHandler"/> |
||||
|
<param name="Threshold" value="ERROR"/> |
||||
|
<param name="TopicConnectionFactoryBindingName" value="java:/ConnectionFactory"/> |
||||
|
<param name="TopicBindingName" value="topic/MyErrorsTopic"/> |
||||
|
</appender> |
||||
|
--> |
||||
|
|
||||
|
<!-- Log events through SNMP |
||||
|
<appender name="TRAP_LOG" class="org.apache.log4j.ext.SNMPTrapAppender"> |
||||
|
<errorHandler class="org.jboss.logging.util.OnlyOnceErrorHandler"/> |
||||
|
<param name="ImplementationClassName" value="org.apache.log4j.ext.JoeSNMPTrapSender"/> |
||||
|
<param name="ManagementHost" value="127.0.0.1"/> |
||||
|
<param name="ManagementHostTrapListenPort" value="162"/> |
||||
|
<param name="EnterpriseOID" value="1.3.6.1.4.1.24.0"/> |
||||
|
<param name="LocalIPAddress" value="127.0.0.1"/> |
||||
|
<param name="LocalTrapSendPort" value="161"/> |
||||
|
<param name="GenericTrapType" value="6"/> |
||||
|
<param name="SpecificTrapType" value="12345678"/> |
||||
|
<param name="CommunityString" value="public"/> |
||||
|
<param name="ForwardStackTraceWithTrap" value="true"/> |
||||
|
<param name="Threshold" value="DEBUG"/> |
||||
|
<param name="ApplicationTrapOID" value="1.3.6.1.4.1.24.12.10.22.64"/> |
||||
|
<layout class="org.apache.log4j.PatternLayout"> |
||||
|
<param name="ConversionPattern" value="%d,%p,[%t],[%c],%m%n"/> |
||||
|
</layout> |
||||
|
</appender> |
||||
|
--> |
||||
|
|
||||
|
<!-- Emit events as JMX notifications |
||||
|
<appender name="JMX" class="org.jboss.monitor.services.JMXNotificationAppender"> |
||||
|
<errorHandler class="org.jboss.logging.util.OnlyOnceErrorHandler"/> |
||||
|
|
||||
|
<param name="Threshold" value="WARN"/> |
||||
|
<param name="ObjectName" value="jboss.system:service=Logging,type=JMXNotificationAppender"/> |
||||
|
|
||||
|
<layout class="org.apache.log4j.PatternLayout"> |
||||
|
<param name="ConversionPattern" value="%d %-5p [%c] %m"/> |
||||
|
</layout> |
||||
|
</appender> |
||||
|
--> |
||||
|
|
||||
|
<!-- Security AUDIT Appender |
||||
|
<appender name="AUDIT" class="org.jboss.logging.appender.DailyRollingFileAppender"> |
||||
|
<errorHandler class="org.jboss.logging.util.OnlyOnceErrorHandler"/> |
||||
|
<param name="File" value="${jboss.server.log.dir}/audit.log"/> |
||||
|
<param name="Append" value="true"/> |
||||
|
<param name="DatePattern" value="'.'yyyy-MM-dd"/> |
||||
|
<layout class="org.apache.log4j.PatternLayout"> |
||||
|
<param name="ConversionPattern" value="%d %-5p [%c] (%t:%x) %m%n"/> |
||||
|
</layout> |
||||
|
</appender> |
||||
|
--> |
||||
|
|
||||
|
<!-- ================ --> |
||||
|
<!-- Limit categories --> |
||||
|
<!-- ================ --> |
||||
|
|
||||
|
<!-- Limit the org.apache category to INFO as its DEBUG is verbose --> |
||||
|
<category name="org.apache"> |
||||
|
<priority value="INFO"/> |
||||
|
</category> |
||||
|
|
||||
|
<!-- Limit the jacorb category to WARN as its INFO is verbose --> |
||||
|
<category name="jacorb"> |
||||
|
<priority value="WARN"/> |
||||
|
</category> |
||||
|
|
||||
|
<!-- Set the logging level of the JSF implementation that uses |
||||
|
| java.util.logging. The jdk logging levels can be controlled |
||||
|
| through the org.jboss.logging.log4j.JDKLevel class that |
||||
|
| in addition to the standard log4j levels it adds support for |
||||
|
| SEVERE, WARNING, CONFIG, FINE, FINER, FINEST |
||||
|
--> |
||||
|
<category name="javax.enterprise.resource.webcontainer.jsf"> |
||||
|
<priority value="INFO" class="org.jboss.logging.log4j.JDKLevel"/> |
||||
|
</category> |
||||
|
|
||||
|
<!-- Limit the org.jgroups category to WARN as its INFO is verbose --> |
||||
|
<category name="org.jgroups"> |
||||
|
<priority value="WARN"/> |
||||
|
</category> |
||||
|
|
||||
|
<!-- Limit the org.quartz category to INFO as its DEBUG is verbose --> |
||||
|
<category name="org.quartz"> |
||||
|
<priority value="INFO"/> |
||||
|
</category> |
||||
|
|
||||
|
<!-- Limit the com.sun category to INFO as its FINE is verbose --> |
||||
|
<category name="com.sun"> |
||||
|
<priority value="INFO"/> |
||||
|
</category> |
||||
|
|
||||
|
<!-- Limit the sun category to INFO as its FINE is verbose --> |
||||
|
<category name="sun"> |
||||
|
<priority value="INFO"/> |
||||
|
</category> |
||||
|
|
||||
|
<!-- Limit the javax.xml.bind category to INFO as its FINE is verbose --> |
||||
|
<category name="javax.xml.bind"> |
||||
|
<priority value="INFO"/> |
||||
|
</category> |
||||
|
|
||||
|
<!-- Limit JBoss categories |
||||
|
<category name="org.jboss"> |
||||
|
<priority value="INFO"/> |
||||
|
</category> |
||||
|
--> |
||||
|
|
||||
|
<!-- Limit the JSR77 categories --> |
||||
|
<category name="org.jboss.management"> |
||||
|
<priority value="INFO"/> |
||||
|
</category> |
||||
|
|
||||
|
<!-- Limit the JBoss server implementation --> |
||||
|
<category name="org.jboss.bootstrap.microcontainer.ServerImpl"> |
||||
|
<priority value="INFO" /> |
||||
|
</category> |
||||
|
|
||||
|
<!-- Limit the DerbyDatabase category (JBAS-7090) --> |
||||
|
<category name="org.jboss.jdbc.DerbyDatabase"> |
||||
|
<priority value="OFF"/> |
||||
|
</category> |
||||
|
|
||||
|
<!-- Limit the verbose facelets compiler --> |
||||
|
<category name="facelets.compiler"> |
||||
|
<priority value="WARN"/> |
||||
|
</category> |
||||
|
|
||||
|
<!-- Limit the verbose ajax4jsf cache initialization --> |
||||
|
<category name="org.ajax4jsf.cache"> |
||||
|
<priority value="WARN"/> |
||||
|
</category> |
||||
|
|
||||
|
<!-- Limit the verbose embedded jopr categories --> |
||||
|
<category name="org.rhq"> |
||||
|
<priority value="WARN"/> |
||||
|
</category> |
||||
|
|
||||
|
<!-- Limit the verbose seam categories --> |
||||
|
<category name="org.jboss.seam"> |
||||
|
<priority value="WARN"/> |
||||
|
</category> |
||||
|
|
||||
|
<!-- Show the evolution of the DataSource pool in the logs [inUse/Available/Max] |
||||
|
<category name="org.jboss.resource.connectionmanager.JBossManagedConnectionPool"> |
||||
|
<priority value="TRACE"/> |
||||
|
</category> |
||||
|
--> |
||||
|
|
||||
|
<!-- Category specifically for Security Audit Provider |
||||
|
<category name="org.jboss.security.audit.providers.LogAuditProvider" additivity="false"> |
||||
|
<priority value="TRACE"/> |
||||
|
<appender-ref ref="AUDIT"/> |
||||
|
</category> |
||||
|
--> |
||||
|
|
||||
|
<!-- Limit the org.jboss.serial (jboss-serialization) to INFO as its DEBUG is verbose --> |
||||
|
<category name="org.jboss.serial"> |
||||
|
<priority value="INFO"/> |
||||
|
</category> |
||||
|
|
||||
|
<!-- Decrease the priority threshold for the org.jboss.varia category |
||||
|
<category name="org.jboss.varia"> |
||||
|
<priority value="DEBUG"/> |
||||
|
</category> |
||||
|
--> |
||||
|
|
||||
|
<!-- Enable JBossWS message tracing |
||||
|
<category name="org.jboss.ws.core.MessageTrace"> |
||||
|
<priority value="TRACE"/> |
||||
|
</category> |
||||
|
--> |
||||
|
|
||||
|
<!-- |
||||
|
| An example of enabling the custom TRACE level priority that is used |
||||
|
| by the JBoss internals to diagnose low level details. This example |
||||
|
| turns on TRACE level msgs for the org.jboss.ejb.plugins package and its |
||||
|
| subpackages. This will produce A LOT of logging output. |
||||
|
| |
||||
|
| Note: since jboss AS 4.2.x, the trace level is supported natively by |
||||
|
| log4j, so although the custom org.jboss.logging.XLevel priority will |
||||
|
| still work, there is no need to use it. The two examples that follow |
||||
|
| will both enable trace logging. |
||||
|
<category name="org.jboss.system"> |
||||
|
<priority value="TRACE" class="org.jboss.logging.XLevel"/> |
||||
|
</category> |
||||
|
<category name="org.jboss.ejb.plugins"> |
||||
|
<priority value="TRACE"/> |
||||
|
</category> |
||||
|
--> |
||||
|
|
||||
|
<!-- |
||||
|
| Logs these events to SNMP: |
||||
|
- server starts/stops |
||||
|
- cluster evolution (node death/startup) |
||||
|
- When an EJB archive is deployed (and associated verified messages) |
||||
|
- When an EAR archive is deployed |
||||
|
|
||||
|
<category name="org.jboss.system.server.Server"> |
||||
|
<priority value="INFO" /> |
||||
|
<appender-ref ref="TRAP_LOG"/> |
||||
|
</category> |
||||
|
|
||||
|
<category name="org.jboss.ha.framework.interfaces.HAPartition.lifecycle"> |
||||
|
<priority value="INFO" /> |
||||
|
<appender-ref ref="TRAP_LOG"/> |
||||
|
</category> |
||||
|
|
||||
|
<category name="org.jboss.deployment.MainDeployer"> |
||||
|
<priority value="ERROR" /> |
||||
|
<appender-ref ref="TRAP_LOG"/> |
||||
|
</category> |
||||
|
|
||||
|
<category name="org.jboss.ejb.EJBDeployer"> |
||||
|
<priority value="INFO" /> |
||||
|
<appender-ref ref="TRAP_LOG"/> |
||||
|
</category> |
||||
|
|
||||
|
<category name="org.jboss.deployment.EARDeployer"> |
||||
|
<priority value="INFO" /> |
||||
|
<appender-ref ref="TRAP_LOG"/> |
||||
|
</category> |
||||
|
--> |
||||
|
|
||||
|
<!-- Clustering logging --> |
||||
|
<!-- Uncomment the following to redirect the org.jgroups and |
||||
|
org.jboss.ha categories to a cluster.log file. |
||||
|
|
||||
|
<appender name="CLUSTER" class="org.jboss.logging.appender.RollingFileAppender"> |
||||
|
<errorHandler class="org.jboss.logging.util.OnlyOnceErrorHandler"/> |
||||
|
<param name="File" value="${jboss.server.log.dir}/cluster.log"/> |
||||
|
<param name="Append" value="false"/> |
||||
|
<param name="MaxFileSize" value="500KB"/> |
||||
|
<param name="MaxBackupIndex" value="1"/> |
||||
|
|
||||
|
<layout class="org.apache.log4j.PatternLayout"> |
||||
|
<param name="ConversionPattern" value="%d %-5p [%c] %m%n"/> |
||||
|
</layout> |
||||
|
</appender> |
||||
|
<category name="org.jgroups"> |
||||
|
<priority value="DEBUG" /> |
||||
|
<appender-ref ref="CLUSTER"/> |
||||
|
</category> |
||||
|
<category name="org.jboss.ha"> |
||||
|
<priority value="DEBUG" /> |
||||
|
<appender-ref ref="CLUSTER"/> |
||||
|
</category> |
||||
|
--> |
||||
|
|
||||
|
<!-- ======================= --> |
||||
|
<!-- Setup the Root category --> |
||||
|
<!-- ======================= --> |
||||
|
|
||||
|
<!-- |
||||
|
TODO The CONSOLE appender should not be used when running as a service |
||||
|
or the '/bin/run.log' will get out of control |
||||
|
--> |
||||
|
|
||||
|
<root> |
||||
|
<!-- |
||||
|
Set the root logger priority via a system property. Note this is parsed by log4j, |
||||
|
so the full JBoss system property format is not supported; e.g. |
||||
|
setting a default via ${jboss.server.log.threshold:WARN} will not work. |
||||
|
--> |
||||
|
<priority value="${jboss.server.log.threshold}"/> |
||||
|
<appender-ref ref="CONSOLE"/> |
||||
|
<appender-ref ref="FILE"/> |
||||
|
</root> |
||||
|
|
||||
|
</log4j:configuration> |
||||
@ -0,0 +1,26 @@ |
|||||
|
############################################### |
||||
|
##### Please do not delete this file ########## |
||||
|
############################################### |
||||
|
|
||||
|
### General Information |
||||
|
# Install folder |
||||
|
# All products are installed in subfolders under this folder |
||||
|
# This is parent product root selected by the user |
||||
|
# For e.g. C:\\Program Files\\smwamui |
||||
|
DEFAULT_INSTALL_FOLDER={{ sm_home }} |
||||
|
|
||||
|
# Server Port |
||||
|
# Port on which application server is going to run |
||||
|
# For e.g. 8080 |
||||
|
DEFAULT_APP_SERVER_PORT=48080 |
||||
|
|
||||
|
# Server Name |
||||
|
# Please enter the fully qualified hostname or IPV4 IP Address or IPV6 IP address |
||||
|
# servername.domain (fully qualifies hostname) OR |
||||
|
# 138.42.194.91 (IPv4 Address) |
||||
|
# 2001:0db8:3c4d:0015:0000:0000:abcd:ef12 (IPV6 Address) |
||||
|
DEFAULT_APP_SERVER_HOST={{ ansible_fqdn }} |
||||
|
|
||||
|
# Review the LGPL license (JBossORG-EULA.txt), located in the directory USER_INSTALL_DIR |
||||
|
# To accept the license, set this (ACCEPT_LGPL_EULA) variable to YES |
||||
|
ACCEPT_LGPL_EULA=YES |
||||
@ -0,0 +1,81 @@ |
|||||
|
--- |
||||
|
- name: This module only works on CentOS 6 |
||||
|
assert: |
||||
|
that: |
||||
|
- "ansible_os_family == 'RedHat'" |
||||
|
|
||||
|
- name: Install compat–gcc-34-c++ |
||||
|
yum: name=compat-gcc-34-c++ state=present |
||||
|
|
||||
|
- name: Upgrade all required libs (64 bits version) |
||||
|
yum: name={{ item }} state=latest |
||||
|
when: "ansible_architecture == 'x86_64'" |
||||
|
with_items: |
||||
|
- ncurses-libs.x86_64 |
||||
|
- compat-libtermcap.x86_64 |
||||
|
- libstdc++.x86_64 |
||||
|
- libXrender.x86_64 |
||||
|
- libXtst.x86_64 |
||||
|
- libuuid.x86_64 |
||||
|
- libSM.x86_64 |
||||
|
- libXext.x86_64 |
||||
|
- libXi.x86_64 |
||||
|
- libXft.x86_64 |
||||
|
- libXt.x86_64 |
||||
|
- libXp.x86_64 |
||||
|
- freetype.x86_64 |
||||
|
- expat.x86_64 |
||||
|
- fontconfig.x86_64 |
||||
|
- libX11.x86_64 |
||||
|
- libxcb.x86_64 |
||||
|
- libXau.x86_64 |
||||
|
- compat-db42.x86_64 |
||||
|
- compat-db43.x86_64 |
||||
|
- libICE.x86_64 |
||||
|
- compat-libstdc++-33.x86_64 |
||||
|
- compat-db.x86_64 |
||||
|
|
||||
|
- name: Install all required libs (32 bits version) |
||||
|
yum: name={{ item }} state=present |
||||
|
with_items: |
||||
|
- ncurses-libs.i686 |
||||
|
- compat-libtermcap.i686 |
||||
|
- libstdc++.i686 |
||||
|
- libXrender.i686 |
||||
|
- libXtst.i686 |
||||
|
- libuuid.i686 |
||||
|
- libSM.i686 |
||||
|
- libXext.i686 |
||||
|
- libXi.i686 |
||||
|
- libXft.i686 |
||||
|
- libXt.i686 |
||||
|
- libXp.i686 |
||||
|
- freetype.i686 |
||||
|
- expat.i686 |
||||
|
- fontconfig.i686 |
||||
|
- libX11.i686 |
||||
|
- libxcb.i686 |
||||
|
- libXau.i686 |
||||
|
- compat-db42.i686 |
||||
|
- compat-db43.i686 |
||||
|
- libICE.i686 |
||||
|
- compat-libstdc++-33.i686 |
||||
|
- compat-db.i686 |
||||
|
|
||||
|
- name: Install KSH |
||||
|
yum: name=ksh state=installed |
||||
|
|
||||
|
- name: Install xauth (needed by smconsole) |
||||
|
yum: name=xorg-x11-xauth state=present |
||||
|
|
||||
|
- name: Install RNGD |
||||
|
yum: name=rng-tools state=installed |
||||
|
|
||||
|
- name: Install the RNGD configuration |
||||
|
lineinfile: dest=/etc/sysconfig/rngd line='EXTRAOPTIONS="-r /dev/urandom -o /dev/random -b -t .1"' regexp="^EXTRAOPTIONS=" |
||||
|
|
||||
|
- name: Restart RNGD and make sure it is enabled |
||||
|
service: name=rngd state=restarted enabled=yes |
||||
|
|
||||
|
- name: Install patch (needed by ansible) |
||||
|
yum: name=patch state=installed |
||||
@ -0,0 +1 @@ |
|||||
|
*.zip |
||||
@ -0,0 +1,528 @@ |
|||||
|
<?xml version="1.0" encoding="UTF-8"?> |
||||
|
<!-- Created by CA SiteMinder Version 12.52.0100.499 |
||||
|
by os:smuser |
||||
|
at 11:45:34 on 2015-02-23 --> |
||||
|
<!-- Uses schema "CA_SiteMinder_WAM-XPS2.xsd". This file |
||||
|
can be found on policy servers under siteminder/db --> |
||||
|
<XPS xmlns:xs="http://www.w3.org/2001/XMLSchema-instance" |
||||
|
xs:noNamespaceSchemaLocation="CA_SiteMinder_WAM-XPS2.xsd"> |
||||
|
<XPSVersion>1</XPSVersion> |
||||
|
<HostInformation>ca-sso</HostInformation> |
||||
|
<XPSAdmin>os:smuser</XPSAdmin> |
||||
|
<PolicyData IsDumpExport="false"> |
||||
|
<References> |
||||
|
<ReferenceValue ReferenceId="Ref00001"> |
||||
|
<StringValue>127.0.0.1,44441,44442,44443</StringValue> |
||||
|
</ReferenceValue> |
||||
|
<ReferenceValue ReferenceId="Ref00002"> |
||||
|
<StringValue>localhost:1389</StringValue> |
||||
|
</ReferenceValue> |
||||
|
<ReferenceValue ReferenceId="Ref00003"> |
||||
|
<StringValue>o=ACME</StringValue> |
||||
|
</ReferenceValue> |
||||
|
<ReferenceObject ReferenceId="Ref00004" ObjectClass="CA.SM::AgentType"> |
||||
|
<Xid>CA.SM::AgentType@10-8d78bb96-ae15-11d1-9cdd-006008aac24b</Xid> |
||||
|
<Attribute Name="CA.SM::AgentType.Name" Type="Identity"> |
||||
|
<StringValue>Web Agent</StringValue> |
||||
|
</Attribute> |
||||
|
<Attribute Name="CA.SM::AgentType.Desc" Type="Comment"> |
||||
|
<StringValue>SiteMinder Web Agent</StringValue> |
||||
|
</Attribute> |
||||
|
</ReferenceObject> |
||||
|
</References> |
||||
|
<Object Class="CA.SM::Agent" Xid="CA.SM::Agent@01-00094e34-f4da-14ea-b2ed-00017f0090ad" CreatedDateTime="2015-02-23T09:37:30" UpdatedBy="siteminder" UpdateMethod="GUI" ExportType="Add"> |
||||
|
<Property Name="CA.SM::Agent.AgentTypeLink"> |
||||
|
<LinkValue> |
||||
|
<XREF>Ref00004</XREF> |
||||
|
</LinkValue> |
||||
|
</Property> |
||||
|
<Property Name="CA.SM::Agent.RealmHintAttrId"> |
||||
|
<NumberValue>0</NumberValue> |
||||
|
</Property> |
||||
|
<Property Name="CA.SM::Agent.Name"> |
||||
|
<StringValue>agent_default</StringValue> |
||||
|
</Property> |
||||
|
<Property Name="CA.SM::Agent.Desc"> |
||||
|
<StringValue>Default VHOST Agent</StringValue> |
||||
|
</Property> |
||||
|
</Object><!-- Xid="CA.SM::Agent@01-00094e34-f4da-14ea-b2ed-00017f0090ad" --> |
||||
|
<Object Class="CA.SM::Agent" Xid="CA.SM::Agent@01-0003e1dc-f4fb-14ea-b2ed-00017f0090ad" CreatedDateTime="2015-02-23T09:38:03" UpdatedBy="siteminder" UpdateMethod="GUI" ExportType="Add"> |
||||
|
<Property Name="CA.SM::Agent.AgentTypeLink"> |
||||
|
<LinkValue> |
||||
|
<XREF>Ref00004</XREF> |
||||
|
</LinkValue> |
||||
|
</Property> |
||||
|
<Property Name="CA.SM::Agent.RealmHintAttrId"> |
||||
|
<NumberValue>0</NumberValue> |
||||
|
</Property> |
||||
|
<Property Name="CA.SM::Agent.Name"> |
||||
|
<StringValue>agent_waop</StringValue> |
||||
|
</Property> |
||||
|
<Property Name="CA.SM::Agent.Desc"> |
||||
|
<StringValue>Option Pack's Agent</StringValue> |
||||
|
</Property> |
||||
|
</Object><!-- Xid="CA.SM::Agent@01-0003e1dc-f4fb-14ea-b2ed-00017f0090ad" --> |
||||
|
<Object Class="CA.SM::AgentConfig" Xid="CA.SM::AgentConfig@21-0007dd6b-f55e-14ea-b2ed-00017f0090ad" CreatedDateTime="2015-02-23T09:39:43" UpdatedBy="siteminder" UpdateMethod="GUI" ExportType="Add"> |
||||
|
<Property Name="CA.SM::AgentConfig.Attributes"> |
||||
|
<StringValue>UseSecureCookies=0=no</StringValue> |
||||
|
<StringValue>FCCCompatMode=0=no</StringValue> |
||||
|
<StringValue>#EnableFormCache=0=</StringValue> |
||||
|
<StringValue>#LogoffUri=0=</StringValue> |
||||
|
<StringValue>LogFileName=0=</StringValue> |
||||
|
<StringValue>RequireCookies=0=yes</StringValue> |
||||
|
<StringValue>MaxUrlSize=0=4097</StringValue> |
||||
|
<StringValue>LegacyVariables=0=yes</StringValue> |
||||
|
<StringValue>CssChecking=0=yes</StringValue> |
||||
|
<StringValue>UseSecureCPCookies=0=no</StringValue> |
||||
|
<StringValue>#FormCacheTimeOut=0=</StringValue> |
||||
|
<StringValue>TransientIPCheck=0=no</StringValue> |
||||
|
<StringValue>ConstructFullPwsvcURL=0=no</StringValue> |
||||
|
<StringValue>#DlpErrorFile=0=</StringValue> |
||||
|
<StringValue>#IgnoreUrl=0=</StringValue> |
||||
|
<StringValue>#SSOTrustedZone=0=</StringValue> |
||||
|
<StringValue>#MaxTimeoutURL=0=</StringValue> |
||||
|
<StringValue>TargetAsRelativeURI=0=no</StringValue> |
||||
|
<StringValue>LogAppend=0=no</StringValue> |
||||
|
<StringValue>MaxSessionCacheSize=0=750</StringValue> |
||||
|
<StringValue>#ForceGetSessionData=0=</StringValue> |
||||
|
<StringValue>LogFileSize=0=100</StringValue> |
||||
|
<StringValue>#PreserveHeaders=0=</StringValue> |
||||
|
<StringValue>#BadFormChars=0=%3C%2C%3E%2C%26%2C%2522</StringValue> |
||||
|
<StringValue>#EnableWebAgent=0=</StringValue> |
||||
|
<StringValue>EnableMonitoring=0=yes</StringValue> |
||||
|
<StringValue>#ValidTargetDomain=0=no</StringValue> |
||||
|
<StringValue>#TraceDelimiter=0=</StringValue> |
||||
|
<StringValue>CookieDomainScope=0=0</StringValue> |
||||
|
<StringValue>#EnableNTChallengeResponse=0=</StringValue> |
||||
|
<StringValue>#CustomIpHeader=0=no</StringValue> |
||||
|
<StringValue>SessionUpdatePeriod=0=60</StringValue> |
||||
|
<StringValue>#ExpireForProxy=0=</StringValue> |
||||
|
<StringValue>DefaultAgentName=2=agent_default</StringValue> |
||||
|
<StringValue>#LogLocalTime=0=yes</StringValue> |
||||
|
<StringValue>#ProxyHeadersAutoAuth10=0=</StringValue> |
||||
|
<StringValue>#OverlookSessionForMethods=0=no</StringValue> |
||||
|
<StringValue>#StoreSessioninServer=0=</StringValue> |
||||
|
<StringValue>#OverlookSessionForMethodUri=0=</StringValue> |
||||
|
<StringValue>#BadQueryChars=0=</StringValue> |
||||
|
<StringValue>#ProxyHeadersAutoAuth=0=</StringValue> |
||||
|
<StringValue>#DlpSupportEnabled=0=None</StringValue> |
||||
|
<StringValue>#SecureApps=0=yes</StringValue> |
||||
|
<StringValue>#HostConfigFile=0=</StringValue> |
||||
|
<StringValue>ProxyTimeout=0=120</StringValue> |
||||
|
<StringValue>DisableDotDotRule=0=no</StringValue> |
||||
|
<StringValue>#LegacyTransferEncoding=0=</StringValue> |
||||
|
<StringValue>#LegacyEncoding=0=</StringValue> |
||||
|
<StringValue>#AcceptTPCookie=0=</StringValue> |
||||
|
<StringValue>#FCCForcelsProtected=0=</StringValue> |
||||
|
<StringValue>TraceFile=0=no</StringValue> |
||||
|
<StringValue>#4xCompatMode=0=</StringValue> |
||||
|
<StringValue>UseAnonAccess=0=no</StringValue> |
||||
|
<StringValue>MaxResourceCacheSize=0=750</StringValue> |
||||
|
<StringValue>#PostPreservationFile=0=</StringValue> |
||||
|
<StringValue>#EnableAccounting=0=</StringValue> |
||||
|
<StringValue>EnforcePolicies=0=yes</StringValue> |
||||
|
<StringValue>LimitCookieProvider=0=no</StringValue> |
||||
|
<StringValue>#CssErrorfile=0=</StringValue> |
||||
|
<StringValue>#IdleTimeoutURL=0=</StringValue> |
||||
|
<StringValue>#Custom401ErrorFile=0=no</StringValue> |
||||
|
<StringValue>TraceAppend=0=no</StringValue> |
||||
|
<StringValue>#UseServerRequestIp=0=no</StringValue> |
||||
|
<StringValue>PersistentIPCheck=0=yes</StringValue> |
||||
|
<StringValue>#LegacyCookieProvider=0=no</StringValue> |
||||
|
<StringValue>PersistentCookies=0=no</StringValue> |
||||
|
<StringValue>#LegacyPostPreservationEncoding=0=</StringValue> |
||||
|
<StringValue>#LegalHostNameChars=0=</StringValue> |
||||
|
<StringValue>SFCCExt=0=.sfcc</StringValue> |
||||
|
<StringValue>#ReqCookieErrorFile=0=</StringValue> |
||||
|
<StringValue>#DefaultHostName=0=</StringValue> |
||||
|
<StringValue>EnableAuditing=0=no</StringValue> |
||||
|
<StringValue>FCCExt=0=.fcc</StringValue> |
||||
|
<StringValue>#BadCssChars=0=</StringValue> |
||||
|
<StringValue>#SharedSecret=0=</StringValue> |
||||
|
<StringValue>#TrackSessionDomain=0=</StringValue> |
||||
|
<StringValue>#RequireClientIP=0=</StringValue> |
||||
|
<StringValue>#ProxyHeadersDefaultTime=0=</StringValue> |
||||
|
<StringValue>#IgnoreCPFornotprotected=0=no</StringValue> |
||||
|
<StringValue>#DefaultLocale=0=</StringValue> |
||||
|
<StringValue>#UseHTTPOnlyCookies=0=</StringValue> |
||||
|
<StringValue>BadUrlChars=0=%2F%2F%2C.%2F%2C%2F.%2C%2F%2A%2C%2A.%2C~%2C%5C%2C%2500-%251f%2C%257f</StringValue> |
||||
|
<StringValue>EnableCookieProvider=0=yes</StringValue> |
||||
|
<StringValue>#CslCertUniqueAttribute=0=</StringValue> |
||||
|
<StringValue>CacheAnonymous=0=no</StringValue> |
||||
|
<StringValue>#XFrameOptions=0=</StringValue> |
||||
|
<StringValue>#HttpServicePrincipal=0=</StringValue> |
||||
|
<StringValue>DecodeQueryData=0=no</StringValue> |
||||
|
<StringValue>#AgentNamesAreFQHostNames=0=no</StringValue> |
||||
|
<StringValue>CCCExt=0=.ccc</StringValue> |
||||
|
<StringValue>#LowerCaseHTTP=0=yes</StringValue> |
||||
|
<StringValue>#CookieValidationPeriod=0=no</StringValue> |
||||
|
<StringValue>#PreservePostData=0=yes</StringValue> |
||||
|
<StringValue>SetRemoteUser=0=no</StringValue> |
||||
|
<StringValue>#ProxyHeadersTimeOutPercentage=0=</StringValue> |
||||
|
<StringValue>ProxyTrust=0=no</StringValue> |
||||
|
<StringValue>#LowerCaseProtocolSpecifier=0=</StringValue> |
||||
|
<StringValue>#SaveCredsTimeout=0=720</StringValue> |
||||
|
<StringValue>TraceConfigFile=0=</StringValue> |
||||
|
<StringValue>#DeleteCerts=0=no</StringValue> |
||||
|
<StringValue>#IgnoreHost=0=</StringValue> |
||||
|
<StringValue>#ClientLocalePreferred=0=no</StringValue> |
||||
|
<StringValue>ResourceCacheTimeout=0=600</StringValue> |
||||
|
<StringValue>AllowLocalConfig=0=no</StringValue> |
||||
|
<StringValue>CookieDomain=0=</StringValue> |
||||
|
<StringValue>#ProxyHeadersUnprotected10=0=</StringValue> |
||||
|
<StringValue>#UseSecureCPCookies=0=</StringValue> |
||||
|
<StringValue>#AutoAuthorizeOptions=0=</StringValue> |
||||
|
<StringValue>AllowCacheHeaders=0=no</StringValue> |
||||
|
<StringValue>SessionGracePeriod=0=30</StringValue> |
||||
|
<StringValue>#IgnoreXMLSDK=0=</StringValue> |
||||
|
<StringValue>#UseSessionForAnonymous=0=</StringValue> |
||||
|
<StringValue>#SSOZoneName=0=</StringValue> |
||||
|
<StringValue>TraceFileName=0=</StringValue> |
||||
|
<StringValue>#MasterCookiePath=0=%2Froot</StringValue> |
||||
|
<StringValue>#TraceFormat=0=</StringValue> |
||||
|
<StringValue>DisableAuthSrcVars=0=no</StringValue> |
||||
|
<StringValue>#OverlookSessionForUrls=0=no</StringValue> |
||||
|
<StringValue>#CookiePathScope=0=%2Froot</StringValue> |
||||
|
<StringValue>#ProxyHeadersProtected=0=</StringValue> |
||||
|
<StringValue>DisableSessionVars=0=no</StringValue> |
||||
|
<StringValue>#ProxyDefinition=0=no</StringValue> |
||||
|
<StringValue>#AgentWaitTime=0=5</StringValue> |
||||
|
<StringValue>#CookiePath=0=no</StringValue> |
||||
|
<StringValue>#ProxyHeadersUnprotected=0=</StringValue> |
||||
|
<StringValue>#SecureURLs=0=</StringValue> |
||||
|
<StringValue>#EncryptAgentName=0=yes</StringValue> |
||||
|
<StringValue>IgnoreQueryData=0=no</StringValue> |
||||
|
<StringValue>TraceFileSize=0=100</StringValue> |
||||
|
<StringValue>TransientIDCookies=0=no</StringValue> |
||||
|
<StringValue>#TraceFilesToKeep=0=</StringValue> |
||||
|
<StringValue>#KCCExt=0=</StringValue> |
||||
|
<StringValue>SCCExt=0=.scc</StringValue> |
||||
|
<StringValue>#WebAppClientResponse=0=Resource%3D%7CMethod%3D%7CStatus%3D%7CBody%3D%7CContent-Type%3D%7CCharset%3D</StringValue> |
||||
|
<StringValue>#ProxyHeadersProtected10=0=</StringValue> |
||||
|
<StringValue>#CookieProvider=0=</StringValue> |
||||
|
<StringValue>#ExpiredCookieURL=0=</StringValue> |
||||
|
<StringValue>Logfile=0=no</StringValue> |
||||
|
<StringValue>ProxyAgent=0=no</StringValue> |
||||
|
<StringValue>DisableUserNameVars=0=no</StringValue> |
||||
|
<StringValue>#SmpsServicePrincipal=0=</StringValue> |
||||
|
<StringValue>#EnforceRealmTimeouts=0=no</StringValue> |
||||
|
<StringValue>#ConformToRFC2047=0=yes</StringValue> |
||||
|
<StringValue>#ForceCookieDomain=0=no</StringValue> |
||||
|
<StringValue>#RemoteUserVar=0=</StringValue> |
||||
|
<StringValue>#AgentName=0=</StringValue> |
||||
|
<StringValue>#Localization=0=yes</StringValue> |
||||
|
<StringValue>#EnableFccWindowsAuth=0=no</StringValue> |
||||
|
<StringValue>#HttpheaderEncodingSpec=0=</StringValue> |
||||
|
<StringValue>PSPollInterval=0=30</StringValue> |
||||
|
<StringValue>#DisableDNSLookup=0=</StringValue> |
||||
|
<StringValue>#HttpsPorts=0=no</StringValue> |
||||
|
<StringValue>#DisallowUTF8NonCanonical=0=</StringValue> |
||||
|
<StringValue>#ForceFQHost=0=no</StringValue> |
||||
|
<StringValue>#DlpExclusionList=0=.aspx%2C.html%2C.htm%2C.ico%2C.jpg</StringValue> |
||||
|
<StringValue>#CslMaxCacheEntries=0=1000</StringValue> |
||||
|
<StringValue>#ServerErrorFile=0=</StringValue> |
||||
|
<StringValue>#LogFilesToKeep=0=</StringValue> |
||||
|
<StringValue>#GetPortFromHeaders=0=no</StringValue> |
||||
|
<StringValue>IgnoreExt=0=.class%2C.gif%2C.jpg%2C.jpeg%2C.png%2C.fcc%2C.scc%2C.sfcc%2C.ccc%2C.ntc%2C.sac</StringValue> |
||||
|
<StringValue>NTCExt=0=.ntc</StringValue> |
||||
|
<StringValue>OverrideIgnoreExtFilter=0=</StringValue> |
||||
|
</Property><!-- Name="CA.SM::AgentConfig.Attributes" --> |
||||
|
<Property Name="CA.SM::AgentConfig.Name"> |
||||
|
<StringValue>ACO_Apache</StringValue> |
||||
|
</Property> |
||||
|
<Property Name="CA.SM::AgentConfig.Desc"> |
||||
|
<StringValue>Apache's Agent Configuration</StringValue> |
||||
|
</Property> |
||||
|
</Object><!-- Xid="CA.SM::AgentConfig@21-0007dd6b-f55e-14ea-b2ed-00017f0090ad" --> |
||||
|
<Object Class="CA.SM::AgentConfig" Xid="CA.SM::AgentConfig@21-0006cccd-f595-14ea-b2ed-00017f0090ad" CreatedDateTime="2015-02-23T09:40:38" UpdatedBy="siteminder" UpdateMethod="GUI" ExportType="Add"> |
||||
|
<Property Name="CA.SM::AgentConfig.Attributes"> |
||||
|
<StringValue>UseSecureCookies=0=no</StringValue> |
||||
|
<StringValue>FCCCompatMode=0=no</StringValue> |
||||
|
<StringValue>#EnableFormCache=0=</StringValue> |
||||
|
<StringValue>#LogoffUri=0=</StringValue> |
||||
|
<StringValue>LogFileName=0=</StringValue> |
||||
|
<StringValue>RequireCookies=0=yes</StringValue> |
||||
|
<StringValue>MaxUrlSize=0=4097</StringValue> |
||||
|
<StringValue>LegacyVariables=0=yes</StringValue> |
||||
|
<StringValue>CssChecking=0=yes</StringValue> |
||||
|
<StringValue>UseSecureCPCookies=0=no</StringValue> |
||||
|
<StringValue>#FormCacheTimeOut=0=</StringValue> |
||||
|
<StringValue>TransientIPCheck=0=no</StringValue> |
||||
|
<StringValue>ConstructFullPwsvcURL=0=no</StringValue> |
||||
|
<StringValue>#DlpErrorFile=0=</StringValue> |
||||
|
<StringValue>#IgnoreUrl=0=</StringValue> |
||||
|
<StringValue>#SSOTrustedZone=0=</StringValue> |
||||
|
<StringValue>#MaxTimeoutURL=0=</StringValue> |
||||
|
<StringValue>TargetAsRelativeURI=0=no</StringValue> |
||||
|
<StringValue>LogAppend=0=no</StringValue> |
||||
|
<StringValue>MaxSessionCacheSize=0=750</StringValue> |
||||
|
<StringValue>#ForceGetSessionData=0=</StringValue> |
||||
|
<StringValue>LogFileSize=0=100</StringValue> |
||||
|
<StringValue>#PreserveHeaders=0=</StringValue> |
||||
|
<StringValue>#BadFormChars=0=%3C%2C%3E%2C%26%2C%2522</StringValue> |
||||
|
<StringValue>#EnableWebAgent=0=</StringValue> |
||||
|
<StringValue>#ValidTargetDomain=0=no</StringValue> |
||||
|
<StringValue>EnableMonitoring=0=yes</StringValue> |
||||
|
<StringValue>#TraceDelimiter=0=</StringValue> |
||||
|
<StringValue>CookieDomainScope=0=0</StringValue> |
||||
|
<StringValue>#EnableNTChallengeResponse=0=</StringValue> |
||||
|
<StringValue>SessionUpdatePeriod=0=60</StringValue> |
||||
|
<StringValue>#CustomIpHeader=0=no</StringValue> |
||||
|
<StringValue>#ExpireForProxy=0=</StringValue> |
||||
|
<StringValue>DefaultAgentName=2=agent_waop</StringValue> |
||||
|
<StringValue>#LogLocalTime=0=yes</StringValue> |
||||
|
<StringValue>#ProxyHeadersAutoAuth10=0=</StringValue> |
||||
|
<StringValue>#OverlookSessionForMethods=0=no</StringValue> |
||||
|
<StringValue>#StoreSessioninServer=0=</StringValue> |
||||
|
<StringValue>#OverlookSessionForMethodUri=0=</StringValue> |
||||
|
<StringValue>#BadQueryChars=0=</StringValue> |
||||
|
<StringValue>#ProxyHeadersAutoAuth=0=</StringValue> |
||||
|
<StringValue>#DlpSupportEnabled=0=None</StringValue> |
||||
|
<StringValue>#SecureApps=0=yes</StringValue> |
||||
|
<StringValue>#HostConfigFile=0=</StringValue> |
||||
|
<StringValue>ProxyTimeout=0=120</StringValue> |
||||
|
<StringValue>DisableDotDotRule=0=no</StringValue> |
||||
|
<StringValue>#LegacyTransferEncoding=0=</StringValue> |
||||
|
<StringValue>#LegacyEncoding=0=</StringValue> |
||||
|
<StringValue>#AcceptTPCookie=0=</StringValue> |
||||
|
<StringValue>#FCCForcelsProtected=0=</StringValue> |
||||
|
<StringValue>TraceFile=0=no</StringValue> |
||||
|
<StringValue>#4xCompatMode=0=</StringValue> |
||||
|
<StringValue>UseAnonAccess=0=no</StringValue> |
||||
|
<StringValue>MaxResourceCacheSize=0=750</StringValue> |
||||
|
<StringValue>#PostPreservationFile=0=</StringValue> |
||||
|
<StringValue>#EnableAccounting=0=</StringValue> |
||||
|
<StringValue>EnforcePolicies=0=yes</StringValue> |
||||
|
<StringValue>LimitCookieProvider=0=no</StringValue> |
||||
|
<StringValue>#CssErrorfile=0=</StringValue> |
||||
|
<StringValue>#IdleTimeoutURL=0=</StringValue> |
||||
|
<StringValue>#Custom401ErrorFile=0=no</StringValue> |
||||
|
<StringValue>TraceAppend=0=no</StringValue> |
||||
|
<StringValue>#UseServerRequestIp=0=no</StringValue> |
||||
|
<StringValue>PersistentIPCheck=0=yes</StringValue> |
||||
|
<StringValue>#LegacyCookieProvider=0=no</StringValue> |
||||
|
<StringValue>PersistentCookies=0=no</StringValue> |
||||
|
<StringValue>#LegacyPostPreservationEncoding=0=</StringValue> |
||||
|
<StringValue>#LegalHostNameChars=0=</StringValue> |
||||
|
<StringValue>SFCCExt=0=.sfcc</StringValue> |
||||
|
<StringValue>#ReqCookieErrorFile=0=</StringValue> |
||||
|
<StringValue>#DefaultHostName=0=</StringValue> |
||||
|
<StringValue>EnableAuditing=0=no</StringValue> |
||||
|
<StringValue>FCCExt=0=.fcc</StringValue> |
||||
|
<StringValue>#BadCssChars=0=</StringValue> |
||||
|
<StringValue>#SharedSecret=0=</StringValue> |
||||
|
<StringValue>#TrackSessionDomain=0=</StringValue> |
||||
|
<StringValue>#RequireClientIP=0=</StringValue> |
||||
|
<StringValue>#ProxyHeadersDefaultTime=0=</StringValue> |
||||
|
<StringValue>#IgnoreCPFornotprotected=0=no</StringValue> |
||||
|
<StringValue>#DefaultLocale=0=</StringValue> |
||||
|
<StringValue>#UseHTTPOnlyCookies=0=</StringValue> |
||||
|
<StringValue>BadUrlChars=0=%2F%2F%2C.%2F%2C%2F.%2C%2F%2A%2C%2A.%2C~%2C%5C%2C%2500-%251f%2C%257f</StringValue> |
||||
|
<StringValue>EnableCookieProvider=0=yes</StringValue> |
||||
|
<StringValue>#CslCertUniqueAttribute=0=</StringValue> |
||||
|
<StringValue>CacheAnonymous=0=no</StringValue> |
||||
|
<StringValue>#XFrameOptions=0=</StringValue> |
||||
|
<StringValue>#HttpServicePrincipal=0=</StringValue> |
||||
|
<StringValue>DecodeQueryData=0=no</StringValue> |
||||
|
<StringValue>#AgentNamesAreFQHostNames=0=no</StringValue> |
||||
|
<StringValue>CCCExt=0=.ccc</StringValue> |
||||
|
<StringValue>#LowerCaseHTTP=0=yes</StringValue> |
||||
|
<StringValue>#CookieValidationPeriod=0=no</StringValue> |
||||
|
<StringValue>#PreservePostData=0=yes</StringValue> |
||||
|
<StringValue>SetRemoteUser=0=no</StringValue> |
||||
|
<StringValue>#ProxyHeadersTimeOutPercentage=0=</StringValue> |
||||
|
<StringValue>ProxyTrust=0=no</StringValue> |
||||
|
<StringValue>#LowerCaseProtocolSpecifier=0=</StringValue> |
||||
|
<StringValue>#SaveCredsTimeout=0=720</StringValue> |
||||
|
<StringValue>TraceConfigFile=0=</StringValue> |
||||
|
<StringValue>#DeleteCerts=0=no</StringValue> |
||||
|
<StringValue>#IgnoreHost=0=</StringValue> |
||||
|
<StringValue>#ClientLocalePreferred=0=no</StringValue> |
||||
|
<StringValue>ResourceCacheTimeout=0=600</StringValue> |
||||
|
<StringValue>AllowLocalConfig=0=no</StringValue> |
||||
|
<StringValue>CookieDomain=0=</StringValue> |
||||
|
<StringValue>#ProxyHeadersUnprotected10=0=</StringValue> |
||||
|
<StringValue>#UseSecureCPCookies=0=</StringValue> |
||||
|
<StringValue>#AutoAuthorizeOptions=0=</StringValue> |
||||
|
<StringValue>AllowCacheHeaders=0=no</StringValue> |
||||
|
<StringValue>SessionGracePeriod=0=30</StringValue> |
||||
|
<StringValue>#IgnoreXMLSDK=0=</StringValue> |
||||
|
<StringValue>#UseSessionForAnonymous=0=</StringValue> |
||||
|
<StringValue>#SSOZoneName=0=</StringValue> |
||||
|
<StringValue>TraceFileName=0=</StringValue> |
||||
|
<StringValue>#MasterCookiePath=0=%2Froot</StringValue> |
||||
|
<StringValue>#TraceFormat=0=</StringValue> |
||||
|
<StringValue>DisableAuthSrcVars=0=no</StringValue> |
||||
|
<StringValue>#OverlookSessionForUrls=0=no</StringValue> |
||||
|
<StringValue>#CookiePathScope=0=%2Froot</StringValue> |
||||
|
<StringValue>#ProxyHeadersProtected=0=</StringValue> |
||||
|
<StringValue>DisableSessionVars=0=no</StringValue> |
||||
|
<StringValue>#ProxyDefinition=0=no</StringValue> |
||||
|
<StringValue>#AgentWaitTime=0=5</StringValue> |
||||
|
<StringValue>#CookiePath=0=no</StringValue> |
||||
|
<StringValue>#ProxyHeadersUnprotected=0=</StringValue> |
||||
|
<StringValue>#SecureURLs=0=</StringValue> |
||||
|
<StringValue>#EncryptAgentName=0=yes</StringValue> |
||||
|
<StringValue>IgnoreQueryData=0=no</StringValue> |
||||
|
<StringValue>TraceFileSize=0=100</StringValue> |
||||
|
<StringValue>TransientIDCookies=0=no</StringValue> |
||||
|
<StringValue>#TraceFilesToKeep=0=</StringValue> |
||||
|
<StringValue>#KCCExt=0=</StringValue> |
||||
|
<StringValue>SCCExt=0=.scc</StringValue> |
||||
|
<StringValue>#WebAppClientResponse=0=Resource%3D%7CMethod%3D%7CStatus%3D%7CBody%3D%7CContent-Type%3D%7CCharset%3D</StringValue> |
||||
|
<StringValue>#ProxyHeadersProtected10=0=</StringValue> |
||||
|
<StringValue>#CookieProvider=0=</StringValue> |
||||
|
<StringValue>#ExpiredCookieURL=0=</StringValue> |
||||
|
<StringValue>Logfile=0=no</StringValue> |
||||
|
<StringValue>ProxyAgent=0=no</StringValue> |
||||
|
<StringValue>DisableUserNameVars=0=no</StringValue> |
||||
|
<StringValue>#SmpsServicePrincipal=0=</StringValue> |
||||
|
<StringValue>#EnforceRealmTimeouts=0=no</StringValue> |
||||
|
<StringValue>#ConformToRFC2047=0=yes</StringValue> |
||||
|
<StringValue>#ForceCookieDomain=0=no</StringValue> |
||||
|
<StringValue>#RemoteUserVar=0=</StringValue> |
||||
|
<StringValue>#AgentName=0=</StringValue> |
||||
|
<StringValue>#Localization=0=yes</StringValue> |
||||
|
<StringValue>#EnableFccWindowsAuth=0=no</StringValue> |
||||
|
<StringValue>#HttpheaderEncodingSpec=0=</StringValue> |
||||
|
<StringValue>PSPollInterval=0=30</StringValue> |
||||
|
<StringValue>#DisableDNSLookup=0=</StringValue> |
||||
|
<StringValue>#HttpsPorts=0=no</StringValue> |
||||
|
<StringValue>#DisallowUTF8NonCanonical=0=</StringValue> |
||||
|
<StringValue>#ForceFQHost=0=no</StringValue> |
||||
|
<StringValue>#DlpExclusionList=0=.aspx%2C.html%2C.htm%2C.ico%2C.jpg</StringValue> |
||||
|
<StringValue>#CslMaxCacheEntries=0=1000</StringValue> |
||||
|
<StringValue>#ServerErrorFile=0=</StringValue> |
||||
|
<StringValue>#LogFilesToKeep=0=</StringValue> |
||||
|
<StringValue>#GetPortFromHeaders=0=no</StringValue> |
||||
|
<StringValue>IgnoreExt=0=.class%2C.gif%2C.jpg%2C.jpeg%2C.png%2C.fcc%2C.scc%2C.sfcc%2C.ccc%2C.ntc%2C.sac</StringValue> |
||||
|
<StringValue>NTCExt=0=.ntc</StringValue> |
||||
|
<StringValue>OverrideIgnoreExtFilter=0=</StringValue> |
||||
|
</Property><!-- Name="CA.SM::AgentConfig.Attributes" --> |
||||
|
<Property Name="CA.SM::AgentConfig.Name"> |
||||
|
<StringValue>ACO_WAOP</StringValue> |
||||
|
</Property> |
||||
|
<Property Name="CA.SM::AgentConfig.Desc"> |
||||
|
<StringValue>Option Pack's Agent Configuration</StringValue> |
||||
|
</Property> |
||||
|
</Object><!-- Xid="CA.SM::AgentConfig@21-0006cccd-f595-14ea-b2ed-00017f0090ad" --> |
||||
|
<Object Class="CA.SM::UserDirectory" Xid="CA.SM::UserDirectory@0e-000bf2ee-f463-14ea-b2ed-00017f0090ad" CreatedDateTime="2015-02-23T09:35:31" UpdatedBy="siteminder" UpdateMethod="GUI" ExportType="Add"> |
||||
|
<Property Name="CA.SM::UserDirectory.UseAdvancedAuthStore"> |
||||
|
<BooleanValue>false</BooleanValue> |
||||
|
</Property> |
||||
|
<Property Name="CA.SM::UserDirectory.SearchScope"> |
||||
|
<NumberValue>2</NumberValue> |
||||
|
</Property> |
||||
|
<Property Name="CA.SM::UserDirectory.EnableSecurityContext"> |
||||
|
<BooleanValue>false</BooleanValue> |
||||
|
</Property> |
||||
|
<Property Name="CA.SM::UserDirectory.SearchRoot"> |
||||
|
<LinkValue><XREF>Ref00003</XREF></LinkValue> |
||||
|
</Property> |
||||
|
<Property Name="CA.SM::UserDirectory.Name"> |
||||
|
<StringValue>DIR_ACME</StringValue> |
||||
|
</Property> |
||||
|
<Property Name="CA.SM::UserDirectory.RequireCredentials"> |
||||
|
<BooleanValue>false</BooleanValue> |
||||
|
</Property> |
||||
|
<Property Name="CA.SM::UserDirectory.EmailAddrAttribute"> |
||||
|
<StringValue>mail</StringValue> |
||||
|
</Property> |
||||
|
<Property Name="CA.SM::UserDirectory.SecureConnection"> |
||||
|
<BooleanValue>false</BooleanValue> |
||||
|
</Property> |
||||
|
<Property Name="CA.SM::UserDirectory.UserLookupEnd"> |
||||
|
<StringValue>)</StringValue> |
||||
|
</Property> |
||||
|
<Property Name="CA.SM::UserDirectory.Desc"> |
||||
|
<StringValue>ACME Users</StringValue> |
||||
|
</Property> |
||||
|
<Property Name="CA.SM::UserDirectory.Server"> |
||||
|
<LinkValue><XREF>Ref00002</XREF></LinkValue> |
||||
|
</Property> |
||||
|
<Property Name="CA.SM::UserDirectory.UserLookupStart"> |
||||
|
<StringValue>(uid=</StringValue> |
||||
|
</Property> |
||||
|
<Property Name="CA.SM::UserDirectory.SearchTimeout"> |
||||
|
<NumberValue>30</NumberValue> |
||||
|
</Property> |
||||
|
<Property Name="CA.SM::UserDirectory.SearchResults"> |
||||
|
<NumberValue>0</NumberValue> |
||||
|
</Property> |
||||
|
<Property Name="CA.SM::UserDirectory.Namespace"> |
||||
|
<StringValue>LDAP:</StringValue> |
||||
|
</Property> |
||||
|
</Object><!-- Xid="CA.SM::UserDirectory@0e-000bf2ee-f463-14ea-b2ed-00017f0090ad" --> |
||||
|
<Object Class="CA.SM::HostConfig" Xid="CA.SM::HostConfig@21-000c9cb1-f404-14ea-b2ed-00017f0090ad" CreatedDateTime="2015-02-23T09:33:56" UpdatedBy="siteminder" UpdateMethod="GUI" ExportType="Add"> |
||||
|
<Property Name="CA.SM::HostConfig.NewSocketStep"> |
||||
|
<NumberValue>2</NumberValue> |
||||
|
</Property> |
||||
|
<Property Name="CA.SM::HostConfig.MinSocketsPerPort"> |
||||
|
<NumberValue>2</NumberValue> |
||||
|
</Property> |
||||
|
<Property Name="CA.SM::HostConfig.EnableFailOver"> |
||||
|
<BooleanValue>true</BooleanValue> |
||||
|
</Property> |
||||
|
<Property Name="CA.SM::HostConfig.PolicyServer"> |
||||
|
<LinkValue><XREF>Ref00001</XREF></LinkValue> |
||||
|
</Property> |
||||
|
<Property Name="CA.SM::HostConfig.Name"> |
||||
|
<StringValue>HCO_Local</StringValue> |
||||
|
</Property> |
||||
|
<Property Name="CA.SM::HostConfig.Desc"> |
||||
|
<StringValue>Local Policy Server</StringValue> |
||||
|
</Property> |
||||
|
<Property Name="CA.SM::HostConfig.RequestTimeout"> |
||||
|
<NumberValue>60</NumberValue> |
||||
|
</Property> |
||||
|
<Property Name="CA.SM::HostConfig.MaxSocketsPerPort"> |
||||
|
<NumberValue>20</NumberValue> |
||||
|
</Property> |
||||
|
</Object><!-- Xid="CA.SM::HostConfig@21-000c9cb1-f404-14ea-b2ed-00017f0090ad" --> |
||||
|
<Object Class="CA.SM::AuthScheme" Xid="CA.SM::AuthScheme@0d-00067686-f4a6-14ea-b2ed-00017f0090ad" CreatedDateTime="2015-02-23T09:36:38" UpdatedBy="siteminder" UpdateMethod="GUI" ExportType="Add"> |
||||
|
<Property Name="CA.SM::AuthScheme.PersistSessionVars"> |
||||
|
<BooleanValue>false</BooleanValue> |
||||
|
</Property> |
||||
|
<Property Name="CA.SM::AuthScheme.Name"> |
||||
|
<StringValue>AS_Form</StringValue> |
||||
|
</Property> |
||||
|
<Property Name="CA.SM::AuthScheme.AllowAuthLevelOverride"> |
||||
|
<BooleanValue>false</BooleanValue> |
||||
|
</Property> |
||||
|
<Property Name="CA.SM::AuthScheme.IsRadius"> |
||||
|
<BooleanValue>false</BooleanValue> |
||||
|
</Property> |
||||
|
<Property Name="CA.SM::AuthScheme.AllowSaveCreds"> |
||||
|
<BooleanValue>false</BooleanValue> |
||||
|
</Property> |
||||
|
<Property Name="CA.SM::AuthScheme.SupportsValidateIdentity"> |
||||
|
<BooleanValue>false</BooleanValue> |
||||
|
</Property> |
||||
|
<Property Name="CA.SM::AuthScheme.IgnorePwCheck"> |
||||
|
<BooleanValue>false</BooleanValue> |
||||
|
</Property> |
||||
|
<Property Name="CA.SM::AuthScheme.IsUsedbyAdmin"> |
||||
|
<BooleanValue>false</BooleanValue> |
||||
|
</Property> |
||||
|
<Property Name="CA.SM::AuthScheme.Desc"> |
||||
|
<StringValue>HTML Form Authentication Scheme</StringValue> |
||||
|
</Property> |
||||
|
<Property Name="CA.SM::AuthScheme.Level"> |
||||
|
<NumberValue>5</NumberValue> |
||||
|
</Property> |
||||
|
<Property Name="CA.SM::AuthScheme.IsTemplate"> |
||||
|
<BooleanValue>false</BooleanValue> |
||||
|
</Property> |
||||
|
<Property Name="CA.SM::AuthScheme.Param"> |
||||
|
<StringValue>/siteminderagent/forms/login.fcc;ACS=0;REL=1</StringValue> |
||||
|
</Property> |
||||
|
<Property Name="CA.SM::AuthScheme.Library"> |
||||
|
<StringValue>smauthhtml</StringValue> |
||||
|
</Property> |
||||
|
<Property Name="CA.SM::AuthScheme.Type"> |
||||
|
<NumberValue>4</NumberValue> |
||||
|
</Property> |
||||
|
</Object><!-- Xid="CA.SM::AuthScheme@0d-00067686-f4a6-14ea-b2ed-00017f0090ad" --> |
||||
|
</PolicyData> |
||||
|
</XPS> |
||||
|
<!-- 11:45:51 2015-02-23 --> |
||||
@ -0,0 +1,48 @@ |
|||||
|
45a46 |
||||
|
> Enabled= 0x1; REG_DWORD |
||||
|
53a55 |
||||
|
> Enabled= 0; REG_DWORD |
||||
|
60a63 |
||||
|
> Enabled= 0; REG_DWORD |
||||
|
174a178 |
||||
|
> Enabled= 0x1; REG_DWORD |
||||
|
185a190 |
||||
|
> Enabled= 0x1; REG_DWORD |
||||
|
210,211c215,216 |
||||
|
< RolloverOnStart= 0x1; REG_DWORD |
||||
|
< RolloverSize= 0xa; REG_DWORD |
||||
|
---
|
||||
|
> RolloverOnStart= 0; REG_DWORD |
||||
|
> RolloverSize= 0; REG_DWORD |
||||
|
227,228c232,233 |
||||
|
< TraceRolloverOnStart= 0x1; REG_DWORD |
||||
|
< TraceRolloverSize= 0xa; REG_DWORD |
||||
|
---
|
||||
|
> TraceRolloverOnStart= 0; REG_DWORD |
||||
|
> TraceRolloverSize= 0; REG_DWORD |
||||
|
244a250 |
||||
|
> KeyStoreProviderNamespace= LDAP:; REG_SZ |
||||
|
293,297c299,303 |
||||
|
< AffiliateFilter= 0; REG_DWORD |
||||
|
< AnonymousAuthFilter= 0; REG_DWORD |
||||
|
< AnonymousAzFilter= 0; REG_DWORD |
||||
|
< AuthFilter= 0; REG_DWORD |
||||
|
< AzFilter= 0; REG_DWORD |
||||
|
---
|
||||
|
> AffiliateFilter= 0x1; REG_DWORD |
||||
|
> AnonymousAuthFilter= 0x1; REG_DWORD |
||||
|
> AnonymousAzFilter= 0x1; REG_DWORD |
||||
|
> AuthFilter= 0x1; REG_DWORD |
||||
|
> AzFilter= 0x1; REG_DWORD |
||||
|
299a306 |
||||
|
> LogAccess= 0x1; REG_DWORD |
||||
|
303,304c310,311 |
||||
|
< RolloverOnStart= 0x1; REG_DWORD |
||||
|
< RolloverSize= 0xa; REG_DWORD |
||||
|
---
|
||||
|
> RolloverOnStart= 0; REG_DWORD |
||||
|
> RolloverSize= 0; REG_DWORD |
||||
|
310c317 |
||||
|
< UserAdminFilter= 0; REG_DWORD |
||||
|
---
|
||||
|
> UserAdminFilter= 0x1; REG_DWORD |
||||
@ -0,0 +1,247 @@ |
|||||
|
--- |
||||
|
- name: This module only works on CentOS 6 |
||||
|
assert: |
||||
|
that: |
||||
|
- "ansible_os_family == 'RedHat'" |
||||
|
|
||||
|
- name: Create the 'smuser' user |
||||
|
user: name={{ sm_user }} comment="CA SiteMinder User" shell=/bin/ksh |
||||
|
tags: user |
||||
|
|
||||
|
- name: Set SSH key for smuser |
||||
|
authorized_key: user={{ sm_user }} key="{{ ansible_ssh_public_key }}" manage_dir=yes |
||||
|
tags: user |
||||
|
|
||||
|
- name: Set the required .profile for smuser |
||||
|
template: src=profile dest=/home/{{ sm_user }}/.profile |
||||
|
sudo_user: "{{ sm_user }}" |
||||
|
tags: user |
||||
|
|
||||
|
- name: Copy the SiteMinder Policy Server files to sources_dir |
||||
|
unarchive: creates={{ sources_dir }}/ps-12.52-sp01-linux src=GEN08170134E-PolicyServerLinux.zip dest={{ sources_dir }} |
||||
|
|
||||
|
- name: Copy the unattended installation response file |
||||
|
template: src=ca-ps-installer.properties dest={{ sources_dir }}/ca-ps-installer.properties |
||||
|
|
||||
|
- name: Create the installation dir |
||||
|
file: path={{ sm_home }} owner={{ sm_user }} state=directory |
||||
|
|
||||
|
- name: Install SiteMinder (warning, no check !) |
||||
|
command: creates={{ sm_home }}/siteminder {{ sources_dir }}/ps-12.52-sp01-linux/ca-ps-12.52-sp01-linux.bin -f {{ sources_dir }}/ca-ps-installer.properties -i silent |
||||
|
sudo_user: "{{ sm_user }}" |
||||
|
ignore_errors: yes |
||||
|
|
||||
|
- name: Copy smreg |
||||
|
command: install {{ sources_dir }}/ps-12.52-sp01-linux/smreg {{ sm_home }}/siteminder/bin/smreg -m 755 -o {{ sm_user }} |
||||
|
|
||||
|
- name: Create the SiteMinderPS DSA |
||||
|
command: creates={{ dx_home }}/dxserver/config/knowledge/SiteMinderPS.dxc /bin/sh -l -c "dxnewdsa SiteMinderPS {{ sm_policy_store_port }} 'ou=PS,o=SiteMinder'" |
||||
|
sudo_user: "{{ dx_user }}" |
||||
|
|
||||
|
- name: Flag the SiteMinderPS DSA as "autostart" |
||||
|
file: path={{ dx_home }}/dxserver/config/autostart/SiteMinderPS state=touch |
||||
|
sudo_user: "{{ dx_user }}" |
||||
|
|
||||
|
- name: Copy netegrity.dxc to the right place |
||||
|
command: creates={{ dx_home }}/dxserver/config/schema/netegrity.dxc install -m 644 -o {{ dx_user }} -g {{ dx_group }} {{ sm_home }}/siteminder/eTrust/netegrity.dxc {{ dx_home }}/dxserver/config/schema/netegrity.dxc |
||||
|
|
||||
|
- name: Copy etrust.dxc to the right place |
||||
|
command: creates={{ dx_home }}/dxserver/config/schema/etrust.dxc install -m 644 -o {{ dx_user }} -g {{ dx_group }} {{ sm_home }}/siteminder/xps/db/etrust.dxc {{ dx_home }}/dxserver/config/schema/etrust.dxc |
||||
|
|
||||
|
- name: Create the smdsa.dxg (custom schema) |
||||
|
template: dest={{ dx_home }}/dxserver/config/schema/smdsa.dxg src=smdsa.dxg owner={{ sm_user }} mode=0644 |
||||
|
tags: config |
||||
|
|
||||
|
- name: Enable the custom schema |
||||
|
lineinfile: dest={{ dx_home }}/dxserver/config/servers/SiteMinderPS.dxi state=present regexp='^source "../schema/[a-z]+.dxg";' line='source "../schema/smdsa.dxg";' |
||||
|
tags: config |
||||
|
|
||||
|
- name: Set config 'ignore-name-bindings' |
||||
|
lineinfile: dest={{ dx_home }}/dxserver/config/servers/SiteMinderPS.dxi state=present insertafter="EOF" line='set ignore-name-bindings = true;' |
||||
|
tags: config |
||||
|
|
||||
|
- name: Create the smdsa.dxc (custom limits) |
||||
|
template: dest={{ dx_home }}/dxserver/config/limits/smdsa.dxc src=smdsa.dxc owner={{ dx_user }} mode=0644 |
||||
|
tags: config |
||||
|
|
||||
|
- name: Bind SiteMinderPS DSA on 127.0.0.1 only |
||||
|
lineinfile: dest="{{ dx_home }}/dxserver/config/knowledge/SiteMinderPS.dxc" line=' bind-address = "127.0.0.1"' insertafter="^\s*address\s*=" regexp='^\s*bind-address\s*=' |
||||
|
sudo_user: "{{ dx_user }}" |
||||
|
tags: config |
||||
|
|
||||
|
- name: Bind SiteMinderPS DSA on 127.0.0.1 only |
||||
|
lineinfile: dest="{{ dx_home }}/dxserver/config/knowledge/SiteMinderPS.dxc" line=' address = tcp "127.0.0.1" port \1' regexp='^\s*address\s*=\s*tcp\s*"[^"]*"\s*port\s*([0-9]+)' backrefs=yes |
||||
|
sudo_user: "{{ dx_user }}" |
||||
|
tags: config |
||||
|
|
||||
|
- name: Enable the custom limits |
||||
|
lineinfile: dest={{ dx_home }}/dxserver/config/servers/SiteMinderPS.dxi state=present regexp='^source "../limits/[a-z]+.dxc";' line='source "../limits/smdsa.dxc";' |
||||
|
tags: config |
||||
|
|
||||
|
- name: Copy the initial DSA to the sources dir |
||||
|
template: src=sm-ps.ldif dest={{ sources_dir }}/sm-ps.ldif |
||||
|
|
||||
|
- name: Stop the SiteMinderPS DSA |
||||
|
command: /bin/sh -l -c "dxserver stop SiteMinderPS" |
||||
|
sudo_user: "{{ dx_user }}" |
||||
|
|
||||
|
- name: Load the LDIF into the SiteMinderPS datastore |
||||
|
command: /bin/sh -l -c "dxloaddb SiteMinderPS {{ sources_dir }}/sm-ps.ldif" |
||||
|
sudo_user: "{{ dx_user }}" |
||||
|
|
||||
|
- name: Start the SiteMinderPS DSA |
||||
|
command: /bin/sh -l -c "dxserver start SiteMinderPS" |
||||
|
sudo_user: "{{ dx_user }}" |
||||
|
|
||||
|
- name: Register the SiteMinder Policy Store |
||||
|
command: /bin/ksh -l -c "smldapsetup reg -hlocalhost -p{{ sm_policy_store_port }} -dcn=DXAdmin,ou=PS,o=SiteMinder -wpassword -rou=PS,o=SiteMinder -v" |
||||
|
sudo_user: "{{ sm_user }}" |
||||
|
|
||||
|
- name: Set the SiteMinder admin password |
||||
|
command: /bin/ksh -l -c "smreg -su {{ sm_admin_password }}" |
||||
|
sudo_user: "{{ sm_user }}" |
||||
|
|
||||
|
- name: Run XPSDDInstall |
||||
|
command: chdir={{ sm_home }}/siteminder/xps/dd /bin/ksh -l -c "XPSDDInstall SmMaster.xdd" |
||||
|
sudo_user: "{{ sm_user }}" |
||||
|
|
||||
|
- name: Run XPSImport |
||||
|
command: chdir={{ sm_home }}/siteminder/db /bin/ksh -l -c "XPSImport smpolicy.xml -npass" |
||||
|
sudo_user: "{{ sm_user }}" |
||||
|
|
||||
|
- name: Disable the Healh Monitor |
||||
|
lineinfile: dest={{ sm_home }}/siteminder/config/siteminder.conf state=present regexp='^MONITOR_ENABLED=[a-zA-Z]+' line='MONITOR_ENABLED=no' |
||||
|
sudo_user: "{{ sm_user }}" |
||||
|
tags: config |
||||
|
|
||||
|
- name: Make a copy of the SiteMinder registry |
||||
|
command: creates={{ sm_home }}/siteminder/registry/sm.registry.initial cp {{ sm_home }}/siteminder/registry/sm.registry {{ sm_home }}/siteminder/registry/sm.registry.initial |
||||
|
sudo_user: "{{ sm_user }}" |
||||
|
|
||||
|
- name: Upload the patch file |
||||
|
copy: src=sm.registry.patch dest={{ sources_dir }}/sm.registry.patch |
||||
|
|
||||
|
- name: Patch the SiteMinder registry |
||||
|
command: patch {{ sm_home }}/siteminder/registry/sm.registry {{ sources_dir }}/sm.registry.patch |
||||
|
sudo_user: "{{ sm_user }}" |
||||
|
|
||||
|
- name: Create the SiteMinderSS DSA |
||||
|
command: creates={{ dx_home }}/dxserver/config/knowledge/SiteMinderSS.dxc /bin/sh -l -c "dxnewdsa SiteMinderSS {{ sm_session_store_port }} 'ou=SS,o=SiteMinder'" |
||||
|
sudo_user: "{{ dx_user }}" |
||||
|
when: sm_session_store_port is defined |
||||
|
tags: session-store |
||||
|
|
||||
|
- name: Flag the SiteMinderSS DSA as "autostart" |
||||
|
file: path={{ dx_home }}/dxserver/config/autostart/SiteMinderSS state=touch |
||||
|
sudo_user: "{{ dx_user }}" |
||||
|
when: sm_session_store_port is defined |
||||
|
tags: session-store |
||||
|
|
||||
|
- name: Enable the custom schema |
||||
|
lineinfile: dest={{ dx_home }}/dxserver/config/servers/SiteMinderSS.dxi state=present regexp='^source "../schema/[a-z]+.dxg";' line='source "../schema/smdsa.dxg";' |
||||
|
sudo_user: "{{ dx_user }}" |
||||
|
when: sm_session_store_port is defined |
||||
|
tags: |
||||
|
- config |
||||
|
- session-store |
||||
|
|
||||
|
- name: Set config 'ignore-name-bindings' |
||||
|
lineinfile: dest={{ dx_home }}/dxserver/config/servers/SiteMinderSS.dxi state=present insertafter="EOF" line='set ignore-name-bindings = true;' |
||||
|
sudo_user: "{{ dx_user }}" |
||||
|
when: sm_session_store_port is defined |
||||
|
tags: |
||||
|
- config |
||||
|
- session-store |
||||
|
|
||||
|
- name: Bind SiteMinderSS DSA on 127.0.0.1 only |
||||
|
lineinfile: dest="{{ dx_home }}/dxserver/config/knowledge/SiteMinderSS.dxc" line=' bind-address = "127.0.0.1"' insertafter="^\s*address\s*=" regexp='^\s*bind-address\s*=' |
||||
|
sudo_user: "{{ dx_user }}" |
||||
|
when: sm_session_store_port is defined |
||||
|
tags: |
||||
|
- config |
||||
|
- session-store |
||||
|
|
||||
|
- name: Bind SiteMinderSS DSA on 127.0.0.1 only |
||||
|
lineinfile: dest="{{ dx_home }}/dxserver/config/knowledge/SiteMinderSS.dxc" line=' address = tcp "127.0.0.1" port \1' regexp='^\s*address\s*=\s*tcp\s*"[^"]*"\s*port\s*([0-9]+)' backrefs=yes |
||||
|
sudo_user: "{{ dx_user }}" |
||||
|
when: sm_session_store_port is defined |
||||
|
tags: |
||||
|
- config |
||||
|
- session-store |
||||
|
|
||||
|
- name: Set "cache-index-all-except = smVariableValue,smsessionblob" |
||||
|
lineinfile: dest="{{ dx_home }}/dxserver/config/servers/SiteMinderSS.dxi" line='set cache-index-all-except = smVariableValue,smsessionblob;' regexp='^\s*set\s+cache-index-all-except\s*=\s*' insertbefore=EOF |
||||
|
sudo_user: "{{ dx_user }}" |
||||
|
when: sm_session_store_port is defined |
||||
|
tags: |
||||
|
- config |
||||
|
- session-store |
||||
|
|
||||
|
- name: Set "lookup-cache = true" |
||||
|
lineinfile: dest="{{ dx_home }}/dxserver/config/servers/SiteMinderSS.dxi" line='set lookup-cache = true;' regexp='^\s*set\s+lookup-cache\s*=\s*' insertbefore=EOF |
||||
|
sudo_user: "{{ dx_user }}" |
||||
|
when: sm_session_store_port is defined |
||||
|
tags: |
||||
|
- config |
||||
|
- session-store |
||||
|
|
||||
|
- name: Set "disable-transaction-log-flush = true" |
||||
|
lineinfile: dest="{{ dx_home }}/dxserver/config/servers/SiteMinderSS.dxi" line='set disable-transaction-log-flush = true;' regexp='^\s*set\s+disable-transaction-log-flush\s*=\s*' insertbefore=EOF |
||||
|
sudo_user: "{{ dx_user }}" |
||||
|
when: sm_session_store_port is defined |
||||
|
tags: |
||||
|
- config |
||||
|
- session-store |
||||
|
|
||||
|
- name: Set "disable-transaction-log = true" |
||||
|
lineinfile: dest="{{ dx_home }}/dxserver/config/servers/SiteMinderSS.dxi" line='set disable-transaction-log = true;' regexp='^\s*set\s+disable-transaction-log\s*=\s*' insertbefore=EOF |
||||
|
sudo_user: "{{ dx_user }}" |
||||
|
when: sm_session_store_port is defined |
||||
|
tags: |
||||
|
- config |
||||
|
- session-store |
||||
|
|
||||
|
- name: Enable the custom limits |
||||
|
lineinfile: dest={{ dx_home }}/dxserver/config/servers/SiteMinderSS.dxi state=present regexp='^source "../limits/[a-z]+.dxc";' line='source "../limits/smdsa.dxc";' |
||||
|
when: sm_session_store_port is defined |
||||
|
tags: |
||||
|
- config |
||||
|
- session-store |
||||
|
|
||||
|
- name: Copy the initial DSA to the sources dir |
||||
|
template: src=sm-ss.ldif dest={{ sources_dir }}/sm-ss.ldif |
||||
|
when: sm_session_store_port is defined |
||||
|
tags: session-store |
||||
|
|
||||
|
- name: Stop the SiteMinderPS DSA |
||||
|
command: /bin/sh -l -c "dxserver stop SiteMinderSS" |
||||
|
sudo_user: "{{ dx_user }}" |
||||
|
when: sm_session_store_port is defined |
||||
|
tags: session-store |
||||
|
|
||||
|
- name: Load the LDIF into the SiteMinderSS datastore |
||||
|
command: /bin/sh -l -c "dxloaddb SiteMinderSS {{ sources_dir }}/sm-ss.ldif" |
||||
|
sudo_user: "{{ dx_user }}" |
||||
|
when: sm_session_store_port is defined |
||||
|
tags: session-store |
||||
|
|
||||
|
- name: Start the SiteMinderSS DSA |
||||
|
command: /bin/sh -l -c "dxserver start SiteMinderSS" |
||||
|
sudo_user: "{{ dx_user }}" |
||||
|
when: sm_session_store_port is defined |
||||
|
tags: session-store |
||||
|
|
||||
|
- name: Upload the patch file to register the Session Store |
||||
|
template: src=sm-ss.registry.patch dest={{ sources_dir }}/sm-ss.registry.patch |
||||
|
when: sm_session_store_port is defined |
||||
|
tags: session-store |
||||
|
|
||||
|
- name: Patch the SiteMinder registry to register the Session Store |
||||
|
command: patch {{ sm_home }}/siteminder/registry/sm.registry {{ sources_dir }}/sm-ss.registry.patch |
||||
|
sudo_user: "{{ sm_user }}" |
||||
|
when: sm_session_store_port is defined |
||||
|
tags: session-store |
||||
|
|
||||
|
- name: Start the SiteMinder Policy Server |
||||
|
command: /bin/ksh -l -c "start-ps" |
||||
|
sudo_user: "{{ sm_user }}" |
||||
@ -0,0 +1,87 @@ |
|||||
|
### General Information |
||||
|
DEFAULT_INSTALL_DIR={{ sm_home }}/siteminder |
||||
|
DEFAULT_SHORTCUTS_DIR= |
||||
|
DEFAULT_JRE_ROOT={{ java_home }}/jre |
||||
|
DEFAULT_BROWSER= |
||||
|
DEFAULT_SMPROFILE_CHOICE= |
||||
|
DEFAULT_ENCRYPTKEY={{ sm_encryption_key }} |
||||
|
CA_SM_PS_FIPS140=COMPAT |
||||
|
|
||||
|
### Feature Selection |
||||
|
DEFAULT_OVMGUI_CHOICE=false |
||||
|
DEFAULT_WEBSERVERS_CHOICE=false |
||||
|
DEFAULT_SNMP_CHOICE=false |
||||
|
DEFAULT_POLICYSTORE_CHOICE=false |
||||
|
|
||||
|
## Adding this key value pair to support silent install ADAM policy store |
||||
|
DEFAULT_XPS_POLICYSTORE_TYPE= |
||||
|
|
||||
|
### OneView Monitor GUI |
||||
|
DEFAULT_JDK_ROOT= |
||||
|
DEFAULT_SERVLETEXEC_INSTANCE_NAME= |
||||
|
DEFAULT_SERVLETEXEC_ROOT= |
||||
|
|
||||
|
### Web Server(s) |
||||
|
# This is a list of web server instance information. |
||||
|
# Format: instance_name_1,root_folder_1;instance_name_2,root_folder_2; etc... |
||||
|
# Examples: To configure IIS, |
||||
|
# DEFAULT_WEBSERVER_INFO=IIS, |
||||
|
# To configure Apache and a Sun instance, |
||||
|
# DEFAULT_WEBSERVER_INFO=,/usr/apache2;suninstance,/usr/sunwebserverroot |
||||
|
# |
||||
|
DEFAULT_WEBSERVER_INFO= |
||||
|
DEFAULT_WEBSERVER_ROOT= |
||||
|
|
||||
|
### SNMP |
||||
|
# DEFAULT_ROOT_PW=<To define cleartext root password, insert string here and uncomment line.> |
||||
|
ENCRYPTED_ROOT_PW= |
||||
|
|
||||
|
|
||||
|
### Policy Store |
||||
|
### For LDAP, DEFAULT_POLICYSTORE_TYPE=LDAP and for ODBC DEFAULT_POLICYSTORE_TYPE=RDB |
||||
|
DEFAULT_POLICYSTORE_TYPE= |
||||
|
DEFAULT_POLICYSTORE_IP= |
||||
|
DEFAULT_POLICYSTORE_PORT= |
||||
|
DEFAULT_POLICYSTORE_ADMINDN= |
||||
|
# DEFAULT_POLICYSTORE_ADMINPW=<To define cleartext LDAP Admin password, insert string here and uncomment line.> |
||||
|
ENCRYPTED_POLICYSTORE_ADMINPW= |
||||
|
DEFAULT_POLICYSTORE_ROOTDN= |
||||
|
DEFAULT_POLICYSTORE_USER_CHOICE= |
||||
|
DEFAULT_POLICYSTORE_USERDN= |
||||
|
# DEFAULT_POLICYSTORE_USERPW=<To define cleartext LDAP user password, insert string here and uncomment line.> |
||||
|
ENCRYPTED_POLICYSTORE_USERPW= |
||||
|
DEFAULT_INIT_POLICYSTORE_CHOICE=false |
||||
|
# DEFAULT_SM_ADMINPW=<To define cleartext LDAP SiteMinder Super User password, insert string here and uncomment line.> |
||||
|
ENCRYPTED_SM_ADMINPW= |
||||
|
|
||||
|
### Policy Store ODBC |
||||
|
## Supported RDB Types are MS SQL Server2005,2008 and ORACLE10g,11i,12c. |
||||
|
## In case of Oracle, DEFAULT_RDB_DBNAME should contain Oracle Service Name. |
||||
|
## In SQL, DEFAULT_RDB_DBNAME should contain SQL Named Instance or Database Name. |
||||
|
## Possible value for DEFAULT_RDB_DBTYPE, For SQL - DB_MSSQL and Oracle - DB_ORACLE |
||||
|
## Specify a PARAM_DSN value if you want to specify different Database source name. It is an optional. |
||||
|
DEFAULT_RDB_DSN= |
||||
|
DEFAULT_RDB_DBSERVER= |
||||
|
DEFAULT_RDB_DBNAME= |
||||
|
DEFAULT_RDB_PORT= |
||||
|
DEFAULT_RDB_USERNAME= |
||||
|
DEFAULT_RDB_DBTYPE= |
||||
|
# DEFAULT_RDB_PASSWORD=<To define a clear text password for the database administrator, enter the value here and uncomment the line. > |
||||
|
ENCRYPTED_RDB_PASSWORD= |
||||
|
|
||||
|
|
||||
|
# Import default CA certificates |
||||
|
DEFAULT_SMKEYDB_IMPORT_CHOICE= |
||||
|
|
||||
|
# Enabling Password Services |
||||
|
# Supported Password Services are Advanced Password Services (APS), Basic Password Services (BPS) |
||||
|
PASSWORD_RESULT=Basic Password Services |
||||
|
|
||||
|
# Master Key Details |
||||
|
# Use below key if you want to supply password in plain text |
||||
|
#MASTER_KEY= |
||||
|
|
||||
|
#Use below key to provide Master Key in encrypted format. |
||||
|
ENCRYPTED_MASTER_KEY= |
||||
|
|
||||
|
IS_SA_ENABLED=false |
||||
@ -0,0 +1,5 @@ |
|||||
|
ulimit -n 1024 |
||||
|
unset LANG |
||||
|
unset LC_CTYPE |
||||
|
unset LC_ALL |
||||
|
. $HOME/CA/siteminder/smprofile.ksh |
||||
@ -0,0 +1,22 @@ |
|||||
|
dn: ou=Netegrity,ou=PS,o=SiteMinder |
||||
|
ou: Netegrity |
||||
|
objectClass: organizationalUnit |
||||
|
|
||||
|
dn: ou=SiteMinder,ou=Netegrity,ou=PS,o=SiteMinder |
||||
|
ou: SiteMinder |
||||
|
objectClass: organizationalUnit |
||||
|
|
||||
|
dn: ou=PolicySvr4,ou=SiteMinder,ou=Netegrity,ou=PS,o=SiteMinder |
||||
|
ou: PolicySvr4 |
||||
|
objectClass: organizationalUnit |
||||
|
|
||||
|
dn: ou=XPS,ou=PolicySvr4,ou=SiteMinder,ou=Netegrity,ou=PS,o=SiteMinder |
||||
|
ou: XPS |
||||
|
objectClass: organizationalUnit |
||||
|
|
||||
|
dn: cn=DXAdmin,ou=PS,o=SiteMinder |
||||
|
cn: DXAdmin |
||||
|
sn: Admin |
||||
|
givenName: DX |
||||
|
userPassword: password |
||||
|
objectClass: inetOrgPerson |
||||
@ -0,0 +1,14 @@ |
|||||
|
dn: ou=SS,o=SiteMinder |
||||
|
ou: SS |
||||
|
objectClass: organizationalUnit |
||||
|
|
||||
|
dn: ou=SessionStore,ou=SS,o=SiteMinder |
||||
|
ou: SessionStore |
||||
|
objectClass: organizationalUnit |
||||
|
|
||||
|
dn: cn=DXAdmin,ou=SS,o=SiteMinder |
||||
|
cn: DXAdmin |
||||
|
sn: Admin |
||||
|
givenName: DX |
||||
|
userPassword: password |
||||
|
objectClass: inetOrgPerson |
||||
@ -0,0 +1,20 @@ |
|||||
|
--- sm.registry.20151021 2015-10-21 14:28:48.560915176 +0200
|
||||
|
+++ sm.registry 2015-10-21 14:30:37.108915156 +0200
|
||||
|
@@ -194,12 +194,12 @@
|
||||
|
Version= 5.0; REG_SZ |
||||
|
|
||||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Netegrity\SiteMinder\CurrentVersion\LdapSessionServer=482496606 |
||||
|
-AdminDN= ; REG_SZ
|
||||
|
-AdminPW= ; REG_SZ
|
||||
|
-Enabled= 0; REG_DWORD
|
||||
|
+AdminDN= cn=DXAdmin,ou=SS,o=SiteMinder; REG_SZ
|
||||
|
+AdminPW= {RC2}ibeBaU6DvuFsFs02B9BFvn5Iyy0E57CD; REG_SZ
|
||||
|
+Enabled= 0x1; REG_DWORD
|
||||
|
MaxConnections= 0xa; REG_DWORD |
||||
|
-Server= ; REG_SZ
|
||||
|
-SSRootDN= ; REG_SZ
|
||||
|
+Server= 127.0.0.1:{{ sm_session_store_port }}; REG_SZ
|
||||
|
+SSRootDN= ou=SessionStore,ou=SS,o=SiteMinder; REG_SZ
|
||||
|
Use Default= 0; REG_DWORD |
||||
|
Use SSL= 0; REG_DWORD |
||||
|
Version= 5.0; REG_SZ |
||||
@ -0,0 +1,30 @@ |
|||||
|
# size limits |
||||
|
set max-users = 1000; |
||||
|
set max-op-size = 4000; |
||||
|
set multi-write-queue = 20000; |
||||
|
|
||||
|
# time limits |
||||
|
set max-bind-time = none; |
||||
|
set bind-idle-time = 3600; |
||||
|
set max-op-time = 600; |
||||
|
|
||||
|
# size limits |
||||
|
set credits = 5; |
||||
|
set max-local-ops = 1000; |
||||
|
|
||||
|
## |
||||
|
## TODO : place me in a separate file ! |
||||
|
## |
||||
|
|
||||
|
# Disable log rollover (when possible) |
||||
|
set rollover-trace-log = false; |
||||
|
set rollover-alarm-log = false; |
||||
|
|
||||
|
# More logs ! |
||||
|
set query-log-advanced = all; |
||||
|
set update-log-show-values = true; |
||||
|
set trace-log = "logs/$s_trace.log"; |
||||
|
set query-log = "logs/$s_query.log"; |
||||
|
set update-log = "logs/$s_update.log"; |
||||
|
set connect-log = "logs/$s_connect.log"; |
||||
|
set trace = query; |
||||
@ -0,0 +1,7 @@ |
|||||
|
source "x500.dxc"; |
||||
|
source "cosine.dxc"; |
||||
|
source "umich.dxc"; |
||||
|
source "inetop.dxc"; |
||||
|
source "dxserver.dxc"; |
||||
|
source "netegrity.dxc"; |
||||
|
source "etrust.dxc"; |
||||
@ -0,0 +1,2 @@ |
|||||
|
*.tar.gz |
||||
|
*.zip |
||||
@ -0,0 +1,84 @@ |
|||||
|
--- |
||||
|
|
||||
|
- name: This module only works on CentOS 6 x86 |
||||
|
assert: |
||||
|
that: |
||||
|
- "ansible_os_family == 'RedHat'" |
||||
|
|
||||
|
- name: Create the 'wauser' user |
||||
|
user: name={{ wa_user }} comment="CA SiteMinder Web Agent User" |
||||
|
tags: user |
||||
|
|
||||
|
- name: Set SSH key for wauser |
||||
|
authorized_key: user={{ wa_user }} key="{{ ansible_ssh_public_key }}" manage_dir=yes |
||||
|
tags: user |
||||
|
|
||||
|
- name: Set the required .profile for wauser |
||||
|
template: src=profile dest=/home/{{ wa_user }}/.bash_profile |
||||
|
sudo_user: "{{ wa_user }}" |
||||
|
tags: user |
||||
|
|
||||
|
- name: Create the local dir for the wauser |
||||
|
file: path=/home/{{ wa_user }}/local state=directory |
||||
|
sudo_user: "{{ wa_user }}" |
||||
|
|
||||
|
- name: Copy the SiteMinder Web Agent files to sources_dir |
||||
|
unarchive: creates={{ sources_dir }}/ca-wa-12.52-linux.bin src=smwa-12.52-cr01-linux.zip dest={{ sources_dir }} |
||||
|
|
||||
|
- name: Copy the unattended installation response file |
||||
|
template: src=ca-wa-installer.properties dest={{ sources_dir }}/ca-wa-installer.properties |
||||
|
|
||||
|
- name: Run the SiteMinder Web Agent installer |
||||
|
command: creates={{ wa_home }}/webagent/bin {{ sources_dir }}/ca-wa-12.52-linux.bin -f {{ sources_dir }}/ca-wa-installer.properties -i silent |
||||
|
sudo_user: "{{ wa_user }}" |
||||
|
ignore_errors: yes |
||||
|
|
||||
|
# |
||||
|
# Manual Configuration to create : |
||||
|
# - agent_default |
||||
|
# - ACO_ApacheWebAgent, with DefaultAgentName = agent_default |
||||
|
# - HCO_Local |
||||
|
# |
||||
|
# TODO : XPS Import |
||||
|
|
||||
|
- name: Configure the SiteMinder Web Agent |
||||
|
shell: source {{ wa_home }}/webagent/ca_wa_env.sh && {{ wa_home }}/webagent/ca-wa-config.sh -f {{ sources_dir }}/ca-wa-installer.properties -i silent |
||||
|
sudo_user: "{{ wa_user }}" |
||||
|
ignore_errors: yes |
||||
|
|
||||
|
# In case of failure ? |
||||
|
# |
||||
|
# - name: Run smreghost to catchup configuration script failure |
||||
|
# shell: source {{ wa_home }}/webagent/ca_wa_env.sh && {{ wa_home }}/webagent/bin/smreghost -i 127.0.0.1 -u {{ sm_admin_user }} -p {{ sm_admin_password }} -f {{ wa_home }}/webagent/config/SmHost.conf -o -hc HCO_Local -hn {{ inventory_hostname }} |
||||
|
# sudo_user: "{{ wa_user }}" |
||||
|
# |
||||
|
# and edit conf/WebAgent.conf to add path to SmHosts |
||||
|
|
||||
|
- name: Copy the SiteMinder Web Agent Option Pack files to sources_dir |
||||
|
unarchive: creates={{ sources_dir }}/ca-wa-opack-12.52-linux.bin src=smwaop-12.52-cr01-linux.zip dest={{ sources_dir }} |
||||
|
|
||||
|
- name: Copy the unattended installation response file |
||||
|
template: src=ca-wa-opack-installer.properties dest={{ sources_dir }}/ca-wa-opack-installer.properties |
||||
|
|
||||
|
- name: Run the SiteMinder Web Agent Option Pack installer |
||||
|
command: creates={{ wa_home }}/webagent/affwebservices {{ sources_dir }}/ca-wa-opack-12.52-linux.bin -f {{ sources_dir }}/ca-wa-opack-installer.properties -i silent |
||||
|
sudo_user: "{{ wa_user }}" |
||||
|
ignore_errors: yes |
||||
|
|
||||
|
- name: Install AffWebServices.properties |
||||
|
template: src=AffWebServices.properties dest={{ wa_home }}/webagent/affwebservices/WEB-INF/classes/AffWebServices.properties |
||||
|
sudo_user: "{{ wa_user }}" |
||||
|
tags: config |
||||
|
|
||||
|
- name: Install LoggerConfig.properties |
||||
|
template: src=LoggerConfig.properties dest={{ wa_home }}/webagent/affwebservices/WEB-INF/classes/LoggerConfig.properties |
||||
|
sudo_user: "{{ wa_user }}" |
||||
|
tags: config |
||||
|
|
||||
|
- name: Install WebAgent.conf |
||||
|
template: src=WebAgent.conf dest={{ wa_home }}/webagent/affwebservices/WEB-INF/classes/WebAgent.conf |
||||
|
sudo_user: "{{ wa_user }}" |
||||
|
|
||||
|
- name: Install the AffWebServices WEBAPP |
||||
|
file: state=link src={{ wa_home }}/webagent/affwebservices dest={{ tomcat_home }}/webapps/affwebservices |
||||
|
sudo_user: "{{ wa_user }}" |
||||
@ -0,0 +1,25 @@ |
|||||
|
//tunnel library type. valid values are 'c' and 'java' |
||||
|
NotificationLibraryType=java |
||||
|
//NotificationLibraryType=c |
||||
|
|
||||
|
//In case of java tunnel library provide the fully qualified classname of the provider. Else |
||||
|
//Library name followed by a space and then the function name |
||||
|
NotificationLibraryDetails=com.netegrity.affiliateminder.webservices.NotificationEventAdapter |
||||
|
//NotificationLibraryDetails=libName funName |
||||
|
|
||||
|
//SiteMinder server that will process the request at the time of the tunnel call. |
||||
|
// Valid values are: |
||||
|
// 0 - for the authorization server port number. |
||||
|
// 1 - for the authentication server port number. |
||||
|
// 2 - for the accounting server port number. |
||||
|
SMserverPort=0 |
||||
|
|
||||
|
//In case of 4.x IIS web agent, please leave its value empty. Else provide the full path |
||||
|
//of the WebAgent.conf file. |
||||
|
AgentConfigLocation={{ wa_home }}/webagent/affwebservices/WEB-INF/classes/WebAgent.conf |
||||
|
|
||||
|
//SAML2.0 Manage NameID feature |
||||
|
//ProcessBackgroundNameIDOperations - Flag indicating that the thread should run on this system. By default, this value will be false. Should be enabled for only one WA-OP. |
||||
|
ProcessBackgroundNameIDOperations=false |
||||
|
//BackgroundProcessingInterval - the number of seconds defining the interval when this thread should wake up to check if there are requests to be processed. By default, this will be 60 seconds |
||||
|
BackgroundProcessingInterval=60 |
||||
@ -0,0 +1,64 @@ |
|||||
|
// Log and trace configuration parameters for com.netegrity.affiliateminder.webservices |
||||
|
|
||||
|
// LoggingOn can be Y, N |
||||
|
LoggingOn=Y |
||||
|
|
||||
|
// If LogFileName is set Log output will go to the file named |
||||
|
LogFileName={{ wa_home }}/webagent/log/affwebserv.log |
||||
|
|
||||
|
// LogLocalTime can be Y, N. Y will log timestamps in local time rather than GMT. |
||||
|
LogLocalTime=N |
||||
|
|
||||
|
// TraceRollover defines the type of rollover functionality desired for trace output files. |
||||
|
// Please choose from the following valid values: |
||||
|
// 0 - [default]. No rollover is performed. Existing files are overwritten at startup. |
||||
|
// 2 - Rollover now. Rollover is only performed at startup.. |
||||
|
// 1 - Append. No rollover is performed. Existing files are appended to at startup. |
||||
|
// 3 - Rollover. Files rollover when they grow to the limit set by LogSize. |
||||
|
// 4 - Rollover now with size. Files rollover at startup and then grow to the limit set by LogSize. |
||||
|
LogRollover=0 |
||||
|
|
||||
|
// LogSize dictates the maximum file size in megabytes when rolling over by size |
||||
|
LogSize=10 |
||||
|
|
||||
|
// LogCount defines how many log output files to leave around when rollover is enabled. |
||||
|
LogCount=10 |
||||
|
|
||||
|
// TracingOn can be Y, N |
||||
|
TracingOn=Y |
||||
|
|
||||
|
// EnableDNSLookUp can be Y, N |
||||
|
EnableDNSLookUp=N |
||||
|
|
||||
|
// If TraceFileName is set Trace output will go to the file named |
||||
|
TraceFileName={{ wa_home }}/webagent/log/FWSTrace.log |
||||
|
|
||||
|
// TraceConfigFile should be set to the full path of the desired Trace.conf configuration file |
||||
|
TraceConfig={{ wa_home }}/webagent/config/FWSTrace.conf |
||||
|
|
||||
|
// TraceRollover defines the type of rollover functionality desired for trace output files. |
||||
|
// Please choose from the following valid values: |
||||
|
// 0 - [default]. No rollover is performed. Existing files are overwritten at startup. |
||||
|
// 1 - Append. No rollover is performed. Existing files are appended to at startup. |
||||
|
// 2 - Rollover now. Rollover is only performed at startup.. |
||||
|
// 3 - Rollover. Files rollover when they grow to the limit set by TraceSize. |
||||
|
// 4 - Rollover now with size. Files rollover at startup and then grow to the limit set by TraceSize. |
||||
|
TraceRollover=0 |
||||
|
|
||||
|
// TraceSize dictates the maximum file size in megabytes when rolling over by size |
||||
|
TraceSize=10 |
||||
|
|
||||
|
// TraceCount defines how many trace output files to leave around when rollover is enabled. |
||||
|
TraceCount=10 |
||||
|
|
||||
|
// TraceFormat dicates the trace output file format. |
||||
|
// Please choose frmo the following valid values: |
||||
|
// 0 - [default] |
||||
|
// 1 - Fixed width fields. |
||||
|
// 2 - Delimited format (delimiter chosen by TraceDelim setting). |
||||
|
// 3 - XML |
||||
|
TraceFormat=0 |
||||
|
|
||||
|
// TraceDelim may be set to any printable ASCII character and defines the field delimiter to use |
||||
|
// when TraceFormat=2. Otherwise this setting is ignored. |
||||
|
TraceDelim=, |
||||
@ -0,0 +1,7 @@ |
|||||
|
# WebAgent.conf - configuration file for SiteMinder Web Agent |
||||
|
|
||||
|
LOCALE=en-US |
||||
|
|
||||
|
HostConfigFile="{{ wa_home }}/webagent/config/SmHost.conf" |
||||
|
AgentConfigObject="ACO_WAOP" |
||||
|
EnableWebAgent="YES" |
||||
@ -0,0 +1,180 @@ |
|||||
|
################################################################## |
||||
|
## nete-wa-installer.properties ## |
||||
|
## Properties file for the SiteMinder Web Agent ## |
||||
|
## unattended installation and configuration ## |
||||
|
## ## |
||||
|
## This file is generated by an initial Web Agent installation ## |
||||
|
## and configuration performed in GUI or Console mode. ## |
||||
|
## Use this file for unattended installation and configuration. ## |
||||
|
################################################################## |
||||
|
|
||||
|
|
||||
|
################################################################ |
||||
|
# General Information |
||||
|
################################################################ |
||||
|
# Specifies the information used for the unattended installation. |
||||
|
|
||||
|
USER_INSTALL_DIR={{ wa_home }} |
||||
|
USER_SHORTCUTS=/home/{{ wa_user }}/local |
||||
|
|
||||
|
################################################################ |
||||
|
# 1. Trusted Host Registration |
||||
|
################################################################ |
||||
|
# A trusted host is a client computer where one or more Agents |
||||
|
# can be installed. To establish a connection between the |
||||
|
# trusted host and the Policy Server, register the host with |
||||
|
# the Policy Server. |
||||
|
|
||||
|
# Register the trusted host only once, not each time you install and |
||||
|
# configure a Web Agent. |
||||
|
|
||||
|
#Set to 1 to register this Agent with a Policy Server. |
||||
|
#Set to 0 if you had registered this Agent with a Policy Server before. |
||||
|
|
||||
|
HOST_REGISTRATION_YES=1 |
||||
|
|
||||
|
################################################################ |
||||
|
# 1.1 Administrator For Trusted Host Registration |
||||
|
################################################################ |
||||
|
# Enter the name and password of an administrator who has the |
||||
|
# right to register a trusted host with the Policy Server. |
||||
|
# This entry must match the name of an administrator defined |
||||
|
# at the Policy Server. |
||||
|
|
||||
|
ADMIN_REG_NAME={{ sm_admin_user }} |
||||
|
DEFAULT_ADMIN_REG_PASSWORD={{ sm_admin_password }} |
||||
|
#ADMIN_REG_PASSWORD=ENC:pT4HvukLeehIkP3Mc6Rq4Q== |
||||
|
|
||||
|
# Set to 1 to enable shared secret rollover |
||||
|
SHARED_SECRET_ROLLOVER_YES=0 |
||||
|
|
||||
|
################################################################ |
||||
|
# 1.2 Cryptographic Hardware Configuration (optional) |
||||
|
# (HKS is not supported for SM r12) CQ #63987 |
||||
|
################################################################ |
||||
|
# This section only applies if you registered a trusted host. |
||||
|
# |
||||
|
# NOTE: These are only used if CRYPTO_CONFIG_YES = 1. |
||||
|
# Select a path and file name of PKCS11, then enter |
||||
|
# the token label and pass phrase. The token label can be blank. |
||||
|
# The pass phrase cannot be blank. |
||||
|
|
||||
|
#Set to 1 to enable PKCS11 Cryptographic Hardware. |
||||
|
#CRYPTO_CONFIG_YES= |
||||
|
|
||||
|
#The location and file name of the PKCS11 library. |
||||
|
#PKCS11_FILENAME= |
||||
|
|
||||
|
#The token label for PKCS11 |
||||
|
#TOKEN_LABEL= |
||||
|
|
||||
|
#The token passphrase |
||||
|
#TOKEN_PASS_PHRASE= |
||||
|
|
||||
|
################################################################ |
||||
|
# 1.3 Trusted Host Name and Host Configuration Object |
||||
|
################################################################ |
||||
|
# Specify the name of the host you want to register with the |
||||
|
# Policy Server. |
||||
|
|
||||
|
# Enter the name of the host configuration object. |
||||
|
# The name must match a host configuration object name |
||||
|
# already defined at the Policy Server. |
||||
|
|
||||
|
TRUSTED_HOST_NAME={{ inventory_hostname }} |
||||
|
CONFIG_OBJ=HCO_Local |
||||
|
|
||||
|
################################################################ |
||||
|
# 1.4 List of Policy Servers IP Addresses and FIPS Mode Settings |
||||
|
################################################################ |
||||
|
# Enter the IP Address of the Policy Server where you are |
||||
|
# registering this host. |
||||
|
# |
||||
|
# Specify the IP address in the form of <IP_address:port> |
||||
|
# To list multiple addresses, enter <IP_address:port>, <IP_address:port> |
||||
|
# For example: 111.112.1.45(IPV4), 122.113.1.47:45(IPV4) |
||||
|
# IPV6: [cd00:a706:a054:1:250:56ff:fe9b:7c8]:44441 |
||||
|
# or [cd00:a706:a054:1:250:56ff:fe9b:7c8] |
||||
|
# or cd00:a706:a054:1:250:56ff:fe9b:7c8 |
||||
|
|
||||
|
|
||||
|
IP_ADDRESS_STRING=127.0.0.1 |
||||
|
FIPS_VALUE=COMPAT |
||||
|
|
||||
|
################################################################ |
||||
|
# 1.5 Host Configuration File Location |
||||
|
################################################################ |
||||
|
# Enter a name and location for the Host Configuration File, |
||||
|
# SmHost.conf. |
||||
|
|
||||
|
SM_HOST_FILENAME=SmHost.conf |
||||
|
SM_HOST_DIR={{ wa_home }}/webagent/config |
||||
|
|
||||
|
############################################################### |
||||
|
# 2. Web Server Selection |
||||
|
############################################################### |
||||
|
|
||||
|
#The following entries are for UNIX systems only: |
||||
|
|
||||
|
APACHE_SELECTED=1 |
||||
|
APACHE_WEBSERVER_ROOT={{ httpd_home }} |
||||
|
|
||||
|
#The following APACHE entries for APACHE VENDOR web servers.ex:IHS, |
||||
|
# Oracle 10g etc.APACHE_SPECIFIC_TYPE is 1,if the |
||||
|
# APACHE WEBSERVER ROOT is specific path.ie, |
||||
|
# other than APACHE webserver path. |
||||
|
|
||||
|
APACHE_SPECIFIC_PATH_YES= |
||||
|
APACHE_VENDOR_TYPE=HTTP_APACHE |
||||
|
APACHE_VERSION=2.2.29 |
||||
|
|
||||
|
|
||||
|
|
||||
|
DOMINO_SELECTED=0 |
||||
|
DOMINO_WEBSERVER_ROOT= |
||||
|
|
||||
|
IPLANET_SELECTED=0 |
||||
|
IPLANET_WEBSERVER_ROOT=/home/apache/iplanet |
||||
|
|
||||
|
IBM_HTTP_SERVER_ZOS= |
||||
|
IBM_HTTP_WEBSERVER_ZOS_CONF_PATH= |
||||
|
|
||||
|
# NOTE: Do not edit the following WEB_SERVER_INFO entry. To modify |
||||
|
# it, re-run the Web Agent configuration to regenerate |
||||
|
# this string with the appropriate values. |
||||
|
|
||||
|
WEB_SERVER_INFO=Apache,/home/www/httpd/conf,Apache 2.2.29,+EMPTYSTR+,apache,2.2.29,/home/www/httpd,Unix,+EMPTYSTR+,1,1,0,0,0,1,No advanced authentication,ACO_Apache,0,undefined,ENC:6f1I5TLVEpuSBHpf4GrASg==, |
||||
|
|
||||
|
###################################################################### |
||||
|
# VIRTUAL SITE CONFIGURATION ON IIS6/IIS7 |
||||
|
|
||||
|
# Enter the Site Names which need to be configured against CONFIGURE_SITES with each |
||||
|
#separated by ",". If they are already configured, and they are listed in |
||||
|
#CONFIGURE_SITES, will be overwritten. Sites which are already configured, and you want to |
||||
|
#unconfigure those, enter against UNCONFIGURE_SITES and each site name separatedby ",". |
||||
|
#Sites, which are already configured and not listed in both sections will be preserved. |
||||
|
############################################################### |
||||
|
# For eg: |
||||
|
#1.If Site1,Site2 need to be configured,then enter CONFIGURE_SITES=Site1,Site2. |
||||
|
#2.If both are configured and you want Site1 to Preserve and Site 2t o be Overwrite |
||||
|
#then use as below CONFIGURE_SITES= Site2 and don't specify site1 in UNCONFIGURE_SITES |
||||
|
#3. If you want to unconfigure site1 and site2 then use UNCONFIGURE_SITES=site1,site2 |
||||
|
#4. If you want to preserve all, then don't specify any sites under CONFIGURE_SITES and |
||||
|
#UNCONFIGURE_SITES. |
||||
|
#################################################################### |
||||
|
|
||||
|
CONFIGURE_SITES= |
||||
|
UNCONFIGURE_SITES= |
||||
|
|
||||
|
################################################################ |
||||
|
# 3. Enable Web Agent Option |
||||
|
################################################################ |
||||
|
ENABLE_WEBAGENT_RESULT=YES |
||||
|
|
||||
|
################################################################ |
||||
|
# 4. Restart Web Server Option (Windows only) |
||||
|
################################################################ |
||||
|
# Set to YES to allow the installation program to reboot the |
||||
|
# Windows machine, if required. |
||||
|
|
||||
|
USER_REQUESTED_RESTART= |
||||
@ -0,0 +1,10 @@ |
|||||
|
#Enter the path of where SiteMinder Web Agent is already installed or |
||||
|
#enter the path where you would like to install CA SiteMinder Option Pack for Web Agent. |
||||
|
# |
||||
|
#For Windows, must use double backslashes for path separator |
||||
|
USER_INSTALL_DIR={{ wa_home }}/webagent |
||||
|
# |
||||
|
NETE_JDK_ROOT={{ java_home }} |
||||
|
|
||||
|
#For Windows, change the line value below to 'YES' if you would like to restart the machine. |
||||
|
USER_REQUESTED_RESTART=NO |
||||
@ -0,0 +1,6 @@ |
|||||
|
unset LANG |
||||
|
unset LC_CTYPE |
||||
|
unset LC_ALL |
||||
|
test -r $HOME/.bashrc && . $HOME/.bashrc |
||||
|
test -r $HOME/CA/webagent/ca_wa_env.sh && . $HOME/CA/webagent/ca_wa_env.sh |
||||
|
test -r $HOME/CA/webagent/ca-wa-opack-env.sh && . $HOME/CA/webagent/ca-wa-opack-env.sh |
||||
@ -0,0 +1,3 @@ |
|||||
|
layer7* |
||||
|
*.rpm |
||||
|
*.xml |
||||
@ -0,0 +1,88 @@ |
|||||
|
--- |
||||
|
|
||||
|
- name: This module only works on CentOS 6 |
||||
|
assert: |
||||
|
that: |
||||
|
- "ansible_os_family == 'RedHat'" |
||||
|
|
||||
|
- name: Install pexpect |
||||
|
yum: name=pexpect state=installed |
||||
|
|
||||
|
- name: Copy the SSG 8.3 installation package |
||||
|
copy: src={{ item }} dest={{ sources_dir }}/rpms |
||||
|
with_items: [ 'ssg-8.3.00-2.noarch.rpm', 'ssg-mag-2.3.0-1.noarch.rpm' ] |
||||
|
register: rpmsdir |
||||
|
tags: rpm |
||||
|
|
||||
|
- name: Update the RPM local repository |
||||
|
command: createrepo {{ sources_dir }}/rpms |
||||
|
when: rpmsdir.changed |
||||
|
tags: rpm |
||||
|
|
||||
|
- name: Flush the yum caches |
||||
|
command: yum clean all |
||||
|
when: rpmsdir.changed |
||||
|
tags: rpm |
||||
|
|
||||
|
- name: Install SSG 8.3 |
||||
|
yum: name=ssg state=installed |
||||
|
tags: rpm |
||||
|
|
||||
|
- name: Set SSH key for the "gateway" user |
||||
|
authorized_key: user={{ ssg_runtime_user }} key="{{ ansible_ssh_public_key }}" manage_dir=yes |
||||
|
tags: user |
||||
|
|
||||
|
- name: Copy the SSG setup script |
||||
|
template: src=setup_ssg_83.py dest={{ sources_dir }}/setup_ssg_83.py mode=0755 |
||||
|
|
||||
|
- name: Setup SSG |
||||
|
command: creates=/opt/SecureSpan/Gateway/node/default/etc/conf/node.properties {{ sources_dir }}/setup_ssg_83.py |
||||
|
|
||||
|
- name: Create the hierarchy for auto provisioning |
||||
|
file: path=/opt/SecureSpan/Gateway/node/default/etc/bootstrap state=directory owner={{ ssg_user }} group={{ ssg_group }} mode=0755 |
||||
|
|
||||
|
- name: Create the hierarchy for license auto provisioning |
||||
|
file: path=/opt/SecureSpan/Gateway/node/default/etc/bootstrap/license state=directory owner={{ ssg_user }} group={{ ssg_group }} mode=0755 |
||||
|
tags: license |
||||
|
|
||||
|
- name: Publish the licence for auto provisioning |
||||
|
copy: src={{ item }} dest=/opt/SecureSpan/Gateway/node/default/etc/bootstrap/license/ |
||||
|
with_items: [ 'gw_license.xml', 'mag_license.xml' ] |
||||
|
tags: license |
||||
|
|
||||
|
- name: Create the hierarchy for service auto provisioning |
||||
|
file: path=/opt/SecureSpan/Gateway/node/default/etc/bootstrap/services state=directory owner={{ ssg_user }} group={{ ssg_group }} mode=0755 |
||||
|
|
||||
|
- name: Publish the services for auto provisioning |
||||
|
file: state=touch owner={{ ssg_user }} group={{ ssg_group }} mode=0755 dest=/opt/SecureSpan/Gateway/node/default/etc/bootstrap/services/{{ item }} |
||||
|
with_items: [ 'restman' ] |
||||
|
|
||||
|
- name: Start the Gateway service |
||||
|
command: /opt/SecureSpan/Gateway/runtime/bin/gateway.sh start |
||||
|
|
||||
|
- name: Install the tcp_tune script |
||||
|
template: dest=/etc/init.d/tcp_tune src=tcp_tune mode=0755 |
||||
|
|
||||
|
- name: Make sure the tcp_tune service is started and enabled |
||||
|
service: name=tcp_tune enabled=yes state=restarted |
||||
|
|
||||
|
- name: Generate certificates for Layer7 |
||||
|
local_action: command creates="{{ lookup('env', 'BASEDIR') }}/roles/ssg-8.3/files/layer7.jks" "{{ lookup('env', 'BASEDIR') }}/pki/gen_certs.sh" |
||||
|
sudo: false |
||||
|
environment: |
||||
|
CERT_CN: "{{ ssg_ssl_certificate_cn }}" |
||||
|
PASSWORD: "{{ ssg_ssl_certificate_password }}" |
||||
|
BASENAME: "layer7" |
||||
|
OUTDIR: "{{ lookup('ENV', 'BASEDIR') }}/roles/ssg-8.3/files/" |
||||
|
tags: certificate |
||||
|
when: ssg_ssl_certificate_cn is defined |
||||
|
|
||||
|
- name: Install MAG 2.3 |
||||
|
yum: name=ssg-mag state=installed |
||||
|
tags: rpm |
||||
|
|
||||
|
- name: Import the MAG DB Schema |
||||
|
mysql_db: login_user={{ ssg_otk_db_user }} login_password={{ ssg_otk_db_password }} name={{ ssg_otk_db_name }} state=import target=/opt/SecureSpan/Gateway/config/etc/sql/mag_db_schema.sql |
||||
|
tags: |
||||
|
- db |
||||
|
- db-schema |
||||
@ -0,0 +1,62 @@ |
|||||
|
#!/usr/bin/python2 |
||||
|
|
||||
|
import pexpect |
||||
|
import sys |
||||
|
import os |
||||
|
|
||||
|
os.environ['IA_TEMPDIR'] = '{{ temp_dir }}' |
||||
|
|
||||
|
child = pexpect.spawn ('/opt/SecureSpan/Gateway/runtime/bin/setup.sh') |
||||
|
child.logfile = sys.stdout |
||||
|
child.timeout = 300 |
||||
|
|
||||
|
child.expect('Please make a selection:') |
||||
|
child.sendline("2") |
||||
|
child.expect('Java VM Path .*:') |
||||
|
child.sendline('{{ java_home }}/jre') |
||||
|
child.expect('Java VM Memory Allocation') |
||||
|
child.sendline('') |
||||
|
child.expect("Database Connection. .Yes.") |
||||
|
child.sendline('') |
||||
|
child.expect('Database Host .*:') |
||||
|
child.sendline('localhost') |
||||
|
child.expect('Database Port .*:') |
||||
|
child.sendline('3306') |
||||
|
child.expect('Database Name .*:') |
||||
|
child.sendline('{{ ssg_db_name }}') |
||||
|
child.expect('Database Username .*:') |
||||
|
child.sendline('{{ ssg_db_user }}') |
||||
|
child.expect('Database Password:') |
||||
|
child.sendline('{{ ssg_db_password }}') |
||||
|
child.expect('Confirm Database Password:') |
||||
|
child.sendline('{{ ssg_db_password }}') |
||||
|
child.expect('Administrative Database Username:') |
||||
|
child.sendline('root') |
||||
|
child.expect('Administrative Database Password:') |
||||
|
child.sendline('{{ mysql_root_password }}') |
||||
|
child.expect('Configure Database Failover Connection') |
||||
|
child.sendline('') |
||||
|
child.expect('SSM Username:') |
||||
|
child.sendline('{{ ssg_admin_user }}') |
||||
|
child.expect('SSM Password:') |
||||
|
child.sendline('{{ ssg_admin_password }}') |
||||
|
child.expect('Confirm SSM Password:') |
||||
|
child.sendline('{{ ssg_admin_password }}') |
||||
|
child.expect('Administrative HTTPS Listener. .No.:') |
||||
|
child.sendline('Yes') |
||||
|
child.expect('Administrative IP Address ...:') |
||||
|
child.sendline('') |
||||
|
child.expect('Administrative Port .8443.:') |
||||
|
child.sendline('{{ ssg_service_port }}') |
||||
|
child.expect('Cluster Host .*:') |
||||
|
child.sendline('{{ ssg_hostname }}') |
||||
|
child.expect('Cluster Passphrase:') |
||||
|
child.sendline('{{ ssg_passphrase }}') |
||||
|
child.expect('Confirm Cluster Passphrase:') |
||||
|
child.sendline('{{ ssg_passphrase }}') |
||||
|
child.expect('Press .Enter. to continue') |
||||
|
child.sendline('') |
||||
|
child.expect('Press .Enter. to continue') |
||||
|
child.sendline('') |
||||
|
child.expect('Please make a selection:') |
||||
|
child.sendline("X") |
||||
@ -0,0 +1,87 @@ |
|||||
|
#!/bin/bash |
||||
|
# Network Startup config |
||||
|
# |
||||
|
# chkconfig: 2345 99 01 |
||||
|
# description: Layer7's Secure Span Gateway TCP protection |
||||
|
# processname: none |
||||
|
# pidfile: none |
||||
|
# config: none |
||||
|
|
||||
|
# Source function library. |
||||
|
. /etc/rc.d/init.d/functions |
||||
|
|
||||
|
# Tune the Linux TCP/IP Stack |
||||
|
start() { |
||||
|
echo "Setting wide local port range for more outbound connections" |
||||
|
echo "1024 65530" > /proc/sys/net/ipv4/ip_local_port_range |
||||
|
echo "Disable ECN because some systems don't do it right yet" |
||||
|
echo 0 > /proc/sys/net/ipv4/tcp_ecn |
||||
|
echo "Setting Low latency TCP" |
||||
|
echo 1 > /proc/sys/net/ipv4/tcp_low_latency |
||||
|
echo "Turning off timestamps" |
||||
|
echo 0 > /proc/sys/net/ipv4/tcp_timestamps |
||||
|
echo "Lowering keepalive time" |
||||
|
echo 2400 > /proc/sys/net/ipv4/tcp_keepalive_time |
||||
|
echo 5 > /proc/sys/net/ipv4/tcp_keepalive_intvl |
||||
|
echo "Lowering FIN timeout" |
||||
|
echo 20 > /proc/sys/net/ipv4/tcp_fin_timeout |
||||
|
echo "Turning On Window scaling" |
||||
|
echo 1 > /proc/sys/net/ipv4/tcp_window_scaling |
||||
|
echo "Turning On Selective Acknowledgement" |
||||
|
echo 1 > /proc/sys/net/ipv4/tcp_sack |
||||
|
echo "Disable route triangulation" |
||||
|
echo 1 > /proc/sys/net/ipv4/conf/all/rp_filter |
||||
|
echo "Disable Source routing" |
||||
|
echo 0 > /proc/sys/net/ipv4/conf/all/accept_source_route |
||||
|
echo "Disable Ping broadcasts" |
||||
|
echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts |
||||
|
echo "Increasing SYN packet Backlog" |
||||
|
echo 8192 > /proc/sys/net/ipv4/tcp_max_syn_backlog |
||||
|
echo "Setting higher tcp memory limits" |
||||
|
echo 16777216 > /proc/sys/net/core/wmem_max |
||||
|
echo 16777216 > /proc/sys/net/core/rmem_max |
||||
|
# The following are in 4k-byte PAGES, not bytes |
||||
|
echo "196608 262144 393216" > /proc/sys/net/ipv4/tcp_mem |
||||
|
echo "Setting socket sizes for best cpu usage" |
||||
|
echo "131072" > /proc/sys/net/core/wmem_default |
||||
|
echo "174760" > /proc/sys/net/core/rmem_default |
||||
|
echo "4096 174760 16777216" > /proc/sys/net/ipv4/tcp_rmem |
||||
|
echo "4096 16384 16777216" > /proc/sys/net/ipv4/tcp_wmem |
||||
|
|
||||
|
echo "Turning on TIME_WAIT recyle and reuse" |
||||
|
echo 1 > /proc/sys/net/ipv4/tcp_tw_recycle |
||||
|
echo 1 > /proc/sys/net/ipv4/tcp_tw_reuse |
||||
|
echo "Increasing number of TIME_WAIT buckets" |
||||
|
echo 360000 > /proc/sys/net/ipv4/tcp_max_tw_buckets |
||||
|
echo "Turning on syncookie protection from Denial of Service (DOS) attacks" |
||||
|
echo 1 > /proc/sys/net/ipv4/tcp_syncookies |
||||
|
echo "Don't cache thresholds from previous connections" |
||||
|
echo 1 > /proc/sys/net/ipv4/tcp_no_metrics_save |
||||
|
echo "Increase Network backlogs for Gigabit" |
||||
|
echo 2500 > /proc/sys/net/core/netdev_max_backlog |
||||
|
echo "Increase maximum connections" |
||||
|
echo 10240 > /proc/sys/net/core/somaxconn |
||||
|
echo "Memory limit for fragment assembly" |
||||
|
echo 4194304 > /proc/sys/net/ipv4/ipfrag_high_thresh |
||||
|
echo "Done" |
||||
|
return 0 |
||||
|
} |
||||
|
stop() { |
||||
|
echo |
||||
|
} |
||||
|
|
||||
|
# See how we were called. |
||||
|
case "$1" in |
||||
|
start) |
||||
|
start |
||||
|
;; |
||||
|
stop) |
||||
|
stop |
||||
|
;; |
||||
|
restart) |
||||
|
stop |
||||
|
start |
||||
|
;; |
||||
|
esac |
||||
|
|
||||
|
exit $RETVAL |
||||
@ -0,0 +1,58 @@ |
|||||
|
--- |
||||
|
|
||||
|
- name: This module only works on RHEL/CentOS |
||||
|
assert: |
||||
|
that: |
||||
|
- "ansible_os_family == 'RedHat'" |
||||
|
|
||||
|
- name: Create the tomcat group |
||||
|
group: name={{ tomcat_group }} state=present |
||||
|
tags: user |
||||
|
|
||||
|
- name: Create the tomcat user |
||||
|
user: name={{ tomcat_user }} state=present group={{ tomcat_group }} |
||||
|
tags: user |
||||
|
|
||||
|
- name: Set SSH key for the tc user |
||||
|
authorized_key: user={{ tomcat_user }} key="{{ ansible_ssh_public_key }}" manage_dir=yes |
||||
|
tags: user |
||||
|
|
||||
|
- name: Download tomcat |
||||
|
command: wget -c --no-check-certificate http://www.mirrorservice.org/sites/ftp.apache.org/tomcat/tomcat-7/v{{ tomcat_version }}/bin/apache-tomcat-{{ tomcat_version }}.tar.gz -O {{ sources_dir }}/apache-tomcat-{{ tomcat_version }}.tar.gz |
||||
|
|
||||
|
- name: Extract the Tomcat 7 archive |
||||
|
unarchive: creates=/home/{{ tomcat_user }}/apache-tomcat-{{ tomcat_version }} src={{ sources_dir }}/apache-tomcat-{{ tomcat_version }}.tar.gz dest="/home/{{ tomcat_user }}/" copy=no |
||||
|
sudo_user: "{{ tomcat_user }}" |
||||
|
|
||||
|
- name: Move it to $TOMCAT_HOME |
||||
|
command: creates={{ tomcat_home }} mv /home/{{ tomcat_user }}/apache-tomcat-{{ tomcat_version }} {{ tomcat_home }} |
||||
|
sudo_user: "{{ tomcat_user }}" |
||||
|
|
||||
|
- name: Copy the MySQL JDBC driver to $TOMCAT_HOME/lib |
||||
|
copy: src=mysql-connector-java-commercial-5.1.30-bin.jar dest={{ tomcat_home }}/lib |
||||
|
sudo_user: "{{ tomcat_user }}" |
||||
|
|
||||
|
- name: Change ports in server.xml |
||||
|
template: src=server.xml dest={{ tomcat_home }}/conf/server.xml |
||||
|
sudo_user: "{{ tomcat_user }}" |
||||
|
tags: config |
||||
|
|
||||
|
- name: Prevent Tomcat from rotating logs |
||||
|
template: src=logging.properties dest={{ tomcat_home }}/conf/logging.properties |
||||
|
sudo_user: "{{ tomcat_user }}" |
||||
|
tags: config |
||||
|
|
||||
|
- name: Create setenv.sh for tomcat |
||||
|
template: src=profile dest={{ tomcat_home }}/bin/setenv.sh |
||||
|
sudo_user: "{{ tomcat_user }}" |
||||
|
tags: config |
||||
|
|
||||
|
- name: Create setenv.sh for tomcat |
||||
|
template: src=custom.sh dest={{ tomcat_home }}/bin/custom.sh |
||||
|
sudo_user: "{{ tomcat_user }}" |
||||
|
tags: config |
||||
|
|
||||
|
- name: Upload the truststore |
||||
|
copy: src={{ lookup('ENV', 'BASEDIR') }}/pki/truststore.jks dest={{ tomcat_home }}/conf/trust.jks |
||||
|
sudo_user: "{{ tomcat_user }}" |
||||
|
tags: certificate |
||||
@ -0,0 +1 @@ |
|||||
|
JAVA_OPTS="$JAVA_OPTS -Djavax.net.ssl.trustStore=$CATALINA_HOME/conf/trust.jks -Djavax.net.ssl.trustStorePassword=changeme -Djavax.net.ssl.trustStoreType=jks" |
||||
@ -0,0 +1,73 @@ |
|||||
|
# Licensed to the Apache Software Foundation (ASF) under one or more |
||||
|
# contributor license agreements. See the NOTICE file distributed with |
||||
|
# this work for additional information regarding copyright ownership. |
||||
|
# The ASF licenses this file to You under the Apache License, Version 2.0 |
||||
|
# (the "License"); you may not use this file except in compliance with |
||||
|
# the License. You may obtain a copy of the License at |
||||
|
# |
||||
|
# http://www.apache.org/licenses/LICENSE-2.0 |
||||
|
# |
||||
|
# Unless required by applicable law or agreed to in writing, software |
||||
|
# distributed under the License is distributed on an "AS IS" BASIS, |
||||
|
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
||||
|
# See the License for the specific language governing permissions and |
||||
|
# limitations under the License. |
||||
|
|
||||
|
handlers = 1catalina.org.apache.juli.FileHandler, 2localhost.org.apache.juli.FileHandler, 3manager.org.apache.juli.FileHandler, 4host-manager.org.apache.juli.FileHandler, java.util.logging.ConsoleHandler |
||||
|
|
||||
|
.handlers = 1catalina.org.apache.juli.FileHandler, java.util.logging.ConsoleHandler |
||||
|
|
||||
|
############################################################ |
||||
|
# Handler specific properties. |
||||
|
# Describes specific configuration info for Handlers. |
||||
|
############################################################ |
||||
|
|
||||
|
1catalina.org.apache.juli.FileHandler.level = FINE |
||||
|
1catalina.org.apache.juli.FileHandler.directory = ${catalina.base}/logs |
||||
|
1catalina.org.apache.juli.FileHandler.prefix = catalina. |
||||
|
|
||||
|
2localhost.org.apache.juli.FileHandler.level = FINE |
||||
|
2localhost.org.apache.juli.FileHandler.directory = ${catalina.base}/logs |
||||
|
2localhost.org.apache.juli.FileHandler.prefix = localhost. |
||||
|
|
||||
|
3manager.org.apache.juli.FileHandler.level = FINE |
||||
|
3manager.org.apache.juli.FileHandler.directory = ${catalina.base}/logs |
||||
|
3manager.org.apache.juli.FileHandler.prefix = manager. |
||||
|
|
||||
|
4host-manager.org.apache.juli.FileHandler.level = FINE |
||||
|
4host-manager.org.apache.juli.FileHandler.directory = ${catalina.base}/logs |
||||
|
4host-manager.org.apache.juli.FileHandler.prefix = host-manager. |
||||
|
|
||||
|
java.util.logging.ConsoleHandler.level = FINE |
||||
|
java.util.logging.ConsoleHandler.formatter = java.util.logging.SimpleFormatter |
||||
|
|
||||
|
# Prevent log rotation |
||||
|
1catalina.org.apache.juli.FileHandler.rotatable = false |
||||
|
2localhost.org.apache.juli.FileHandler.rotatable = false |
||||
|
3manager.org.apache.juli.FileHandler.rotatable = false |
||||
|
4host-manager.org.apache.juli.FileHandler.rotatable = false |
||||
|
1catalina.org.apache.juli.FileHandler.suffix = log |
||||
|
2localhost.org.apache.juli.FileHandler.suffix = log |
||||
|
3manager.org.apache.juli.FileHandler.suffix = log |
||||
|
4host-manager.org.apache.juli.FileHandler.suffix = log |
||||
|
|
||||
|
############################################################ |
||||
|
# Facility specific properties. |
||||
|
# Provides extra control for each logger. |
||||
|
############################################################ |
||||
|
|
||||
|
org.apache.catalina.core.ContainerBase.[Catalina].[localhost].level = INFO |
||||
|
org.apache.catalina.core.ContainerBase.[Catalina].[localhost].handlers = 2localhost.org.apache.juli.FileHandler |
||||
|
|
||||
|
org.apache.catalina.core.ContainerBase.[Catalina].[localhost].[/manager].level = INFO |
||||
|
org.apache.catalina.core.ContainerBase.[Catalina].[localhost].[/manager].handlers = 3manager.org.apache.juli.FileHandler |
||||
|
|
||||
|
org.apache.catalina.core.ContainerBase.[Catalina].[localhost].[/host-manager].level = INFO |
||||
|
org.apache.catalina.core.ContainerBase.[Catalina].[localhost].[/host-manager].handlers = 4host-manager.org.apache.juli.FileHandler |
||||
|
|
||||
|
# For example, set the org.apache.catalina.util.LifecycleBase logger to log |
||||
|
# each component that extends LifecycleBase changing state: |
||||
|
#org.apache.catalina.util.LifecycleBase.level = FINE |
||||
|
|
||||
|
# To see debug messages in TldLocationsCache, uncomment the following line: |
||||
|
#org.apache.jasper.compiler.TldLocationsCache.level = FINE |
||||
@ -0,0 +1,6 @@ |
|||||
|
unset LANG |
||||
|
unset LC_CTYPE |
||||
|
unset LC_ALL |
||||
|
test -r $HOME/.bashrc && . $HOME/.bashrc |
||||
|
test -r $HOME/.bash_profile && . $HOME/.bash_profile |
||||
|
test -r $CATALINA_HOME/bin/custom.sh && . $CATALINA_HOME/bin/custom.sh |
||||
@ -0,0 +1,143 @@ |
|||||
|
<?xml version='1.0' encoding='utf-8'?> |
||||
|
<!-- |
||||
|
Licensed to the Apache Software Foundation (ASF) under one or more |
||||
|
contributor license agreements. See the NOTICE file distributed with |
||||
|
this work for additional information regarding copyright ownership. |
||||
|
The ASF licenses this file to You under the Apache License, Version 2.0 |
||||
|
(the "License"); you may not use this file except in compliance with |
||||
|
the License. You may obtain a copy of the License at |
||||
|
|
||||
|
http://www.apache.org/licenses/LICENSE-2.0 |
||||
|
|
||||
|
Unless required by applicable law or agreed to in writing, software |
||||
|
distributed under the License is distributed on an "AS IS" BASIS, |
||||
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
||||
|
See the License for the specific language governing permissions and |
||||
|
limitations under the License. |
||||
|
--> |
||||
|
<!-- Note: A "Server" is not itself a "Container", so you may not |
||||
|
define subcomponents such as "Valves" at this level. |
||||
|
Documentation at /docs/config/server.html |
||||
|
--> |
||||
|
<Server address="127.0.0.1" port="{{ tomcat_port_prefix }}8005" shutdown="SHUTDOWN"> |
||||
|
<!-- Security listener. Documentation at /docs/config/listeners.html |
||||
|
<Listener className="org.apache.catalina.security.SecurityListener" /> |
||||
|
--> |
||||
|
<!--APR library loader. Documentation at /docs/apr.html --> |
||||
|
<Listener className="org.apache.catalina.core.AprLifecycleListener" SSLEngine="on" /> |
||||
|
<!--Initialize Jasper prior to webapps are loaded. Documentation at /docs/jasper-howto.html --> |
||||
|
<Listener className="org.apache.catalina.core.JasperListener" /> |
||||
|
<!-- Prevent memory leaks due to use of particular java/javax APIs--> |
||||
|
<Listener className="org.apache.catalina.core.JreMemoryLeakPreventionListener" /> |
||||
|
<Listener className="org.apache.catalina.mbeans.GlobalResourcesLifecycleListener" /> |
||||
|
<Listener className="org.apache.catalina.core.ThreadLocalLeakPreventionListener" /> |
||||
|
|
||||
|
<!-- Global JNDI resources |
||||
|
Documentation at /docs/jndi-resources-howto.html |
||||
|
--> |
||||
|
<GlobalNamingResources> |
||||
|
<!-- Editable user database that can also be used by |
||||
|
UserDatabaseRealm to authenticate users |
||||
|
--> |
||||
|
<Resource name="UserDatabase" auth="Container" |
||||
|
type="org.apache.catalina.UserDatabase" |
||||
|
description="User database that can be updated and saved" |
||||
|
factory="org.apache.catalina.users.MemoryUserDatabaseFactory" |
||||
|
pathname="conf/tomcat-users.xml" /> |
||||
|
</GlobalNamingResources> |
||||
|
|
||||
|
<!-- A "Service" is a collection of one or more "Connectors" that share |
||||
|
a single "Container" Note: A "Service" is not itself a "Container", |
||||
|
so you may not define subcomponents such as "Valves" at this level. |
||||
|
Documentation at /docs/config/service.html |
||||
|
--> |
||||
|
<Service name="Catalina"> |
||||
|
|
||||
|
<!--The connectors can use a shared executor, you can define one or more named thread pools--> |
||||
|
<!-- |
||||
|
<Executor name="tomcatThreadPool" namePrefix="catalina-exec-" |
||||
|
maxThreads="150" minSpareThreads="4"/> |
||||
|
--> |
||||
|
|
||||
|
|
||||
|
<!-- A "Connector" represents an endpoint by which requests are received |
||||
|
and responses are returned. Documentation at : |
||||
|
Java HTTP Connector: /docs/config/http.html (blocking & non-blocking) |
||||
|
Java AJP Connector: /docs/config/ajp.html |
||||
|
APR (HTTP/AJP) Connector: /docs/apr.html |
||||
|
Define a non-SSL HTTP/1.1 Connector on port 8080 |
||||
|
--> |
||||
|
<Connector address="127.0.0.1" port="{{ tomcat_port_prefix }}8080" protocol="HTTP/1.1" |
||||
|
connectionTimeout="20000" |
||||
|
redirectPort="{{ tomcat_port_prefix }}8443" /> |
||||
|
<!-- A "Connector" using the shared thread pool--> |
||||
|
<!-- |
||||
|
<Connector executor="tomcatThreadPool" |
||||
|
port="8080" protocol="HTTP/1.1" |
||||
|
connectionTimeout="20000" |
||||
|
redirectPort="8443" /> |
||||
|
--> |
||||
|
<!-- Define a SSL HTTP/1.1 Connector on port 8443 |
||||
|
This connector uses the BIO implementation that requires the JSSE |
||||
|
style configuration. When using the APR/native implementation, the |
||||
|
OpenSSL style configuration is required as described in the APR/native |
||||
|
documentation --> |
||||
|
<!-- |
||||
|
<Connector port="8443" protocol="org.apache.coyote.http11.Http11Protocol" |
||||
|
maxThreads="150" SSLEnabled="true" scheme="https" secure="true" |
||||
|
clientAuth="false" sslProtocol="TLS" /> |
||||
|
--> |
||||
|
|
||||
|
<!-- Define an AJP 1.3 Connector on port 8009 --> |
||||
|
<Connector address="127.0.0.1" port="{{ tomcat_port_prefix }}8009" protocol="AJP/1.3" redirectPort="{{ tomcat_port_prefix }}8443" /> |
||||
|
|
||||
|
|
||||
|
<!-- An Engine represents the entry point (within Catalina) that processes |
||||
|
every request. The Engine implementation for Tomcat stand alone |
||||
|
analyzes the HTTP headers included with the request, and passes them |
||||
|
on to the appropriate Host (virtual host). |
||||
|
Documentation at /docs/config/engine.html --> |
||||
|
|
||||
|
<!-- You should set jvmRoute to support load-balancing via AJP ie : |
||||
|
<Engine name="Catalina" defaultHost="localhost" jvmRoute="jvm1"> |
||||
|
--> |
||||
|
<Engine name="Catalina" defaultHost="localhost"> |
||||
|
|
||||
|
<!--For clustering, please take a look at documentation at: |
||||
|
/docs/cluster-howto.html (simple how to) |
||||
|
/docs/config/cluster.html (reference documentation) --> |
||||
|
<!-- |
||||
|
<Cluster className="org.apache.catalina.ha.tcp.SimpleTcpCluster"/> |
||||
|
--> |
||||
|
|
||||
|
<!-- Use the LockOutRealm to prevent attempts to guess user passwords |
||||
|
via a brute-force attack --> |
||||
|
<Realm className="org.apache.catalina.realm.LockOutRealm"> |
||||
|
<!-- This Realm uses the UserDatabase configured in the global JNDI |
||||
|
resources under the key "UserDatabase". Any edits |
||||
|
that are performed against this UserDatabase are immediately |
||||
|
available for use by the Realm. --> |
||||
|
<Realm className="org.apache.catalina.realm.UserDatabaseRealm" |
||||
|
resourceName="UserDatabase"/> |
||||
|
</Realm> |
||||
|
|
||||
|
<Host name="localhost" appBase="webapps" |
||||
|
unpackWARs="true" autoDeploy="true"> |
||||
|
|
||||
|
<!-- SingleSignOn valve, share authentication between web applications |
||||
|
Documentation at: /docs/config/valve.html --> |
||||
|
<!-- |
||||
|
<Valve className="org.apache.catalina.authenticator.SingleSignOn" /> |
||||
|
--> |
||||
|
|
||||
|
<!-- Access log processes all example. |
||||
|
Documentation at: /docs/config/valve.html |
||||
|
Note: The pattern used is equivalent to using pattern="common" --> |
||||
|
<Valve className="org.apache.catalina.valves.AccessLogValve" directory="logs" |
||||
|
prefix="http_access" suffix=".log" rotatable="false" |
||||
|
pattern="%h %l %u %t "%r" %s %b" /> |
||||
|
|
||||
|
</Host> |
||||
|
</Engine> |
||||
|
</Service> |
||||
|
</Server> |
||||
@ -0,0 +1,69 @@ |
|||||
|
#!/bin/bash |
||||
|
# |
||||
|
# Tomcat Startup Script |
||||
|
# |
||||
|
# chkconfig: 2345 80 30 |
||||
|
# description: Tomcat Application Server |
||||
|
# |
||||
|
|
||||
|
### BEGIN INIT INFO |
||||
|
# Provides: webfort |
||||
|
# Required-Start: $local_fs $network $remote_fs |
||||
|
# Required-Stop: $local_fs $network $remote_fs |
||||
|
# Default-Start: 2 3 4 5 |
||||
|
# Default-Stop: 0 1 6 |
||||
|
# Short-Description: start and stop tomcat server |
||||
|
# Description: Tomcat Application server |
||||
|
### END INIT INFO |
||||
|
|
||||
|
# Source function library. |
||||
|
. /etc/rc.d/init.d/functions |
||||
|
|
||||
|
TOMCAT_USER={{ tomcat_user }} |
||||
|
tomcat_pid="$(pgrep -U $TOMCAT_USER java)" |
||||
|
running=$? |
||||
|
|
||||
|
start() { |
||||
|
[ "$EUID" != "0" ] && exit 4 |
||||
|
su "$TOMCAT_USER" -c "{{ tomcat_home }}/bin/catalina.sh start" |
||||
|
} |
||||
|
|
||||
|
stop() { |
||||
|
[ "$EUID" != "0" ] && exit 4 |
||||
|
su "$TOMCAT_USER" -c "{{ tomcat_home }}/bin/catalina.sh stop" |
||||
|
} |
||||
|
|
||||
|
status() { |
||||
|
echo -n "Tomcat " |
||||
|
if [ -n "$tomcat_pid" ]; then |
||||
|
echo "started" |
||||
|
else |
||||
|
echo "stopped" |
||||
|
fi |
||||
|
return $running |
||||
|
} |
||||
|
|
||||
|
# See how we were called. |
||||
|
case "$1" in |
||||
|
start) |
||||
|
[ $running -eq 0 ] && exit 0 |
||||
|
start |
||||
|
;; |
||||
|
stop) |
||||
|
[ $running -eq 0 ] || exit 0 |
||||
|
stop |
||||
|
;; |
||||
|
restart|force-reload) |
||||
|
stop |
||||
|
sleep 5 |
||||
|
start |
||||
|
;; |
||||
|
status) |
||||
|
status |
||||
|
;; |
||||
|
*) |
||||
|
echo $"Usage: $0 {start|stop|restart}" |
||||
|
exit 2 |
||||
|
esac |
||||
|
|
||||
|
exit $? |
||||
@ -0,0 +1 @@ |
|||||
|
*.tar.gz |
||||
@ -0,0 +1,24 @@ |
|||||
|
--- |
||||
|
|
||||
|
- name: This module only works on CentOS 6 x86 |
||||
|
assert: |
||||
|
that: |
||||
|
- "ansible_userspace_bits == '32'" |
||||
|
- "ansible_os_family == 'RedHat'" |
||||
|
|
||||
|
- name: Unarchive the VMware Tools installation media |
||||
|
unarchive: creates={{ sources_dir }}/vmware-tools-distrib src=VMwareTools-9.6.2-1688356.tar.gz dest={{ sources_dir }} |
||||
|
|
||||
|
- name: Install the VMware Tools |
||||
|
command: creates=/usr/bin/vmware-config-tools.pl {{ sources_dir }}/vmware-tools-distrib/vmware-install.pl --default |
||||
|
|
||||
|
- name: Install fuse |
||||
|
yum: name=fuse-libs state=installed |
||||
|
|
||||
|
- name: Patch the startup scripts |
||||
|
template: src=vmware-tools-thinprint.conf dest=/etc/init/vmware-tools-thinprint.conf |
||||
|
|
||||
|
# TODO : start the vmware-tools-thinprint service before ? |
||||
|
|
||||
|
- name: Configure the VMware Tools |
||||
|
command: /usr/bin/vmware-config-tools.pl -d -p |
||||
@ -0,0 +1,6 @@ |
|||||
|
author "Nicolas MASSE" |
||||
|
description "Dummy Service" |
||||
|
|
||||
|
console output |
||||
|
|
||||
|
exec /bin/sleep 5 |
||||
@ -0,0 +1,31 @@ |
|||||
|
--- |
||||
|
|
||||
|
- name: Bootstrap a CentOS node |
||||
|
hosts: bootstrap |
||||
|
sudo: no |
||||
|
roles: |
||||
|
- bootstrap |
||||
|
|
||||
|
- name: OneAccess Demo |
||||
|
hosts: sm |
||||
|
sudo: yes |
||||
|
roles: |
||||
|
- bootstrap |
||||
|
- base |
||||
|
- vmware-tools |
||||
|
- java-7 |
||||
|
- pki |
||||
|
- ca-directory |
||||
|
- siteminder-common |
||||
|
- siteminder-policy-server |
||||
|
- siteminder-adminui |
||||
|
- apache-2.2 |
||||
|
- tomcat-7 |
||||
|
- siteminder-webagent |
||||
|
- mysql-ee-5.6 |
||||
|
- ssg-8.3 |
||||
|
- oneaccess |
||||
|
- iptables |
||||
|
# - prepare-to-export |
||||
|
# - service-control |
||||
|
# - backup |
||||
@ -0,0 +1,22 @@ |
|||||
|
The MIT License (MIT) |
||||
|
|
||||
|
Copyright (c) 2015 Nicolas MASSE |
||||
|
|
||||
|
Permission is hereby granted, free of charge, to any person obtaining a copy |
||||
|
of this software and associated documentation files (the "Software"), to deal |
||||
|
in the Software without restriction, including without limitation the rights |
||||
|
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell |
||||
|
copies of the Software, and to permit persons to whom the Software is |
||||
|
furnished to do so, subject to the following conditions: |
||||
|
|
||||
|
The above copyright notice and this permission notice shall be included in all |
||||
|
copies or substantial portions of the Software. |
||||
|
|
||||
|
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR |
||||
|
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, |
||||
|
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE |
||||
|
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER |
||||
|
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, |
||||
|
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE |
||||
|
SOFTWARE. |
||||
|
|
||||
@ -0,0 +1,4 @@ |
|||||
|
[defaults] |
||||
|
log_path = ./logs/ansible.log |
||||
|
filter_plugins = ./local_plugins/filter_plugins |
||||
|
|
||||
@ -0,0 +1,48 @@ |
|||||
|
#!/bin/bash |
||||
|
|
||||
|
# Set environment variables |
||||
|
export ANSIBLE_CONFIG="./ansible.cfg" |
||||
|
|
||||
|
options="" |
||||
|
target="$1" |
||||
|
ssh_key="$HOME/.ssh/id_rsa" |
||||
|
|
||||
|
if [ -z "$target" ]; then |
||||
|
echo "No target specified. Please specify an inventory or 'bootstrap' !" |
||||
|
exit 1 |
||||
|
fi |
||||
|
|
||||
|
if [ "$target" == "bootstrap" -o "$target" == "bootstrap-minimal" ]; then |
||||
|
if [ -z "$2" ]; then |
||||
|
echo "Please specify the target host !" |
||||
|
exit 1 |
||||
|
fi |
||||
|
host="$2" |
||||
|
echo "Starting $target..." |
||||
|
echo |
||||
|
echo -n "Please enter the initial root password: " |
||||
|
read -s password |
||||
|
echo |
||||
|
echo |
||||
|
echo "Connecting to $host to register the SSH Host Key !" |
||||
|
sshpass -p "$password" ssh -i $ssh_key -o StrictHostKeyChecking=no "root@$host" /bin/true |
||||
|
auth="" |
||||
|
if [ -n "$password" ]; then |
||||
|
auth="ansible_ssh_pass=$password" |
||||
|
else |
||||
|
auth="ansible_ssh_private_key_file=$ssh_key" |
||||
|
fi |
||||
|
echo -e "[$target]\n$2 ansible_ssh_user=root $auth\n" > ./hosts-$target |
||||
|
else |
||||
|
shift |
||||
|
options="$@" |
||||
|
fi |
||||
|
|
||||
|
if [ ! -f "./hosts-$target" ]; then |
||||
|
echo "Invalid target '$target' !" |
||||
|
exit 1 |
||||
|
fi |
||||
|
|
||||
|
ansible-playbook -i ./hosts-$target $options site.yml |
||||
|
|
||||
|
rm -f hosts-bootstrap hosts-bootstrap-minimal # temporary file |
||||
Some files were not shown because too many files changed in this diff
Loading…
Reference in new issue