Merge branch 'docker-updates'

docker/pom.xml

@@ -25,7 +25,7 @@
             <plugin>
                 <groupId>com.google.cloud.tools</groupId>
                 <artifactId>jib-maven-plugin</artifactId>
-                <version>0.9.10</version>
+                <version>0.9.13</version>
                 <executions>
                     <execution>
                         <id>make-docker-image</id>
@@ -34,24 +34,23 @@
                             <goal>buildTar</goal>
                         </goals>
                         <configuration>
+                            <from>
+                                <image>adoptopenjdk/openjdk11</image>
+                            </from>
                             <to>
                                 <image>${dockerImageTag}</image>
                             </to>
                             <container>
-                                <jvmFlags>
-                                    <jvmFlag>-Xms1g</jvmFlag>
-                                    <jvmFlag>-Xmx1g</jvmFlag>
-                                </jvmFlags>
-                                <mainClass>password.pwm.onejar.OnejarMain</mainClass>
-                                <args>
+                                <entrypoint>
+                                    <arg>java</arg>
+                                    <arg>-jar</arg>
+                                    <arg>/app/libs/pwm-onejar-${project.version}.jar</arg>
                                     <arg>-applicationPath</arg>
                                     <arg>/config</arg>
-                                </args>
+                                </entrypoint>
                                 <format>docker</format>
                                 <ports>8443</ports>
                             </container>
-                            <!--<useCurrentTimestamp>true</useCurrentTimestamp>-->
-                            <allowInsecureRegistries>true</allowInsecureRegistries>
                         </configuration>
                     </execution>
                 </executions>

onejar/src/main/java/password/pwm/onejar/TomcatOnejarRunner.java

@@ -22,7 +22,6 @@
 
 package password.pwm.onejar;
 
-import org.apache.catalina.LifecycleException;
 import org.apache.catalina.connector.Connector;
 import org.apache.catalina.startup.Tomcat;
 import org.apache.catalina.util.ServerInfo;
@@ -142,16 +141,13 @@ public class TomcatOnejarRunner
         final String warPath = onejarConfig.getWarFolder().getAbsolutePath();
         tomcat.addWebapp( "/" + onejarConfig.getContext(), warPath );
 
-
         try
         {
-            tomcat.start();
-
             tomcat.setConnector( makeConnector( onejarConfig ) );
-
+            tomcat.start();
             out( "tomcat started in " + Duration.between( Instant.now(), startTime ).toString() );
         }
-        catch ( LifecycleException e )
+        catch ( Exception e )
         {
             throw new OnejarException( "unable to start tomcat: " + e.getMessage() );
         }
@@ -185,6 +181,7 @@ public class TomcatOnejarRunner
 
 
     private Connector makeConnector( final OnejarConfig onejarConfig )
+            throws Exception
     {
         final Connector connector = new Connector( "HTTP/1.1" );
         connector.setPort( onejarConfig.getPort() );
@@ -201,10 +198,20 @@ public class TomcatOnejarRunner
         connector.setAttribute( "keyAlias", OnejarMain.KEYSTORE_ALIAS );
         connector.setAttribute( "clientAuth", "false" );
 
+        final Properties tlsProperties = readConfiguredTlsProperties( onejarConfig );
+        if ( tlsProperties != null )
+        {
+            for ( final String key : tlsProperties.stringPropertyNames() )
+            {
+                final String value = tlsProperties.getProperty( key );
+                connector.setAttribute( key, value );
+            }
+        }
+
         return connector;
     }
 
-     static String getVersion( ) throws OnejarException
+    static String getVersion( ) throws OnejarException
     {
         try
         {
@@ -250,31 +257,21 @@ public class TomcatOnejarRunner
     void generatePwmKeystore( final OnejarConfig onejarConfig )
             throws IOException, ClassNotFoundException, IllegalAccessException, NoSuchMethodException, InvocationTargetException
     {
-        final File warPath = onejarConfig.getWarFolder();
-        final String keystoreFile = onejarConfig.getKeystoreFile().getAbsolutePath();
-        final File webInfPath = new File( warPath.getAbsolutePath() + File.separator + "WEB-INF" + File.separator + "lib" );
-        final File[] jarFiles = webInfPath.listFiles();
-        final List<URL> jarURLList = new ArrayList<>();
-        if ( jarFiles != null )
+        try ( URLClassLoader classLoader = warClassLoaderFromConfig( onejarConfig ) )
         {
-            for ( final File jarFile : jarFiles )
-            {
-                jarURLList.add( jarFile.toURI().toURL() );
-            }
+            final Class pwmMainClass = classLoader.loadClass( "password.pwm.util.cli.MainClass" );
+            final String keystoreFile = onejarConfig.getKeystoreFile().getAbsolutePath();
+            final Method mainMethod = pwmMainClass.getMethod( "main", String[].class );
+            final String[] arguments = new String[] {
+                    "-applicationPath=" + onejarConfig.getApplicationPath().getAbsolutePath(),
+                    "ExportHttpsKeyStore",
+                    keystoreFile,
+                    OnejarMain.KEYSTORE_ALIAS,
+                    onejarConfig.getKeystorePass(),
+            };
+
+            mainMethod.invoke( null, ( Object ) arguments );
         }
-        final URLClassLoader classLoader = URLClassLoader.newInstance( jarURLList.toArray( new URL[ jarURLList.size() ] ) );
-        final Class pwmMainClass = classLoader.loadClass( "password.pwm.util.cli.MainClass" );
-        final Method mainMethod = pwmMainClass.getMethod( "main", String[].class );
-        final String[] arguments = new String[] {
-                "-applicationPath=" + onejarConfig.getApplicationPath().getAbsolutePath(),
-                "ExportHttpsKeyStore",
-                keystoreFile,
-                OnejarMain.KEYSTORE_ALIAS,
-                onejarConfig.getKeystorePass(),
-        };
-
-        mainMethod.invoke( null, ( Object ) arguments );
-        classLoader.close();
     }
 
     void setupEnv( final OnejarConfig onejarConfig )
@@ -315,4 +312,37 @@ public class TomcatOnejarRunner
             }
         }
     }
+
+    Properties readConfiguredTlsProperties( final OnejarConfig onejarConfig )
+            throws Exception
+    {
+        out( "beginning read of tlsProperties " );
+        try ( URLClassLoader classLoader = warClassLoaderFromConfig( onejarConfig ) )
+        {
+            final Class pwmMainClass = classLoader.loadClass( "password.pwm.util.cli.commands.ExportHttpsTomcatConfigCommand" );
+            final Method readMethod = pwmMainClass.getMethod( "readAsProperties", String.class );
+            final String arguments = onejarConfig.getApplicationPath().getAbsolutePath();
+            final Object returnObjValue = readMethod.invoke( null, ( Object ) arguments );
+            final Properties returnProps = ( Properties ) returnObjValue;
+            out( "completed read of tlsProperties " );
+            return returnProps;
+        }
+    }
+
+    URLClassLoader warClassLoaderFromConfig( final OnejarConfig onejarConfig )
+            throws IOException
+    {
+        final File warPath = onejarConfig.getWarFolder();
+        final File webInfPath = new File( warPath.getAbsolutePath() + File.separator + "WEB-INF" + File.separator + "lib" );
+        final File[] jarFiles = webInfPath.listFiles();
+        final List<URL> jarURLList = new ArrayList<>();
+        if ( jarFiles != null )
+        {
+            for ( final File jarFile : jarFiles )
+            {
+                jarURLList.add( jarFile.toURI().toURL() );
+            }
+        }
+        return URLClassLoader.newInstance( jarURLList.toArray( new URL[ jarURLList.size() ] ) );
+    }
 }

server/src/main/java/password/pwm/config/option/TLSVersion.java

@@ -28,7 +28,8 @@ public enum TLSVersion
     SSL_3_0( "SSLv3" ),
     TLS_1_0( "TLSv1" ),
     TLS_1_1( "TLSv1.1" ),
-    TLS_1_2( "TLSv1.2" ),;
+    TLS_1_2( "TLSv1.2" ),
+    TLS_1_3( "TLSv1.3" ),;
 
     private final String tomcatValueName;
 

server/src/main/java/password/pwm/util/cli/commands/ExportHttpsTomcatConfigCommand.java

@@ -27,7 +27,10 @@ import password.pwm.PwmConstants;
 import password.pwm.config.Configuration;
 import password.pwm.config.PwmSetting;
 import password.pwm.config.option.TLSVersion;
+import password.pwm.config.stored.ConfigurationReader;
+import password.pwm.error.PwmUnrecoverableException;
 import password.pwm.util.cli.CliParameters;
+import password.pwm.util.java.StringUtil;
 
 import java.io.File;
 import java.io.FileInputStream;
@@ -38,6 +41,7 @@ import java.io.OutputStream;
 import java.util.ArrayList;
 import java.util.Iterator;
 import java.util.List;
+import java.util.Properties;
 import java.util.Set;
 
 public class ExportHttpsTomcatConfigCommand extends AbstractCliCommand
@@ -105,6 +109,29 @@ public class ExportHttpsTomcatConfigCommand extends AbstractCliCommand
         return cliParameters;
     }
 
+    /**
+     * Invoked (via reflection) by tomcatOneJar class in Onejar module.
+     * @param applicationPath application path containing configuration file.
+     * @return Properties with tomcat connector parameters.
+     * @throws PwmUnrecoverableException if problem loading config
+     */
+    public static Properties readAsProperties( final String applicationPath )
+            throws PwmUnrecoverableException
+    {
+        final File configFile = new File( applicationPath + File.separator + PwmConstants.DEFAULT_CONFIG_FILE_FILENAME );
+        final ConfigurationReader reader = new ConfigurationReader( configFile );
+        final Configuration configuration = reader.getConfiguration();
+        final String sslProtocolSettingValue = TomcatConfigWriter.getTlsProtocolsValue( configuration );
+        final Properties newProps = new Properties();
+        newProps.setProperty( "sslEnabledProtocols",  sslProtocolSettingValue );
+        final String ciphers = configuration.readSettingAsString( PwmSetting.HTTPS_CIPHERS );
+        if ( !StringUtil.isEmpty( ciphers ) )
+        {
+            newProps.setProperty( "ciphers", ciphers );
+        }
+        return newProps;
+    }
+
 
     public static class TomcatConfigWriter
     {
@@ -126,7 +153,6 @@ public class ExportHttpsTomcatConfigCommand extends AbstractCliCommand
             outputFile.write( fileContents.getBytes( PwmConstants.DEFAULT_CHARSET ) );
         }
 
-
         private static String getTlsProtocolsValue( final Configuration configuration )
         {
             final Set<TLSVersion> tlsVersions = configuration.readSettingAsOptionList( PwmSetting.HTTPS_PROTOCOLS, TLSVersion.class );
@@ -142,6 +168,5 @@ public class ExportHttpsTomcatConfigCommand extends AbstractCliCommand
             }
             return output.toString();
         }
-
     }
 }

server/src/main/resources/password/pwm/config/PwmSetting.xml

@@ -3993,6 +3993,7 @@
     <setting hidden="false" key="https.server.tls.protocols" level="1">
         <default>
             <value>TLS_1_2</value>
+            <value>TLS_1_3</value>
         </default>
         <options>
             <option value="SSL_2_0">SSL v2.0</option>
@@ -4000,11 +4001,12 @@
             <option value="TLS_1_0">TLS v1.0</option>
             <option value="TLS_1_1">TLS v1.1</option>
             <option value="TLS_1_2">TLS v1.2</option>
+            <option value="TLS_1_3">TLS v1.3</option>
         </options>
     </setting>
     <setting hidden="false" key="https.server.tls.ciphers" level="1">
         <default>
-            <value>TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_DHE_RSA_WITH_AES_128_GCM_SHA256,TLS_DHE_DSS_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_SHA256,TLS_ECDHE_RSA_WITH_AES_128_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_SHA,TLS_DHE_RSA_WITH_AES_128_SHA256,TLS_DHE_RSA_WITH_AES_128_SHA,TLS_DHE_DSS_WITH_AES_128_SHA256</value>
+            <value/>
         </default>
     </setting>
     <setting hidden="false" key="pwm.wordlist.location" level="1">