configs/metagen.sh

   1 #! /bin/sh
   2
   3 while getopts a:c:e:h:n:o:s:t: c
   4      do
   5          case $c in
   6            c)         CERTS[${#CERTS[*]}]=$OPTARG;;
   7            e)         ENTITYID=$OPTARG;;
   8            h)         HOSTS[${#HOSTS[*]}]=$OPTARG;;
   9            n)         NAKEDHOSTS[${#NAKEDHOSTS[*]}]=$OPTARG;;
  10            o)         ORGNAME=$OPTARG;;
  11            a)         ADMIN[${#ADMIN[*]}]=$OPTARG;;
  12            s)         SUP[${#SUP[*]}]=$OPTARG;;
  13            t)         TECH[${#TECH[*]}]=$OPTARG;;
  14            \?)        echo metagen -c cert1 [-c cert2 ...] -h host1 [-h host2 ...] [-e entityID]
  15                       exit 1;;
  16          esac
  17      done
  18
  19 if [ ${#HOSTS[*]} -eq 0 -a ${#NAKEDHOSTS[*]} -eq 0 ] ; then
  20     echo metagen -c cert1 [-c cert2 ...] -h host1 [-h host2 ...] [-e entityID]
  21     exit 1
  22 fi
  23
  24 if [ ${#CERTS[*]} -eq 0 ] ; then
  25     CERTS[${#CERTS[*]}]=sp-cert.pem
  26 fi
  27
  28 for c in ${CERTS[@]}
  29 do
  30     if  [ ! -s $c ] ; then
  31         echo Certificate file $c does not exist!
  32         exit 2
  33     fi
  34 done
  35
  36 if [ -z $ENTITYID ] ; then
  37     ENTITYID=https://${HOSTS[0]}/shibboleth
  38 fi
  39
  40 cat <<EOF
  41 <md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" entityID="${ENTITYID}">
  42   <md:SPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol urn:oasis:names:tc:SAML:1.1:protocol urn:oasis:names:tc:SAML:1.0:protocol">
  43     <md:Extensions>
  44 EOF
  45
  46 count=1
  47 for h in ${HOSTS[@]}
  48 do
  49   cat << EOF
  50       <DiscoveryResponse xmlns="urn:oasis:names:tc:SAML:profiles:SSO:idp-discovery-protocol" Binding="urn:oasis:names:tc:SAML:profiles:SSO:idp-discovery-protocol" Location="https://$h/Shibboleth.sso/DS" index="$count"/>
  51 EOF
  52   let "count++"
  53 done
  54
  55 for h in ${NAKEDHOSTS[@]}
  56 do
  57   cat << EOF
  58       <DiscoveryResponse xmlns="urn:oasis:names:tc:SAML:profiles:SSO:idp-discovery-protocol" Binding="urn:oasis:names:tc:SAML:profiles:SSO:idp-discovery-protocol" Location="http://$h/Shibboleth.sso/DS" index="$count"/>
  59 EOF
  60   let "count++"
  61 done
  62
  63 cat << EOF
  64     </md:Extensions>
  65 EOF
  66
  67 for c in ${CERTS[@]}
  68 do
  69 cat << EOF
  70     <md:KeyDescriptor>
  71       <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
  72         <ds:X509Data>
  73           <ds:X509Certificate>
  74 EOF
  75 grep -v ^- $c
  76 cat << EOF
  77           </ds:X509Certificate>
  78         </ds:X509Data>
  79       </ds:KeyInfo>
  80     </md:KeyDescriptor>
  81 EOF
  82 done
  83
  84 cat << EOF
  85     <!--
  86 EOF
  87
  88 for h in ${HOSTS[@]}
  89 do
  90   cat <<EOF
  91     <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" Location="https://$h/Shibboleth.sso/SLO/SOAP"/>
  92     <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://$h/Shibboleth.sso/SLO/Redirect"/>
  93     <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://$h/Shibboleth.sso/SLO/POST"/>
  94     <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact" Location="https://$h/Shibboleth.sso/SLO/Artifact"/>
  95 EOF
  96 done
  97
  98 for h in ${NAKEDHOSTS[@]}
  99 do
 100   cat <<EOF
 101     <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" Location="http://$h/Shibboleth.sso/SLO/SOAP"/>
 102     <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="http://$h/Shibboleth.sso/SLO/Redirect"/>
 103     <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="http://$h/Shibboleth.sso/SLO/POST"/>
 104     <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact" Location="http://$h/Shibboleth.sso/SLO/Artifact"/>
 105 EOF
 106 done
 107
 108 for h in ${HOSTS[@]}
 109 do
 110   cat <<EOF
 111     <md:ManageNameIDService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" Location="https://$h/Shibboleth.sso/NIM/SOAP"/>
 112     <md:ManageNameIDService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://$h/Shibboleth.sso/NIM/Redirect"/>
 113     <md:ManageNameIDService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://$h/Shibboleth.sso/NIM/POST"/>
 114     <md:ManageNameIDService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact" Location="https://$h/Shibboleth.sso/NIM/Artifact"/>
 115 EOF
 116 done
 117
 118 for h in ${NAKEDHOSTS[@]}
 119 do
 120   cat <<EOF
 121     <md:ManageNameIDService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" Location="http://$h/Shibboleth.sso/NIM/SOAP"/>
 122     <md:ManageNameIDService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="http://$h/Shibboleth.sso/NIM/Redirect"/>
 123     <md:ManageNameIDService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="http://$h/Shibboleth.sso/NIM/POST"/>
 124     <md:ManageNameIDService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact" Location="http://$h/Shibboleth.sso/NIM/Artifact"/>
 125 EOF
 126 done
 127
 128 cat <<EOF
 129     -->
 130 EOF
 131
 132 count=0
 133 for h in ${HOSTS[@]}
 134 do
 135   cat <<EOF
 136     <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://$h/Shibboleth.sso/SAML2/POST" index="$((count+1))"/>
 137     <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign" Location="https://$h/Shibboleth.sso/SAML2/POST-SimpleSign" index="$((count+2))"/>
 138     <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact" Location="https://$h/Shibboleth.sso/SAML2/Artifact" index="$((count+3))"/>
 139     <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:PAOS" Location="https://$h/Shibboleth.sso/SAML2/ECP" index="$((count+4))"/>
 140     <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:1.0:profiles:browser-post" Location="https://$h/Shibboleth.sso/SAML/POST" index="$((count+5))"/>
 141     <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:1.0:profiles:artifact-01" Location="https://$h/Shibboleth.sso/SAML/Artifact" index="$((count+6))"/>
 142 EOF
 143   let "count+=6"
 144 done
 145
 146 for h in ${NAKEDHOSTS[@]}
 147 do
 148   cat <<EOF
 149     <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="http://$h/Shibboleth.sso/SAML2/POST" index="$((count+1))"/>
 150     <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign" Location="http://$h/Shibboleth.sso/SAML2/POST-SimpleSign" index="$((count+2))"/>
 151     <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact" Location="http://$h/Shibboleth.sso/SAML2/Artifact" index="$((count+3))"/>
 152     <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:PAOS" Location="http://$h/Shibboleth.sso/SAML2/ECP" index="$((count+4))"/>
 153     <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:1.0:profiles:browser-post" Location="http://$h/Shibboleth.sso/SAML/POST" index="$((count+5))"/>
 154     <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:1.0:profiles:artifact-01" Location="http://$h/Shibboleth.sso/SAML/Artifact" index="$((count+6))"/>
 155 EOF
 156   let "count+=6"
 157 done
 158
 159 cat <<EOF
 160   </md:SPSSODescriptor>
 161 EOF
 162
 163 if [ -n "$ORGNAME" ] ; then
 164   cat <<EOF
 165   <md:Organization>
 166     <md:OrganizationName xml:lang="en">$ORGNAME</md:OrganizationName>
 167     <md:OrganizationDisplayName xml:lang="en">$ORGNAME</md:OrganizationDisplayName>
 168     <md:OrganizationURL xml:lang="en">$ENTITYID</md:OrganizationURL>
 169   </md:Organization>
 170 EOF
 171 fi
 172
 173 for c in ${ADMIN[@]}
 174 do
 175   c=(${c//\// })
 176   cat <<EOF
 177   <md:ContactPerson contactType="administrative">
 178     <md:GivenName>${c[0]}</md:GivenName>
 179     <md:SurName>${c[1]}</md:SurName>
 180     <md:EmailAddress>${c[2]}</md:EmailAddress>
 181   </md:ContactPerson>
 182 EOF
 183 done
 184
 185 for c in ${SUP[@]}
 186 do
 187   c=(${c//\// })
 188   cat <<EOF
 189   <md:ContactPerson contactType="support">
 190     <md:GivenName>${c[0]}</md:GivenName>
 191     <md:SurName>${c[1]}</md:SurName>
 192     <md:EmailAddress>${c[2]}</md:EmailAddress>
 193   </md:ContactPerson>
 194 EOF
 195 done
 196
 197 for c in ${TECH[@]}
 198 do
 199   c=(${c//\// })
 200   cat <<EOF
 201   <md:ContactPerson contactType="technical">
 202     <md:GivenName>${c[0]}</md:GivenName>
 203     <md:SurName>${c[1]}</md:SurName>
 204     <md:EmailAddress>${c[2]}</md:EmailAddress>
 205   </md:ContactPerson>
 206 EOF
 207 done
 208
 209 cat <<EOF
 210 </md:EntityDescriptor>
 211 EOF