rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: update entrypoint to autogenerate SAML certificate and private key

Browse Source 
Signed-off-by: Thomas Stocker <thomas.stocker.pro@gmail.com>
This commit is contained in:
Thomas Stocker
2025-11-12 15:11:31 +01:00
committed by Bryan Frimin
parent 53965631c8
commit 9adc975369
2 changed files with 32 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
docs/DOCKER_ENVIRONMENT_VARIABLES.md
View File

@@ -128,12 +128,12 @@ This document provides a comprehensive reference for all environment variables u
## SAML Authentication
| Variable | Description | Default Value | Required |
| ------------------------------- | ----------------------------------------------------------------- | ----------------------- | -------- |
| `SAML_SESSION_DURATION` | SAML session validity duration in seconds | `604800` (7 days) | No |
| `SAML_CLEANUP_INTERVAL_SECONDS` | Interval in seconds for cleaning up expired SAML sessions (0=off) | `0` (disabled) | No |
| `SAML_CERTIFICATE` | SAML service provider certificate in PEM format | - | No |
| `SAML_PRIVATE_KEY` | SAML service provider private key in PEM format | - | No |
| Variable | Description | Default Value | Required |
| ------------------------------- | ----------------------------------------------------------------- |------------------| -------- |
| `SAML_SESSION_DURATION` | SAML session validity duration in seconds | `604800` (7 days) | No |
| `SAML_CLEANUP_INTERVAL_SECONDS` | Interval in seconds for cleaning up expired SAML sessions (0=off) | `0` (disabled) | No |
| `SAML_CERTIFICATE` | SAML service provider certificate in PEM format | `autogenerated` | No |
| `SAML_PRIVATE_KEY` | SAML service provider private key in PEM format | `autogenerated` | No |
## Custom Domains

28
entrypoint.sh
View File

@@ -4,12 +4,38 @@ set -e
# Configuration file path
CONFIG_FILE="${CONFIG_FILE:-/etc/probod/config.yml}"
# Function to generate default SAML certificate and private key if not provided
generate_saml_defaults() {
if [ -z "$SAML_CERTIFICATE" ] || [ -z "$SAML_PRIVATE_KEY" ]; then
echo "Generating default SAML certificate and private key..."
# Generate private key and certificate valid for 10 years
TEMP_KEY=$(mktemp)
TEMP_CERT=$(mktemp)
openssl req -x509 -newkey rsa:2048 -keyout "$TEMP_KEY" -out "$TEMP_CERT" \
-days 3650 -nodes -subj "/CN=probo-saml/O=Probo/C=US" 2>/dev/null
# Read generated files and export as environment variables
export SAML_PRIVATE_KEY=$(cat "$TEMP_KEY")
export SAML_CERTIFICATE=$(cat "$TEMP_CERT")
# Clean up temporary files
rm -f "$TEMP_KEY" "$TEMP_CERT"
echo "Default SAML certificate and private key generated successfully"
fi
}
# Check if config file already exists (e.g., mounted from ConfigMap)
if [ -f "$CONFIG_FILE" ]; then
echo "Using existing configuration file at: $CONFIG_FILE"
else
echo "Generating configuration file from environment variables at: $CONFIG_FILE"
# Generate default SAML credentials if not provided
generate_saml_defaults
# Create directory if it doesn't exist
mkdir -p "$(dirname "$CONFIG_FILE")"
@@ -121,7 +147,6 @@ EOF
fi
# Add SAML config if any SAML variable is configured
if [ -n "$SAML_SESSION_DURATION" ] || [ -n "$SAML_CLEANUP_INTERVAL_SECONDS" ] || [ -n "$SAML_CERTIFICATE" ] || [ -n "$SAML_PRIVATE_KEY" ]; then
cat >> "$CONFIG_FILE" <<EOF
saml:
@@ -132,7 +157,6 @@ $(echo "${SAML_CERTIFICATE:-}" | sed 's/^/ /')
private-key: |
$(echo "${SAML_PRIVATE_KEY:-}" | sed 's/^/ /')
EOF
fi
echo "Configuration file generated at: $CONFIG_FILE"
fi