Grouper Users - Open Discussion List

[Christopher Hubing <>]

Good addition to the mix, John. Do you use this feature and then how do 
you deploy it? Would you include such secrets in a cloudformation template 
or just create them manually, as needed? There is also a 4096 byte limit 
to each secret, so has lengthty configuration items that contain secrets 
been a problem?

-c


On Sun, 29 Apr 2018, John Schrader wrote:

> This is a great conversation..
> For those of us running in AWS cloud, AWS has released "SecretsManager" [1]
>
> SecretsManager opens up some interesting possibilities for both EC2 instances 
> and containers(tasks) running in ECS.
>
> As a POC, I've created an elConfig class (thanks to Chris for the capability) 
> that retrieves values for hibernate properties:
>
> hibernate.connection.url.sm.elConfig            = 
> ${edu.internet2.middleware.grouperClient.config.SecretsManagerElClass.getSecret('/grouper/dev','url')}
> hibernate.connection.url                        = 
> $$hibernate.connection.url.sm$$
>
> hibernate.connection.username.sm.elConfig       = 
> ${edu.internet2.middleware.grouperClient.config.SecretsManagerElClass.getSecret('/grouper/dev','username')}
> hibernate.connection.username                   = 
> $$hibernate.connection.username.sm$$
>
> hibernate.connection.password.sm.elConfig       = 
> ${edu.internet2.middleware.grouperClient.config.SecretsManagerElClass.getSecret('/grouper/dev','password')}
> hibernate.connection.password                   = 
> $$hibernate.connection.password.sm$$
> from SecretsManager.
>
> Read/Decrypt access to the `/grouper/dev` secret is controlled by the role 
> associated with an EC2 instance or ECS task.
> Using a role helps with the initial credential bootstrapping and allows for 
> immutability.
>
> -John
>
> [1] https://aws.amazon.com/secrets-manager/
>
>
>
>
>
>
>
>
> On Thu, Apr 26, 2018 at 1:27 PM, Jack Stewart 
> <>
>  wrote:
>       Everyone,
>
> Thank you all for your wonderful feedback!  I hope the discussion continues.
>
> A few thoughts:
>
> - Although Grouper can run with environment variables, it would take a lot of 
> time to convert, and each major upgrade could possibly be made tricky as a 
> result.  Or am I being too
> paranoid?
>
> - I don’t quite see consensus on a clear way forward.  All the information 
> presented here has been helpful, though.  I will check what others are doing 
> locally.
>
> Jack
>
>
> -- 
> Jack Stewart
> Solutions Architect, Identity and Access Management
> University of Michigan
> 4251 Plymouth Road
> Ann Arbor, Michigan 48105-3640
> (734) 764-0853
>
> On Apr 26, 2018, at 12:39 PM, Hyzer, Chris 
> <>
>  wrote:
>
>       Fyi grouper config can happen in env vars, also the sources.xml can be 
> migrated to subject.properties
>
>       
> https://spaces.internet2.edu/display/Grouper/Grouper+configuration+overlay#Grouperconfigurationoverlay-Environmentvariables
>
>       
> https://spaces.internet2.edu/display/Grouper/Grouper+sources.xml+conversion+to+subject.properties
>
>       Thanks
>       Chris
>
>       -----Original Message-----
>       From: 
>
>  
> [mailto:]
>  On Behalf Of Christopher Hubing
>       Sent: Wednesday, April 25, 2018 1:00 PM
>       To: Jack Stewart 
> <>
>       Cc: 
> ;
>  csp study grouper 
> <>
>       Subject: Re: [grouper-users] Containerized Grouper and Secrets
>
>
>       For I2, we are storing secret things in an encrypted S3 bucket. The 
> build
>       host has access to read from it, and then pushes the images to a private
>       Elastic Container Repo. The containers run in ECS.
>
>       Here's an example of our Dockerfile for the UI:
>       
> https://github.internet2.edu/gist/chubing/c4e663ab5a39fb73dccdcd748a92c5fe
>
>       Since the new Grouper container is pushed to Dockerhub (and have tags 
> for
>       patches), it should make it pretty easy to manange (hopefully).
>
>       -c
>
>       On Wed, 25 Apr 2018, Jack Stewart wrote:
>
>             Everyone,
>
>             I would like to start out by saying that the new role-based 
> Grouper containers are great!  It was very easy to build the images.
>
>
>             Now my question is, what are other schools doing with regard to their 
> Grouper configurations?  Are you "burning them into" storing them in the 
> containers
>             themselves, or are you using
>
>             secrets?
>
>
>             Converting an application like Grouper to use secrets would be a 
> LOT of work.  Effectively, you would need to convert all of the settings to 
> environment
>             variables.  How would you deal with
>
>             the sources.xml files which, by design, need to be customized?
>
>
>             Many thanks,
>
>             Jack
>
>
>
>             --
>
>             Jack Stewart
>
>             Solutions Architect, Identity and Access Management
>
>             University of Michigan
>
>             4251 Plymouth Road
>
>             Ann Arbor, Michigan 48105-3640
>
>             (734) 764-0853
>
>
>
>
>
>
> --
> John Schrader
> Identity and Access Management
> Office of Information Technologies
> University of Notre Dame
>
> EVERYTHING SHOULD BE MADE AS SIMPLE AS POSSIBLE, BUT NOT ANY SIMPLER—ALBERT 
> EINSTEIN