Skip to content

Latest commit

 

History

History
97 lines (76 loc) · 7.53 KB

README.md

File metadata and controls

97 lines (76 loc) · 7.53 KB
Raw

Docker Deployment of the PKI Toolkit

This repository provides the required tools for a local docker deployment of the PKI Toolkit provided by the Munich University of Applied Sciences.

Requirements

  • Valid Sectigo Account
  • Enabled API in Sectigo Cert-Manager
  • Installed Docker
  • OIDC at your IDP or any other OIDC provider
  • Overall 5 FQDNs
    • Frontend (e.g. pki.example.edu)
    • Urls for EAB, PKI and Domainmanagement REST-Service
    • ACME

Shibboleth IDP Configuration

Setting up and configuring an shibboleth IDP to provide an working OIDC endpoint can be pretty cumberstone.

The following configuration must be adapted for the own domains but provides a basic setup. The second client allows the use of OAuth2 beside OIDC. This results in 'readable' JWT for the frontend and the backend.

{
  "scope":"openid profile email offline_access Certificates Domains EAB",
  "redirect_uris":["https://pki.example.edu/api/auth/callback/oidc"],
  "client_id":"pki.example.edu"
  "subject_type":"pairwise",
  "client_secret":"XXXXXXXXXXXXX",
  "response_types": [
    "code"
  ],
  "grant_types": [
    "authorization_code",
    "refresh_token"
  ],
  "audience": [
    "https://api.example.edu"
  ]
}, {
  "client_id":"https://api.example.edu"
}

Please ensure that the following points are also configured:

  • Active OAUTH2.TokenAudience profile in the relying-party.xml
  • The Client Secret is passed as HTTP-Header and thus should contain any strange special characters. We recommend a long alpha-numeric string

Configuration

Before building and starting the containers serveral environment variables should be configured. Therefor you should copy the .env.example file to .env and set the appropriate values.

Variable Description Example Value
SECTIGO_USER Your Sectigo Username youruser
SECTIGO_PASSWORD Your Sectigo Password yourpassword
SMIME_ORG_ID The Organization ID to be used for SMIME Certificates (can be found in the Sectigo Certificate Manager -> Organization -> ID) 1234
SSL_ORG_ID The Organization ID to be used for SSL Certificates (normaly the same as for SMIME) 1234
SSL_TERM The requested validity of the SSL certificate. 365
SSL_PROFILE The requested profile of the SSL certificate 15863
SMIME_TERM The requested validity of the SMIME certificate. 1095
SMIME_STUDENT_TERM The requested validity of the SMIME certificate for students. 365
SMIME_PROFILE The requested profile of the SMIME certificate. 16307
SMIME_KEY_LENGTH The requested keylength of the SMIME certificate. 3072
SMIME_KEY_TYPE The requested key type of the SMIME certificate. (Currently only RSA is supported and recommended) RSA
JWKS_URI The URI to your JSON Web Key Set to validate the OIDC/OAuth2 Authentication https://your.idp.example.edu/idp/profile/oidc/keyset
AUDIENCE The used adiennce for OAuth2 (must be the same value as AUTH_RESOURCE) https://api.example.edu
NEXTAUTH_URL The canonical URL of your site https://pki.example.edu
NEXT_PUBLIC_AUTH_IDP The IDP that shal be used for OIDC authentication https://sso.example.edu
NEXT_PUBLIC_EAB_HOST The API Backend host for EAB operations https://eab.api.example.edu
NEXT_PUBLIC_PKI_HOST The API Backend host for PKI operations https://pki.api.example.edu
NEXT_PUBLIC_DOMAIN_HOST The API Backend host for Domain operations https://domain.api.example.edu
NEXT_PUBLIC_ACME_HOST The host for ACME operations https://domain.api.example.edu
NEXT_PUBLIC_SENTRY_DSN In case of using sentry the sentry DSN to upload error reports
AUTH_CLIENT_ID The OIDC Client ID pki
AUTH_CLIENT_SECRET The OIDC Client Secret Random String
AUTH_IDP The IDP that shal be used for OIDC authentication (Should be the same as during build time) https://sso.example.edu
AUTH_RESOURCE The requested OIDC resource to get OAuth2 working. https://api.example.edu
AUTH_SECRET The Next.JS Auth Secret used to encrypt JWT Random String

Getting Started

After setting all required values you can build the docker containers.

docker compose build

Afterwards you should be able to start the deployment

docker compose up -d