oaeproject/puppet-hilary — pull request #89 by simong (2014-03-18 13:36:33+00:00)
Title: Adds support for running a Shibboleth Service Provider

Note: this hasn't been enabled for the production environment yet. I also need to ensure the shib headers can't be forged. I'd like to get some feedback first, before I make those changes though.

Configurations happens through hiera by configuring:
* `shibboleth_entity_id` - The entity ID of our SP (e.g.: https://sp.oaeproject.org/shibboleth)
* `shibboleth_keyname` - The name of our key (e.g.: `web0`)
* `shibboleth_subjectname` - The subject name of our key (e.g.: `CN=web0`)
* `shibboleth_hosts` - A hash of hashes, each inner hash containing the `hostname` where it's running and the attribute that should be used for the `remote_user` variable

The certificate and key should be copied to `./modules/shibboleth/templates/sp-cert.pem` and `./modules/shibboleth/templates/sp-key.pem`. (Note: **NOT** `modules/shibboleth/files`, this is due to puppet limitations)

Supporting Shib authentication is done by installing the Shibboleth SP software and running an apache with mod_shib.

The Shibboleth metadata is also generated by this puppet work and is served by Nginx.
It's available at the typical endpoint at /Shibboleth.sso/Metadata.
Usually, it's the Shibboleth SP that outputs this metadata, but the data it outputs
does not work well in a multi-tenant environment.

There are 2 new modules included that are required to support this work:
* puppetlabs/apache
* puppetlabs/concat (The apache module requires it)