hacktoberlat/opensource_authenticationprotoc1 repository overview

⁠Quick Overview

The hacktoberlat/opensource_authenticationprotoc repository contains a custom implementation of the SATOSA⁠ solution housed in this custom repository⁠ owned and maintained by [email protected]⁠. This solution was originally developed for Hacktoberfest 2020. This repo does not maintain updates or push newer versions, since the experimental protocol has some fundamental design flaws. DO NOT USE IN PRODUCTION.

⁠How to use this Image?

The basic pattern for starting an instance of this proxy is

docker run --name hacktoberfest2024_lat -d latosa

To access the instance from the host without the container's IP, use port mapping:
docker run --name hacktoberfest2024_lat -p 80:8080 -d latosa

⁠Modifying the Image

⁠Configuration Files

The image stores it's configuration in /etc/satosa. This configuration must persist among instances, particularly the SAML2 entity ID (derived from the proxy's base URL by default) and related keying material. Use volumes, bind mounts, or custom images⁠⁠ to maintain this configuration.

⁠Entrypoint Script

The satosa image's entrypoint script runs Gunicorn⁠⁠ by default if the first argument looks like a command-line flag. For example, the following will use a bind mount to provide an X.509 certificate and corresponding private key to the instance, and it will run Gunicorn with HTTPS enabled:

docker run --name hacktoberlatosa -p 443:8443 \
    -v /etc/letsencrypt/live/some-latosa/fullchain.pem:/etc/https.crt \
    -v /etc/letsencrypt/live/some-latosa/privkey.pem:/etc/https.key \
    -d satosa \
    -b0.0.0.0:8443 --certfile /etc/https.crt --keyfile /etc/https.key satosa.wsgi:app

If the first argument looks like a command instead of a flag, the entrypoint script will run that instead of Gunicorn. For example, the following will start an interactive, unprivileged shell inside the container:
docker run -it --name some-latosa satosa bash

⁠Environment Variables

The entrypoint script uses environment variables to generate the initial configuration, which sets SATOSA up as a SAML2 proxy between the free SAMLtest.ID⁠⁠

test service provider and test identity provider. All of the environment variables are optional.

The environment variables' values can be read from Docker secrets⁠⁠ . Append _FILE to the variable name (e.g., STATE_ENCRYPTION_KEY_FILE), and set it to the pathname of the corresponding secret (e.g., /run/secrets/state_encryption_key).