Update saml-idp image using simplesamlphp 2.1.x and PHP 8.3

misc/docker-bake.hcl

@@ -1,6 +1,6 @@
 variable ALPINE_VERSION {}
 variable SIMPLESAMLPHP_VERSION {
-  default = "2.1.1"
+  default = "2.1.5"
 }
 
 group "default" {
@@ -30,8 +30,8 @@ target "curl" {
 target "saml-idp" {
   inherits = ["common"]
   context = "./misc/saml-idp"
+  target = "final"
   args = {
-    ALPINE_VERSION = "${ALPINE_VERSION}"
     SIMPLESAMLPHP_VERSION = "${SIMPLESAMLPHP_VERSION}"
   }
   tags = ["druidfi/saml-idp:${SIMPLESAMLPHP_VERSION}"]

misc/saml-idp/Dockerfile

@@ -1,8 +1,8 @@
-ARG ALPINE_VERSION
-
-FROM alpine:${ALPINE_VERSION} as simplesamlphp
+FROM alpine as simplesamlphp
 
 ARG SIMPLESAMLPHP_VERSION
+#ARG SIMPLESAMLPHP_URL=https://github.com/simplesamlphp/simplesamlphp/releases/download/v${SIMPLESAMLPHP_VERSION}/simplesamlphp-${SIMPLESAMLPHP_VERSION}.tar.gz
+# After 2.1.0
 ARG SIMPLESAMLPHP_URL=https://github.com/simplesamlphp/simplesamlphp/releases/download/v${SIMPLESAMLPHP_VERSION}/simplesamlphp-${SIMPLESAMLPHP_VERSION}.tar.gz
 
 RUN apk --update --no-cache add curl
@@ -11,20 +11,22 @@ RUN tar xzf /tmp/simplesamlphp.tar.gz -C /tmp
 RUN mv /tmp/simplesamlphp-* /home/simplesamlphp
 RUN rm -rf /home/simplesamlphp/modules/cron /home/simplesamlphp/modules/multiauth
 
-FROM druidfi/php-fpm:8.2 as final
+FROM druidfi/php-fpm:8.3 as final
 
 USER root
 
 RUN apk --update --no-cache add nginx && \
-    apk --update --no-cache add php82-tokenizer php82-xmlreader
-
-USER druid
+    apk --update --no-cache add php83-intl php83-tokenizer php83-xmlreader
 
 # Copy SimpleSAMLphp
-COPY --from=simplesamlphp /home/simplesamlphp /app/simplesamlphp
+COPY --from=simplesamlphp --chown=www-data /home/simplesamlphp /app/simplesamlphp
+
+RUN cd /app/simplesamlphp && php bin/translations translations:update:binary
 
 # Copy configuration files and scripts
-COPY files/ /
+COPY --chown=www-data files/ /
+
+USER druid
 
 EXPOSE 8080
 

misc/saml-idp/files/app/simplesamlphp/config/config.php

@@ -259,14 +259,29 @@
     /*
      * Set the allowed clock skew between encrypting/decrypting assertions
      *
-     * If you have an server that is constantly out of sync, this option
+     * If you have a server that is constantly out of sync, this option
      * allows you to adjust the allowed clock-skew.
      *
      * Allowed range: 180 - 300
      * Defaults to 180.
      */
     'assertion.allowed_clock_skew' => 180,
 
+    /*
+     * Set custom security headers. The defaults can be found in \SimpleSAML\Configuration::DEFAULT_SECURITY_HEADERS
+     *
+     * NOTE: When a header is already set on the response we will NOT overrule it and leave it untouched.
+     *
+     * Whenever you change any of these headers, make sure to validate your config by running your
+     * hostname through a security-test like https://en.internet.nl
+    'headers.security' => [
+        'Content-Security-Policy' => "default-src 'none'; frame-ancestors 'self'; object-src 'none'; script-src 'self'; style-src 'self'; font-src 'self'; connect-src 'self'; img-src 'self' data:; base-uri 'none'",
+        'X-Frame-Options' => 'SAMEORIGIN',
+        'X-Content-Type-Options' => 'nosniff',
+        'Referrer-Policy' => 'origin-when-cross-origin',
+    ],
+     */
+
 
     /************************
     | ERRORS AND DEBUGGING |
@@ -349,7 +364,7 @@
      * loggingdir above to 'null'.
      */
     'logging.level' => SimpleSAML\Logger::DEBUG,
-    'logging.handler' => 'syslog',
+    'logging.handler' => 'stderr',
 
     /*
      * Specify the format of the logs. Its use varies depending on the log handler used (for instance, you cannot
@@ -1163,6 +1178,7 @@
     'metadata.sign.privatekey' => null,
     'metadata.sign.privatekey_pass' => null,
     'metadata.sign.certificate' => null,
+    'metadata.sign.algorithm' => 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha256',
 
 
     /****************************
@@ -1225,6 +1241,28 @@
     'store.redis.username' => '',
     'store.redis.password' => '',
 
+    /*
+     * Communicate with Redis over a secure connection instead of plain TCP.
+     *
+     * This setting affects both single host connections as
+     * well as Sentinel mode.
+     */
+    'store.redis.tls' => false,
+
+    /*
+     * Verify the Redis server certificate.
+     */
+    'store.redis.insecure' => false,
+
+    /*
+     * Files related to secure communication with Redis.
+     *
+     * Files are searched in the 'certdir' when using relative paths.
+     */
+    'store.redis.ca_certificate' => null,
+    'store.redis.certificate' => null,
+    'store.redis.privatekey' => null,
+
     /*
      * The prefix we should use on our Redis datastore.
      */
@@ -1243,6 +1281,9 @@
      *     'tcp://[yoursentinel2]:[port]',
      *     'tcp://[yoursentinel3]:[port]
      * ],
+     *
+     * Use 'tls' instead of 'tcp' in order to make use of the additional
+     * TLS settings.
      */
     'store.redis.sentinels' => [],
 

misc/saml-idp/files/etc/nginx/fastcgi.conf

@@ -0,0 +1,55 @@
+set $fastcgi_port "80";
+set $fastcgi_https "off";
+if ($http_x_forwarded_proto = 'https') {
+    set $fastcgi_https "on";
+    set $fastcgi_port  "443";
+}
+
+fastcgi_param  SCRIPT_FILENAME    $realpath_root$fastcgi_script_name;
+fastcgi_param  QUERY_STRING       $query_string;
+fastcgi_param  REQUEST_METHOD     $request_method;
+fastcgi_param  CONTENT_TYPE       $content_type;
+fastcgi_param  CONTENT_LENGTH     $content_length;
+
+fastcgi_param  SCRIPT_NAME        $fastcgi_script_name;
+fastcgi_param  REQUEST_URI        $request_uri;
+fastcgi_param  DOCUMENT_URI       $document_uri;
+fastcgi_param  DOCUMENT_ROOT      $document_root;
+fastcgi_param  SERVER_PROTOCOL    $server_protocol;
+fastcgi_param  REQUEST_SCHEME     $scheme;
+fastcgi_param  HTTPS              $https if_not_empty;
+fastcgi_param  HTTPS              $fastcgi_https if_not_empty;
+
+fastcgi_param  GATEWAY_INTERFACE  CGI/1.1;
+fastcgi_param  SERVER_SOFTWARE    nginx/$nginx_version;
+
+fastcgi_param  REMOTE_ADDR        $remote_addr;
+fastcgi_param  REMOTE_PORT        $remote_port;
+fastcgi_param  SERVER_ADDR        $server_addr;
+
+# Setting to Port 80 and 443 based on if we have an upstream https or not
+fastcgi_param  SERVER_PORT        $fastcgi_port;
+
+# Setting to $host as $server_name is empty all the time
+fastcgi_param  SERVER_NAME        $host;
+
+# PHP only, required if PHP was built with --enable-force-cgi-redirect
+fastcgi_param  REDIRECT_STATUS    200;
+
+# Mitigate https://httpoxy.org/ vulnerabilities
+fastcgi_param  HTTP_PROXY         "";
+
+# Mitigate CVE-2018-14773: https://symfony.com/blog/cve-2018-14773-remove-support-for-legacy-and-risky-http-headers
+fastcgi_param  HTTP_X-ORIGINAL-URL "";
+fastcgi_param  HTTP_X_ORIGINAL_URL "";
+fastcgi_param  HTTP_X-REWRITE-URL  "";
+fastcgi_param  HTTP_X_REWRITE_URL  "";
+
+fastcgi_keep_conn on;
+fastcgi_index  index.php;
+fastcgi_hide_header 'X-Generator';
+
+fastcgi_buffers         256 32k;
+fastcgi_buffer_size     32k;
+fastcgi_read_timeout    3600s;
+fastcgi_temp_path       /tmp/fastcgi_temp;

misc/saml-idp/files/etc/nginx/nginx.conf

@@ -77,5 +77,5 @@ http {
                                 text/x-component
                                 text/x-cross-domain-policy;
 
-    include /etc/nginx/http.d/*.conf;
+    include /etc/nginx/conf.d/*.conf;
 }