PurpleComputing/scim-examples
2
0
Fork 0
mirror of https://github.com/PurpleComputing/scim-examples.git synced 2026-06-10 23:00:32 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

Renamed docker -> docker-compose, removed Dockerfile, adapted guide to use env vars, added warning about use in prodction

Browse Source
This commit is contained in:
agilecohix
2018-05-08 19:48:03 -04:00
parent 6b6f20c364
commit 69ed06cfd1
5 changed files with 42 additions and 34 deletions
Download Patch File Download Diff File Expand all files Collapse all files

32
docker-compose/README.md Normal file
View File

@@ -0,0 +1,32 @@
# Deploying the 1Password SCIM Bridge using Docker Compose
This example describes the simplest method of deploying the 1Password SCIM bridge, using Docker Compose. These instructions require a remote Docker host be set up and configured to be accessed by the Docker CLI.
Note that this deployment strategy is very useful for testing, but it is not reccomended for use in a production environment. The scimsession file is passed into the container via an environment variable, which is less secure than Docker Swarm secrets or Kubernetes secrets, both of which are supported, and reccomended.
## Create your DNS record
The 1Password SCIM bridge requires SSL/TLS in order to communicate with your IdP. You must create a DNS record that points to your Docker node. _Do not attempt to perform a provisioning sync before the DNS records have been propogated_. The record must exist and the SCIM bridge server must be running in order for LetsEncrypt to issue a certificate.
## Create your scimsession file
Use the [create-session-file.sh](https://github.com/1Password/scim-examples/tree/master/session) script on your local machine to create a scimsession file. This script uses a Docker container to run the `op-scim init` command and writes the scimsession file back to your local machine using a mounted volume. Your bearer token will be printed to the console. Save your bearer token, as it will be needed to authenticate with your IdP.
The scimsession file is equivalent to your Master Password and Secret Key when combined with the bearer token, therefore they should never be stored in the same place.
Example:
```
create-session-file.sh
[account sign-in]
Bearer token: jafewnqrrupcnoiqj0829fe209fnsoudbf02efsdo
```
## Deploy the SCIM bridge
Once your scimsession file has been created, copy it into this directory (next to docker-compose.yml), as we need to populate some ENV variables in the container. `generate-env.sh` will create a `scim.env` file, allowing docker-compose to pass the scimsession file into the container without writing it to the container filesystem, leading to insecure storage of the file. The scimsession is base64 encoded before being put into the .env file.
Next, edit `docker-compose.yml`, replacing `{YOUR-DOMAIN-HERE}` with the domain name indicated by the DNS record created for your SCIM bridge. This will configure LetsEncrypt to automatically issue a certificate for your bridge.
Running `docker-compose up --build` will now create a container from the `onepassword/scim` image. A redis container will also be started automatically to be used by the SCIM bridge. _After the DNS record has been propogated_, you can continue setting up your IdP with the SCIM bridge Administration Guide while monitoring the logs from the bridge on your local machine.
Once you have tested the configuration, the bridge can be exited using ctrl/cmd-c, and restarted in daemon mode using `docker-compose up -d, or deployed for production use with Docker Swarm or Kubernetes. You can access logs using `docker-compose logs` at any point in the future.

3
docker/docker-compose.yml → docker-compose/docker-compose.yml
View File

@@ -2,12 +2,13 @@ version: '3.3'
services:
scim:
build: .
image: onepassword/scim:v0.4.2
ports:
- "80:8080"
- "443:8443"
links:
- redis
entrypoint: ["/op-scim/op-scim", "--letsencrypt-domain={YOUR-DOMAIN-HERE}"]
env_file: scim.env
redis:
image: redis:latest

8
docker-compose/generate-env.sh Normal file
View File

@@ -0,0 +1,8 @@
#!/bin/bash
# this script generates a file called `scim.env` using the contents of a scimsession file in the PWD.
# This env file is used to populate the scimsession env var in the container to prevent copying the sensitive file into a container layer.
SESSION=$(cat scimsession | base64 | tr -d "\n")
echo "OPSCIM_SESSION=$SESSION" > scim.env

3
docker/Dockerfile
View File

@@ -1,3 +0,0 @@
FROM onepassword/scim:v0.4.2
COPY ./scimsession /root/.op/scimsession

30
docker/README.md
View File

@@ -1,30 +0,0 @@
# Deploying the 1Password SCIM Bridge using Docker Compose
This example describes the simplest method of deploying the 1Password SCIM bridge, using Docker Compose. These instructions require a remote Docker host be set up and configured to be accessed by the Docker CLI.
## Create your DNS record
The 1Password SCIM bridge requires SSL/TLS in order to communicate with your IdP. You must create a DNS record that points to your Docker node. _Do not attempt to perform a provisioning sync before the DNS records have been propogated_. The record must exist and the SCIM bridge server must be running in order for LetsEncrypt to issue a certificate.
## Create your scimsession file
Use the [create-session-file.sh](https://github.com/1Password/scim-examples/tree/master/session) script on your local machine to create a scimsession file. This script uses a Docker container to run the `op-scim init` command and writes the scimsession file back to your local machine using a mounted volume. Your bearer token will be printed to the console. Save your bearer token, as it will be needed to authenticate with your IdP.
The scimsession file is equivalent to your account key and master password when combined with the bearer token, therefore they should never be stored in the same place.
Example:
```
create-session-file.sh
[account sign-in]
Bearer token: jafewnqrrupcnoiqj0829fe209fnsoudbf02efsdo
```
## Deploy the SCIM bridge
Once your scimsession file has been created, copy it into this directory (next to the Dockerfile and docker-compose.yml), as it will be copied into your container at build time.
Next, edit `docker-compose.yml`, replacing `{YOUR-DOMAIN-HERE}` with the domain name indicated by the DNS record created for the SCIM bridge. This will configure LetsEncrypt to automatically issue a certificate for your bridge.
Running `docker-compose up --build` will now create a new container with `onepassword/scim` as the base image. A redis container will also be started automatically to be used by the SCIM bridge. _After the DNS record has been propogated_, you can continue setting up your IdP with the SCIM bridge Administration Guide while monitoring the logs from the bridge on your local machine.
Once you have tested the configuration, the bridge can be exited using ctrl/cmd-c, and restarted in daemon mode for permanent use. `docker-compose up -d` will re-deploy the containers, allowing you to access logs using `docker-compose logs` at any point in the future.