Merge branch 'iam-spring-update-oct-2021' of git://github.com/indigo-…

…iam/iam into iam-spring-update-oct-2021

.github/workflows/maven.yml

@@ -4,17 +4,23 @@ on: [push, pull_request]
 
 jobs:
   build:
+    strategy:
+      matrix:
+        java-version: [11]
+
     runs-on: ubuntu-latest
 
     steps:
     - name: Checkout
       uses: actions/checkout@v2
       with:
         fetch-depth: 0
-    - name: Set up JDK 1.8
+
+    - name: Set up JDK ${{matrix.java-version}}
       uses: actions/setup-java@v1
       with:
-        java-version: 1.8
+        java-version: ${{matrix.java-version}}
+
     - name: Cache Maven packages
       uses: actions/cache@v1
       with:
@@ -34,6 +40,7 @@ jobs:
       run: |
         cp iam-login-service/target/iam-login-service.war iam-login-service/docker
         cp iam-test-client/target/iam-test-client.jar iam-test-client/docker
+
     - name: Build & push iam-login-service docker image
       uses: docker/build-push-action@v1
       with:
@@ -44,7 +51,8 @@ jobs:
         tag_with_sha: true
         dockerfile: iam-login-service/docker/Dockerfile.prod
         path: iam-login-service/docker
-        push: ${{ startsWith(github.ref, 'refs/tags/') }}
+        push: ${{ matrix.java-version == '11' && startsWith(github.ref, 'refs/tags/') }}
+
     - name: Build & push iam-test-client docker image
       uses: docker/build-push-action@v1
       with:
@@ -55,4 +63,4 @@ jobs:
         tag_with_sha: true
         dockerfile: iam-test-client/docker/Dockerfile.prod
         path: iam-test-client/docker
-        push: ${{ startsWith(github.ref, 'refs/tags/') }}
+        push: ${{ matrix.java-version == '11' && startsWith(github.ref, 'refs/tags/') }}

.github/workflows/sonar.yaml.disabled → .github/workflows/sonar.yaml

@@ -1,29 +1,35 @@
 name: Sonar analysis
 
 on: 
-
   pull_request:
     types: [opened, edited, reopened, synchronize]
 
 jobs:
   build:
+    strategy:
+      matrix:
+        java-version: [11]
+
     runs-on: ubuntu-latest
 
     steps:
     - name: Checkout
       uses: actions/checkout@v2
       with:
         fetch-depth: 0
-    - name: Set up JDK 1.8
+
+    - name: Set up JDK ${{matrix.java-version}}
       uses: actions/setup-java@v1
       with:
-        java-version: 1.8
+        java-version: ${{matrix.java-version}}
+
     - name: Cache Maven packages
       uses: actions/cache@v1
       with:
         path: ~/.m2
         key: ${{ runner.os }}-m2-${{ hashFiles('**/pom.xml') }}
         restore-keys: ${{ runner.os }}-m2
+
     - name: Sonar analysis
       env:
         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

Jenkinsfile

@@ -4,13 +4,21 @@
 def kubeLabel = getKubeLabel()
 
 def maybeArchiveJUnitReports(){
+  def hasJunitReports = fileExists 'iam-login-service/target/surefire-reports'
+  if (hasJunitReports) {
+    junit '**/target/surefire-reports/TEST-*.xml'
+  }
+}
+
+def maybeArchiveJUnitReportsWithJacoco(){
   def hasJunitReports = fileExists 'iam-login-service/target/surefire-reports'
   if (hasJunitReports) {
     junit '**/target/surefire-reports/TEST-*.xml'
     step( [ $class: 'JacocoPublisher' ] )
   }
 }
 
+
 pipeline {
 
   agent any
@@ -45,7 +53,7 @@ pipeline {
           label "${kubeLabel}"
           cloud 'Kube mwdevel'
           defaultContainer 'runner'
-          inheritFrom 'iam-template'
+          inheritFrom 'iam-template-java11'
         }
       }
 
@@ -86,6 +94,14 @@ pipeline {
           steps {
             sh 'mvn -B test'
           }
+
+          post {
+            always {
+              script {
+                maybeArchiveJUnitReports()
+              }
+            }
+          }
         }
 
         stage('PR analysis'){
@@ -128,7 +144,7 @@ pipeline {
           post {
             always {
               script {
-                maybeArchiveJUnitReports()
+                maybeArchiveJUnitReportsWithJacoco()
               }
             }
             unsuccessful {

LICENSE

@@ -1,4 +1,4 @@
-Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.

compose/custom-logging/logback-spring.xml

@@ -0,0 +1,42 @@
+<?xml version="1.0" encoding="UTF-8"?>
+
+<configuration>
+
+  <include resource="org/springframework/boot/logging/logback/defaults.xml" />
+  <include resource="org/springframework/boot/logging/logback/console-appender.xml" />
+
+  <appender name="AUDIT" class="ch.qos.logback.core.rolling.RollingFileAppender">
+
+    <File>${IAM_LOG_PATH:=/var/log/iam}/iam-audit.log</File>
+
+    <rollingPolicy class="ch.qos.logback.core.rolling.TimeBasedRollingPolicy">
+      <FileNamePattern>${IAM_LOG_PATH:-/var/log/iam}/iam-audit-%d{yyyy-MM-dd}.log.gz</FileNamePattern>
+    </rollingPolicy>
+
+    <encoder>
+      <pattern>${FILE_LOG_PATTERN}</pattern>
+    </encoder>
+  </appender>
+
+  <appender name="SERVICE" class="ch.qos.logback.core.rolling.RollingFileAppender">
+
+    <File>${IAM_LOG_PATH:-/var/log/iam}/iam-service.log</File>
+
+    <rollingPolicy class="ch.qos.logback.core.rolling.TimeBasedRollingPolicy">
+      <FileNamePattern>${IAM_LOG_PATH:-/var/log/iam}/iam-service-%d{yyyy-MM-dd}.log.gz</FileNamePattern>
+    </rollingPolicy>
+
+    <encoder>
+      <pattern>${FILE_LOG_PATTERN}</pattern>
+    </encoder>
+  </appender>
+
+  <logger name="AUDIT" additivity="false" level="INFO">
+    <appender-ref ref="AUDIT" />
+  </logger>
+
+  <root level="INFO">
+    <appender-ref ref="CONSOLE" />
+    <appender-ref ref="SERVICE" />
+  </root>
+</configuration>

docker-compose.yml

@@ -1,6 +1,7 @@
 version: '3.5'
 
 volumes:
+  logs:
   db_data:
   trust:
 
@@ -14,8 +15,8 @@ services:
 
   db:
     image: ${DB_IMAGE}
-    volumes:
-      - db_data:/var/lib/mysql
+      # volumes:
+      #  - db_data:/var/lib/mysql
 
     # The setting below enables custom configuration
     # that turns on the MySQL query log
@@ -48,7 +49,7 @@ services:
 
     environment:
       TZ: Europe/Rome
-      IAM_JAVA_OPTS: -Djava.security.egd=file:/dev/./urandom -Xdebug -Xrunjdwp:server=y,transport=dt_socket,suspend=n,address=1044 -Dspring.profiles.active=mysql-test
+      IAM_JAVA_OPTS: -Djava.security.egd=file:/dev/./urandom -Xdebug -Xrunjdwp:server=y,transport=dt_socket,suspend=n,address=1044 -Dspring.profiles.active=mysql-test -debug
       IAM_JAR: /code/iam-login-service/target/iam-login-service.war
       IAM_HOST: iam.local.io
       IAM_BASE_URL: https://iam.local.io
@@ -85,8 +86,11 @@ services:
 
     volumes:
       - trust:/etc/grid-security/certificates
+      - logs:/var/log/iam
       - .:/code:ro
       - /dev/urandom:/dev/random
+      - ./compose/custom-logging/logback-spring.xml:/indigo-iam/logback-spring.xml:ro
+
         # - ./compose/metadata/iam.local.io.metadata.xml:/indigo-iam/iam.local.io.metadata.xml:ro
         # - ./compose/metadata/spid-idp.example.metadata.xml:/indigo-iam/spid-idp.example.metadata.xml:ro
         # - ./compose/custom-saml/application-saml.yml:/indigo-iam/config/application-saml.yml:ro

iam-common/pom.xml

@@ -7,7 +7,7 @@
   <parent>
     <groupId>it.infn.mw</groupId>
     <artifactId>iam-parent</artifactId>
-    <version>1.7.1</version>
+    <version>1.8.0-spring-update-SNAPSHOT</version>
   </parent>
 
   <artifactId>iam-common</artifactId>

iam-login-service/docker/Dockerfile

@@ -1,8 +1,8 @@
-FROM openjdk:8
+FROM openjdk:11
 
 RUN mkdir /indigo-iam
 WORKDIR /indigo-iam
-CMD java -XX:+UnlockExperimentalVMOptions -XX:+UseCGroupMemoryLimitForHeap ${IAM_JAVA_OPTS} -jar ${IAM_JAR}
+CMD java ${IAM_JAVA_OPTS} -jar ${IAM_JAR}
 
 # Embed TINI since compose v3 syntax do not support the init 
 # option to run docker --init

iam-login-service/docker/Dockerfile.prod

@@ -1,10 +1,10 @@
-FROM openjdk:8
+FROM openjdk:11
 
 RUN mkdir /indigo-iam
 WORKDIR /indigo-iam
 COPY iam-login-service.war /indigo-iam/
 
-CMD java -XX:MaxRAMFraction=1 -XX:+UnlockExperimentalVMOptions -XX:+UseCGroupMemoryLimitForHeap ${IAM_JAVA_OPTS} -jar iam-login-service.war 
+CMD java -XX:MaxRAMFraction=1 ${IAM_JAVA_OPTS} -jar iam-login-service.war 
 
 # Embed TINI since compose v3 syntax do not support the init 
 # option to run docker --init

iam-login-service/docker/build-prod-image.sh

@@ -1,6 +1,6 @@
 #!/bin/bash
 #
-# Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+# Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.

iam-login-service/docker/push-prod-image.sh

@@ -1,6 +1,6 @@
 #!/bin/bash
 #
-# Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+# Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.