datasealer.pp

# If the datasealer file is not present, run datasealer_update.pl so it
# gets created.

class shibb_idp3::datasealer {

  # The datasealer_update.pl script is in the stanford-shibbolethidp3-tool
  # package.
  package { 'stanford-shibbolethidp3-tools':
    ensure  => installed,
    require => Package['shibboleth-identity-provider'],
  }

  # We want to copy the datasealer file from the master to the slaves. To
  # do whit we use scp and the master host's keytab. Thus, we need to put
  # the master host's keytab in /root/.k5login. We do the simple thing and
  # stick in enough servers to cover expansion of the pool later.
  K5login['/root/.k5login'] {
    principals +> [
      "host/idp-${shibb_idp3::host_suffix}1.stanford.edu@stanford.edu",
      "host/idp-${shibb_idp3::host_suffix}2.stanford.edu@stanford.edu",
      "host/idp-${shibb_idp3::host_suffix}3.stanford.edu@stanford.edu",
      "host/idp-${shibb_idp3::host_suffix}4.stanford.edu@stanford.edu",
      "host/idp-${shibb_idp3::host_suffix}5.stanford.edu@stanford.edu",
    ],
  }

  # Run this command only if the sealer file does NOT exist.
  exec { 'create_datasealer_file':
    command => 'datasealer_update',
    path    => ['/usr/bin', '/usr/sbin'],
    creates => '/opt/shibboleth-idp/credentials/sealer.jks',
    require => [
                 Package['stanford-shibbolethidp3-tools'],
                 File['/etc/shibboleth-idp/conf/idp.properties'],
               ],
  }

}