Merge branch 'ags-backend-enterprise' into ags-frontend-enterprise

.env

@@ -4,15 +4,11 @@ ALFRESCO_LICENSE_DIR=~/alfresco/license
 PROXY_PROTOCOL=http
 PROXY_HOST=localhost
 PROXY_PORT=8080
-IDENTITY_SERVICE_PROTOCOL=http
-IDENTITY_SERVICE_HOST=auth.example.org
-IDENTITY_SERVICE_PORT=8080
 
 ACS_TAG=7.4.1.1
 ATR_TAG=3.0.0
 ATE_AIO_TAG=4.0.0
 ASFS_TAG=3.0.0
-AIS_TAG=1.8.0.1
 AAMQ_TAG=latest
 POSTGRES_TAG=13
 ASIE_TAG=2.0.8.2

README.md

@@ -3,3 +3,11 @@
 
 This Git Repository intends to represent environments in Docker Compose.  All environments are effectively a derivative of other environments.  The original environment is the environment represented by the `base` branch.  All derivative environments are represented by other branches.  Those branches are named in the format `{core}.{parent}`.
 
+## Licensing
+
+This version of Alfresco requires licensing.
+
+### ACS Enterprise
+
+The enterprise version of ACS requires a license file for it to work for more than 2 days.  This means it isn't really required, but it is becomes important when you utilize any `persist` branch.  For licensing to work, you must place your license file in the following directory relative to the user home directory that runs the Docker Compose command: `alfresco/license/acs`.  There must be just one file in there that ends in `.lic`.
+

docker-compose.yml

@@ -5,7 +5,7 @@ version: "3"
 services:
 
     platform:
-        image: quay.io/alfresco/alfresco-content-repository:${ACS_TAG}
+        image: quay.io/alfresco/alfresco-governance-repository-enterprise:${ACS_TAG}
         environment:
             JAVA_TOOL_OPTIONS: "
                 -Dencryption.keystore.type=JCEKS
@@ -37,8 +37,7 @@ services:
                 -Dmessaging.broker.url=\"failover:(nio://activemq:61616)?timeout=3000&jms.useCompression=true\"
                 -Ddeployment.method=DOCKER_COMPOSE
                 -Dcsrf.filter.enabled=false
-                -Dcors.enabled=true
-                -Dcors.allowed.origins=http://localhost:4200,http://localhost:8080,${PROXY_PROTOCOL}://${PROXY_HOST}
+                -Dcors.enabled=false
                 -Dtransform.service.enabled=true
                 -Dtransform.service.url=http://transform-router:8095
                 -Dsfs.url=http://shared-file-store:8099
@@ -49,22 +48,14 @@ services:
                 -Dtika.url=http://transform-engine-aio:8090
                 -Dtransform.misc.url=http://transform-engine-aio:8090
                 -Ddsync.service.uris=${PROXY_PROTOCOL}://${PROXY_HOST}:${PROXY_PORT}/sync
-                -Dauthentication.chain=aims:identity-service,builtin:alfrescoNtlm
-                -Didentity-service.authentication.defaultAdministratorUserNames=admin.1
-                -Didentity-service.auth-server-url=http://identity:8080/auth
                 -Dsystem.content.eagerOrphanCleanup=true
                 -Dsystem.content.orphanProtectDays=0
                 -Djodconverter.enabled=false
                 "
         depends_on:
-            postgres-acs:
-                condition: service_started
-            activemq:
-                condition: service_started
-            shared-file-store:
-                condition: service_started
-            identity:
-                condition: service_healthy
+            - postgres-acs
+            - activemq
+            - shared-file-store
         volumes:
             - "$ALFRESCO_LICENSE_DIR/acs:/usr/local/tomcat/shared/classes/alfresco/extension/license:ro"
     
@@ -93,7 +84,7 @@ services:
             - shared-file-store-volume:/tmp/Alfresco/sfs
     
     share:
-        image: alfresco/alfresco-share:${ACS_SHARE_TAG}
+        image: quay.io/alfresco/alfresco-governance-share-enterprise:${ACS_SHARE_TAG}
         environment:
             REPO_HOST: "platform"
             CSRF_FILTER_REFERER: "${PROXY_PROTOCOL}://${PROXY_HOST}(:${PROXY_PORT})?/?.*"
@@ -105,16 +96,6 @@ services:
                 -Dalfresco.host=${PROXY_HOST}
                 -Dalfresco.port=${PROXY_PORT}
                 -Dalfresco.protocol=${PROXY_PROTOCOL}
-                -Daims.enabled=true
-                -Daims.realm=alfresco
-                -Daims.resource=acs-share
-                -Daims.authServerUrl=${IDENTITY_SERVICE_PROTOCOL}://${IDENTITY_SERVICE_HOST}:${IDENTITY_SERVICE_PORT}/auth
-                -Daims.sslRequired=none
-                -Daims.publicClient=true
-                -Daims.autodetectBearerOnly=true
-                -Daims.alwaysRefreshToken=true
-                -Daims.principalAttribute=preferred_username
-                -Daims.enableBasicAuth=true
                 "
     
     postgres-acs:
@@ -158,8 +139,6 @@ services:
                 -Drepo.hostname=platform
                 -Drepo.port=8080
                 -Ddw.server.applicationConnectors[0].type=http
-                -Didentity-service.auth-server-url=${IDENTITY_SERVICE_PROTOCOL}://${IDENTITY_SERVICE_HOST}:${IDENTITY_SERVICE_PORT}/auth
-                -Didentity-service.resource=acs-sync
                 "
         depends_on:
             - postgres-acs
@@ -171,38 +150,10 @@ services:
             BASE_PATH: ./
             APP_CONFIG_ECM_HOST: "${PROXY_PROTOCOL}://${PROXY_HOST}:${PROXY_PORT}"
             APP_BASE_SHARE_URL: "${PROXY_PROTOCOL}://${PROXY_HOST}:${PROXY_PORT}/#/preview/s"
-            APP_CONFIG_AUTH_TYPE: OAUTH
-            APP_CONFIG_OAUTH2_HOST: "${IDENTITY_SERVICE_PROTOCOL}://${IDENTITY_SERVICE_HOST}:${IDENTITY_SERVICE_PORT}/auth/realms/alfresco"
-            APP_CONFIG_OAUTH2_CLIENTID: alfresco
-            APP_CONFIG_OAUTH2_IMPLICIT_FLOW: "true"
-            APP_CONFIG_OAUTH2_REDIRECT_LOGIN: "/workspace/"
-            APP_CONFIG_OAUTH2_REDIRECT_LOGOUT: "/workspace/logout"
-
-    identity:
-        image: alfresco/alfresco-identity-service:${AIS_TAG}
-        user: jboss
-        environment:
-            KEYCLOAK_USER: admin
-            KEYCLOAK_PASSWORD: admin
-            KEYCLOAK_FRONTEND_URL: ${IDENTITY_SERVICE_PROTOCOL}://${IDENTITY_SERVICE_HOST}:${IDENTITY_SERVICE_PORT}/auth
-            KEYCLOAK_IMPORT: /tmp/keycloak-alfresco-realm.json
-            KEYCLOAK_STATISTICS: enabled
-        networks:
-            default:
-                aliases:
-                    - "${IDENTITY_SERVICE_HOST}"
-        healthcheck:
-            test: ["CMD", "curl", "-f", "http://localhost:8080/auth/realms/alfresco"]
-            interval: 10s
-            timeout: 10s
-            # Really long startup times on Windows
-            retries: 18
-        volumes:
-            - ./keycloak-alfresco-realm.json:/tmp/keycloak-alfresco-realm.json:ro
-
+    
     proxy:
         build: ./nginx-ingress
-        image: local/nginx-ingress:acs-sync-share-adw-aims
+        image: local/nginx-ingress:acs-sync-share-adw
         ports:
             - 8080:8080
         depends_on:
@@ -210,7 +161,6 @@ services:
             - sync
             - share
             - digital-workspace
-            - identity
 
 volumes:
     shared-file-store-volume:

keycloak-alfresco-realm.json

@@ -1,80 +0,0 @@
-{
-  "realm": "alfresco",
-  "enabled": true,
-  "sslRequired": "external",
-  "registrationAllowed": false,
-  "roles": {
-    "realm": [ {
-      "name": "user",
-      "description": "User privileges"
-    }, {
-      "name": "admin",
-      "description": "Administrator privileges"
-    } ]
-  },
-  "clients": [
-    {
-      "clientId": "alfresco",
-      "name": "Alfresco Products",
-      "enabled": true,
-      "alwaysDisplayInConsole": false,
-      "redirectUris": [ "*" ],
-      "standardFlowEnabled": true,
-      "implicitFlowEnabled": true,
-      "directAccessGrantsEnabled": false,
-      "publicClient": true,
-      "protocol": "openid-connect",
-      "attributes": {
-        "login_theme": "alfresco"
-      }
-    },
-    {
-      "clientId": "acs-share",
-      "name": "ACS Share",
-      "enabled": true,
-      "alwaysDisplayInConsole": false,
-      "redirectUris": [ "*" ],
-      "standardFlowEnabled": true,
-      "implicitFlowEnabled": false,
-      "directAccessGrantsEnabled": false,
-      "publicClient": true,
-      "protocol": "openid-connect",
-      "attributes": {
-        "login_theme": "alfresco"
-      }
-    },
-    {
-      "clientId": "acs-sync",
-      "name": "Alfresco Sync Service Clients",
-      "enabled": true,
-      "alwaysDisplayInConsole": false,
-      "redirectUris": [
-        "http://127.0.0.1*",
-        "http://localhost*"
-      ],
-      "standardFlowEnabled": true,
-      "implicitFlowEnabled": false,
-      "directAccessGrantsEnabled": false,
-      "publicClient": true,
-      "protocol": "openid-connect",
-      "attributes": {
-        "login_theme": "alfresco"
-      }
-    }
-  ],
-  "requiredCredentials": [ "password" ],
-  "users": [
-    {
-      "username": "admin",
-      "email": "admin@app.activiti.com",
-      "enabled": true,
-      "credentials" : [
-        {
-          "type" : "password",
-          "value" : "admin"
-        }
-      ],
-      "realmRoles": [ "user", "admin" ]
-    }
-  ]
-}

nginx-ingress/entrypoint.sh

@@ -16,10 +16,6 @@ if [[ $ADW_URL ]]; then
   sed -i s%http:\/\/digital-workspace:8080%"$ADW_URL"%g /etc/nginx/nginx.conf
 fi
 
-if [[ $AIMS_URL ]]; then
-  sed -i s%http:\/\/identity:8080%"$AIMS_URL"%g /etc/nginx/nginx.conf
-fi
-
 if [[ $ACCESS_LOG ]]; then
   sed -i s%\#ENV_ACCESS_LOG%"access_log $ACCESS_LOG;"%g /etc/nginx/nginx.conf
 fi

nginx-ingress/nginx.conf

@@ -19,10 +19,7 @@ http {
 
         proxy_next_upstream error timeout invalid_header http_500 http_502 http_503 http_504;
         proxy_redirect off;
-#        proxy_buffering off;
-        proxy_buffer_size	64k;
-        proxy_buffers		4 256k;
-        proxy_busy_buffers_size	256k;
+        proxy_buffering off;
         proxy_set_header Host              $http_host;
         proxy_set_header X-Real-IP         $remote_addr;
         proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
@@ -58,6 +55,9 @@ http {
 
         location /share/ {
             proxy_pass http://share:8080;
+
+            # If using external proxy / load balancer (for initial redirect if no trailing slash)
+            absolute_redirect off;
         }
         
         location /workspace/ {
@@ -66,12 +66,5 @@ http {
             # If using external proxy / load balancer (for initial redirect if no trailing slash)
             absolute_redirect off;
         }
-
-        location /auth/ {
-            proxy_pass http://identity:8080;
-
-            # If using external proxy / load balancer (for initial redirect if no trailing slash)
-            absolute_redirect off;
-        }
     }
 }

server.xml

@@ -1,175 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!--
-  Licensed to the Apache Software Foundation (ASF) under one or more
-  contributor license agreements.  See the NOTICE file distributed with
-  this work for additional information regarding copyright ownership.
-  The ASF licenses this file to You under the Apache License, Version 2.0
-  (the "License"); you may not use this file except in compliance with
-  the License.  You may obtain a copy of the License at
-
-      http://www.apache.org/licenses/LICENSE-2.0
-
-  Unless required by applicable law or agreed to in writing, software
-  distributed under the License is distributed on an "AS IS" BASIS,
-  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-  See the License for the specific language governing permissions and
-  limitations under the License.
--->
-<!-- Note:  A "Server" is not itself a "Container", so you may not
-     define subcomponents such as "Valves" at this level.
-     Documentation at /docs/config/server.html
- -->
-<Server port="8005" shutdown="SHUTDOWN">
-  <Listener className="org.apache.catalina.startup.VersionLoggerListener" logArgs="false" />
-  <!-- Security listener. Documentation at /docs/config/listeners.html
-  <Listener className="org.apache.catalina.security.SecurityListener" />
-  -->
-  <!-- APR library loader. Documentation at /docs/apr.html -->
-  <Listener className="org.apache.catalina.core.AprLifecycleListener" SSLEngine="on" />
-  <!-- Prevent memory leaks due to use of particular java/javax APIs-->
-  <Listener className="org.apache.catalina.core.JreMemoryLeakPreventionListener" />
-  <Listener className="org.apache.catalina.mbeans.GlobalResourcesLifecycleListener" />
-  <Listener className="org.apache.catalina.core.ThreadLocalLeakPreventionListener" />
-
-  <!-- Global JNDI resources
-       Documentation at /docs/jndi-resources-howto.html
-  -->
-  <GlobalNamingResources>
-    <!-- Editable user database that can also be used by
-         UserDatabaseRealm to authenticate users
-    -->
-    <Resource name="UserDatabase" auth="Container"
-              type="org.apache.catalina.UserDatabase"
-              description="User database that can be updated and saved"
-              factory="org.apache.catalina.users.MemoryUserDatabaseFactory"
-              pathname="conf/tomcat-users.xml" />
-  </GlobalNamingResources>
-
-  <!-- A "Service" is a collection of one or more "Connectors" that share
-       a single "Container" Note:  A "Service" is not itself a "Container",
-       so you may not define subcomponents such as "Valves" at this level.
-       Documentation at /docs/config/service.html
-   -->
-  <Service name="Catalina">
-
-    <!--The connectors can use a shared executor, you can define one or more named thread pools-->
-    <!--
-    <Executor name="tomcatThreadPool" namePrefix="catalina-exec-"
-        maxThreads="150" minSpareThreads="4"/>
-    -->
-
-
-    <!-- A "Connector" represents an endpoint by which requests are received
-         and responses are returned. Documentation at :
-         Java HTTP Connector: /docs/config/http.html
-         Java AJP  Connector: /docs/config/ajp.html
-         APR (HTTP/AJP) Connector: /docs/apr.html
-         Define a non-SSL/TLS HTTP/1.1 Connector on port 8080
-    -->
-    <Connector port="8080" protocol="HTTP/1.1"
-               Server=" "
-               connectionTimeout="20000"
-               redirectPort="8443"
-               proxyName="alfresco.inteligr8.com" proxyPort="443" />
-    <!-- A "Connector" using the shared thread pool-->
-    <!--
-    <Connector executor="tomcatThreadPool"
-               port="8080" protocol="HTTP/1.1"
-               connectionTimeout="20000"
-               redirectPort="8443"
-               proxyHost="alfresco.inteligr8.com" proxyPort="443" />
-    -->
-    <!-- Define an SSL/TLS HTTP/1.1 Connector on port 8443
-         This connector uses the NIO implementation. The default
-         SSLImplementation will depend on the presence of the APR/native
-         library and the useOpenSSL attribute of the AprLifecycleListener.
-         Either JSSE or OpenSSL style configuration may be used regardless of
-         the SSLImplementation selected. JSSE style configuration is used below.
-    -->
-    <!--
-    <Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol"
-               maxThreads="150" SSLEnabled="true">
-        <SSLHostConfig>
-            <Certificate certificateKeystoreFile="conf/localhost-rsa.jks"
-                         type="RSA" />
-        </SSLHostConfig>
-    </Connector>
-    -->
-    <!-- Define an SSL/TLS HTTP/1.1 Connector on port 8443 with HTTP/2
-         This connector uses the APR/native implementation which always uses
-         OpenSSL for TLS.
-         Either JSSE or OpenSSL style configuration may be used. OpenSSL style
-         configuration is used below.
-    -->
-    <!--
-    <Connector port="8443" protocol="org.apache.coyote.http11.Http11AprProtocol"
-               maxThreads="150" SSLEnabled="true" >
-        <UpgradeProtocol className="org.apache.coyote.http2.Http2Protocol" />
-        <SSLHostConfig>
-            <Certificate certificateKeyFile="conf/localhost-rsa-key.pem"
-                         certificateFile="conf/localhost-rsa-cert.pem"
-                         certificateChainFile="conf/localhost-rsa-chain.pem"
-                         type="RSA" />
-        </SSLHostConfig>
-    </Connector>
-    -->
-
-    <!-- Define an AJP 1.3 Connector on port 8009 -->
-    <!--
-    <Connector protocol="AJP/1.3"
-               address="::1"
-               port="8009"
-               redirectPort="8443" />
-    -->
-
-    <!-- An Engine represents the entry point (within Catalina) that processes
-         every request.  The Engine implementation for Tomcat stand alone
-         analyzes the HTTP headers included with the request, and passes them
-         on to the appropriate Host (virtual host).
-         Documentation at /docs/config/engine.html -->
-
-    <!-- You should set jvmRoute to support load-balancing via AJP ie :
-    <Engine name="Catalina" defaultHost="localhost" jvmRoute="jvm1">
-    -->
-    <Engine name="Catalina" defaultHost="localhost">
-
-      <!--For clustering, please take a look at documentation at:
-          /docs/cluster-howto.html  (simple how to)
-          /docs/config/cluster.html (reference documentation) -->
-      <!--
-      <Cluster className="org.apache.catalina.ha.tcp.SimpleTcpCluster"/>
-      -->
-
-      <!-- Use the LockOutRealm to prevent attempts to guess user passwords
-           via a brute-force attack -->
-      <Realm className="org.apache.catalina.realm.LockOutRealm">
-        <!-- This Realm uses the UserDatabase configured in the global JNDI
-             resources under the key "UserDatabase".  Any edits
-             that are performed against this UserDatabase are immediately
-             available for use by the Realm.  -->
-        <Realm className="org.apache.catalina.realm.UserDatabaseRealm"
-               resourceName="UserDatabase"/>
-      </Realm>
-
-      <Host name="localhost"  appBase="webapps"
-            unpackWARs="true" autoDeploy="true">
-
-        <!-- SingleSignOn valve, share authentication between web applications
-             Documentation at: /docs/config/valve.html -->
-        <!--
-        <Valve className="org.apache.catalina.authenticator.SingleSignOn" />
-        -->
-
-        <!-- Access log processes all example.
-             Documentation at: /docs/config/valve.html
-             Note: The pattern used is equivalent to using pattern="common" -->
-        <Valve className="org.apache.catalina.valves.AccessLogValve" directory="logs"
-               prefix="localhost_access_log" suffix=".txt"
-               pattern="%h %l %u %t &quot;%r&quot; %s %b" />
-
-	<Valve className="org.apache.catalina.valves.RemoteIpValve" />
-
-      </Host>
-    </Engine>
-  </Service>
-</Server>