Merge branch 'ags-frontend-enterprise-persist' into dbp-persist

.env

@@ -4,16 +4,12 @@ ALFRESCO_LICENSE_DIR=~/alfresco/license
 PROXY_PROTOCOL=http
 PROXY_HOST=localhost
 PROXY_PORT=8080
-IDENTITY_SERVICE_PROTOCOL=http
-IDENTITY_SERVICE_HOST=auth.example.org
-IDENTITY_SERVICE_PORT=8080
 
 ACS_TAG=7.4.1.1
 ATR_TAG=3.0.0
 ATE_AIO_TAG=4.0.0
 ASFS_TAG=3.0.0
 APS_TAG=2.4.1
-AIS_TAG=1.8.0.1
 AAMQ_TAG=latest
 POSTGRES_TAG=13
 ASIE_TAG=2.0.8.2

docker-compose.yml

@@ -48,24 +48,17 @@ services:
                 -Dtika.url=http://transform-engine-aio:8090
                 -Dtransform.misc.url=http://transform-engine-aio:8090
                 -Ddsync.service.uris=${PROXY_PROTOCOL}://${PROXY_HOST}:${PROXY_PORT}/sync
-                -Dauthentication.chain=aims:identity-service,builtin:alfrescoNtlm
-                -Didentity-service.authentication.defaultAdministratorUserNames=admin.1
-                -Didentity-service.auth-server-url=${IDENTITY_SERVICE_PROTOCOL}://${IDENTITY_SERVICE_HOST}:${IDENTITY_SERVICE_PORT}/auth
                 -Dsystem.content.eagerOrphanCleanup=true
                 -Dsystem.content.orphanProtectDays=0
                 -Djodconverter.enabled=false
                 "
         depends_on:
-            postgres-acs:
-                condition: service_started
-            activemq:
-                condition: service_started
-            shared-file-store:
-                condition: service_started
-            identity:
-                condition: service_healthy
+            - postgres-acs
+            - activemq
+            - shared-file-store
         volumes:
             - "$ALFRESCO_LICENSE_DIR/acs:/usr/local/tomcat/shared/classes/alfresco/extension/license:ro"
+            - acsbin-volume:/usr/local/tomcat/alf_data:rw
     
     transform-router:
         image: quay.io/alfresco/alfresco-transform-router:${ATR_TAG}
@@ -104,16 +97,6 @@ services:
                 -Dalfresco.host=${PROXY_HOST}
                 -Dalfresco.port=${PROXY_PORT}
                 -Dalfresco.protocol=${PROXY_PROTOCOL}
-                -Daims.enabled=true
-                -Daims.realm=alfresco
-                -Daims.resource=acs-share
-                -Daims.authServerUrl=${IDENTITY_SERVICE_PROTOCOL}://${IDENTITY_SERVICE_HOST}:${IDENTITY_SERVICE_PORT}/auth
-                -Daims.sslRequired=none
-                -Daims.publicClient=true
-                -Daims.autodetectBearerOnly=true
-                -Daims.alwaysRefreshToken=true
-                -Daims.principalAttribute=preferred_username
-                -Daims.enableBasicAuth=true
                 "
     
     postgres-acs:
@@ -123,6 +106,8 @@ services:
             POSTGRES_USER: alfresco
             POSTGRES_DB: alfresco
         command: postgres -c max_connections=300 -c log_min_messages=LOG
+        volumes:
+            - acsdb-volume:/var/lib/postgresql/data:rw
     
     search:
         image: alfresco/alfresco-search-services:${ASIE_TAG}
@@ -136,6 +121,8 @@ services:
                 "
         healthcheck:
             test: "curl -fsS http://localhost:8983/solr"
+        volumes:
+            - solrindex-volume:/opt/alfresco-search-services/data:rw
 
     activemq:
         image: alfresco/alfresco-activemq:${AAMQ_TAG}
@@ -143,6 +130,8 @@ services:
             ACTIVEMQ_OPTS_MEMORY: -Xms64m -Xmx256m
             ACTIVEMQ_ADMIN_LOGIN: alfresco
             ACTIVEMQ_ADMIN_PASSWORD: alfresco
+        volumes:
+            - activemq-volume:/opt/activemq/data:rw
 
     sync:
         image: quay.io/alfresco/service-sync:${ALF_SYNC_SERV_TAG}
@@ -157,8 +146,6 @@ services:
                 -Drepo.hostname=platform
                 -Drepo.port=8080
                 -Ddw.server.applicationConnectors[0].type=http
-                -Didentity-service.auth-server-url=${IDENTITY_SERVICE_PROTOCOL}://${IDENTITY_SERVICE_HOST}:${IDENTITY_SERVICE_PORT}/auth
-                -Didentity-service.resource=acs-sync
                 "
         depends_on:
             - postgres-acs
@@ -169,17 +156,7 @@ services:
         environment:
             BASE_PATH: ./
             APP_CONFIG_ECM_HOST: "${PROXY_PROTOCOL}://${PROXY_HOST}:${PROXY_PORT}"
-            APP_CONFIG_BPM_HOST: "${PROXY_PROTOCOL}://${PROXY_HOST}:${PROXY_PORT}"
-            APP_BASE_SHARE_URL: "${PROXY_PROTOCOL}://${PROXY_HOST}:${PROXY_PORT}/workspace/#/preview/s"
-            APP_CONFIG_PROVIDER: "ALL"
-            APP_CONFIG_PLUGIN_PROCESS_SERVICE: "true"
-            #APP_CONFIG_PLUGIN_PROCESS_AUTOMATION: "true"
-            APP_CONFIG_AUTH_TYPE: OAUTH
-            APP_CONFIG_OAUTH2_HOST: "${IDENTITY_SERVICE_PROTOCOL}://${IDENTITY_SERVICE_HOST}:${IDENTITY_SERVICE_PORT}/auth/realms/alfresco"
-            APP_CONFIG_OAUTH2_CLIENTID: alfresco
-            APP_CONFIG_OAUTH2_IMPLICIT_FLOW: "true"
-            APP_CONFIG_OAUTH2_REDIRECT_LOGIN: "/workspace/"
-            APP_CONFIG_OAUTH2_REDIRECT_LOGOUT: "/workspace/logout"
+            APP_BASE_SHARE_URL: "${PROXY_PROTOCOL}://${PROXY_HOST}:${PROXY_PORT}/#/preview/s"
 
     activiti-app:
         image: quay.io/alfresco/alfresco-process-services:${APS_TAG}
@@ -189,14 +166,12 @@ services:
             ACTIVITI_DATASOURCE_DRIVER: org.postgresql.Driver
             ACTIVITI_HIBERNATE_DIALECT: org.hibernate.dialect.PostgreSQLDialect
             ACTIVITI_DATASOURCE_URL: 'jdbc:postgresql://postgres-aps:5432/activiti?characterEncoding=UTF-8'
-            IDENTITY_SERVICE_ENABLED: "true"
-            IDENTITY_SERVICE_AUTH: http://identity:8080/auth
-            IDENTITY_SERVICE_CONTENT_SSO_REDIRECT_URI: ${PROXY_PROTOCOL}://${PROXY_HOST}:${PROXY_PORT}/activiti-app/app/rest/integration/sso/confirm-auth-request
             JAVA_OPTS: "-Xms128m -Xmx256m"
         depends_on:
             - postgres-aps
         volumes:
             - "$ALFRESCO_LICENSE_DIR/aps:/home/alfresco/.activiti/enterprise-license:ro"
+            - apsbin-volume:/var/lib/postgresql/data:rw
     
     activiti-admin:
         image: quay.io/alfresco/alfresco-process-services-admin:${APS_TAG}
@@ -220,6 +195,8 @@ services:
             POSTGRES_USER: alfresco
             POSTGRES_PASSWORD: alfresco
         command: postgres -c max_connections=300 -c log_min_messages=LOG
+        volumes:
+            - apsdb-volume:/var/lib/postgresql/data:rw
     
     postgres-aps-admin:
         image: postgres:${POSTGRES_TAG}
@@ -228,32 +205,12 @@ services:
             POSTGRES_USER: alfresco
             POSTGRES_PASSWORD: alfresco
         command: postgres -c max_connections=50 -c log_min_messages=LOG
-
-    identity:
-        image: alfresco/alfresco-identity-service:${AIS_TAG}
-        user: jboss
-        environment:
-            KEYCLOAK_USER: admin
-            KEYCLOAK_PASSWORD: admin
-            KEYCLOAK_FRONTEND_URL: ${IDENTITY_SERVICE_PROTOCOL}://${IDENTITY_SERVICE_HOST}:${IDENTITY_SERVICE_PORT}/auth
-            KEYCLOAK_IMPORT: /tmp/keycloak-alfresco-realm.json
-            KEYCLOAK_STATISTICS: enabled
-        networks:
-            default:
-                aliases:
-                    - "${IDENTITY_SERVICE_HOST}"
-        healthcheck:
-            test: ["CMD", "curl", "-f", "http://localhost:8080/auth/realms/alfresco"]
-            interval: 10s
-            timeout: 10s
-            # Really long startup times on Windows
-            retries: 18
         volumes:
-            - ./keycloak-alfresco-realm.json:/tmp/keycloak-alfresco-realm.json:ro
+            - apsadmindb-volume:/var/lib/postgresql/data:rw
     
     proxy:
         build: ./nginx-ingress
-        image: local/nginx-ingress:acs-sync-share-adw-aps-aims
+        image: local/nginx-ingress:acs-sync-share-adw-aps
         ports:
             - 8080:8080
         depends_on:
@@ -263,10 +220,23 @@ services:
             - digital-workspace
             - activiti-app
             - activiti-admin
-            - identity
 
 volumes:
     shared-file-store-volume:
         driver_opts:
             type: tmpfs
             device: tmpfs
+    acsbin-volume:
+        driver: local
+    acsdb-volume:
+        driver: local
+    activemq-volume:
+        driver: local
+    solrindex-volume:
+        driver: local
+    apsbin-volume:
+        driver: local
+    apsdb-volume:
+        driver: local
+    apsadmindb-volume:
+        driver: local

keycloak-alfresco-realm.json

@@ -1,80 +0,0 @@
-{
-  "realm": "alfresco",
-  "enabled": true,
-  "sslRequired": "external",
-  "registrationAllowed": false,
-  "roles": {
-    "realm": [ {
-      "name": "user",
-      "description": "User privileges"
-    }, {
-      "name": "admin",
-      "description": "Administrator privileges"
-    } ]
-  },
-  "clients": [
-    {
-      "clientId": "alfresco",
-      "name": "Alfresco Products",
-      "enabled": true,
-      "alwaysDisplayInConsole": false,
-      "redirectUris": [ "*" ],
-      "standardFlowEnabled": true,
-      "implicitFlowEnabled": true,
-      "directAccessGrantsEnabled": false,
-      "publicClient": true,
-      "protocol": "openid-connect",
-      "attributes": {
-        "login_theme": "alfresco"
-      }
-    },
-    {
-      "clientId": "acs-share",
-      "name": "ACS Share",
-      "enabled": true,
-      "alwaysDisplayInConsole": false,
-      "redirectUris": [ "*" ],
-      "standardFlowEnabled": true,
-      "implicitFlowEnabled": false,
-      "directAccessGrantsEnabled": false,
-      "publicClient": true,
-      "protocol": "openid-connect",
-      "attributes": {
-        "login_theme": "alfresco"
-      }
-    },
-    {
-      "clientId": "acs-sync",
-      "name": "Alfresco Sync Service Clients",
-      "enabled": true,
-      "alwaysDisplayInConsole": false,
-      "redirectUris": [
-        "http://127.0.0.1*",
-        "http://localhost*"
-      ],
-      "standardFlowEnabled": true,
-      "implicitFlowEnabled": false,
-      "directAccessGrantsEnabled": false,
-      "publicClient": true,
-      "protocol": "openid-connect",
-      "attributes": {
-        "login_theme": "alfresco"
-      }
-    }
-  ],
-  "requiredCredentials": [ "password" ],
-  "users": [
-    {
-      "username": "admin",
-      "email": "admin@app.activiti.com",
-      "enabled": true,
-      "credentials" : [
-        {
-          "type" : "password",
-          "value" : "admin"
-        }
-      ],
-      "realmRoles": [ "user", "admin" ]
-    }
-  ]
-}

nginx-ingress/entrypoint.sh

@@ -24,10 +24,6 @@ if [[ $APS_ADMIN_URL ]]; then
   sed -i s%http:\/\/activiti-admin:8080%"$APS_ADMIN_URL"%g /etc/nginx/nginx.conf
 fi
 
-if [[ $AIMS_URL ]]; then
-  sed -i s%http:\/\/identity:8080%"$AIMS_URL"%g /etc/nginx/nginx.conf
-fi
-
 if [[ $ACCESS_LOG ]]; then
   sed -i s%\#ENV_ACCESS_LOG%"access_log $ACCESS_LOG;"%g /etc/nginx/nginx.conf
 fi

nginx-ingress/nginx.conf

@@ -19,10 +19,7 @@ http {
 
         proxy_next_upstream error timeout invalid_header http_500 http_502 http_503 http_504;
         proxy_redirect off;
-#        proxy_buffering off;
-        proxy_buffer_size	64k;
-        proxy_buffers		4 256k;
-        proxy_busy_buffers_size	256k;
+        proxy_buffering off;
         proxy_set_header Host              $http_host;
         proxy_set_header X-Real-IP         $remote_addr;
         proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
@@ -72,6 +69,9 @@ http {
 
         location /share/ {
             proxy_pass http://share:8080;
+
+            # If using external proxy / load balancer (for initial redirect if no trailing slash)
+            absolute_redirect off;
         }
         
         location /workspace/ {
@@ -80,12 +80,5 @@ http {
             # If using external proxy / load balancer (for initial redirect if no trailing slash)
             absolute_redirect off;
         }
-
-        location /auth/ {
-            proxy_pass http://identity:8080;
-
-            # If using external proxy / load balancer (for initial redirect if no trailing slash)
-            absolute_redirect off;
-        }
     }
 }

server.xml

@@ -1,175 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!--
-  Licensed to the Apache Software Foundation (ASF) under one or more
-  contributor license agreements.  See the NOTICE file distributed with
-  this work for additional information regarding copyright ownership.
-  The ASF licenses this file to You under the Apache License, Version 2.0
-  (the "License"); you may not use this file except in compliance with
-  the License.  You may obtain a copy of the License at
-
-      http://www.apache.org/licenses/LICENSE-2.0
-
-  Unless required by applicable law or agreed to in writing, software
-  distributed under the License is distributed on an "AS IS" BASIS,
-  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-  See the License for the specific language governing permissions and
-  limitations under the License.
--->
-<!-- Note:  A "Server" is not itself a "Container", so you may not
-     define subcomponents such as "Valves" at this level.
-     Documentation at /docs/config/server.html
- -->
-<Server port="8005" shutdown="SHUTDOWN">
-  <Listener className="org.apache.catalina.startup.VersionLoggerListener" logArgs="false" />
-  <!-- Security listener. Documentation at /docs/config/listeners.html
-  <Listener className="org.apache.catalina.security.SecurityListener" />
-  -->
-  <!-- APR library loader. Documentation at /docs/apr.html -->
-  <Listener className="org.apache.catalina.core.AprLifecycleListener" SSLEngine="on" />
-  <!-- Prevent memory leaks due to use of particular java/javax APIs-->
-  <Listener className="org.apache.catalina.core.JreMemoryLeakPreventionListener" />
-  <Listener className="org.apache.catalina.mbeans.GlobalResourcesLifecycleListener" />
-  <Listener className="org.apache.catalina.core.ThreadLocalLeakPreventionListener" />
-
-  <!-- Global JNDI resources
-       Documentation at /docs/jndi-resources-howto.html
-  -->
-  <GlobalNamingResources>
-    <!-- Editable user database that can also be used by
-         UserDatabaseRealm to authenticate users
-    -->
-    <Resource name="UserDatabase" auth="Container"
-              type="org.apache.catalina.UserDatabase"
-              description="User database that can be updated and saved"
-              factory="org.apache.catalina.users.MemoryUserDatabaseFactory"
-              pathname="conf/tomcat-users.xml" />
-  </GlobalNamingResources>
-
-  <!-- A "Service" is a collection of one or more "Connectors" that share
-       a single "Container" Note:  A "Service" is not itself a "Container",
-       so you may not define subcomponents such as "Valves" at this level.
-       Documentation at /docs/config/service.html
-   -->
-  <Service name="Catalina">
-
-    <!--The connectors can use a shared executor, you can define one or more named thread pools-->
-    <!--
-    <Executor name="tomcatThreadPool" namePrefix="catalina-exec-"
-        maxThreads="150" minSpareThreads="4"/>
-    -->
-
-
-    <!-- A "Connector" represents an endpoint by which requests are received
-         and responses are returned. Documentation at :
-         Java HTTP Connector: /docs/config/http.html
-         Java AJP  Connector: /docs/config/ajp.html
-         APR (HTTP/AJP) Connector: /docs/apr.html
-         Define a non-SSL/TLS HTTP/1.1 Connector on port 8080
-    -->
-    <Connector port="8080" protocol="HTTP/1.1"
-               Server=" "
-               connectionTimeout="20000"
-               redirectPort="8443"
-               proxyName="alfresco.inteligr8.com" proxyPort="443" />
-    <!-- A "Connector" using the shared thread pool-->
-    <!--
-    <Connector executor="tomcatThreadPool"
-               port="8080" protocol="HTTP/1.1"
-               connectionTimeout="20000"
-               redirectPort="8443"
-               proxyHost="alfresco.inteligr8.com" proxyPort="443" />
-    -->
-    <!-- Define an SSL/TLS HTTP/1.1 Connector on port 8443
-         This connector uses the NIO implementation. The default
-         SSLImplementation will depend on the presence of the APR/native
-         library and the useOpenSSL attribute of the AprLifecycleListener.
-         Either JSSE or OpenSSL style configuration may be used regardless of
-         the SSLImplementation selected. JSSE style configuration is used below.
-    -->
-    <!--
-    <Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol"
-               maxThreads="150" SSLEnabled="true">
-        <SSLHostConfig>
-            <Certificate certificateKeystoreFile="conf/localhost-rsa.jks"
-                         type="RSA" />
-        </SSLHostConfig>
-    </Connector>
-    -->
-    <!-- Define an SSL/TLS HTTP/1.1 Connector on port 8443 with HTTP/2
-         This connector uses the APR/native implementation which always uses
-         OpenSSL for TLS.
-         Either JSSE or OpenSSL style configuration may be used. OpenSSL style
-         configuration is used below.
-    -->
-    <!--
-    <Connector port="8443" protocol="org.apache.coyote.http11.Http11AprProtocol"
-               maxThreads="150" SSLEnabled="true" >
-        <UpgradeProtocol className="org.apache.coyote.http2.Http2Protocol" />
-        <SSLHostConfig>
-            <Certificate certificateKeyFile="conf/localhost-rsa-key.pem"
-                         certificateFile="conf/localhost-rsa-cert.pem"
-                         certificateChainFile="conf/localhost-rsa-chain.pem"
-                         type="RSA" />
-        </SSLHostConfig>
-    </Connector>
-    -->
-
-    <!-- Define an AJP 1.3 Connector on port 8009 -->
-    <!--
-    <Connector protocol="AJP/1.3"
-               address="::1"
-               port="8009"
-               redirectPort="8443" />
-    -->
-
-    <!-- An Engine represents the entry point (within Catalina) that processes
-         every request.  The Engine implementation for Tomcat stand alone
-         analyzes the HTTP headers included with the request, and passes them
-         on to the appropriate Host (virtual host).
-         Documentation at /docs/config/engine.html -->
-
-    <!-- You should set jvmRoute to support load-balancing via AJP ie :
-    <Engine name="Catalina" defaultHost="localhost" jvmRoute="jvm1">
-    -->
-    <Engine name="Catalina" defaultHost="localhost">
-
-      <!--For clustering, please take a look at documentation at:
-          /docs/cluster-howto.html  (simple how to)
-          /docs/config/cluster.html (reference documentation) -->
-      <!--
-      <Cluster className="org.apache.catalina.ha.tcp.SimpleTcpCluster"/>
-      -->
-
-      <!-- Use the LockOutRealm to prevent attempts to guess user passwords
-           via a brute-force attack -->
-      <Realm className="org.apache.catalina.realm.LockOutRealm">
-        <!-- This Realm uses the UserDatabase configured in the global JNDI
-             resources under the key "UserDatabase".  Any edits
-             that are performed against this UserDatabase are immediately
-             available for use by the Realm.  -->
-        <Realm className="org.apache.catalina.realm.UserDatabaseRealm"
-               resourceName="UserDatabase"/>
-      </Realm>
-
-      <Host name="localhost"  appBase="webapps"
-            unpackWARs="true" autoDeploy="true">
-
-        <!-- SingleSignOn valve, share authentication between web applications
-             Documentation at: /docs/config/valve.html -->
-        <!--
-        <Valve className="org.apache.catalina.authenticator.SingleSignOn" />
-        -->
-
-        <!-- Access log processes all example.
-             Documentation at: /docs/config/valve.html
-             Note: The pattern used is equivalent to using pattern="common" -->
-        <Valve className="org.apache.catalina.valves.AccessLogValve" directory="logs"
-               prefix="localhost_access_log" suffix=".txt"
-               pattern="%h %l %u %t &quot;%r&quot; %s %b" />
-
-	<Valve className="org.apache.catalina.valves.RemoteIpValve" />
-
-      </Host>
-    </Engine>
-  </Service>
-</Server>