How to run the Connect2id server in a Docker container

The Connect2id server is now also available as a Docker image for easy container-based setup and evaluation.

1. Docker quick start

1.1 Installing Docker

If Docker isn't installed on your computer you can find instructions here. The Community Edition (CE) is sufficient to run a Connect2id server.

1.2 Content of the Docker image

The provided Docker image includes the required Java runtime and an exploded copy of the ZIP package we make available for download -- a Tomcat servlet container with a Connect2id server WAR, an OpenID relying party client and a few other sample WARs deployed in it. A relational database (H2 in embedded mode) for the Connect2id server to persist its own data is also included.

1.3 Configuring the Connect2id server

The Connect2id server configuration is located in a set of properties files in the /WEB-INF/ directory of its web application archive (WAR).

Any of those properties can be overridden by injecting a text file with the new properties into the Docker container at /etc/c2id/override.properties. The injection can be done by means of a volume, bind mount or a custom storage driver. The steps below use the bind mount method.

1.4 To run in a container

Important: The provided Docker image uses host networking, which has no isolation between host and container and is limited to Linux hosts.

The steps to run the Connect2id server in a Docker container:

1. Pull the latest image from Docker Hub

   The available versions are listed in the c2id Docker repository.

   docker pull c2id/c2id-server:[version]

2. (Optional) Save your custom properties in a override.properties file

   For example:

   op.issuer                   = https://my.idp.com
   op.authz.endpoint           = https://my.idp.com/login
   op.authz.apiAccessToken     = vuxiehaiGhohrahJeik0ui0aib9jai9c
   op.reg.apiAccessToken       = Oosoje7choh1dom8ahng4kueQuoo6la0
   op.logout.apiAccessToken    = eik1Oosahpaic5dei2ioco4og9rahkee
   authzStore.apiAccessToken   = Ahrek9shie3Eidaex9lu4biem7ahpeeb
   sessionStore.apiAccessToken = foo7ahM5koo9eiziah7ahwaequaek5ta
   monitor.apiAccessToken      = caew6jaeX2phah8oolaoghaec0Heer8l
   jose.jwkSet                 = eyAia2V5cyIgOiBbIHsgImt0eSIgOi...
   

3. Run a container with the Connect2id server image

   Replace host_port with an available port on your host.

   • To use the default server setting and embedded H2 database:

     docker run -p host_port:8080 --network host c2id/c2id-server:[version]

   • To pass your own server settings in override.properties via bind mount:

     docker run -p host_port:8080 --mount type=bind,source="/directory/containing/override/file",target=/etc/c2id c2id/c2id-server:[version]

For extra options that may be of use see the Docker run command reference.

2. Logging

The Connect2id server ships with a configuration for writing the log messages to tomcat/logs/c2id-server.log. When running the server in a Docker container it may be more useful to write the logs to the standard output, which can then be monitored with docker logs or other tools.

To write the logs to the standard output, replace the WEB-INF/log4j.xml configuration in c2id.war with this one.

2.1 AWS CloudWatch

Connect2id server deployments in AWS Elastic Container Service (ECS) can be made to have their logs collected in AWS CloudWatch.

• First, make sure the server is configured to write the logs to the standard output, as explained above.

• In the AWS CloudWatch console, create a new log group with a suitable name, e.g. c2id-docker (Log groups → Actions → Create log group).

• In the AWS ECS console, set the definition for your Connect2id server Docker container to use the log driver awslogs, and then its parameters to point to the desired log group, e.g.

  • awslogs-group = c2id-docker (the CloudWatch log group name)
  • awslogs-region = eu-central (the region of the CloudWatch log group)

3. Database connectivity

Make sure the database parameters in the Connect2id server configuration are correctly set so that the server can connect via TCP/IP to the intended database for persisting its objects.

An occasional mistake with Docker host networking where the database is also deployed on the same host is trying to connect to localhost, which is actually the container with the Connect2id server itself.

In some cases the Docker container environment may require an additional setup.