IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2024-12-25 08:21:05 -06:00
Code Issues Packages Projects Releases Wiki Activity
496e3ace85
freeipa/install/share/ipa-pki-proxy.conf.template

49 lines
2.5 KiB
Plaintext
Raw Normal View History

ipa-pki-proxy.conf: provide access to /kra/admin/kra/getStatus The access to /kra/admin/kra/getStatus will be needed in order to fix pki-healthcheck. Note that this commit is a pre-requisite for the fix to be done on PKI side. No test added since the full integration test already exists in test_replica_promotion.py, in TestHiddenReplicaPromotion::test_ipahealthcheck_hidden_replica Fixes: https://pagure.io/freeipa/issue/9099 Related: https://pagure.io/freeipa/issue/8582 Signed-off-by: Florence Blanc-Renaud <flo@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
2022-01-28 09:58:42 -06:00
# VERSION 17 - DO NOT REMOVE THIS LINE
Improved handling for ipa-pki-proxy.conf - Remove ipa-pki-proxy.conf when IPA is uninstalled - Move file removal to httpinstance.py and use remove_file() - Add a version stanza - Create the file if it doesn't exist on upgraded installs https://fedorahosted.org/freeipa/ticket/1771
2011-09-09 16:07:09 -05:00
enable proxy for dogtag Dogtag is going to be proxied through httpd. To make this work, it has to support renegotiation of the SSL connection. This patch enables renegotiate in the nss configuration file during during apache configuration, as well as modifies libnss to set the appropriate optins on the ssl connection in order to renegotiate. The IPA install uses the internal ports instead of proxying through httpd since httpd is not set up yet. IPA needs to Request the certificate through a port that uses authentication. On the Dogtag side, they provide an additional mapping for this: /ca/eeca/ca as opposed tp /ca/ee/ca just for this purpose. https://fedorahosted.org/freeipa/ticket/1334 add flag to pkicreate in order to enable using proxy. add the proxy file in /etc/http/conf.d/ Signed-off-by: Simo Sorce <ssorce@redhat.com>
2011-08-17 14:36:18 -05:00
ProxyRequests Off
# matches for ee port
Proxy PKI clone /ca/ee/ca/profileSubmit URI PKI change done in ticket https://fedorahosted.org/pki/ticket/816 requires the PKI Clone's SSL Server certificate to be issued by it's associated PKI master. Allow this call on IPA master. https://fedorahosted.org/freeipa/ticket/4265 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-03-20 03:34:53 -05:00
<LocationMatch "^/ca/ee/ca/checkRequest|^/ca/ee/ca/getCertChain|^/ca/ee/ca/getTokenInfo|^/ca/ee/ca/tokenAuthenticate|^/ca/ocsp|^/ca/ee/ca/updateNumberRange|^/ca/ee/ca/getCRL|^/ca/ee/ca/profileSubmit">
Convert ipa-pki-proxy.conf to use mod_ssl directives Related: https://pagure.io/freeipa/issue/3757 Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
2018-01-08 12:56:24 -06:00
SSLOptions +StdEnvVars +ExportCertData +StrictRequire +OptRenegotiate
SSLVerifyClient none
Secure AJP connector between Dogtag and Apache proxy AJP implementation in Tomcat is vulnerable to CVE-2020-1938 if used without shared secret. Set up a shared secret between localhost connector and Apache mod_proxy_ajp pass-through. For existing secured AJP pass-through make sure the option used for configuration on the tomcat side is up to date. Tomcat 9.0.31.0 deprecated 'requiredSecret' option name in favor of 'secret'. Details can be found at https://tomcat.apache.org/migration-9.html#Upgrading_9.0.x Fixes: https://pagure.io/freeipa/issue/8221 Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Florence Blanc-Renaud <flo@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
2020-03-10 16:00:55 -05:00
ProxyPassMatch ajp://localhost:$DOGTAG_PORT $DOGTAG_AJP_SECRET
Use Dogtag 10 only when it is available Put the changes from Ade's dogtag 10 patch into namespaced constants in dogtag.py, which are then referenced in the code. Make ipaserver.install.CAInstance use the service name specified in the configuration. Uninstallation, where config is removed before CA uninstall, also uses the (previously) configured value. This and Ade's patch address https://fedorahosted.org/freeipa/ticket/2846
2012-08-23 11:38:45 -05:00
ProxyPassReverse ajp://localhost:$DOGTAG_PORT
enable proxy for dogtag Dogtag is going to be proxied through httpd. To make this work, it has to support renegotiation of the SSL connection. This patch enables renegotiate in the nss configuration file during during apache configuration, as well as modifies libnss to set the appropriate optins on the ssl connection in order to renegotiate. The IPA install uses the internal ports instead of proxying through httpd since httpd is not set up yet. IPA needs to Request the certificate through a port that uses authentication. On the Dogtag side, they provide an additional mapping for this: /ca/eeca/ca as opposed tp /ca/ee/ca just for this purpose. https://fedorahosted.org/freeipa/ticket/1334 add flag to pkicreate in order to enable using proxy. add the proxy file in /etc/http/conf.d/ Signed-off-by: Simo Sorce <ssorce@redhat.com>
2011-08-17 14:36:18 -05:00
</LocationMatch>
Modifications to install scripts for dogtag 10 Dogtag 10 uses a new installer, new directory layout and new default ports. This patch changes the ipa install code to integrate these changes. https://fedorahosted.org/freeipa/ticket/2846
2012-08-15 21:53:51 -05:00
# matches for admin port and installer
ipa-pki-proxy.conf: provide access to /kra/admin/kra/getStatus The access to /kra/admin/kra/getStatus will be needed in order to fix pki-healthcheck. Note that this commit is a pre-requisite for the fix to be done on PKI side. No test added since the full integration test already exists in test_replica_promotion.py, in TestHiddenReplicaPromotion::test_ipahealthcheck_hidden_replica Fixes: https://pagure.io/freeipa/issue/9099 Related: https://pagure.io/freeipa/issue/8582 Signed-off-by: Florence Blanc-Renaud <flo@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
2022-01-28 09:58:42 -06:00
<LocationMatch "^/ca/admin/ca/getCertChain|^/ca/admin/ca/getConfigEntries|^/ca/admin/ca/getCookie|^/ca/admin/ca/getStatus|^/ca/admin/ca/securityDomainLogin|^/ca/admin/ca/getDomainXML|^/ca/admin/ca/updateNumberRange|^/ca/admin/ca/tokenAuthenticate|^/ca/admin/ca/updateNumberRange|^/ca/admin/ca/updateDomainXML|^/ca/admin/ca/updateConnector|^/ca/admin/ca/getSubsystemCert|^/kra/admin/kra/updateNumberRange|^/kra/admin/kra/getConfigEntries|^/kra/admin/kra/getStatus">
Convert ipa-pki-proxy.conf to use mod_ssl directives Related: https://pagure.io/freeipa/issue/3757 Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
2018-01-08 12:56:24 -06:00
SSLOptions +StdEnvVars +ExportCertData +StrictRequire +OptRenegotiate
SSLVerifyClient none
Secure AJP connector between Dogtag and Apache proxy AJP implementation in Tomcat is vulnerable to CVE-2020-1938 if used without shared secret. Set up a shared secret between localhost connector and Apache mod_proxy_ajp pass-through. For existing secured AJP pass-through make sure the option used for configuration on the tomcat side is up to date. Tomcat 9.0.31.0 deprecated 'requiredSecret' option name in favor of 'secret'. Details can be found at https://tomcat.apache.org/migration-9.html#Upgrading_9.0.x Fixes: https://pagure.io/freeipa/issue/8221 Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Florence Blanc-Renaud <flo@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
2020-03-10 16:00:55 -05:00
ProxyPassMatch ajp://localhost:$DOGTAG_PORT $DOGTAG_AJP_SECRET
Use Dogtag 10 only when it is available Put the changes from Ade's dogtag 10 patch into namespaced constants in dogtag.py, which are then referenced in the code. Make ipaserver.install.CAInstance use the service name specified in the configuration. Uninstallation, where config is removed before CA uninstall, also uses the (previously) configured value. This and Ade's patch address https://fedorahosted.org/freeipa/ticket/2846
2012-08-23 11:38:45 -05:00
ProxyPassReverse ajp://localhost:$DOGTAG_PORT
enable proxy for dogtag Dogtag is going to be proxied through httpd. To make this work, it has to support renegotiation of the SSL connection. This patch enables renegotiate in the nss configuration file during during apache configuration, as well as modifies libnss to set the appropriate optins on the ssl connection in order to renegotiate. The IPA install uses the internal ports instead of proxying through httpd since httpd is not set up yet. IPA needs to Request the certificate through a port that uses authentication. On the Dogtag side, they provide an additional mapping for this: /ca/eeca/ca as opposed tp /ca/ee/ca just for this purpose. https://fedorahosted.org/freeipa/ticket/1334 add flag to pkicreate in order to enable using proxy. add the proxy file in /etc/http/conf.d/ Signed-off-by: Simo Sorce <ssorce@redhat.com>
2011-08-17 14:36:18 -05:00
</LocationMatch>
# matches for agent port and eeca port
Fixed KRA installation problem. The ipa-pki-proxy.conf has been modified to optionally require client certificate authentication for PKI REST services as it's done in standalone PKI to allow the proper KRA installation. https://fedorahosted.org/freeipa/ticket/5058 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-06-08 00:30:47 -05:00
<LocationMatch "^/ca/agent/ca/displayBySerial|^/ca/agent/ca/doRevoke|^/ca/agent/ca/doUnrevoke|^/ca/agent/ca/updateDomainXML|^/ca/eeca/ca/profileSubmitSSLClient|^/kra/agent/kra/connector">
Convert ipa-pki-proxy.conf to use mod_ssl directives Related: https://pagure.io/freeipa/issue/3757 Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
2018-01-08 12:56:24 -06:00
SSLOptions +StdEnvVars +ExportCertData +StrictRequire +OptRenegotiate
SSLVerifyClient require
Secure AJP connector between Dogtag and Apache proxy AJP implementation in Tomcat is vulnerable to CVE-2020-1938 if used without shared secret. Set up a shared secret between localhost connector and Apache mod_proxy_ajp pass-through. For existing secured AJP pass-through make sure the option used for configuration on the tomcat side is up to date. Tomcat 9.0.31.0 deprecated 'requiredSecret' option name in favor of 'secret'. Details can be found at https://tomcat.apache.org/migration-9.html#Upgrading_9.0.x Fixes: https://pagure.io/freeipa/issue/8221 Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Florence Blanc-Renaud <flo@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
2020-03-10 16:00:55 -05:00
ProxyPassMatch ajp://localhost:$DOGTAG_PORT $DOGTAG_AJP_SECRET
Use Dogtag 10 only when it is available Put the changes from Ade's dogtag 10 patch into namespaced constants in dogtag.py, which are then referenced in the code. Make ipaserver.install.CAInstance use the service name specified in the configuration. Uninstallation, where config is removed before CA uninstall, also uses the (previously) configured value. This and Ade's patch address https://fedorahosted.org/freeipa/ticket/2846
2012-08-23 11:38:45 -05:00
ProxyPassReverse ajp://localhost:$DOGTAG_PORT
enable proxy for dogtag Dogtag is going to be proxied through httpd. To make this work, it has to support renegotiation of the SSL connection. This patch enables renegotiate in the nss configuration file during during apache configuration, as well as modifies libnss to set the appropriate optins on the ssl connection in order to renegotiate. The IPA install uses the internal ports instead of proxying through httpd since httpd is not set up yet. IPA needs to Request the certificate through a port that uses authentication. On the Dogtag side, they provide an additional mapping for this: /ca/eeca/ca as opposed tp /ca/ee/ca just for this purpose. https://fedorahosted.org/freeipa/ticket/1334 add flag to pkicreate in order to enable using proxy. add the proxy file in /etc/http/conf.d/ Signed-off-by: Simo Sorce <ssorce@redhat.com>
2011-08-17 14:36:18 -05:00
</LocationMatch>
Configure the initial CA as the CRL generator. Any installed clones will have CRL generation explicitly disabled. It is a manual process to make a different CA the CRL generator. There should be only one. https://fedorahosted.org/freeipa/ticket/3051
2012-10-09 09:40:20 -05:00
Simplify pki proxy conf ``pkispawn`` is being modified to use PKI CLI for installation. Add ``/pki/rest`` to proxied routes and simplify location matching with a prefix regular expression. Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2020-05-04 08:17:33 -05:00
# matches for REST API of CA, KRA, and PKI
<LocationMatch "^/(ca|kra|pki)/rest/">
Convert ipa-pki-proxy.conf to use mod_ssl directives Related: https://pagure.io/freeipa/issue/3757 Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Stanislav Laznicka <slaznick@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
2018-01-08 12:56:24 -06:00
SSLOptions +StdEnvVars +ExportCertData +StrictRequire +OptRenegotiate
SSLVerifyClient optional
Secure AJP connector between Dogtag and Apache proxy AJP implementation in Tomcat is vulnerable to CVE-2020-1938 if used without shared secret. Set up a shared secret between localhost connector and Apache mod_proxy_ajp pass-through. For existing secured AJP pass-through make sure the option used for configuration on the tomcat side is up to date. Tomcat 9.0.31.0 deprecated 'requiredSecret' option name in favor of 'secret'. Details can be found at https://tomcat.apache.org/migration-9.html#Upgrading_9.0.x Fixes: https://pagure.io/freeipa/issue/8221 Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Florence Blanc-Renaud <flo@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
2020-03-10 16:00:55 -05:00
ProxyPassMatch ajp://localhost:$DOGTAG_PORT $DOGTAG_AJP_SECRET
ipa-pki-proxy: provide access to profiles REST API Part of: https://fedorahosted.org/freeipa/ticket/57 Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-04-29 05:07:58 -05:00
ProxyPassReverse ajp://localhost:$DOGTAG_PORT
</LocationMatch>
acme: ipa-pki-proxy: proxy /acme to Dogtag Update ipa-pki-proxy.conf to proxy requests to the /acme resource namespace to Dogtag. Part of: https://pagure.io/freeipa/issue/4751 Reviewed-By: Rob Crittenden <rcritten@redhat.com>
2020-02-20 01:26:08 -06:00
# Matches for ACME service
<LocationMatch "^/acme">
SSLOptions +StdEnvVars +ExportCertData +StrictRequire +OptRenegotiate
# RFC 8555 says HTTPS is REQUIRED
SSLRequireSSL
SSLVerifyClient none
ProxyPassMatch ajp://localhost:$DOGTAG_PORT
ProxyPassReverse ajp://localhost:$DOGTAG_PORT
</LocationMatch>
Configure the initial CA as the CRL generator. Any installed clones will have CRL generation explicitly disabled. It is a manual process to make a different CA the CRL generator. There should be only one. https://fedorahosted.org/freeipa/ticket/3051
2012-10-09 09:40:20 -05:00
# Only enable this on servers that are not generating a CRL
Redirect CRL requests to the http port, not the https port https://pagure.io/freeipa/issue/7433 Signed-off-by: Rob Crittenden <rcritten@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
2018-03-14 17:08:59 -05:00
${CLONE}RewriteRule ^/ipa/crl/MasterCRL.bin http://$FQDN/ca/ee/ca/getCRL?op=getCRL&crlIssuingPoint=MasterCRL [L,R=301,NC]
Reference in New Issue Copy Permalink