IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2024-12-27 09:21:59 -06:00
Code Issues Packages Projects Releases Wiki Activity
49e45f28a2
freeipa/install/updates/30-s4u2proxy.update

25 lines
858 B
Plaintext
Raw Normal View History

Configure s4u2proxy during installation. This creates a new container, cn=s4u2proxy,cn=etc,$SUFFIX Within that container we control which services are allowed to delegate tickets for other services. Right now that is limited from the IPA HTTP to ldap services. Requires a version of mod_auth_kerb that supports s4u2proxy https://fedorahosted.org/freeipa/ticket/1098
2012-01-10 21:39:26 -06:00
dn: cn=s4u2proxy,cn=etc,$SUFFIX
default: objectClass: nsContainer
default: objectClass: top
default: cn: s4u2proxy
dn: cn=ipa-http-delegation,cn=s4u2proxy,cn=etc,$SUFFIX
default: objectClass: ipaKrb5DelegationACL
default: objectClass: groupOfPrincipals
default: objectClass: top
default: cn: ipa-http-delegation
Use correct template variable for hosts, FQDN. https://fedorahosted.org/freeipa/ticket/2268
2012-01-17 08:09:15 -06:00
default: memberPrincipal: HTTP/$FQDN@$REALM
Correct update syntax in 30-s4u2proxy.update Always have FQDN available in the update dictionary. There were cases where it would contain the ldapi socket path and not the FQDN. https://fedorahosted.org/freeipa/ticket/2147
2012-02-10 11:00:35 -06:00
default: ipaAllowedTarget: cn=ipa-ldap-delegation-targets,cn=s4u2proxy,cn=etc,$SUFFIX
Configure s4u2proxy during installation. This creates a new container, cn=s4u2proxy,cn=etc,$SUFFIX Within that container we control which services are allowed to delegate tickets for other services. Right now that is limited from the IPA HTTP to ldap services. Requires a version of mod_auth_kerb that supports s4u2proxy https://fedorahosted.org/freeipa/ticket/1098
2012-01-10 21:39:26 -06:00
dn: cn=ipa-ldap-delegation-targets,cn=s4u2proxy,cn=etc,$SUFFIX
default: objectClass: groupOfPrincipals
default: objectClass: top
default: cn: ipa-ldap-delegation-targets
Use correct template variable for hosts, FQDN. https://fedorahosted.org/freeipa/ticket/2268
2012-01-17 08:09:15 -06:00
default: memberPrincipal: ldap/$FQDN@$REALM
Add S4U2Proxy delegation permissions on upgrades https://fedorahosted.org/freeipa/ticket/2396
2012-02-15 10:16:52 -06:00
dn: cn=ipa-http-delegation,cn=s4u2proxy,cn=etc,$SUFFIX
add: memberPrincipal: HTTP/$FQDN@$REALM
dn: cn=ipa-ldap-delegation-targets,cn=s4u2proxy,cn=etc,$SUFFIX
add: memberPrincipal: ldap/$FQDN@$REALM
Reference in New Issue Copy Permalink