freeipa/install/share/gssproxy.conf.template

#Installed and maintained by ipa update tools, please do not modify
[service/ipa-httpd]
  mechs = krb5
  cred_store = keytab:$HTTP_KEYTAB
  cred_store = client_keytab:$HTTP_KEYTAB
  allow_protocol_transition = true
  cred_usage = both
  euid = $HTTPD_USER

[service/ipa-api]
  mechs = krb5
  cred_store = keytab:$HTTP_KEYTAB
  cred_store = client_keytab:$HTTP_KEYTAB
  allow_constrained_delegation = true
  cred_usage = initiate
  euid = $IPAAPI_USER
Configure HTTPD to work via Gss-Proxy https://fedorahosted.org/freeipa/ticket/4189 https://fedorahosted.org/freeipa/ticket/5959 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com> 2016-11-29 10:10:22 -06:00			`#Installed and maintained by ipa update tools, please do not modify`
			`[service/ipa-httpd]`
			`mechs = krb5`
			`cred_store = keytab:$HTTP_KEYTAB`
			`cred_store = client_keytab:$HTTP_KEYTAB`
			`allow_protocol_transition = true`
			`cred_usage = both`
			`euid = $HTTPD_USER`
Add a new user to run the framework code Add the apache user the ipawebui group. Make the ccaches directory owned by the ipawebui group and make mod_auth_gssapi write the ccache files as r/w by the apache user and the ipawebui group. Fix tmpfiles creation ownership and permissions to allow the user to access ccaches files. The webui framework now works as a separate user than apache, so the certs used to access the dogtag instance need to be usable by this new user as well. Both apache and the webui user are in the ipawebui group, so use that. https://fedorahosted.org/freeipa/ticket/5959 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com> 2016-08-16 08:03:19 -05:00
			`[service/ipa-api]`
			`mechs = krb5`
			`cred_store = keytab:$HTTP_KEYTAB`
			`cred_store = client_keytab:$HTTP_KEYTAB`
			`allow_constrained_delegation = true`
			`cred_usage = initiate`
			`euid = $IPAAPI_USER`