IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2024-12-24 16:10:02 -06:00
Code Issues Packages Projects Releases Wiki Activity
f741c62f59
freeipa/install/share/Makefile.am

102 lines
2.1 KiB
Makefile
Raw Normal View History

Autotool ipa-server - patch from William Jon McCann <mccann@jhu.edu>.
0000-12-31 18:09:24 -05:50
NULL =
Add ipa-advise plugins for legacy clients Old versions of SSSD do not directly support cross-realm trusts between IPA and AD. This patch introduces plugins for the ipa-advise tool, which should help with configuring an old version of SSSD (1.5-1.8) to gain access to resources in trusted domain. Since the configuration steps differ depending on whether the platform includes the authconfig tool, two plugins are needed: * config-redhat-sssd-before-1-9 - provides configuration for Red Hat based systems, as these system include the autconfig utility * config-generic-sssd-before-1-9 - provides configuration for other platforms https://fedorahosted.org/freeipa/ticket/3671 https://fedorahosted.org/freeipa/ticket/3672
2013-08-01 07:12:39 -05:00
SUBDIRS = \
advise \
Import included profiles during install or upgrade Add a default service profile template as part of FreeIPA and format and import it as part of installation or upgrade process. Also remove the code that modifies the old (file-based) `caIPAserviceCert' profile. Fixes https://fedorahosted.org/freeipa/ticket/4002 Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-05-11 20:17:48 -05:00
profiles \
support schema files from third-party plugins Allow upgrade process to include schema files from third-party plugins installed in /usr/share/ipa/schema.d/*.schema. The directory /usr/shar/eipa/schema.d is owned by the server-common subpackage and therefore third-party plugins should depend on freeipa-server-common (ipa-server-common) package in their package dependencies. Resolves: https://fedorahosted.org/freeipa/ticket/5864 Reviewed-By: Martin Basti <mbasti@redhat.com>
2016-08-05 05:04:19 -05:00
schema.d \
Add ipa-advise plugins for legacy clients Old versions of SSSD do not directly support cross-realm trusts between IPA and AD. This patch introduces plugins for the ipa-advise tool, which should help with configuring an old version of SSSD (1.5-1.8) to gain access to resources in trusted domain. Since the configuration steps differ depending on whether the platform includes the authconfig tool, two plugins are needed: * config-redhat-sssd-before-1-9 - provides configuration for Red Hat based systems, as these system include the autconfig utility * config-generic-sssd-before-1-9 - provides configuration for other platforms https://fedorahosted.org/freeipa/ticket/3671 https://fedorahosted.org/freeipa/ticket/3672
2013-08-01 07:12:39 -05:00
$(NULL)
Autotool ipa-server - patch from William Jon McCann <mccann@jhu.edu>.
0000-12-31 18:09:24 -05:50
appdir = $(IPA_DATA_DIR)
Build: Remove spurious EXTRA_DIST from install/share/Makefile.am dist_ prefix can be used instead of EXTRA_DIST magic. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
2016-11-02 09:00:54 -05:00
dist_app_DATA = \
Incorporate new schema for IPAv2 Loading this via LDIF is a temporary measure until we can load it online. This requires removing the dNSRecord declarations from 05rfc2247.ldif so a replacement copy is included for now. Also add the netgroups container.
2009-02-10 14:52:25 -06:00
05rfc2247.ldif \
Add formerly update-only schema Some schema was only delivered in updates. Add it back as ldif files. https://fedorahosted.org/freeipa/ticket/3454
2013-04-29 11:09:45 -05:00
15rfc2307bis.ldif \
15rfc4876.ldif \
merge initial radius work
2007-11-03 11:22:20 -05:00
60kerberos.ldif \
60samba.ldif \
Fix installation Add missing schema for GUI Config, and missing objectclass for cn=accounts container
2007-11-18 14:02:26 -06:00
60ipaconfig.ldif \
Incorporate new schema for IPAv2 Loading this via LDIF is a temporary measure until we can load it online. This requires removing the dNSRecord declarations from 05rfc2247.ldif so a replacement copy is included for now. Also add the netgroups container.
2009-02-10 14:52:25 -06:00
60basev2.ldif \
v3-schema: Add new ipaExternalGroup objectclass This construct allows to have a group of ipaExternalMember attributes, that can be nested in a normal ipa Group ('memberOf' is allowed). It cannot contain normal ipa users/groups and cannot be nested with another group of the same type ('member' is not allowed).
2011-08-15 14:02:19 -05:00
60basev3.ldif \
schema: Split ipadns definitions from basev2 ones
2011-08-15 13:18:50 -05:00
60ipadns.ldif \
DNSSEC: schema Tickets: https://fedorahosted.org/freeipa/ticket/3801 https://fedorahosted.org/freeipa/ticket/4417 Design: https://fedorahosted.org/bind-dyndb-ldap/wiki/BIND9/Design/DNSSEC Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: David Kupka <dkupka@redhat.com>
2014-10-16 08:33:32 -05:00
60ipapk11.ldif \
Add schema for certificate profiles The certprofile object class is used to track IPA-managed certificate profiles in Dogtag and store IPA-specific settings. Part of: https://fedorahosted.org/freeipa/ticket/57 Reviewed-By: Martin Basti <mbasti@redhat.com>
2015-04-21 01:24:10 -05:00
60certificate-profiles.ldif \
Perform case-insensitive searches for principals on TGS requests We want to always resolve TGS requests even if the user mistakenly sends a request for a service ticket where the fqdn part contain upper case letters. The actual implementation follows hints set by KDC. When AP_REQ is done, KDC sets KRB5_FLAG_ALIAS_OK and we obey it when looking for principals on TGS requests. https://fedorahosted.org/freeipa/ticket/1577
2012-03-26 06:23:42 -05:00
61kerberos-ipav3.ldif \
Add LDAP schema for certificate store. Part of https://fedorahosted.org/freeipa/ticket/3259 Part of https://fedorahosted.org/freeipa/ticket/3520 Reviewed-By: Rob Crittenden <rcritten@redhat.com>
2014-06-10 07:04:36 -05:00
65ipacertstore.ldif \
Add support for sudoOrder Update ipaSudoRule objectClass on upgrades to add new attributes. Ensure uniqueness of sudoOrder in rules. The attributes sudoNotBefore and sudoNotAfter are being added to schema but not as Params. https://fedorahosted.org/freeipa/ticket/1314
2012-03-01 13:02:28 -06:00
65ipasudo.ldif \
Add IPA OTP schema and ACLs This commit adds schema support for two factor authentication via OTP devices, including RADIUS or TOTP. This schema will be used by future patches which will enable two factor authentication directly. https://fedorahosted.org/freeipa/ticket/3365 http://freeipa.org/page/V3/OTP
2013-04-11 12:24:46 -05:00
70ipaotp.ldif \
ds plugin - manage replication topology in the shared tree Implementation of ticket: https://fedorahosted.org/freeipa/ticket/4302 Design page: http://www.freeipa.org/page/V4/Manage_replication_topology Reviewed-By: Thierry Bordaz <tbordaz@redhat.com>
2015-05-20 10:28:39 -05:00
70topology.ldif \
idviews: Add necessary schema for the ID views Part of: https://fedorahosted.org/freeipa/ticket/3979 Reviewed-By: Petr Viktorin <pviktori@redhat.com> Reviewed-By: Petr Vobornik <pvoborni@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2014-07-31 04:57:53 -05:00
71idviews.ldif \
Add Domain Level feature https://fedorahosted.org/freeipa/ticket/5018 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2015-05-14 03:49:55 -05:00
72domainlevels.ldif \
Support for Certificate Identity Mapping See design http://www.freeipa.org/page/V4/Certificate_Identity_Mapping https://fedorahosted.org/freeipa/ticket/6542 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: David Kupka <dkupka@redhat.com>
2016-12-20 09:21:58 -06:00
73certmap.ldif \
Use Anonymous user to obtain FAST armor ccache The anonymous user allows the framework to obtain an armor ccache without relying on usable credentials, either via a keytab or a pkinit and public certificates. This will be needed once the HTTP keytab is moved away for privilege separation. https://fedorahosted.org/freeipa/ticket/5959 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2016-12-02 05:48:35 -06:00
anon-princ-aci.ldif \
merge initial radius work
2007-11-03 11:22:20 -05:00
bootstrap-template.ldif \
topology: manage ca replication agreements Configure IPA so that topology plugin will manage also CA replication agreements. upgrades if CA is congigured: - ipaca suffix is added to cn=topology,cn=ipa,cn=etc,$SUFFIX - ipaReplTopoManagedSuffix: o=ipaca is added to master entry - binddngroup is added to o=ipaca replica entry Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-07-15 04:17:14 -05:00
ca-topology.uldif \
Add ipa-custodia service Add a customized Custodia daemon and enable it after installation. Generates server keys and loads them in LDAP autonomously on install or update. Provides client code classes too. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-05-08 12:39:29 -05:00
custodia.conf.template \
merge initial radius work
2007-11-03 11:22:20 -05:00
default-aci.ldif \
Create default HBAC rule allowing any user to access any host from any host This is to make initial installation and testing easier. Use the --no_hbac_allow option on the command-line to disable this when doing an install. To remove it from a running server do: ipa hbac-del allow_all
2010-05-04 14:24:54 -05:00
default-hbac.ldif \
ipa-adtrust-install: create fallback group with ldif file Currently the framework is used to add the group but we want to avoid that users are added explicitly to the group by removing the objectclasses groupofnames, ipausergroup and nestedgroup and we want to use a name with spaces in it. Both it not easy possible with the framework, a LDIF file is used instead to create the group. Fixes https://fedorahosted.org/freeipa/ticket/3147
2012-10-08 03:44:07 -05:00
default-smb-group.ldif \
idviews: Add Default Trust View as part of adtrustinstall Add a Default Trust View, which is used by SSSD as default mapping for AD users. Part of: https://fedorahosted.org/freeipa/ticket/3979 Reviewed-By: Petr Viktorin <pviktori@redhat.com> Reviewed-By: Petr Vobornik <pvoborni@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2014-09-22 05:19:26 -05:00
default-trust-view.ldif \
Make --setup-dns work on replica installation The ipa-replica-install script will setup the DNS if user specifies the --setup-dns option. It will only add the zone into LDAP if the cn=dns,$SUFFIX container doesn't exist. For now, however, we do not add the records.
2009-06-26 12:37:49 -05:00
delegation.ldif \
Add replication related acis to all replicas Fixes: https://fedorahosted.org/freeipa/ticket/617
2010-12-11 10:02:08 -06:00
replica-acis.ldif \
ds: ignore time skew during initial replication step Initial replica creation can go with ignoring time skew checks. We should, however, force time skew checks during normal operation. Fixes https://pagure.io/freeipa/issue/7211 Reviewed-By: Rob Crittenden <rcritten@redhat.com>
2017-10-16 05:32:38 -05:00
replica-prevent-time-skew.ldif \
Autotune directory server to use a greater number of files This changes the system limits for the dirsrv user as well as configuring DS to allow by default 8192 max files and 64 reserved files (for replication indexes, etc..). Fixes: https://fedorahosted.org/freeipa/ticket/464
2010-11-16 11:45:21 -06:00
ds-nfiles.ldif \
Use LDAP instead of flat file for zone storage
2009-05-12 08:20:24 -05:00
dns.ldif \
DNSSEC: DNS key synchronization daemon Tickets: https://fedorahosted.org/freeipa/ticket/3801 https://fedorahosted.org/freeipa/ticket/4417 Design: https://fedorahosted.org/bind-dyndb-ldap/wiki/BIND9/Design/DNSSEC Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: David Kupka <dkupka@redhat.com>
2014-10-16 08:43:29 -05:00
dnssec.ldif \
Add Domain Level feature https://fedorahosted.org/freeipa/ticket/5018 Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2015-05-14 03:49:55 -05:00
domainlevel.ldif \
merge initial radius work
2007-11-03 11:22:20 -05:00
kerberos.ldif \
Fix misspelling of the word indices.
2008-01-25 12:29:49 -06:00
indices.ldif \
merge initial radius work
2007-11-03 11:22:20 -05:00
bind.named.conf.template \
certmap.conf.template \
kdc.conf.template \
Add support for configuring KDC certs for PKINIT This patch adds support only for the selfsign case. Replica support is also still missing at this stage.
2010-10-29 15:23:21 -05:00
kdc_extensions.template \
kdc_req.conf.template \
merge initial radius work
2007-11-03 11:22:20 -05:00
krb5.conf.template \
krb5.ini.template \
krb.con.template \
krbrealm.con.template \
Add ipa-adtrust-install utility https://fedorahosted.org/freeipa/ticket/1619
2011-09-07 03:17:12 -05:00
smb.conf.template \
Add trust management for Active Directory trusts
2012-02-28 05:24:41 -06:00
smb.conf.empty \
Introduce service base class and clean up ipa-server-install 1) Add a base class for all of the instance objects. 2) Normalize usage of logging. 3) General cleanups of ipa-server-install. 4) Make better use of httpinstance. 5) Add webguiinstance. 6) Improve progress reporting during installation. Works Here (TM), but it would be nice to get someone else to test since this moves code around a bit.
0000-12-31 18:09:24 -05:50
referint-conf.ldif \
id ranges: change DNA configuration Change the way we specify the id ranges to force uid and gid ranges to always be the same. Add option to specify a maximum id. Change DNA configuration to use shared ranges so that masters and replicas can actually share the same overall range in a safe way. Configure replicas so that their default range is depleted. This will force them to fetch a range portion from the master on the first install. fixes: https://fedorahosted.org/freeipa/ticket/198
2010-11-11 17:15:28 -06:00
dna.ldif \
Add posix auto gen for single master case
2007-11-06 17:57:15 -06:00
master-entry.ldif \
Initialize memberof patch from Pete Rowley.
0000-12-31 18:09:24 -05:50
memberof-task.ldif \
No longer use the IPA-specific memberof plugin. Use the DS-supplied one.
2009-10-09 16:07:03 -05:00
memberof-conf.ldif \
New tool to enable/disable DS plugin to act as NIS server
2009-05-07 09:51:44 -05:00
nis.uldif \
Upgrade: Fix upgrade of NIS Server configuration Former upgrade file always created the NIS Server container, that caused the ipa-nis-manage did not set all required NIS maps. Default creation of container has been removed. Updating of NIS Server configuration and NIS maps is done only if the NIS Server container exists. https://fedorahosted.org/freeipa/ticket/5507 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
2016-01-06 12:47:22 -06:00
nis-update.uldif \
DNSSEC: opendnssec services Tickets: https://fedorahosted.org/freeipa/ticket/3801 https://fedorahosted.org/freeipa/ticket/4417 Design: https://fedorahosted.org/bind-dyndb-ldap/wiki/BIND9/Design/DNSSEC Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: David Kupka <dkupka@redhat.com>
2014-10-16 09:03:46 -05:00
opendnssec_conf.template \
opendnssec_kasp.template \
Make sure KrbPrincipalName is unique server-wide
2008-02-21 21:31:16 -06:00
unique-attributes.ldif \
Install the ldapi ldif file
2009-08-28 07:46:54 -05:00
ldapi.ldif \
Run ipaserver under mod_wsgi
2010-02-24 12:29:23 -06:00
wsgi.py \
Move Managed Entries into their own container in the replicated space. Repoint cn=Managed Entries,cn=plugins,cn=config in common_setup Create: cn=Managed Entries,cn=etc,$SUFFIX Create: cn=Definitions,cn=Managed Entries,cn=etc,$SUFFIX Create: cn=Templates,cn=Managed Entries,cn=etc,$SUFFIX Create method for dynamically migrating any and all custom Managed Entries from the cn=config space into the new container. Separate the connection creation during update so that a restart can be performed to initialize changes before performing a delete. Add wait_for_open_socket() method in installutils https://fedorahosted.org/freeipa/ticket/1708
2011-09-08 14:07:26 -05:00
repoint-managed-entries.ldif \
managed-entries.ldif \
install part - manage topology in shared tree https://fedorahosted.org/freeipa/ticket/4302 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2015-05-20 10:12:04 -05:00
topology-entries.ldif \
Add support for User-Private Groups This uses a new 389-ds plugin, Managed Entries, to automatically create a group entry when a user is created. The DNA plugin ensures that the group has a gidNumber that matches the users uidNumber. When the user is removed the group is automatically removed as well. If the managed entries plugin is not available or if a specific, separate range for gidNumber is passed in at install time then User-Private Groups will not be configured. The code checking for the Managed Entries plugin may be removed at some point. This is there because this plugin is only available in a 389-ds alpha release currently (1.2.6-a4).
2010-06-25 15:14:46 -05:00
user_private_groups.ldif \
managed entry hostgroup netgroup support https://fedorahosted.org/freeipa/ticket/543
2010-12-10 17:21:39 -06:00
host_nis_groups.ldif \
DNSSEC: DNS key synchronization daemon Tickets: https://fedorahosted.org/freeipa/ticket/3801 https://fedorahosted.org/freeipa/ticket/4417 Design: https://fedorahosted.org/bind-dyndb-ldap/wiki/BIND9/Design/DNSSEC Reviewed-By: Jan Cholasta <jcholast@redhat.com> Reviewed-By: David Kupka <dkupka@redhat.com>
2014-10-16 08:43:29 -05:00
uuid.ldif \
ipa-modrdn: Enable plugin to handle krbPrincipalName on renames
2010-10-22 15:03:18 -05:00
modrdn-krbprinc.ldif \
Enable EntryUSN plugin by default, with global scope This will allow clients to use entryusn values to track what changed in the directory regardles of replication delays. Fixes: https://fedorahosted.org/freeipa/ticket/526
2010-11-23 09:35:49 -06:00
entryusn.ldif \
Allow SASL/EXTERNAL authentication for the root user This gives the root user low privileges so that when anonymous searches are denied the init scripts can still search the directory via ldapi to get the list of serevices to start. Fixes: https://fedorahosted.org/freeipa/ticket/795
2011-01-19 14:17:25 -06:00
root-autobind.ldif \
Create default disabled sudo bind user Read access is denied to the sudo container for unauthenticated users. This shared user can be used to provide authenticated access to the sudo information. https://fedorahosted.org/freeipa/ticket/998
2011-02-23 13:37:07 -06:00
sudobind.ldif \
34 Create FreeIPA CLI Plugin for the 389 Auto Membership plugin Added new container in etc to hold the automembership configs. Modified constants to point to the new container Modified dsinstance to create the container Created automember.py to add the new commands Added xmlrpc test to verify functionality Added minor fix to user.py for constant behavior between memberof and automember https://fedorahosted.org/freeipa/ticket/1272
2011-08-30 19:48:15 -05:00
automember.ldif \
replica-automember.ldif \
Enable SASL mapping fallback. Assign a default priority of 10 to our SASL mappings. https://fedorahosted.org/freeipa/ticket/3330
2013-03-22 05:15:51 -05:00
sasl-mapping-fallback.ldif \
Fix nsslapdPlugin object class after initial replication. This is a workaround for <https://fedorahosted.org/389/ticket/47490>. https://fedorahosted.org/freeipa/ticket/3915
2013-09-09 03:15:11 -05:00
schema-update.ldif \
install: support KRA update https://fedorahosted.org/freeipa/ticket/5250 Reviewed-By: Petr Vobornik <pvoborni@redhat.com>
2015-09-14 00:56:44 -05:00
vault.ldif \
Provide Kerberos over HTTP (MS-KKDCP) Add integration of python-kdcproxy into FreeIPA to support the MS Kerberos KDC proxy protocol (MS-KKDCP), to allow KDC and KPASSWD client requests over HTTP and HTTPS. - freeipa-server now depends on python-kdcproxy >= 0.3. All kdcproxy dependencies are already satisfied. - The service's state is configured in cn=KDC,cn=$FQDN,cn=masters,cn=ipa, cn=etc,$SUFFIX. It's enabled, when ipaConfigString=kdcProxyEnabled is present. - The installers and update create a new Apache config file /etc/ipa/kdcproxy/ipa-kdc-proxy.conf that mounts a WSGI app on /KdcProxy. The app is run inside its own WSGI daemon group with a different uid and gid than the webui. - A ExecStartPre script in httpd.service symlinks the config file to /etc/httpd/conf.d/ iff ipaConfigString=kdcProxyEnabled is present. - The httpd.service also sets KDCPROXY_CONFIG=/etc/ipa/kdcproxy.conf, so that an existing config is not used. SetEnv from Apache config does not work here, because it doesn't set an OS env var. - python-kdcproxy is configured to *not* use DNS SRV lookups. The location of KDC and KPASSWD servers are read from /etc/krb5.conf. - The state of the service can be modified with two ldif files for ipa-ldap-updater. No CLI script is offered yet. https://www.freeipa.org/page/V4/KDC_Proxy https://fedorahosted.org/freeipa/ticket/4801 Reviewed-By: Nathaniel McCallum <npmccallum@redhat.com> Reviewed-By: Simo Sorce <ssorce@redhat.com>
2015-06-23 10:01:00 -05:00
kdcproxy-enable.uldif \
kdcproxy-disable.uldif \
Change session handling Stop using memcache, use mod_auth_gssapi filesystem based ccaches. Remove custom session handling, use mod_auth_gssapi and mod_session to establish and keep a session cookie. Add loopback to mod_auth_gssapi to do form absed auth and pass back a valid session cookie. And now that we do not remove ccaches files to move them to the memcache, we can avoid the risk of pollutting the filesystem by keeping a common ccache file for all instances of the same user. https://fedorahosted.org/freeipa/ticket/5959 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2016-08-19 08:23:55 -05:00
ipa-httpd.conf.template \
Replace wsgi package conflict with config file Instead of a package conflict, freeIPA now uses an Apache config file to enforce the correct wsgi module. The workaround only applies to Fedora since it is the only platform that permits parallel installation of Python 2 and Python 3 mod_wsgi modules. RHEL 7 has only Python 2 and Debian doesn't permit installation of both variants. See: https://pagure.io/freeipa/issue/7161 Fixes: https://pagure.io/freeipa/issue/7394 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
2018-02-06 03:05:49 -06:00
ipa-httpd-wsgi.conf.template \
Change session handling Stop using memcache, use mod_auth_gssapi filesystem based ccaches. Remove custom session handling, use mod_auth_gssapi and mod_session to establish and keep a session cookie. Add loopback to mod_auth_gssapi to do form absed auth and pass back a valid session cookie. And now that we do not remove ccaches files to move them to the memcache, we can avoid the risk of pollutting the filesystem by keeping a common ccache file for all instances of the same user. https://fedorahosted.org/freeipa/ticket/5959 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2016-08-19 08:23:55 -05:00
gssapi.login \
Configure HTTPD to work via Gss-Proxy https://fedorahosted.org/freeipa/ticket/4189 https://fedorahosted.org/freeipa/ticket/5959 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2016-11-29 10:10:22 -06:00
gssproxy.conf.template \
Replace hard-coded kdcproxy path with WSGI script mod_wsgi has no way to import a WSGI module by dotted module name. A new kdcproxy.wsgi script is used to import kdcproxy from whatever Python version mod_wsgi is compiled against. This will simplify moving FreeIPA to Python 3 and solves an import problem on Debian. Resolves: https://pagure.io/freeipa/issue/6834 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Martin Basti <mbasti@redhat.com>
2017-03-29 10:58:47 -05:00
kdcproxy.wsgi \
install: introduce generic Kerberos Augeas lens Introduce new IPAKrb5 lens to handle krb5.conf and kdc.conf changes using Augeas. The stock Krb5 lens does not work on our krb5.conf and kdc.conf. https://pagure.io/freeipa/issue/6831 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com> Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
2017-05-18 02:57:40 -05:00
ipakrb5.aug \
Move config templates from install/conf to install/share Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
2017-03-15 12:28:07 -05:00
ipa.conf.template \
ipa-kdc-proxy.conf.template \
ipa-pki-proxy.conf.template \
ipa-rewrite.conf.template \
Change session handling Stop using memcache, use mod_auth_gssapi filesystem based ccaches. Remove custom session handling, use mod_auth_gssapi and mod_session to establish and keep a session cookie. Add loopback to mod_auth_gssapi to do form absed auth and pass back a valid session cookie. And now that we do not remove ccaches files to move them to the memcache, we can avoid the risk of pollutting the filesystem by keeping a common ccache file for all instances of the same user. https://fedorahosted.org/freeipa/ticket/5959 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2016-08-19 08:23:55 -05:00
$(NULL)
Autotool ipa-server - patch from William Jon McCann <mccann@jhu.edu>.
0000-12-31 18:09:24 -05:50
Build: fix KDC proxy installation and remove unused kdcproxy.conf The only useful file is /etc/ipa/kdcproxy/kdcproxy.conf so I've removed the other copy of the file in /usr. https://fedorahosted.org/freeipa/ticket/6418 Reviewed-By: Martin Basti <mbasti@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
2016-11-04 08:00:01 -05:00
kdcproxyconfdir = $(IPA_SYSCONF_DIR)/kdcproxy
dist_kdcproxyconf_DATA = \
kdcproxy.conf
Reference in New Issue Copy Permalink