IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2025-02-25 18:55:28 -06:00
Code Issues Packages Projects Releases Wiki Activity

Simplify pki proxy conf

Browse Source 
``pkispawn`` is being modified to use PKI CLI for installation.

Add ``/pki/rest`` to proxied routes and simplify location matching with
a prefix regular expression.

Signed-off-by: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
This commit is contained in:
Christian Heimes 2020-05-04 15:17:33 +02:00
parent fefd1153d5
commit 19ea1b97a1
1 changed files with 3 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
install/share/ipa-pki-proxy.conf.template
View File

@ -1,4 +1,4 @@
# VERSION 14 - DO NOT REMOVE THIS LINE # VERSION 15 - DO NOT REMOVE THIS LINE
ProxyRequests Off ProxyRequests Off
@ -26,16 +26,8 @@ ProxyRequests Off
ProxyPassReverse ajp://localhost:$DOGTAG_PORT ProxyPassReverse ajp://localhost:$DOGTAG_PORT
</LocationMatch> </LocationMatch>
# matches for CA REST API # matches for REST API of CA, KRA, and PKI
<LocationMatch "^/ca/rest/account/login|^/ca/rest/account/logout|^/ca/rest/installer/installToken|^/ca/rest/securityDomain/domainInfo|^/ca/rest/securityDomain/installToken|^/ca/rest/profiles|^/ca/rest/authorities|^/ca/rest/certrequests|^/ca/rest/admin/kraconnector/remove|^/ca/rest/certs/search"> <LocationMatch "^/(ca|kra|pki)/rest/">
SSLOptions +StdEnvVars +ExportCertData +StrictRequire +OptRenegotiate
SSLVerifyClient optional
ProxyPassMatch ajp://localhost:$DOGTAG_PORT $DOGTAG_AJP_SECRET
ProxyPassReverse ajp://localhost:$DOGTAG_PORT
</LocationMatch>
# matches for KRA REST API
<LocationMatch "^/kra/rest/config/cert/transport|^/kra/rest/account|^/kra/rest/agent/keyrequests|^/kra/rest/agent/keys">
SSLOptions +StdEnvVars +ExportCertData +StrictRequire +OptRenegotiate SSLOptions +StdEnvVars +ExportCertData +StrictRequire +OptRenegotiate
SSLVerifyClient optional SSLVerifyClient optional
ProxyPassMatch ajp://localhost:$DOGTAG_PORT $DOGTAG_AJP_SECRET ProxyPassMatch ajp://localhost:$DOGTAG_PORT $DOGTAG_AJP_SECRET