IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2025-02-25 18:55:28 -06:00
Code Issues Packages Projects Releases Wiki Activity

ipa-pki-proxy: allow certificate and password authentication

Browse Source 
ipa-replica-install --setup-ca is failing because the security
domain login attempts password authentication, but the current
ipa-pki-proxy requires certificate authentication.

Set NSSVerifyClient optional to allow both certificate and password
authentication to work.

Reviewed-By: Martin Basti <mbasti@redhat.com>
This commit is contained in:
Fraser Tweedale 2015-06-05 05:02:58 -04:00 committed by Petr Vobornik
parent 8b3bc99a73
commit 355b6d416d
1 changed files with 10 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
install/conf/ipa-pki-proxy.conf
View File

@ -1,4 +1,4 @@
# VERSION 6 - DO NOT REMOVE THIS LINE
# VERSION 7 - DO NOT REMOVE THIS LINE
ProxyRequests Off
@ -27,9 +27,16 @@ ProxyRequests Off
</LocationMatch>
# matches for REST API
<LocationMatch "^/ca/rest/account/login|^/ca/rest/account/logout|^/ca/rest/profiles">
<LocationMatch "^/ca/rest/account/login|^/ca/rest/account/logout">
NSSOptions +StdEnvVars +ExportCertData +StrictRequire +OptRenegotiate
NSSVerifyClient require
NSSVerifyClient optional
ProxyPassMatch ajp://localhost:$DOGTAG_PORT
ProxyPassReverse ajp://localhost:$DOGTAG_PORT
</LocationMatch>
<LocationMatch "^/ca/rest/profiles">
NSSOptions +StdEnvVars +ExportCertData +StrictRequire +OptRenegotiate
NSSVerifyClient none
ProxyPassMatch ajp://localhost:$DOGTAG_PORT
ProxyPassReverse ajp://localhost:$DOGTAG_PORT
</LocationMatch>