IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2026-09-03 20:52:56 -05:00
Code Issues Packages Projects Releases Wiki Activity

Re-root the IPA web UI to /ipa and the XML-RPC interface to /ipaxml.

Browse Source 
438021
This commit is contained in:
Rob Crittenden
2008-03-24 15:54:55 -04:00
parent 0b7117596d
commit 4c288e653a
6 changed files with 34 additions and 31 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ipa-python/rpcclient.py
+1 -1
View File
@@ -37,7 +37,7 @@ class RPCClient:
def server_url(self, server):
"""Build the XML-RPC server URL from our configuration"""
return "https://" + server + "/ipa"
return "https://" + server + "/ipaxml"
def setup_server(self):
"""Create our XML-RPC server connection using kerberos
ipa-server/ipa-gui/ipa_webgui.cfg
+2 -2
View File
@@ -29,7 +29,7 @@ server.thread_pool = 10
# if this is part of a larger site, you can set the path
# to the TurboGears instance here
# server.webpath=""
server.webpath="/ipa"
# Set to True if you are deploying your App behind a proxy
# e.g. Apache using mod_proxy
@@ -58,7 +58,7 @@ session_filter.storage_path='/var/cache/ipa/sessions'
# Listen only on the local interface so all requests go through
# Apache/mod_auth_kerb/mod_proxy.
server.server_port = 8080
server.socket_port = 8080
server.socket_host="127.0.0.1"
# LOGGING
ipa-server/ipa-gui/ipagui/proxyprovider.py
+11 -4
View File
@@ -25,6 +25,7 @@ import ipa.config
import ipa.group
import ipa.user
import ldap
import krbV
log = logging.getLogger("turbogears.identity")
@@ -132,7 +133,7 @@ class ProxyIdentityProvider(SqlObjectIdentityProvider):
user = IPA_User(user_name)
log.debug( "validate_identity %s" % user_name)
return ProxyIdentity(visit_key, user)
except:
except Exception, e:
# Something went wrong in fetching the user. Set to
# anonymous which will deny access.
return ProxyIdentity( None )
@@ -143,12 +144,18 @@ class ProxyIdentityProvider(SqlObjectIdentityProvider):
def load_identity(self, visit_key):
try:
user_name= cherrypy.request.headers['X-FORWARDED-USER']
os.environ["KRB5CCNAME"] = cherrypy.request.headers['X-FORWARDED-KEYTAB']
# user_name = "test@FREEIPA.ORG"
# os.environ["KRB5CCNAME"] = "FILE:/tmp/krb5cc_500"
ccache = krbV.CCache(cherrypy.request.headers['X-FORWARDED-KEYTAB'])
user_name = ccache.principal().name
# user_name = "test@FREEIPA.ORG"
# os.environ["KRB5CCNAME"] = "FILE:/tmp/krb5cc_500"
except KeyError:
return None
except AttributeError:
return None
except krbV.Krb5Error:
return None
set_login_attempted( True )
return self.validate_identity( user_name, None, visit_key )
ipa-server/ipa-gui/ipagui/templates/master.kid
+6 -6
View File
@@ -24,13 +24,13 @@
<title py:replace="''">Your title goes here</title>
<meta py:replace="item[:]"/>
<style type="text/css" media="all">
@import "${tg.url('/static/css/style_platform.css')}";
@import "${tg.url('/static/css/style_platform-objects.css')}";
@import "${tg.url('/static/css/style_freeipa.css')}";
@import "/static/css/style_platform.css";
@import "/static/css/style_platform-objects.css";
@import "/static/css/style_freeipa.css";
</style>
<script type="text/javascript" charset="utf-8" src="${tg.url('/static/javascript/prototype.js')}"></script>
<script type="text/javascript" charset="utf-8" src="${tg.url('/static/javascript/scriptaculous.js?load=effects')}"></script>
<script type="text/javascript" charset="utf-8" src="${tg.url('/static/javascript/ipautil.js')}"></script>
<script type="text/javascript" charset="utf-8" src="/static/javascript/prototype.js"></script>
<script type="text/javascript" charset="utf-8" src="/static/javascript/scriptaculous.js?load=effects"></script>
<script type="text/javascript" charset="utf-8" src="/static/javascript/ipautil.js"></script>
</head>
<body py:match="item.tag=='{http://www.w3.org/1999/xhtml}body'" py:attrs="item.items()">
ipa-server/xmlrpc-server/ipa-rewrite.conf
+5
View File
@@ -1,5 +1,10 @@
RewriteEngine on
# By default forward all requests to /ipa. If you don't want IPA
# to be the default on your web server comment this line out. You will
# need to modify ipa_webgui.cfg as well.
RewriteRule ^/$$ https://$FQDN/ipa [L,NC,R=301]
# Redirect to the fully-qualified hostname. Not redirecting to secure
# port so configuration files can be retrieved without requiring SSL.
RewriteCond %{HTTP_HOST} !^$FQDN$$ [NC]
ipa-server/xmlrpc-server/ipa.conf
+9 -18
View File
@@ -22,36 +22,27 @@ AddType application/java-archive jar
Order deny,allow
Allow from all
# We create a subrequest to find REMOTE_USER. Don't do this for every
# subrequest too (slow and huge logs result)
RewriteCond %{IS_SUBREQ}% false
RewriteRule .* - [E=RU:%{LA-U:REMOTE_USER}]
RequestHeader set X-Forwarded-User %{RU}e
RequestHeader set X-Forwarded-Keytab %{KRB5CCNAME}e
# RequestHeader unset Authorization
</Proxy>
# The URI's with a trailing ! are those that aren't handled by the proxy
ProxyPass /cgi-bin !
ProxyPass /errors !
ProxyPass /config !
ProxyPass /ipa !
#ProxyPass /ipatest !
ProxyPass / http://localhost:8080/
ProxyPassReverse /cgi-bin !
ProxyPassReverse /errors !
ProxyPassReverse /config !
ProxyPassReverse /ipa !
#ProxyPassReverse /ipatest !
ProxyPassReverse / http://localhost:8080/
ProxyPass /ipa http://localhost:8080/ipa
ProxyPassReverse /ipa http://localhost:8080/ipa
# Configure the XML-RPC service
Alias /ipaxml "/usr/share/ipa/ipaserver/XMLRPC"
Alias /ipa "/usr/share/ipa/ipaserver/XMLRPC"
# This is where we redirect on failed auth
Alias /errors "/usr/share/ipa/html"
# For the MIT Windows config files
Alias /config "/usr/share/ipa/html"
# So we don't have to hardcode a path into the CSS
Alias /static "/usr/share/ipa/ipagui/static"
<Directory "/usr/share/ipa/ipaserver">
AuthType Kerberos
AuthName "Kerberos Login"