IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2025-02-25 18:55:28 -06:00
Code Issues Packages Projects Releases Wiki Activity

Configure s4u2proxy during installation.

Browse Source 
This creates a new container, cn=s4u2proxy,cn=etc,$SUFFIX

Within that container we control which services are allowed to
delegate tickets for other services. Right now that is limited
from the IPA HTTP to ldap services.

Requires a version of mod_auth_kerb that supports s4u2proxy

https://fedorahosted.org/freeipa/ticket/1098
This commit is contained in:
Rob Crittenden
2012-01-10 22:39:26 -05:00
parent 74857a8ee4
commit c08296adff
6 changed files with 51 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
install/conf/ipa.conf
View File

@@ -1,5 +1,5 @@
#
# VERSION 2 - DO NOT REMOVE THIS LINE
# VERSION 3 - DO NOT REMOVE THIS LINE
#
# LoadModule auth_kerb_module modules/mod_auth_kerb.so
@@ -42,6 +42,7 @@ WSGIScriptReloading Off
SetHandler None
</Location>
KrbConstrainedDelegationLock ipa
# Protect /ipa with Kerberos
<Location "/ipa">
@@ -53,6 +54,7 @@ WSGIScriptReloading Off
KrbAuthRealms $REALM
Krb5KeyTab /etc/httpd/conf/ipa.keytab
KrbSaveCredentials on
KrbConstrainedDelegation on
Require valid-user
ErrorDocument 401 /ipa/errors/unauthorized.html
</Location>