IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2025-02-25 18:55:28 -06:00
Code Issues Packages Projects Releases Wiki Activity

Allow Apache to answer to ipa-ca requests without a redirect

Browse Source 
Any request other than the FQDN is redirected with a permanent
move (301). Allowing ipa-ca as a valid name saves a round-trip.

This is only allowed on /ca, /kra, /pki, /acme and /ipa/crl.

https://pagure.io/freeipa/issue/8595

Signed-off-by: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
This commit is contained in:
Rob Crittenden
2020-11-24 16:15:17 -05:00
committed by Alexander Bokovoy
parent 6816de0892
commit e731b2725a
1 changed files with 7 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
install/share/ipa-rewrite.conf.template
View File

@@ -1,4 +1,4 @@
# VERSION 6 - DO NOT REMOVE THIS LINE
# VERSION 7 - DO NOT REMOVE THIS LINE
RewriteEngine on
@@ -9,6 +9,7 @@ ${AUTOREDIR}RewriteRule ^/$$ https://$FQDN/ipa/ui [L,NC,R=301]
# Redirect to the fully-qualified hostname. Not redirecting to secure
# port so configuration files can be retrieved without requiring SSL.
RewriteCond %{HTTP_HOST} !^$FQDN$$ [NC]
RewriteCond %{HTTP_HOST} !^ipa-ca.$DOMAIN$$ [NC]
RewriteRule ^/ipa/(.*) http://$FQDN/ipa/$$1 [L,R=301]
# Redirect to the secure port if not displaying an error or retrieving
@@ -18,5 +19,10 @@ RewriteCond %{REQUEST_URI} !^/ipa/(errors|config|crl)
RewriteCond %{REQUEST_URI} !^/ipa/[^\?]+(\.js|\.css|\.png|\.gif|\.ico|\.woff|\.svg|\.ttf|\.eot)$$
RewriteRule ^/ipa/(.*) https://$FQDN/ipa/$$1 [L,R=301,NC]
RewriteCond %{HTTP_HOST} ^ipa-ca.$DOMAIN$$ [NC]
RewriteCond %{REQUEST_URI} !^/ipa/crl
RewriteCond %{REQUEST_URI} !^/(ca|kra|pki|acme)
RewriteRule ^/(.*) https://$FQDN/$$1 [L,R=301]
# Rewrite for plugin index, make it like it's a static file
RewriteRule ^/ipa/ui/js/freeipa/plugins.js$$ /ipa/wsgi/plugins.py [PT]