Go to file
Simo Sorce 4fd89833ee Add a new user to run the framework code
Add the apache user the ipawebui group.
Make the ccaches directory owned by the ipawebui group and make
mod_auth_gssapi write the ccache files as r/w by the apache user and
the ipawebui group.
Fix tmpfiles creation ownership and permissions to allow the user to
access ccaches files.
The webui framework now works as a separate user than apache, so the certs
used to access the dogtag instance need to be usable by this new user as well.
Both apache and the webui user are in the ipawebui group, so use that.

https://fedorahosted.org/freeipa/ticket/5959

Signed-off-by: Simo Sorce <simo@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2017-02-15 07:13:37 +01:00
asn1 Build: fix distribution of asn1/asn1c files 2016-11-09 13:08:32 +01:00
client Clarify meaning of --domain and --realm in installers 2017-01-05 09:47:25 +01:00
contrib Build: integrate contrib directory into build system 2016-11-09 13:08:32 +01:00
daemons Clean / ignore make check artefact 2017-01-18 09:19:15 +01:00
doc Add main guards to a couple of Python scripts 2016-11-24 16:35:43 +01:00
init Configure HTTPD to work via Gss-Proxy 2017-02-15 07:13:37 +01:00
install Add a new user to run the framework code 2017-02-15 07:13:37 +01:00
ipaclient Separate RA cert store from the HTTP cert store 2017-02-15 07:13:37 +01:00
ipalib Add a new user to run the framework code 2017-02-15 07:13:37 +01:00
ipaplatform Add a new user to run the framework code 2017-02-15 07:13:37 +01:00
ipapython Simplify NSSDatabase password file handling 2017-02-15 07:13:37 +01:00
ipaserver Add a new user to run the framework code 2017-02-15 07:13:37 +01:00
ipatests Separate RA cert store from the HTTP cert store 2017-02-15 07:13:37 +01:00
po Lowered the version of gettext 2016-12-09 14:01:06 +01:00
util Build: transform util directory to libutil convenience library 2016-10-24 13:30:12 +02:00
.git-commit-template git: Add commit template 2016-11-14 18:15:04 +01:00
.gitignore Clean / ignore make check artefact 2017-01-18 09:19:15 +01:00
.mailmap Update Contributors.txt 2016-06-24 12:49:39 +02:00
.test_runner_config.yaml Travis CI: Upload the logs from failed jobs to transfer.sh 2017-02-09 13:26:07 +01:00
.travis_run_task.sh Travis CI: actually return non-zero exit status when the test job fails 2017-01-09 15:22:51 +01:00
.travis.yml Travis CI: Upload the logs from failed jobs to transfer.sh 2017-02-09 13:26:07 +01:00
ACI.txt DNS: Support URI resource record type 2016-10-11 16:48:47 +02:00
API.txt Allow nsaccountlock to be searched in user-find command 2017-02-14 17:09:45 +01:00
autogen.sh build tweaks - use automake's foreign mode, avoid creating empty files to satisfy gnu mode - run autoreconf -f to ensure that everything matches 2010-11-29 11:39:55 -05:00
BUILD.txt Build: remove obsolete instructions about BuildRequires from BUILD.txt 2016-11-09 13:08:32 +01:00
configure.ac Generate tmpfiles config at install time 2017-02-15 07:13:37 +01:00
Contributors.txt ipatests: nested netgroups (intg) 2017-02-07 11:56:14 +01:00
COPYING Change FreeIPA license to GPLv3+ 2010-12-20 17:19:53 -05:00
COPYING.openssl Add a clear OpenSSL exception. 2015-02-23 16:25:54 +01:00
freeipa.spec.in Configure HTTPD to work via Gss-Proxy 2017-02-15 07:13:37 +01:00
ignore_import_errors.py makeapi, makeaci: do not fail on missing imports 2016-10-24 14:11:08 +02:00
ipa Revert "Switch /usr/bin/ipa to Python 3" 2016-06-14 13:07:04 +02:00
ipasetup.py.in Py3: Fix ToASCII method 2017-01-06 12:48:10 +01:00
lite-server.py Python3 pylint fixes 2016-11-25 16:18:22 +01:00
make-doc Make an ipa-tests package 2013-06-17 19:22:50 +02:00
make-test Use pytest conftest.py and drop pytest.ini 2017-01-05 17:37:02 +01:00
makeaci makeapi, makeaci: do not fail on missing imports 2016-10-24 14:11:08 +02:00
makeapi Python3 pylint fixes 2016-11-25 16:18:22 +01:00
Makefile.am Use pytest conftest.py and drop pytest.ini 2017-01-05 17:37:02 +01:00
Makefile.python.am Build: properly integrate ipasetup.py into build system 2016-11-29 15:28:24 +01:00
makerpms.sh Build: update makerpms.sh to use same paths as rpmbuild 2016-11-16 09:12:07 +01:00
pylint_plugins.py Change session handling 2017-02-15 07:13:37 +01:00
pylintrc Pylint: whitelist packages with extension modules 2016-11-22 17:37:39 +01:00
README Update README and BUILD 2014-02-12 14:04:07 +01:00
VERSION.m4 Allow nsaccountlock to be searched in user-find command 2017-02-14 17:09:45 +01:00
zanata.xml Zanata: exlude testing ipa.pot file 2016-11-21 14:47:47 +01:00

                               IPA Server

  Overview
  --------

  FreeIPA allows Linux administrators to centrally manage identity,
  authentication and access control aspects of Linux and UNIX systems
  by providing simple to install and use command line and web based
  managment tools.
  FreeIPA is built on top of well known Open Source components and standard
  protocols with a very strong focus on ease of management and automation
  of installation and configuration tasks.
  FreeIPA can seamlessly integrate into an Active Directory environment via
  cross-realm Kerberos trust or user synchronization.

  Benefits
  --------

  FreeIPA:
  * Allows all your users to access all the machines with the same credentials
    and security settings
  * Allows users to access personal files transparently from any machine in
    an authenticated and secure way
  * Uses an advanced grouping mechanism to restrict network access to services
    and files only to specific users
  * Allows central management of security mechanisms like passwords,
    SSH Public Keys, SUDO rules, Keytabs, Access Control Rules
  * Enables delegation of selected administrative tasks to other power users
  * Integrates into Active Directory environments

  Components
  ----------

  The FreeIPA project provides unified installation and management
  tools for the following components:

  * LDAP Server - based on the 389 project (LDAP)
    http://directory.fedoraproject.org/wiki/Main_Page

  * KDC - based on MIT Kerberos implementation
    http://k5wiki.kerberos.org/wiki/Main_Page

  * PKI based on Dogtag project
    http://pki.fedoraproject.org/wiki/PKI_Main_Page

  * Samba libraries for Active Directory integration
    http://www.samba.org/

  * DNS Server based on BIND and the Bind-DynDB-LDAP plugin
    https://www.isc.org/software/bind
    https://fedorahosted.org/bind-dyndb-ldap


  Project Website
  ---------------

  Releases, announcements and other information can be found on the IPA
  server project page at <http://www.freeipa.org/>.

  Documentation
  -------------

  The most up-to-date documentation can be found at
  <http://freeipa.org/page/Documentation>.

  Quick Start
  -----------

  To get started quickly, start here:
  <http://www.freeipa.org/page/Quick_Start_Guide>

  Licensing
  ---------

  Please see the file called COPYING.

  Contacts
  --------

     * If you want to be informed about new code releases, bug fixes,
       security fixes, general news and information about the IPA server
       subscribe to the freeipa-announce mailing list at
       <https://www.redhat.com/mailman/listinfo/freeipa-interest/>.

     * If you have a bug report please submit it at:
       <https://bugzilla.redhat.com>

     * If you want to participate in actively developing IPA please
       subscribe to the freeipa-devel mailing list at
       <https://www.redhat.com/mailman/listinfo/freeipa-devel/> or join
       us in IRC at irc://irc.freenode.net/freeipa