mirror of
https://salsa.debian.org/freeipa-team/freeipa.git
synced 2026-10-25 22:50:12 -05:00
Alexander Bokovoy
c775de3c2b
Cockpit can use GSSAPI authentication and has pretty good definition of how to enable it: https://cockpit-project.org/guide/latest/sso.html. These instructions work on IPA clients but they cannot be used on IPA servers because IPA framework already owns HTTP/.. Kerberos service and its keytab. Luckily, there are two changes that need to be done to enable Cockpit single sign-on with GSSAPI on IPA servers: - create a symlink /etc/cockpit/krb5.keytab to /var/lib/ipa/gssproxy/http.keytab - add SELinux policy to allow cockpit_session_t to operate on /var/lib/ipa/gssproxy/http.keytab file For existing installation an upgrade process would restore SELinux context of the http.keytab file to the new value. Note that Cockpit documentation above also talks about Kerberos service modifications to enable delegation. These modifications should not be done for IPA servers' HTTP services, as these services are already enabled to handle delegation. Fixes: https://pagure.io/freeipa/issue/9675 Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
IPA SELinux policy
The ipa SELinux policy is used by IPA client and server. The
policy was forked off from Fedora upstream policy
at commit b1751347f4af99de8c88630e2f8d0a352d7f5937.
Some file locations are owned by other policies:
/var/lib/ipa/pki-ca/publish(/.*)?is owned by Dogtag PKI policy/usr/lib/ipa/certmonger(/.*)?is owned by certmonger policy/var/lib/ipa-client(/.*)?is owned by realmd policy