mirror of
https://salsa.debian.org/freeipa-team/freeipa.git
synced 2024-12-28 01:41:14 -06:00
495da412f1
Add integration of python-kdcproxy into FreeIPA to support the MS Kerberos KDC proxy protocol (MS-KKDCP), to allow KDC and KPASSWD client requests over HTTP and HTTPS. - freeipa-server now depends on python-kdcproxy >= 0.3. All kdcproxy dependencies are already satisfied. - The service's state is configured in cn=KDC,cn=$FQDN,cn=masters,cn=ipa, cn=etc,$SUFFIX. It's enabled, when ipaConfigString=kdcProxyEnabled is present. - The installers and update create a new Apache config file /etc/ipa/kdcproxy/ipa-kdc-proxy.conf that mounts a WSGI app on /KdcProxy. The app is run inside its own WSGI daemon group with a different uid and gid than the webui. - A ExecStartPre script in httpd.service symlinks the config file to /etc/httpd/conf.d/ iff ipaConfigString=kdcProxyEnabled is present. - The httpd.service also sets KDCPROXY_CONFIG=/etc/ipa/kdcproxy.conf, so that an existing config is not used. SetEnv from Apache config does not work here, because it doesn't set an OS env var. - python-kdcproxy is configured to *not* use DNS SRV lookups. The location of KDC and KPASSWD servers are read from /etc/krb5.conf. - The state of the service can be modified with two ldif files for ipa-ldap-updater. No CLI script is offered yet. https://www.freeipa.org/page/V4/KDC_Proxy https://fedorahosted.org/freeipa/ticket/4801 Reviewed-By: Nathaniel McCallum <npmccallum@redhat.com> Reviewed-By: Simo Sorce <ssorce@redhat.com>
31 lines
1.1 KiB
Plaintext
31 lines
1.1 KiB
Plaintext
# Kerberos over HTTP / MS-KKDCP support (Kerberos KDC Proxy)
|
|
#
|
|
# The symlink from /etc/ipa/kdcproxy/ to /etc/httpd/conf.d/ is maintained
|
|
# by the ExecStartPre script /usr/libexec/ipa/ipa-httpd-kdcproxy in
|
|
# httpd.service. The service also sets the environment variable
|
|
# KDCPROXY_CONFIG to $KDCPROXY_CONFIG.
|
|
#
|
|
# Disable KDC Proxy on the current host:
|
|
# # ipa-ldap-updater /usr/share/ipa/kdcproxy-disable.uldif
|
|
# # systemctl restart httpd.service
|
|
#
|
|
# Enable KDC Proxy on the current host:
|
|
# # ipa-ldap-updater /usr/share/ipa/kdcproxy-enable.uldif
|
|
# # systemctl restart httpd.service
|
|
#
|
|
|
|
WSGIDaemonProcess kdcproxy processes=2 threads=15 maximum-requests=5000 \
|
|
user=kdcproxy group=kdcproxy display-name=%{GROUP}
|
|
WSGIImportScript /usr/lib/python2.7/site-packages/kdcproxy/__init__.py \
|
|
process-group=kdcproxy application-group=kdcproxy
|
|
WSGIScriptAlias /KdcProxy /usr/lib/python2.7/site-packages/kdcproxy/__init__.py
|
|
WSGIScriptReloading Off
|
|
|
|
<Location "/KdcProxy">
|
|
Satisfy Any
|
|
Order Deny,Allow
|
|
Allow from all
|
|
WSGIProcessGroup kdcproxy
|
|
WSGIApplicationGroup kdcproxy
|
|
</Location>
|