Alexander Bokovoy ee7dfc3d29 Allow mod_auth_gssapi to create and access ccaches in /run/ipa/ccaches ... With commit c6644b8566 we default to create unique credential caches in /run/ipa/ccaches for every client that connects to IPA with a new session. On F34, mod_auth_gssapi process running as 'apache' cannot create the ccache in /run/ipa/ccaches because it has no access rights. The core of the problem is that we have two different paths to obtaining a ccache: one where 'apache' running httpd process creates it directly and one where an internal redirect from 'ipaapi' running httpd process is happening. Use SUID and SGID to 'ipaapi'/'ipaapi' and allow 'apache' group to write to '/run/ipa/ccaches'. This fixes the problem. Note that we cannot completely remove 'GssapiDelegCcachePerms'. If we'd do so, mod_auth_gssapi will do redirects and fail. Fixes: https://pagure.io/freeipa/issue/8613 Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>		2020-12-10 13:47:16 +02:00
..
ipa.conf.in	Allow mod_auth_gssapi to create and access ccaches in /run/ipa/ccaches	2020-12-10 13:47:16 +02:00
Makefile.am	Move ipa's systemd tmpfiles from /var/run to /run	2018-10-15 10:04:33 +02:00