diff options
| author | Adam Young <ayoung@redhat.com> | 2011-08-17 15:36:18 -0400 |
|---|---|---|
| committer | Simo Sorce <ssorce@redhat.com> | 2011-08-29 17:54:49 -0400 |
| commit | 5ee93349f6700d024fa4db68c960951d9964504b (patch) | |
| tree | 6a1d480036fbc0a820563ff9166caeb9d53a4585 /freeipa.spec.in | |
| parent | 3ef732d7381a8d59400a669009904e14c8265792 (diff) | |
| download | freeipa-5ee93349f6700d024fa4db68c960951d9964504b.tar.gz freeipa-5ee93349f6700d024fa4db68c960951d9964504b.tar.xz freeipa-5ee93349f6700d024fa4db68c960951d9964504b.zip | |
enable proxy for dogtag
Dogtag is going to be proxied through httpd. To make this work, it has to support renegotiation of the SSL
connection. This patch enables renegotiate in the nss configuration file during during apache configuration,
as well as modifies libnss to set the appropriate optins on the ssl connection in order to renegotiate.
The IPA install uses the internal ports instead of proxying through
httpd since httpd is not set up yet.
IPA needs to Request the certificate through a port that uses authentication. On the Dogtag side, they provide an additional mapping for this: /ca/eeca/ca as opposed tp /ca/ee/ca just for this purpose.
https://fedorahosted.org/freeipa/ticket/1334
add flag to pkicreate in order to enable using proxy.
add the proxy file in /etc/http/conf.d/
Signed-off-by: Simo Sorce <ssorce@redhat.com>
Diffstat (limited to 'freeipa.spec.in')
| -rw-r--r-- | freeipa.spec.in | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/freeipa.spec.in b/freeipa.spec.in index 456562296..1ef14a801 100644 --- a/freeipa.spec.in +++ b/freeipa.spec.in @@ -304,6 +304,7 @@ ln -s ../../../..%{_sysconfdir}/ipa/html/ipa_error.css \ # So we can own our Apache configuration mkdir -p %{buildroot}%{_sysconfdir}/httpd/conf.d/ /bin/touch %{buildroot}%{_sysconfdir}/httpd/conf.d/ipa.conf +/bin/touch %{buildroot}%{_sysconfdir}/httpd/conf.d/ipa-pki-proxy.conf /bin/touch %{buildroot}%{_sysconfdir}/httpd/conf.d/ipa-rewrite.conf mkdir -p %{buildroot}%{_initrddir} install -m755 ipa.init %{buildroot}%{_initrddir}/ipa @@ -449,8 +450,10 @@ fi %config(noreplace) %{_sysconfdir}/ipa/html/hbac-deny-remove.html %ghost %attr(0644,root,apache) %config(noreplace) %{_sysconfdir}/httpd/conf.d/ipa-rewrite.conf %ghost %attr(0644,root,apache) %config(noreplace) %{_sysconfdir}/httpd/conf.d/ipa.conf +%ghost %attr(0644,root,apache) %config(noreplace) %{_sysconfdir}/httpd/conf.d/ipa-pki-proxy.conf %{_usr}/share/ipa/ipa.conf %{_usr}/share/ipa/ipa-rewrite.conf +%{_usr}/share/ipa/ipa-pki-proxy.conf %dir %{_usr}/share/ipa/updates/ %{_usr}/share/ipa/updates/* %attr(755,root,root) %{plugin_dir}/libipa_pwd_extop.so |