diff options
author | Rob Crittenden <rcritten@redhat.com> | 2012-01-10 22:39:26 -0500 |
---|---|---|
committer | Rob Crittenden <rcritten@redhat.com> | 2012-01-10 22:39:26 -0500 |
commit | c08296adff58517934b3ea3e4a6581b55fbc2d0c (patch) | |
tree | c2d8eae25edb6d6b7b51cc53759c2fcd6dcdae6f /install/updates | |
parent | 74857a8ee465819b262c3445ea22119196e92c5e (diff) | |
download | freeipa-c08296adff58517934b3ea3e4a6581b55fbc2d0c.tar.gz freeipa-c08296adff58517934b3ea3e4a6581b55fbc2d0c.tar.xz freeipa-c08296adff58517934b3ea3e4a6581b55fbc2d0c.zip |
Configure s4u2proxy during installation.
This creates a new container, cn=s4u2proxy,cn=etc,$SUFFIX
Within that container we control which services are allowed to
delegate tickets for other services. Right now that is limited
from the IPA HTTP to ldap services.
Requires a version of mod_auth_kerb that supports s4u2proxy
https://fedorahosted.org/freeipa/ticket/1098
Diffstat (limited to 'install/updates')
-rw-r--r-- | install/updates/30-s4u2proxy.update | 18 | ||||
-rw-r--r-- | install/updates/Makefile.am | 1 |
2 files changed, 19 insertions, 0 deletions
diff --git a/install/updates/30-s4u2proxy.update b/install/updates/30-s4u2proxy.update new file mode 100644 index 000000000..be1d557e7 --- /dev/null +++ b/install/updates/30-s4u2proxy.update @@ -0,0 +1,18 @@ +dn: cn=s4u2proxy,cn=etc,$SUFFIX +default: objectClass: nsContainer +default: objectClass: top +default: cn: s4u2proxy + +dn: cn=ipa-http-delegation,cn=s4u2proxy,cn=etc,$SUFFIX +default: objectClass: ipaKrb5DelegationACL +default: objectClass: groupOfPrincipals +default: objectClass: top +default: cn: ipa-http-delegation +default: memberPrincipal: HTTP/$HOST@$REALM +default: ipaAllowedTarget: 'cn=ipa-ldap-delegation-targets,cn=etc,$SUFFIX' + +dn: cn=ipa-ldap-delegation-targets,cn=s4u2proxy,cn=etc,$SUFFIX +default: objectClass: groupOfPrincipals +default: objectClass: top +default: cn: ipa-ldap-delegation-targets +default: memberPrincipal: ldap/$HOST@$REALM diff --git a/install/updates/Makefile.am b/install/updates/Makefile.am index cc7117614..20a1ce3a9 100644 --- a/install/updates/Makefile.am +++ b/install/updates/Makefile.am @@ -18,6 +18,7 @@ app_DATA = \ 20-user_private_groups.update \ 20-winsync_index.update \ 21-replicas_container.update \ + 30-s4u2proxy.update \ 40-delegation.update \ 40-dns.update \ 40-automember.update \ |