ipsilon.git/ipsilon, branch v0.2.4

Fix typo in selinux boolean name

2014-05-20T12:03:46+00:00

This was causing pam auth to fail, as the boolean was not being turned on.

Signed-off-by: Simo Sorce

Fix generation fo server's metadata file

2014-05-19T19:17:06+00:00

At some point a '/' got lost, causing the generation of wrong endpoints.
Clients would then be redirected to an unexisting path and get a 404.

Signed-off-by: Simo Sorce

Fix broken login plugins order config handling

2014-05-10T14:00:17+00:00

The administrative page for configuring login plugins order had
a number of problems.  The html template expects a list of plugin
names to be supplied,  but a list of the actual plugin objects
was being supplied.  This caused a 500 error since join() would
throw an exception when it encounters something other than a string.

Even after fixing the 500 error, actually modifying the plugin
order would not work due to further issues with plugin objects
being used when strings representing the plugin names are expected
(and vice-versa).

This patch ensures that strings representing plugin names are
supplied to the html template, and that plugin objects are used
when re-ordering the live plugin list.

Resolves: https://fedorahosted.org/ipsilon/ticket/2

Signed-off-by: Nathan Kinder 
Reviewed-by: Simo Sorce

Add 500 Error handler for krb module

2014-05-07T14:00:35+00:00

If mod_auth_kerb encounters an internal error, catch it so we can fall back to
the next authentication module, if any, or return a proper failure message.

Signed-off-by: Simo Sorce

Remind the user to restart HTTPD when done

2014-05-07T14:00:35+00:00

On a successful install you need to retsart apache to enable the instance,
remind the user that is necessary.

Signed-off-by: Simo Sorce

Give more user feedback around keytab issues

2014-05-07T14:00:25+00:00

Signed-off-by: Simo Sorce

Add IPA helper for server install

2014-05-02T01:05:47+00:00

The IPa helper chcks a krb keytab is available for the local HTTPD
service at the standard ipa location, and if not available, tries
to register the sevice and retrieve one from the IPA server.

At the end of the process forces the activation of the krb plugin
as well as the fallback to pam for authentication.

Signed-off-by: Simo Sorce

Add Environment Helpers installer framework

2014-05-02T01:05:47+00:00

Environment helpers are meta-plugins that allow to set ipsilon in
well defined environments.
For example when ipsilon is install in a FreeIPA or AD domains and
authentication methods, cetificate, keytabs etc, can be pre-configured
and deployed at the same time the server is installed with minimal
effort and wellknown methods.

These are run before any of the other plugins as they can chage the
configuration option for any of the plugins, enable or disable plugins,
or pre-configure some elements.

Signed-off-by: Simo Sorce

Always use saml by default

2014-05-02T01:05:47+00:00

Signed-off-by: Simo Sorce

Make SELinux happy

2014-05-02T01:05:45+00:00

Add proper context to shared state directories so that httpd can write there.

Relax SElinux boolans to allow use of pam modules
This allows running Ipsilon in fully enforcing mode when pam auth
using the python-pam modules is used.

Signed-off-by: Simo Sorce