freeipa.git/install/conf, branch cakeysfix

Revert "Store GSSAPI session key in /var/run/ipa"

2017-04-27T13:39:54+00:00

This reverts commit 2bab2d4963daa99742875f3633a99966bc56f5a3. It was
pointed out that apache has no access to /var/lib/ipa directory breaking
the session handling.

https://pagure.io/freeipa/issue/6880

Reviewed-By: Simo Sorce

Store GSSAPI session key in /var/run/ipa

2017-04-27T10:35:46+00:00

Runtime data should be stored in /var/run instead of /etc/httpd/alias.
This change is also compatible with selinux policy.

https://pagure.io/freeipa/issue/6880

Reviewed-By: Tomas Krizek 
Reviewed-By: Jan Cholasta

Replace hard-coded kdcproxy path with WSGI script

2017-04-12T11:05:23+00:00

mod_wsgi has no way to import a WSGI module by dotted module name. A new
kdcproxy.wsgi script is used to import kdcproxy from whatever Python
version mod_wsgi is compiled against. This will simplify moving FreeIPA
to Python 3 and solves an import problem on Debian.

Resolves: https://pagure.io/freeipa/issue/6834

Signed-off-by: Christian Heimes 
Reviewed-By: Martin Basti

WebUI: cert login: Configure name of parameter used to pass username

2017-04-11T13:29:11+00:00

Directive LookupUserByCertificateParamName tells mod_lookup_identity module the
name of GET parameter that is used to provide username in case certificate is
mapped to multiple user accounts.
Without this directive login with certificate that's mapped to multiple users
doesn't work.

https://pagure.io/freeipa/issue/6860

Reviewed-By: Florence Blanc-Renaud

Increase Apache HTTPD's default keep alive timeout

2017-03-20T18:24:28+00:00

Apache has a default keep alive timeout of 5 seconds. That's too low for
interactive commands, e.g. password prompts. 30 seconds sounds like a
good compromise.

Signed-off-by: Christian Heimes 
Reviewed-By: Tomas Krizek

Support certificate login after installation and upgrade

2017-03-14T14:13:43+00:00

Add necessary steps which set SSSD and set SELinux boolean during
installation or upgrade. Also create new endpoint in apache for
login using certificates.

https://pagure.io/freeipa/issue/6225

Reviewed-By: Florence Blanc-Renaud 
Reviewed-By: Petr Vobornik 
Reviewed-By: David Kupka

Limit sessions to 30 minutes by default

2017-03-01T12:43:40+00:00

When we changed the session handling code we unintentinally extended
sessions expiraion time to the whole ticket lifetime of 24h.

Related to https://fedorahosted.org/freeipa/ticket/5959

Signed-off-by: Simo Sorce 
Reviewed-By: Christian Heimes

Deduplicate session cookies in headers

2017-02-17T08:57:23+00:00

This removes one of the 2 identical copies of the ipa_session cookie

Fixes https://fedorahosted.org/freeipa/ticket/6676

Signed-off-by: Simo Sorce 
Reviewed-By: Alexander Bokovoy

Add a new user to run the framework code

2017-02-15T06:13:37+00:00

Add the apache user the ipawebui group.
Make the ccaches directory owned by the ipawebui group and make
mod_auth_gssapi write the ccache files as r/w by the apache user and
the ipawebui group.
Fix tmpfiles creation ownership and permissions to allow the user to
access ccaches files.
The webui framework now works as a separate user than apache, so the certs
used to access the dogtag instance need to be usable by this new user as well.
Both apache and the webui user are in the ipawebui group, so use that.

https://fedorahosted.org/freeipa/ticket/5959

Signed-off-by: Simo Sorce 
Reviewed-By: Jan Cholasta

Configure HTTPD to work via Gss-Proxy

2017-02-15T06:13:37+00:00

https://fedorahosted.org/freeipa/ticket/4189
https://fedorahosted.org/freeipa/ticket/5959

Signed-off-by: Simo Sorce 
Reviewed-By: Jan Cholasta