ipsilon.git, branch login_stacks

Make availble a list of alternative aut methods

2015-04-27T16:46:39+00:00

In the form case there is no way to automatically fallback to
ther auth methods or even repeat transparent methods.
Add a simple list of alternative auth methods under the description
box so that the user can easily switch back and froth between them
if desired.

Fixes: https://fedorahosted.org/ipsilon/ticket/96

Signed-off-by: Simo Sorce

Populate krb_principal_name from GSS_NAME env var

2015-04-27T15:51:24+00:00

mod_auth_gssapi provides by default the local name in
REMOTE_USER and the full principal in GSS_NAME. Grab a
copy of that principal for krb_principal_name.

https://fedorahosted.org/ipsilon/ticket/115

Signed-off-by: Rob Crittenden 
Reviewed-by: Simo Sorce

Disallow iframes via X-Frame-Options and CSP by default

2015-04-24T17:10:34+00:00

A decorator, allow_iframe, is also created so that specific
pages can remove the deny values and allow operating within
a frame.

The Persona plugin relies on iframes and uses this decorator
for all endpoints.

https://fedorahosted.org/ipsilon/ticket/15

Signed-off-by: Rob Crittenden 
Reviewed-by: Patrick Uiterwijk

Use the new transaction convenience function in Persona

2015-04-24T17:08:27+00:00

Signed-off-by: Patrick Uiterwijk 
Reviewed-by: Rob Crittenden

Fix sticter lint checks

2015-04-17T20:09:17+00:00

Signed-off-by: Simo Sorce 
Reviewed-by: Rob Crittenden

Use mod_auth_gssapi instead of mod_auth_kerb

2015-04-17T20:05:11+00:00

Change configuration on new installs only.

Enable GssapiLocalName so we have access to the local name in
REMOTE_USER and the full principle in GSS_NAME.

Enable GssapiSSLonly even though SSLRequireSSL is also set.
The belt and suspenders principla.

https://fedorahosted.org/ipsilon/ticket/89

Signed-off-by: Rob Crittenden 
Reviewed-by: Simo Sorce

Move ipsilon WSGI script from /usr/sbin to /usr/libexec

2015-04-15T17:57:42+00:00

This command is not intended to be executed by end-users.

https://fedorahosted.org/ipsilon/ticket/76

Signed-off-by: Rob Crittenden 
Reviewed-by: Nathan Kinder

Release v0.6.0

2015-04-15T14:40:59+00:00

Signed-off-by: Patrick Uiterwijk 
Reviewed-by: Rob Crittenden

Close database sesssions

2015-04-15T14:35:04+00:00

This will close any opened database sessions at the end
of the request.

https://fedorahosted.org/ipsilon/ticket/110

Signed-off-by: Patrick Uiterwijk 
Reviewed-by: Rob Crittenden

Better error handling for login mgrs in server install/uninstall

2015-04-13T16:30:37+00:00

The purpose is to catch it when either no modules are enabled or if
you try to set the login module order and one of them is not
available/installed, then fail gracefully.

There were some baked-in assumptions that all login providers
are installed. Add some error handling around trying to determine
what is available, and rather than trying to force pam to be enabled
just exit with a handy message.

Don't rely on lm_order during uninstall. Use the list of enabled
Login managers instead.

Bail out of argument checking if uninstall is requested.

https://fedorahosted.org/ipsilon/ticket/105

Signed-off-by: Rob Crittenden 
Reviewed-by: Patrick Uiterwijk