diff options
author | Rob Crittenden <rcritten@redhat.com> | 2015-04-14 11:49:00 -0400 |
---|---|---|
committer | Simo Sorce <simo@redhat.com> | 2015-04-17 16:05:11 -0400 |
commit | 7e33a3a2df613ecdfd49d621f7cc7a6424d4f96f (patch) | |
tree | c0a977e398b95306de3ffa939dcfc5989c5062e9 /ipsilon/login/authkrb.py | |
parent | eaaffe854977912f9a4c0cc477197bd8ba96230f (diff) | |
download | ipsilon-7e33a3a2df613ecdfd49d621f7cc7a6424d4f96f.tar.gz ipsilon-7e33a3a2df613ecdfd49d621f7cc7a6424d4f96f.tar.xz ipsilon-7e33a3a2df613ecdfd49d621f7cc7a6424d4f96f.zip |
Use mod_auth_gssapi instead of mod_auth_kerb
Change configuration on new installs only.
Enable GssapiLocalName so we have access to the local name in
REMOTE_USER and the full principle in GSS_NAME.
Enable GssapiSSLonly even though SSLRequireSSL is also set.
The belt and suspenders principla.
https://fedorahosted.org/ipsilon/ticket/89
Signed-off-by: Rob Crittenden <rcritten@redhat.com>
Reviewed-by: Simo Sorce <simo@redhat.com>
Diffstat (limited to 'ipsilon/login/authkrb.py')
-rw-r--r-- | ipsilon/login/authkrb.py | 30 |
1 files changed, 12 insertions, 18 deletions
diff --git a/ipsilon/login/authkrb.py b/ipsilon/login/authkrb.py index 60eeb6b..6fc0c53 100644 --- a/ipsilon/login/authkrb.py +++ b/ipsilon/login/authkrb.py @@ -53,7 +53,7 @@ class KrbError(LoginPageBase): def root(self, *args, **kwargs): cherrypy.log.error('REQUEST: %s' % cherrypy.request.headers) - # If we have no negotiate header return whatever mod_auth_kerb + # If we have no negotiate header return whatever mod_auth_gssapi # generated and wait for the next request if 'WWW-Authenticate' not in cherrypy.request.headers: @@ -81,8 +81,8 @@ class LoginManager(LoginManagerBase): self.path = 'krb/negotiate' self.page = None self.description = """ -Kereros Negotiate authentication plugin. Relies on the mod_auth_kerb apache -plugin for actual authentication. """ +Kerberos Negotiate authentication plugin. Relies on the mod_auth_gssapi +apache plugin for actual authentication. """ self.new_config(self.name) def get_tree(self, site): @@ -96,16 +96,11 @@ plugin for actual authentication. """ CONF_TEMPLATE = """ <Location /${instance}/login/krb/negotiate> - AuthType Kerberos - AuthName "Kerberos Login" - KrbMethodNegotiate on - KrbMethodK5Passwd off - KrbServiceName HTTP - $realms + AuthType GSSAPI + AuthName "GSSAPI Single Sign On Login" $keytab - KrbSaveCredentials off - KrbConstrainedDelegation off - # KrbLocalUserMapping On + GssapiSSLonly $gssapisslonly + GssapiLocalName on Require valid-user ErrorDocument 401 /${instance}/login/krb/unauthorized @@ -124,8 +119,6 @@ class Installer(LoginManagerInstaller): def install_args(self, group): group.add_argument('--krb', choices=['yes', 'no'], default='no', help='Configure Kerberos authentication') - group.add_argument('--krb-realms', - help='Allowed Kerberos Auth Realms') group.add_argument('--krb-httpd-keytab', default='/etc/httpd/conf/http.keytab', help='Kerberos keytab location for HTTPD') @@ -137,14 +130,15 @@ class Installer(LoginManagerInstaller): confopts = {'instance': opts['instance']} if os.path.exists(opts['krb_httpd_keytab']): - confopts['keytab'] = ' Krb5KeyTab %s' % opts['krb_httpd_keytab'] + confopts['keytab'] = 'GssapiCredStore keytab:%s' % ( + opts['krb_httpd_keytab']) else: raise Exception('Keytab not found') - if opts['krb_realms'] is None: - confopts['realms'] = ' # KrbAuthRealms - Any realm is allowed' + if opts['secure'] == 'no': + confopts['gssapisslonly'] = 'Off' else: - confopts['realms'] = ' KrbAuthRealms %s' % opts['krb_realms'] + confopts['gssapisslonly'] = 'On' tmpl = Template(CONF_TEMPLATE) hunk = tmpl.substitute(**confopts) # pylint: disable=star-args |