Alias /idp/ui /usr/share/ipsilon/ui
WSGIScriptAlias /idp /usr/sbin/ipsilon.py
WSGIDaemonProcess idp maximum-requests=2 user=ipsilon group=ipsilon
WSGIProcessGroup idp

<Location /idp/login/krb/negotiate>
  AuthType Kerberos
  AuthName "Kerberos Login"
  KrbMethodNegotiate on
  KrbMethodK5Passwd off
  KrbServiceName HTTP
  KrbAuthRealms IPA.DEV.LAN
  Krb5KeyTab /etc/httpd/conf/http.keytab
  KrbSaveCredentials off
  KrbConstrainedDelegation off
  KrbLocalUserMapping On
  Require valid-user

  ErrorDocument 401 /idp/login/krb/unauthorized
</Location>

<Directory /usr/sbin>
    Order allow,deny
    Allow from all
    Require all granted
</Directory>