mod_auth_gssapi.git, branch rfc5929

Experimental support for RFC5929 channel bindings

2014-03-26T03:17:35+00:00

This code depends on a patch that has not yet been upstreamed in mod_ssl,
it also require client support whichis not available in Firefox, unclear if
available in Chrome or other similar browser.

It is available on Windows systems when Extended Protection Authentication
is enabled.

Add normative reference documents

2014-03-26T00:54:14+00:00

Implement checking for TLS connections

2014-03-13T20:02:03+00:00

Obey the GSSSSLOnly setting.

Allow context to be attached to the connection

2014-03-09T21:33:21+00:00

This means the authentication is not repeated for every request but
is retained for the life of the connection.

This may be a security issue if a frontend proxy shares connections
between multiple users so must be used with care.
RFC 4559 warns that clients should not try SPNEGO if such a proxy
is present. Unfortuntely the RFC assumes a non-standard method to
determine if a proxy maintain separate connections.

Fix module name

2014-03-09T21:19:05+00:00

The module structure name used throughout the code didn't match the
name of the initialized structure, so the one used was always
uninitialized.

Add option to map GSS Name to local Name

2014-03-08T19:57:42+00:00

Always preserves the received name in GSS_NAME.
In the kereberos case this will result in the environment variable
called GSS_NAME the user's principal, while REMOTE_USER will contain
the user name as mapped by the kerberos library.

Use the cred_store extension to save credentials

2014-03-08T19:25:39+00:00

Fix warnings

2014-02-15T22:33:00+00:00

Add initial configure scripts

2014-02-15T21:45:39+00:00

Example apache module conf

2014-02-15T19:25:09+00:00