mod_auth_gssapi.git/README, branch master

Add option to set alternative ccname env var

2017-02-08T12:39:47+00:00

In some cases (e.g. if you want to convey the ccname over AJP) the
request environment variable name "KRB5CCNAME" is not appropriate.
Add the GssapiDelegCcacheEnvVar option that allows the env var name
to be changed.

Fixes: https://github.com/modauthgssapi/mod_auth_gssapi/issues/123

Reviewed-by: Simo Sorce 
Closes #124
Closes #123

Add option to store the session encryption key.

2017-01-03T16:42:52+00:00

With the new 'file:' sytnax a session key can be automatically generated
the first time mod_auth_gssapi runs and stored on the filesystem.

Signed-off-by: Simo Sorce 
Reviewed-by: Robbie Harwood 

Closes #117

Add docs for new GssapiDelegCcachePerms option

2016-12-01T10:46:15+00:00

Signed-off-by: Simo Sorce 
Reviewed-by: Isaac Boukris 
Closes #113

Add support for GssapiImpersonate.

2016-06-09T14:11:43+00:00

This is can be enabled on locations that are authenticated by another module
to obtain a ticket for the user, so that the application gets access to
krb5 credentials and all named attributes for the client.

The service needs to be authorized by the KDC if there is the need to use
credentials for further ticket acquisition by setting the
ok_to_auth_as_delegate flag on the service principal. This will provide a
forwardable ticket that can be used to obtain additional tickets via consrained
delegation (also subkect to KDC access control).

Signed-off-by: Jan Pazdziora 
Signed-off-by: Simo Sorce 
Close #92

Additional python modules are needed.

2016-06-06T15:30:55+00:00

Failed imports were found in tracebacks in ./scratchdir/tests.log.

Signed-off-by: Jan Pazdziora 
Reviewed-by: Simo Sorce 
Close #89

The distribution does not ship ./configure, generate it.

2016-06-06T09:54:00+00:00

Signed-off-by: Jan Pazdziora 
Reviewed-by: Simo Sorce 
Close #88

Clarify make test dependencies.

2016-06-02T14:14:15+00:00

Signed-off-by: Jan Pazdziora 
Reviewed-by: Simo Sorce 
Close #85

Implement unique ccache names

2016-05-18T21:46:14+00:00

Unique ccache names may be requested using the GssapiDelegCcacheUnique
configuration option.  This option is off by default.  If both unique
ccache names and session use are enabled, then a mechanism for removing
old ccaches must be supplied.

Signed-off-by: Robbie Harwood 
Also-authored-by: Petr Vobornik 
Reviewed-by: Simo Sorce

Cleanup s4u2proxy in mag_auth_basic

2016-02-18T01:44:36+00:00

It doesn't have any effect since we set GSS_C_DELEG_FLAG
when we initiate client credentials so we always get
delegated TGT regardless of constrained delegation.

This commit is not intended to change the current behaviour.

See #70

Reviewed-by: Simo Sorce 
Closes #70
Closes #72

Add option to not send a Negotiate headers

2016-02-17T23:59:31+00:00

If negotiation was attempted but failed do not send a new Negotiate header.
Useful when only one single sign on mechanism is allowed and to avoid
misleading login prompts in some browsers.

Added a test of the GssapiDontReauth option to the test suite.
Also added SPNEGO no auth test.

[SS: reworded and fixed commit subject/comment]
[SS: fixed whitespace errors and 80 column wrappings]

Reviewed-by: Simo Sorce 

Close #65