mod_auth_gssapi.git/README, branch perms

Add support for GssapiImpersonate.

2016-06-09T14:11:43+00:00

This is can be enabled on locations that are authenticated by another module
to obtain a ticket for the user, so that the application gets access to
krb5 credentials and all named attributes for the client.

The service needs to be authorized by the KDC if there is the need to use
credentials for further ticket acquisition by setting the
ok_to_auth_as_delegate flag on the service principal. This will provide a
forwardable ticket that can be used to obtain additional tickets via consrained
delegation (also subkect to KDC access control).

Signed-off-by: Jan Pazdziora 
Signed-off-by: Simo Sorce 
Close #92

Additional python modules are needed.

2016-06-06T15:30:55+00:00

Failed imports were found in tracebacks in ./scratchdir/tests.log.

Signed-off-by: Jan Pazdziora 
Reviewed-by: Simo Sorce 
Close #89

The distribution does not ship ./configure, generate it.

2016-06-06T09:54:00+00:00

Signed-off-by: Jan Pazdziora 
Reviewed-by: Simo Sorce 
Close #88

Clarify make test dependencies.

2016-06-02T14:14:15+00:00

Signed-off-by: Jan Pazdziora 
Reviewed-by: Simo Sorce 
Close #85

Implement unique ccache names

2016-05-18T21:46:14+00:00

Unique ccache names may be requested using the GssapiDelegCcacheUnique
configuration option.  This option is off by default.  If both unique
ccache names and session use are enabled, then a mechanism for removing
old ccaches must be supplied.

Signed-off-by: Robbie Harwood 
Also-authored-by: Petr Vobornik 
Reviewed-by: Simo Sorce

Cleanup s4u2proxy in mag_auth_basic

2016-02-18T01:44:36+00:00

It doesn't have any effect since we set GSS_C_DELEG_FLAG
when we initiate client credentials so we always get
delegated TGT regardless of constrained delegation.

This commit is not intended to change the current behaviour.

See #70

Reviewed-by: Simo Sorce 
Closes #70
Closes #72

Add option to not send a Negotiate headers

2016-02-17T23:59:31+00:00

If negotiation was attempted but failed do not send a new Negotiate header.
Useful when only one single sign on mechanism is allowed and to avoid
misleading login prompts in some browsers.

Added a test of the GssapiDontReauth option to the test suite.
Also added SPNEGO no auth test.

[SS: reworded and fixed commit subject/comment]
[SS: fixed whitespace errors and 80 column wrappings]

Reviewed-by: Simo Sorce 

Close #65

Corrected two typos in the README file.

2016-02-17T22:52:10+00:00

Reviewed-by: Simo Sorce 

Close #71

Minor formatting changes to the README.

2016-02-03T12:13:45+00:00

[Changes to original commit: removed trailing whitespace]

Reviewed-by: Simo Sorce 

Closes #67

Add code to set attribute names in the environment

2015-12-03T18:30:09+00:00

This code allows to specify which attributes in a name are interesting
to the application and set them as named environemnt variables.
Optionally the whole set of attributes can be exported in a json
formatted structure.

Signed-off-by: Simo Sorce 

Close #62
Close #63