mod_auth_gssapi.git/src, branch perms

Add option to set custom permissions on ccache

2016-11-02T13:09:41+00:00

This allows apache to set permission so that another user in the default
group can access the ccache. Useful when apache passes the request to a
process running under a different user or group id number.

Signed-off-by: Simo Sorce

Write 'Persistent-Auth' header to err_headers_out

2016-10-11T13:01:23+00:00

In some cases, like internal redirects, authentication is completed but our
'Persistent-Auth' header is dropped by the server because headers_out is ignored
with errors (4xx, 5xx) and internal redirects.

See: https://ci.apache.org/projects/httpd/trunk/doxygen/structrequest__rec.html#a9f49c2d5680987c0c28466ea37d41a62

This fixes #110

Reviewed-by: Simo Sorce 
Reviewed-by: Isaac Boukris 
Closes #111

Declare mag_complete outside the ifdef block

2016-10-11T12:59:32+00:00

Signed-off-by: Simo Sorce 
Reviewed-by: Isaac Boukris 
Reviewed-by: Robbie Harwood 
Fixes #106
Closes #107

Fix behavior of NULL ccname for cookie creation

2016-08-15T18:32:45+00:00

This resolves an issue where the session cookie would not be populated
when sesions were used but unique ccaches were not.

Based on a report from Bhagavan Das.

Signed-off-by: Robbie Harwood 
Reviewed-by: Simo Sorce 
Closes #98

Add compatibility with OpenSSL 1.1.0

2016-07-06T20:16:22+00:00

In their continued wisdom OpenSSL developers keep breaking APIs left and
right with very poor documentation and forward/backward source compatibility.

Signed-off-by: Simo Sorce 
Closes #96
Closes #97

Insure the asn1 definitions are in the tarball

2016-06-15T15:04:08+00:00

Signed-off-by: Simo Sorce 
Close #95

Move context loops to a helper function

2016-06-15T15:03:44+00:00

This work simplifies the calling code and reduces duplication.

Signed-off-by: Simo Sorce 
Reviewed-by: Reviewed-by: Isaac Boukris 
Close #94

Postpone adding spnego mech to mech list

2016-06-09T20:15:05+00:00

Add the SPNEGO mech oid only if we are performing negotiate auth.
This cacthes earlier, with a hard failure, the case where a mechanism defined
on the command line is not available, by checking if there are any desired
mechs.

Signed-off-by: Simo Sorce 
Reviewed-by: Isaac Boukris 
Close #93

Add support for GssapiImpersonate.

2016-06-09T14:11:43+00:00

This is can be enabled on locations that are authenticated by another module
to obtain a ticket for the user, so that the application gets access to
krb5 credentials and all named attributes for the client.

The service needs to be authorized by the KDC if there is the need to use
credentials for further ticket acquisition by setting the
ok_to_auth_as_delegate flag on the service principal. This will provide a
forwardable ticket that can be used to obtain additional tickets via consrained
delegation (also subkect to KDC access control).

Signed-off-by: Jan Pazdziora 
Signed-off-by: Simo Sorce 
Close #92

Split the book keeping operations into a function

2016-06-09T14:11:18+00:00

This will be used in a following patch that perform gssapi operations
using a different path but need to perform the same bookj keeping as the
main auth path.

Signed-off-by: Simo Sorce 
Reviewed-by: Jan Pazdziora