diff options
| author | Jan Pazdziora <jpazdziora@redhat.com> | 2016-05-28 08:31:32 +0200 |
|---|---|---|
| committer | Simo Sorce <simo@redhat.com> | 2016-06-09 10:11:43 -0400 |
| commit | d1710aff7c72263f691f09f20f91922a3ce57cfc (patch) | |
| tree | 4840aa7bba096593a3470097b44c6f066664d37c /README | |
| parent | 17c292a0b4f7ce7c08780c17c1300721c3256031 (diff) | |
| download | mod_auth_gssapi-d1710aff7c72263f691f09f20f91922a3ce57cfc.tar.gz mod_auth_gssapi-d1710aff7c72263f691f09f20f91922a3ce57cfc.tar.xz mod_auth_gssapi-d1710aff7c72263f691f09f20f91922a3ce57cfc.zip | |
Add support for GssapiImpersonate.
This is can be enabled on locations that are authenticated by another module
to obtain a ticket for the user, so that the application gets access to
krb5 credentials and all named attributes for the client.
The service needs to be authorized by the KDC if there is the need to use
credentials for further ticket acquisition by setting the
ok_to_auth_as_delegate flag on the service principal. This will provide a
forwardable ticket that can be used to obtain additional tickets via consrained
delegation (also subkect to KDC access control).
Signed-off-by: Jan Pazdziora <jpazdziora@redhat.com>
Signed-off-by: Simo Sorce <simo@redhat.com>
Close #92
Diffstat (limited to 'README')
| -rw-r--r-- | README | 16 |
1 files changed, 16 insertions, 0 deletions
@@ -310,3 +310,19 @@ Auth mechanism. Enable GssapiNegotiateOnce to avoid this situation. - **Enable with:** GssapiNegotiateOnce On - **Default:** GssapiNegotiateOnce Off +### GssapiImpersonate + +This option can be used even if AuthType GSSAPI is not used for given +Location or LocationMatch, to obtain service ticket for a user that was +already authenticated by different module. + +The principal of the user is retrieved from the internal r->user +identifier which typically holds the username from the authentication +results. + +Make sure the server principal is set to allow to acquire forwardable +tickets to itself from arbitrary users, for use with constrained +delegation, for example with the option +ok_to_auth_as_delegate. + +- **Enable with:** GssapiImpersonate On +- **Default:** GssapiImpersonate Off |