From 6a0bc4f5cd46b1ab85dba5bd2de28f568cc947b0 Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Sun, 8 May 2016 02:31:00 -0400 Subject: Implement unique ccache names Unique ccache names may be requested using the GssapiDelegCcacheUnique configuration option. This option is off by default. If both unique ccache names and session use are enabled, then a mechanism for removing old ccaches must be supplied. Signed-off-by: Robbie Harwood Also-authored-by: Petr Vobornik Reviewed-by: Simo Sorce --- README | 13 +++++++++++++ 1 file changed, 13 insertions(+) (limited to 'README') diff --git a/README b/README index b4eca28..781f3ea 100644 --- a/README +++ b/README @@ -171,6 +171,19 @@ A user foo@EXAMPLE.COM delegating its credentials would cause the server to create a ccache file named /var/run/httpd/clientcaches/foo@EXAMPLE.COM +### GssapiDelegCcacheUnique + +Enables using unique ccache names for delegation. ccache files will be placed +in GssapiDelegCcacheDir and named using the principal and a six-digit unique +suffix. + +**Note:** Consuming application must delete the ccache otherwise it will +litter the filesystem if sessions are used. An example sweeper can be found +in the contrib directory. + +#### Example + GssapiDelegCcacheUnique On + ### GssapiUseS4U2Proxy Enables the use of the s4u2Proxy Kerberos extension also known as -- cgit