public/freeipa
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ipaserver: Use apache VirtualHost for IPA UI

Browse Source
This commit is contained in:
zpericic authored and Zoran Peričić committed 2022-08-17 08:43:12 +02:00
1 parent e2d7602c1d
commit 0b4badd451
10 files changed
+135 -19
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

install/share/ipa-vhost.conf.template
+53
View File
@@ -0,0 +1,53 @@
#
# VERSION 32 - DO NOT REMOVE THIS LINE
#
# This file may be overwritten on upgrades.
#
# FIXME: WSGISocketPrefix is a server-scope directive. The mod_wsgi package
# should really be fixed by adding this its /etc/httpd/conf.d/wsgi.conf:
WSGISocketPrefix $WSGI_PREFIX_DIR
# Configure mod_wsgi handler for /ipa
WSGIDaemonProcess ipa processes=$WSGI_PROCESSES threads=1 maximum-requests=500 \
user=ipaapi group=ipaapi display-name=%{GROUP} socket-timeout=2147483647 \
lang=C.UTF-8 locale=C.UTF-8
WSGIImportScript /usr/share/ipa/wsgi.py process-group=ipa application-group=ipa
<VirtualHost *:80>
ServerName $FQDN
ServerAlias ipa-ca.$DOMAIN
# Logging
CustomLog /var/log/httpd/ipa-access.log combined
ErrorLog /var/log/httpd/ipa-error.log
IncludeOptional $HTTPD_IPA_PKI_PROXY_CONF
Include $HTTPD_IPA_REWRITE_CONF
Include $HTTPD_IPA_CONF
</VirtualHost>
# the below section is only need if you have above 3 lines and want SSL
<VirtualHost *:443>
ServerName $FQDN
ServerAlias ipa-ca.$DOMAIN
# Logging
CustomLog /var/log/httpd/ipa-access.log combined
ErrorLog /var/log/httpd/ipa-error.log
# SSL
SSLEngine on
SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1
SSLCACertificateFile /etc/ipa/ca.crt
SSLCertificateKeyFile /var/lib/ipa/private/httpd.key
SSLCertificateFile /var/lib/ipa/certs/httpd.crt
SSLCipherSuite PROFILE=SYSTEM
SSLProxyCipherSuite PROFILE=SYSTEM
#
IncludeOptional $HTTPD_IPA_KDCPROXY_CONF_SYMLINK
IncludeOptional $HTTPD_IPA_PKI_PROXY_CONF
Include $HTTPD_IPA_REWRITE_CONF
Include $HTTPD_IPA_CONF
</VirtualHost>
ipaplatform/base/paths.py
+7 -5
View File
@@ -45,12 +45,14 @@ class BasePathNamespace:
GSSAPI_SESSION_KEY = "/etc/httpd/alias/ipasession.key"
OLD_KRA_AGENT_PEM = "/etc/httpd/alias/kra-agent.pem"
HTTPD_CONF_D_DIR = "/etc/httpd/conf.d/"
HTTPD_IPA_DIR = "/etc/httpd/ipa"
HTTPD_IPA_KDCPROXY_CONF = "/etc/ipa/kdcproxy/ipa-kdc-proxy.conf"
HTTPD_IPA_KDCPROXY_CONF_SYMLINK = "/etc/httpd/conf.d/ipa-kdc-proxy.conf"
HTTPD_IPA_PKI_PROXY_CONF = "/etc/httpd/conf.d/ipa-pki-proxy.conf"
HTTPD_IPA_REWRITE_CONF = "/etc/httpd/conf.d/ipa-rewrite.conf"
HTTPD_IPA_CONF = "/etc/httpd/conf.d/ipa.conf"
HTTPD_IPA_WSGI_CONF = "/etc/httpd/conf.d/ipa-wsgi.conf"
HTTPD_IPA_KDCPROXY_CONF_SYMLINK = "/etc/httpd/ipa/ipa-kdc-proxy.conf"
HTTPD_IPA_PKI_PROXY_CONF = "/etc/httpd/ipa/ipa-pki-proxy.conf"
HTTPD_IPA_REWRITE_CONF = "/etc/httpd/ipa/ipa-rewrite.conf"
HTTPD_IPA_CONF = "/etc/httpd/ipa/ipa.conf"
HTTPD_IPA_SITE_CONF = "/etc/httpd/conf.d/vhost-ipa.conf"
HTTPD_IPA_WSGI_CONF = "/etc/httpd/ipa/ipa-wsgi.conf"
HTTPD_NSS_CONF = "/etc/httpd/conf.d/nss.conf"
HTTPD_SSL_CONF = "/etc/httpd/conf.d/ssl.conf"
HTTPD_SSL_SITE_CONF = "/etc/httpd/conf.d/ssl.conf"
ipaplatform/debian/paths.py
+7 -5
View File
@@ -20,11 +20,13 @@ class DebianPathNamespace(BasePathNamespace):
ETC_HTTPD_DIR = "/etc/apache2"
HTTPD_ALIAS_DIR = "/etc/apache2/ipa"
HTTPD_CONF_D_DIR = "/etc/apache2/conf-enabled/"
HTTPD_IPA_KDCPROXY_CONF_SYMLINK = "/etc/apache2/conf-enabled/ipa-kdc-proxy.conf"
HTTPD_IPA_PKI_PROXY_CONF = "/etc/apache2/conf-enabled/ipa-pki-proxy.conf"
HTTPD_IPA_REWRITE_CONF = "/etc/apache2/conf-available/ipa-rewrite.conf"
HTTPD_IPA_CONF = "/etc/apache2/conf-enabled/ipa.conf"
HTTPD_IPA_WSGI_CONF = "/etc/apache2/conf-enabled/ipa-wsgi.conf"
HTTPD_IPA_DIR = "/etc/apache2/ipa/"
HTTPD_IPA_KDCPROXY_CONF_SYMLINK = "/etc/apache2/ipa/ipa-kdc-proxy.conf"
HTTPD_IPA_PKI_PROXY_CONF = "/etc/apache2/ipa/ipa-pki-proxy.conf"
HTTPD_IPA_REWRITE_CONF = "/etc/apache2/ipa/ipa-rewrite.conf"
HTTPD_IPA_CONF = "/etc/apache2/ipa/ipa.conf"
HTTPD_IPA_WSGI_CONF = "/etc/apache2/ipa/ipa-wsgi.conf"
HTTPD_IPA_SITE_CONF = "/etc/apache2/sites-available/ipa.conf"
HTTPD_NSS_CONF = "/etc/apache2/mods-available/nss.conf"
HTTPD_SSL_CONF = "/etc/apache2/mods-available/ssl.conf"
HTTPD_SSL_SITE_CONF = "/etc/apache2/sites-available/default-ssl.conf"
ipaplatform/suse/paths.py
+7 -5
View File
@@ -17,11 +17,13 @@ class SusePathNamespace(BasePathNamespace):
HTTPD_ALIAS_DIR = "/etc/apache2/ipa"
GSSAPI_SESSION_KEY = "/etc/apache2/ipa/ipasession.key"
HTTPD_CONF_D_DIR = "/etc/apache2/conf.d/"
HTTPD_IPA_KDCPROXY_CONF_SYMLINK = "/etc/apache2/conf.d/ipa-kdc-proxy.conf"
HTTPD_IPA_PKI_PROXY_CONF = "/etc/apache2/conf.d/ipa-pki-proxy.conf"
HTTPD_IPA_REWRITE_CONF = "/etc/apache2/conf.d/ipa-rewrite.conf"
HTTPD_IPA_CONF = "/etc/apache2/conf.d/ipa.conf"
HTTPD_IPA_WSGI_CONF = "/etc/apache2/conf.d/ipa-wsgi.conf"
HTTPD_IPA_DIR = "/etc/apache2/ipa/"
HTTPD_IPA_KDCPROXY_CONF_SYMLINK = "/etc/apache2/ipa/ipa-kdc-proxy.conf"
HTTPD_IPA_PKI_PROXY_CONF = "/etc/apache2/ipa/ipa-pki-proxy.conf"
HTTPD_IPA_REWRITE_CONF = "/etc/apache2/ipa/ipa-rewrite.conf"
HTTPD_IPA_CONF = "/etc/apache2/ipa/ipa.conf"
HTTPD_IPA_WSGI_CONF = "/etc/apache2/ipa/ipa-wsgi.conf"
HTTPD_IPA_SITE_CONF = "/etc/apache2/conf.d/ipa-vhost.conf"
HTTPD_NSS_CONF = "/etc/apache2/conf.d/nss.conf"
HTTPD_SSL_CONF = "/etc/apache2/conf.d/ssl.conf"
HTTPD_SSL_SITE_CONF = "/etc/apache2/conf.d/ssl.conf"
ipaserver/install/httpinstance.py
+27 -2
View File
@@ -87,13 +87,14 @@ class HTTPInstance(service.Service):
def create_instance(self, realm, fqdn, domain_name, dm_password=None,
pkcs12_info=None,
subject_base=None, auto_redirect=True, ca_file=None,
ca_is_configured=None, promote=False,
subject_base=None, auto_redirect=True, ui_vhost=False,
ca_file=None, ca_is_configured=None, promote=False,
master_fqdn=None):
self.fqdn = fqdn
self.realm = realm
self.domain = domain_name
self.dm_password = dm_password
self.ui_vhost = ui_vhost
self.suffix = ipautil.realm_to_suffix(self.realm)
self.pkcs12_info = pkcs12_info
self.cert = None
@@ -112,6 +113,10 @@ class HTTPInstance(service.Service):
IPA_CCACHES=paths.IPA_CCACHES,
WSGI_PREFIX_DIR=paths.WSGI_PREFIX_DIR,
WSGI_PROCESSES=constants.WSGI_PROCESSES,
HTTPD_IPA_KDCPROXY_CONF_SYMLINK=paths.HTTPD_IPA_KDCPROXY_CONF_SYMLINK,
HTTPD_IPA_PKI_PROXY_CONF=paths.HTTPD_IPA_PKI_PROXY_CONF,
HTTPD_IPA_REWRITE_CONF=paths.HTTPD_IPA_REWRITE_CONF,
HTTPD_IPA_CONF=paths.HTTPD_IPA_CONF
)
self.ca_file = ca_file
if ca_is_configured is not None:
@@ -198,6 +203,14 @@ class HTTPInstance(service.Service):
# https://pagure.io/freeipa/issue/7662
tasks.restore_context(session_dir)
# create /etc/httpd/ipa
if not os.path.isdir(paths.HTTPD_IPA_DIR):
os.makedirs(paths.HTTPD_IPA_DIR)
# Must be world-readable / executable
os.chmod(paths.HTTPD_IPA_DIR, 0o755)
# Restore SELinux context of /etc/httpd/ipa
tasks.restore_context(paths.HTTPD_IPA_DIR)
target_fname = paths.HTTPD_IPA_CONF
http_txt = ipautil.template_file(
os.path.join(paths.USR_SHARE_IPA_DIR,
@@ -220,6 +233,18 @@ class HTTPInstance(service.Service):
http_fd.close()
os.chmod(target_fname, 0o644)
target_fname = paths.HTTPD_IPA_SITE_CONF
http_txt = ipautil.template_file(
os.path.join(paths.USR_SHARE_IPA_DIR,
"ipa-vhost.conf.template"),
self.sub_dict)
self.fstore.backup_file(paths.HTTPD_IPA_SITE_CONF)
http_fd = open(target_fname, "w")
http_fd.write(http_txt)
http_fd.close()
os.chmod(target_fname, 0o644)
target_fname = paths.HTTPD_IPA_REWRITE_CONF
http_txt = ipautil.template_file(
os.path.join(paths.USR_SHARE_IPA_DIR,
ipaserver/install/ipa_backup.py
+1
View File
@@ -154,6 +154,7 @@ class Backup(admintool.AdminTool):
paths.HTTPD_CERT_FILE,
paths.HTTPD_KEY_FILE,
paths.HTTPD_IPA_CONF,
paths.HTTPD_IPA_SITE_CONF,
paths.HTTPD_WSGI_CONF,
paths.SSHD_CONFIG,
paths.SSHD_IPA_CONFIG,
ipaserver/install/server/__init__.py
+6
View File
@@ -317,6 +317,12 @@ class ServerInstallInterface(ServerCertificateInstallInterface,
)
no_ui_redirect = enroll_only(no_ui_redirect)
ui_vhost = knob(
None,
description="Use virtual host for Web UI",
)
ui_vhost = enroll_only(ui_vhost)
dirsrv_config_file = knob(
str, None,
description="The path to LDIF file that will be used to modify "
ipaserver/install/server/install.py
+2
View File
@@ -943,12 +943,14 @@ def install(installer):
realm_name, host_name, domain_name, dm_password,
pkcs12_info=http_pkcs12_info, subject_base=options.subject_base,
auto_redirect=not options.no_ui_redirect,
ui_vhost=options.ui_vhost,
ca_is_configured=setup_ca)
else:
http.create_instance(
realm_name, host_name, domain_name, dm_password,
subject_base=options.subject_base,
auto_redirect=not options.no_ui_redirect,
ui_vhost=options.ui_vhost,
ca_is_configured=setup_ca)
ca.set_subject_base_in_config(options.subject_base)
ipaserver/install/server/replicainstall.py
+3 -2
View File
@@ -150,7 +150,7 @@ def install_ca_cert(ldap, base_dn, realm, cafile, destfile=paths.IPA_CA_CRT):
return destfile
def install_http(config, auto_redirect, ca_is_configured, ca_file,
def install_http(config, auto_redirect, ui_vhost, ca_is_configured, ca_file,
pkcs12_info=None, fstore=None):
# if we have a pkcs12 file, create the cert db from
# that. Otherwise the ds setup will create the CA
@@ -163,7 +163,7 @@ def install_http(config, auto_redirect, ca_is_configured, ca_file,
http.create_instance(
config.realm_name, config.host_name, config.domain_name,
config.dirman_password, pkcs12_info,
auto_redirect=auto_redirect, ca_file=ca_file,
auto_redirect=auto_redirect, ui_vhost=ui_vhost, ca_file=ca_file,
ca_is_configured=ca_is_configured, promote=True,
subject_base=config.subject_base, master_fqdn=config.master_host_name)
@@ -1315,6 +1315,7 @@ def install(installer):
install_http(
config,
auto_redirect=not options.no_ui_redirect,
ui_vhost=options.ui_vhost,
pkcs12_info=http_pkcs12_info,
ca_is_configured=ca_enabled,
ca_file=cafile,
ipaserver/install/server/upgrade.py
+22
View File
@@ -152,6 +152,19 @@ def find_autoredirect(fqdn):
return False
return True
def find_uivhost(fqdn):
"""
When upgrading we need to see if the UI virtual host usage
was disabled during install time (or afterward). So sift through the
configuration file and see if we can determine the status.
Returns True if use_vhost is enabled, False otherwise
"""
filename = paths.HTTPD_IPA_SITE_CONF
if os.path.exists(filename):
return True
return False
def find_version(filename):
"""Find the version of a configuration file
@@ -1677,10 +1690,12 @@ def upgrade_configuration():
fix_permissions()
auto_redirect = find_autoredirect(fqdn)
use_vhost = find_usevhost(fqdn)
sub_dict = dict(
REALM=api.env.realm,
FQDN=fqdn,
AUTOREDIR='' if auto_redirect else '#',
UI_VHOST='' if use_vhost else '#',
CRL_PUBLISH_PATH=paths.PKI_CA_PUBLISH_DIR,
DOGTAG_PORT=8009,
CLONE='#',
@@ -1694,6 +1709,10 @@ def upgrade_configuration():
IPA_CUSTODIA_SOCKET=paths.IPA_CUSTODIA_SOCKET,
KDCPROXY_CONFIG=paths.KDCPROXY_CONFIG,
DOMAIN=api.env.domain,
HTTPD_IPA_KDCPROXY_CONF_SYMLINK=paths.HTTPD_IPA_KDCPROXY_CONF_SYMLINK,
HTTPD_IPA_PKI_PROXY_CONF=paths.HTTPD_IPA_PKI_PROXY_CONF,
HTTPD_IPA_REWRITE_CONF=paths.HTTPD_IPA_REWRITE_CONF,
HTTPD_IPA_CONF=paths.HTTPD_IPA_CONF
)
subject_base = find_subject_base()
@@ -1730,6 +1749,9 @@ def upgrade_configuration():
upgrade_file(sub_dict, paths.HTTPD_IPA_CONF,
os.path.join(paths.USR_SHARE_IPA_DIR,
"ipa.conf.template"))
upgrade_file(sub_dict, paths.HTTPD_IPA_SITE_CONF,
os.path.join(paths.USR_SHARE_IPA_DIR,
"ipa-vhost.conf.template"))
upgrade_file(sub_dict, paths.HTTPD_IPA_WSGI_CONF,
os.path.join(paths.USR_SHARE_IPA_DIR,
"ipa-wsgi.conf.template"))