From f4cd61f3011877fc9cc2a809438059b07362b0aa Mon Sep 17 00:00:00 2001 From: Pavel Vomacka Date: Tue, 14 Mar 2017 17:44:01 +0100 Subject: [PATCH] Remove allow_constrained_delegation from gssproxy.conf The Apache process must not allowed to use constrained delegation to contact services because it is already allowed to impersonate users to itself. Allowing it to perform constrained delegation would let it impersonate any user against the LDAP service without authentication. https://pagure.io/freeipa/issue/6225 Reviewed-By: Simo Sorce --- install/share/gssproxy.conf.template | 1 - 1 file changed, 1 deletion(-) diff --git a/install/share/gssproxy.conf.template b/install/share/gssproxy.conf.template index d7031448a..fbb158a68 100644 --- a/install/share/gssproxy.conf.template +++ b/install/share/gssproxy.conf.template @@ -4,7 +4,6 @@ cred_store = keytab:$HTTP_KEYTAB cred_store = client_keytab:$HTTP_KEYTAB allow_protocol_transition = true - allow_constrained_delegation = true cred_usage = both euid = $HTTPD_USER