freeipa

0 Fork 0

Files

T

Stanislav Levin 0fd06f33b8 gssproxy: Don't refresh expired delegated credentials

`mod_auth_gssapi` exports delegated credentials into `/run/ipa/ccaches`
and pass down that path as `KRB5CCNAME` env variable to WSGI worker.

GSSProxy in turn, protects these credentials from direct usage of
`ipa-api`. But the configuration of `service/ipa-api` (in particular,
'cred_store = client_keytab:/var/lib/ipa/gssproxy/http.keytab') and
default GSS name ('=None') dictates to refresh expired credentials
with the client's keytab overwriting the origin credentials with
initial credentials of keytab's principal.

Signed-off-by: Stanislav Levin <slev@altlinux.org>
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>

2021-06-14 10:14:34 +03:00

certmonger

Improve performance of ipa-server-guard

2020-08-19 13:59:11 -04:00

custodia

Replace PYTHONSHEBANG with valid shebang

2019-06-24 09:35:57 +02:00

html

Change FreeIPA references to IPA and Identity Management

2021-02-09 09:48:23 -05:00

migration

Change FreeIPA references to IPA and Identity Management

2021-02-09 09:48:23 -05:00

oddjob

use a constant instead of /var/lib/sss/keytabs

2021-01-22 21:10:58 -05:00

restart_scripts

Don't create log files from help scripts

2019-09-24 15:23:30 +02:00

gssproxy: Don't refresh expired delegated credentials

2021-06-14 10:14:34 +03:00

tools

krb_utils: Simplify get_credentials

2021-06-14 10:14:34 +03:00

WebUI: Add support of 'ipaautoprivategroups' LDAP attribute on 'ID Ranges' page

2021-06-03 20:10:57 +03:00

updates

ds: Support renaming of a replication plugin in 389-ds

2021-06-01 21:12:14 +03:00

wsgi

wgi/plugins.py: ignore empty plugin directories

2020-11-06 16:38:37 -05:00

Makefile.am

Move Custodia secrets handler to scripts

2019-04-26 12:09:22 +02:00

README.schema

Add some basic rules for adding new schema

2010-08-27 13:40:37 -04:00

README.schema

Ground rules on adding new schema

Brand new schema, particularly when written specifically for IPA, should be
added in share/*.ldif. Any new files need to be explicitly loaded in
ipaserver/install/dsinstance.py. These simply get copied directly into
the new instance schema directory.

Existing schema (e.g. in an LDAP draft) may either be added as a separate
ldif in share or as an update in the updates directory. The advantage of
adding the schema as an update is if 389-ds ever adds the schema then the
installation won't fail due to existing schema failing to load during
bootstrap.

If the new schema requires a new container then this should be added
to install/bootstrap-template.ldif.