Files
freeipa/install
Christian Heimes b6c893aae6 mod_auth_gssapi: Remove ntlmssp support and restrict mechanism to krb5
By default mod_auth_gssapi allows all locally available mechanisms. If
the gssntlmssp package is installed, it also offers ntlmssp.  This has
the annoying side effect that some browser will pop up a
username/password request dialog if no Krb5 credentials are available.

The patch restricts the mechanism to krb5 and removes ntlmssp and
iakerb support from Apache's ipa.conf.

The new feature was added to mod_auth_gssapi 1.3.0.

https://fedorahosted.org/freeipa/ticket/5114

Reviewed-By: Simo Sorce <ssorce@redhat.com>
2015-11-26 15:20:19 +01:00
..
2015-11-13 14:02:45 +01:00
2015-11-25 09:12:25 +01:00
2015-08-12 18:17:23 +02:00

Ground rules on adding new schema

Brand new schema, particularly when written specifically for IPA, should be
added in share/*.ldif. Any new files need to be explicitly loaded in
ipaserver/install/dsinstance.py. These simply get copied directly into
the new instance schema directory.

Existing schema (e.g. in an LDAP draft) may either be added as a separate
ldif in share or as an update in the updates directory. The advantage of
adding the schema as an update is if 389-ds ever adds the schema then the
installation won't fail due to existing schema failing to load during
bootstrap.

If the new schema requires a new container then this should be added
to install/bootstrap-template.ldif.