Pavel Vomacka
f4cd61f301
The Apache process must not allowed to use constrained delegation to contact services because it is already allowed to impersonate users to itself. Allowing it to perform constrained delegation would let it impersonate any user against the LDAP service without authentication. https://pagure.io/freeipa/issue/6225 Reviewed-By: Simo Sorce <ssorce@redhat.com>
17 lines
451 B
Plaintext
17 lines
451 B
Plaintext
#Installed and maintained by ipa update tools, please do not modify
|
|
[service/ipa-httpd]
|
|
mechs = krb5
|
|
cred_store = keytab:$HTTP_KEYTAB
|
|
cred_store = client_keytab:$HTTP_KEYTAB
|
|
allow_protocol_transition = true
|
|
cred_usage = both
|
|
euid = $HTTPD_USER
|
|
|
|
[service/ipa-api]
|
|
mechs = krb5
|
|
cred_store = keytab:$HTTP_KEYTAB
|
|
cred_store = client_keytab:$HTTP_KEYTAB
|
|
allow_constrained_delegation = true
|
|
cred_usage = initiate
|
|
euid = $IPAAPI_USER
|