Infrastructure/ansible
3
0
Fork 0
Code Issues Pull requests 6 Projects Releases Packages Wiki Activity Actions

Enable both client cert and krb for stg koji

Browse source 
Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com>
This commit is contained in:
Patrick Uiterwijk 2016-11-23 00:23:23 +00:00
parent e7aa36f169
commit 4b5ba6e16e
1 changed files with 28 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

28
roles/koji_hub/templates/kojihub.conf.j2
View file

@ -26,9 +26,37 @@ Alias /kojifiles "/mnt/koji/"
SSLVerifyClient optional SSLVerifyClient optional
<Location /kojihub/ssllogin> <Location /kojihub/ssllogin>
{% if env == "production" %}
SSLVerifyClient require SSLVerifyClient require
SSLVerifyDepth 10 SSLVerifyDepth 10
SSLOptions +StdEnvVars SSLOptions +StdEnvVars
{% else %}
SSLVerifyClient optional
SSLVerifyDepth 1
SSLOptions +StrictRequire +StdEnvVars +OptRenegotiate
AuthType GSSAPI
GssapiSSLonly On
AuthName "GSSAPI Single Sign On Login"
GssapiCredStore keytab:/etc/koji-hub-http.keytab
# This complicated ACL stuff is to support both SSL and kerb auth at the same time
# To be killed on December 12th, 2016, after which "Require valid-user" remains
SetEnvIfExpr "%{SSL_CLIENT_S_DN_O} == 'Fedora Project'" cert_s_o_valid
SetEnvIfExpr "%{SSL_CLIENT_S_DN_OU} == 'Fedora User Cert'" cert_s_ou_valid
SetEnvIfExpr "%{SSL_CLIENT_I_DN_O} == 'Fedora Project'" cert_i_o_valid
SetEnvIfExpr "%{SSL_CLIENT_I_DN_OU} == 'Fedora Project CA'" cert_i_ou_valid
<RequireAny>
<RequireAll>
Require env cert_s_o_valid
Require env cert_s_ou_valid
Require env cert_i_o_valid
Require env cert_i_ou_valid
</RequireAll>
Require valid-user
</RequireAny>
{% endif %}
</Location> </Location>
# uncomment this to enable authentication via SSL client certificates # uncomment this to enable authentication via SSL client certificates