Infrastructure/ansible
3
0
Fork 0
Code Issues Pull requests 6 Projects Releases Packages Wiki Activity Actions

Enable GSSAPI

Browse source 
Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com>
This commit is contained in:
Patrick Uiterwijk 2016-12-12 00:31:30 +00:00
parent 8f24e63bcb
commit bbdef52169
1 changed files with 0 additions and 26 deletions
Download patch file Download diff file Expand all files Collapse all files

26
roles/koji_hub/templates/kojihub.conf.j2
View file

@ -24,39 +24,13 @@ Alias /kojifiles "/mnt/koji/"
</Directory> </Directory>
{% endif %} {% endif %}
{% if env == "production" %}
SSLVerifyClient optional
{% endif %}
<Location /kojihub/ssllogin> <Location /kojihub/ssllogin>
{% if env == "production" %}
SSLVerifyClient require
SSLVerifyDepth 10
SSLOptions +StdEnvVars
# This complicated ACL stuff is to support both SSL and kerb auth at the same time
# To be killed on December 12th, 2016, after which "Require valid-user" remains
#SetEnvIfExpr "%{SSL_CLIENT_S_DN_O} == 'Fedora Project'" cert_s_o_valid
#SetEnvIfExpr "%{SSL_CLIENT_S_DN_OU} == 'Fedora User Cert'" cert_s_ou_valid
#SetEnvIfExpr "%{SSL_CLIENT_I_DN_O} == 'Fedora Project'" cert_i_o_valid
#SetEnvIfExpr "%{SSL_CLIENT_I_DN_OU} == 'Fedora Project CA'" cert_i_ou_valid
#<RequireAny>
# <RequireAll>
# Require env cert_s_o_valid
# Require env cert_s_ou_valid
# Require env cert_i_o_valid
# Require env cert_i_ou_valid
# </RequireAll>
# Require valid-user
# </RequireAny>
{% else %}
AuthType GSSAPI AuthType GSSAPI
GssapiSSLonly On GssapiSSLonly On
GssapiLocalName On GssapiLocalName On
AuthName "GSSAPI Single Sign On Login" AuthName "GSSAPI Single Sign On Login"
GssapiCredStore keytab:/etc/koji-hub-http.keytab GssapiCredStore keytab:/etc/koji-hub-http.keytab
Require valid-user Require valid-user
{% endif %}
</Location> </Location>
# uncomment this to enable authentication via SSL client certificates # uncomment this to enable authentication via SSL client certificates