Skip to content

Commit 03df30e

Browse files
david22swandavid22swan
authored
Merge pull request #2214 from canth1/master
mod_auth_gssapi: Add support for every configuration directive
2 parents 5666926 + e60af06 commit 03df30e

File tree

3 files changed

+310
-28
lines changed

3 files changed

+310
-28
lines changed

‎manifests/vhost.pp

Lines changed: 31 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1463,10 +1463,37 @@
14631463
# directories => [
14641464
# { path => '/path/to/different/dir',
14651465
# gssapi => {
1466-
# basicauth => 'On',
1467-
# credstore => 'keytab:/foo/bar.keytab',
1468-
# localname => 'Off',
1469-
# sslonly => 'On',
1466+
# acceptor_name => '{HOSTNAME}',
1467+
# allowed_mech => ['krb5', 'iakerb', 'ntlmssp'],
1468+
# basic_auth => true,
1469+
# basic_auth_mech => ['krb5', 'iakerb', 'ntlmssp'],
1470+
# basic_ticket_timeout => 300,
1471+
# connection_bound => true,
1472+
# cred_store => {
1473+
# ccache => ['/path/to/directory'],
1474+
# client_keytab => ['/path/to/example.keytab'],
1475+
# keytab => ['/path/to/example.keytab'],
1476+
# },
1477+
# deleg_ccache_dir => '/path/to/directory',
1478+
# deleg_ccache_env_var => 'KRB5CCNAME',
1479+
# deleg_ccache_perms => {
1480+
# mode => '0600',
1481+
# uid => 'example-user',
1482+
# gid => 'example-group',
1483+
# },
1484+
# deleg_ccache_unique => true,
1485+
# impersonate => true,
1486+
# local_name => true,
1487+
# name_attributes => 'json',
1488+
# negotiate_once => true,
1489+
# publish_errors => true,
1490+
# publish_mech => true,
1491+
# required_name_attributes => 'auth-indicators=high',
1492+
# session_key => 'file:/path/to/example.key',
1493+
# signal_persistent_auth => true,
1494+
# ssl_only => true,
1495+
# use_s4u2_proxy => true,
1496+
# use_sessions => true,
14701497
# }
14711498
# },
14721499
# ],

‎spec/defines/vhost_spec.rb

Lines changed: 158 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -267,10 +267,37 @@
267267
'passenger_app_log_file' => '/tmp/app.log',
268268
'passenger_debugger' => false,
269269
'gssapi' => {
270-
'basicauth' => 'On',
271-
'credstore' => 'keytab:/foo/bar.keytab',
272-
'localname' => 'On',
273-
'sslonly' => 'Off',
270+
'acceptor_name' => '{HOSTNAME}',
271+
'allowed_mech' => ['krb5', 'iakerb', 'ntlmssp'],
272+
'basic_auth' => true,
273+
'basic_auth_mech' => ['krb5', 'iakerb', 'ntlmssp'],
274+
'basic_ticket_timeout' => 300,
275+
'connection_bound' => true,
276+
'cred_store' => {
277+
'ccache' => ['/path/to/directory'],
278+
'client_keytab' => ['/path/to/example.keytab'],
279+
'keytab' => ['/path/to/example.keytab'],
280+
},
281+
'deleg_ccache_dir' => '/path/to/directory',
282+
'deleg_ccache_env_var' => 'KRB5CCNAME',
283+
'deleg_ccache_perms' => {
284+
'mode' => '0600',
285+
'uid' => 'example-user',
286+
'gid' => 'example-group',
287+
},
288+
'deleg_ccache_unique' => true,
289+
'impersonate' => true,
290+
'local_name' => true,
291+
'name_attributes' => 'json',
292+
'negotiate_once' => true,
293+
'publish_errors' => true,
294+
'publish_mech' => true,
295+
'required_name_attributes' => 'auth-indicators=high',
296+
'session_key' => 'file:/path/to/example.key',
297+
'signal_persistent_auth' => true,
298+
'ssl_only' => true,
299+
'use_s4u2_proxy' => true,
300+
'use_sessions' => true,
274301
},
275302
},
276303
{
@@ -971,26 +998,151 @@
971998
content: %r{^\s+PassengerDebugger\sOff$},
972999
)
9731000
}
1001+
it {
1002+
is_expected.to contain_concat__fragment('rspec.example.com-directories').with(
1003+
content: %r{^\s+GssapiAcceptorName\s{HOSTNAME}$},
1004+
)
1005+
}
1006+
it {
1007+
is_expected.to contain_concat__fragment('rspec.example.com-directories').with(
1008+
content: %r{^\s+GssapiAllowedMech\skrb5$},
1009+
)
1010+
}
1011+
it {
1012+
is_expected.to contain_concat__fragment('rspec.example.com-directories').with(
1013+
content: %r{^\s+GssapiAllowedMech\siakerb$},
1014+
)
1015+
}
1016+
it {
1017+
is_expected.to contain_concat__fragment('rspec.example.com-directories').with(
1018+
content: %r{^\s+GssapiAllowedMech\sntlmssp$},
1019+
)
1020+
}
9741021
it {
9751022
is_expected.to contain_concat__fragment('rspec.example.com-directories').with(
9761023
content: %r{^\s+GssapiBasicAuth\sOn$},
9771024
)
9781025
}
9791026
it {
9801027
is_expected.to contain_concat__fragment('rspec.example.com-directories').with(
981-
content: %r{^\s+GssapiCredStore\skeytab:/foo/bar.keytab$},
1028+
content: %r{^\s+GssapiBasicAuthMech\skrb5$},
1029+
)
1030+
}
1031+
it {
1032+
is_expected.to contain_concat__fragment('rspec.example.com-directories').with(
1033+
content: %r{^\s+GssapiBasicAuthMech\siakerb$},
1034+
)
1035+
}
1036+
it {
1037+
is_expected.to contain_concat__fragment('rspec.example.com-directories').with(
1038+
content: %r{^\s+GssapiBasicAuthMech\sntlmssp$},
1039+
)
1040+
}
1041+
it {
1042+
is_expected.to contain_concat__fragment('rspec.example.com-directories').with(
1043+
content: %r{^\s+GssapiBasicTicketTimeout\s300$},
1044+
)
1045+
}
1046+
it {
1047+
is_expected.to contain_concat__fragment('rspec.example.com-directories').with(
1048+
content: %r{^\s+GssapiConnectionBound\sOn$},
1049+
)
1050+
}
1051+
it {
1052+
is_expected.to contain_concat__fragment('rspec.example.com-directories').with(
1053+
content: %r{^\s+GssapiCredStore\sccache:FILE:/path/to/directory$},
1054+
)
1055+
}
1056+
it {
1057+
is_expected.to contain_concat__fragment('rspec.example.com-directories').with(
1058+
content: %r{^\s+GssapiCredStore\sclient_keytab:/path/to/example\.keytab$},
1059+
)
1060+
}
1061+
it {
1062+
is_expected.to contain_concat__fragment('rspec.example.com-directories').with(
1063+
content: %r{^\s+GssapiCredStore\skeytab:/path/to/example\.keytab$},
1064+
)
1065+
}
1066+
it {
1067+
is_expected.to contain_concat__fragment('rspec.example.com-directories').with(
1068+
content: %r{^\s+GssapiDelegCcacheDir\s/path/to/directory$},
1069+
)
1070+
}
1071+
it {
1072+
is_expected.to contain_concat__fragment('rspec.example.com-directories').with(
1073+
content: %r{^\s+GssapiDelegCcacheEnvVar\sKRB5CCNAME$},
1074+
)
1075+
}
1076+
it {
1077+
is_expected.to contain_concat__fragment('rspec.example.com-directories').with(
1078+
content: %r{^\s+GssapiDelegCcachePerms\smode:0600\suid:example-user\sgid:example-group$},
9821079
)
9831080
}
9841081
it {
9851082
is_expected.to contain_concat__fragment('rspec.example.com-directories').with(
986-
content: %r{^\s+GssapiSSLonly\sOff$},
1083+
content: %r{^\s+GssapiDelegCcacheUnique\sOn$},
1084+
)
1085+
}
1086+
it {
1087+
is_expected.to contain_concat__fragment('rspec.example.com-directories').with(
1088+
content: %r{^\s+GssapiImpersonate\sOn$},
9871089
)
9881090
}
9891091
it {
9901092
is_expected.to contain_concat__fragment('rspec.example.com-directories').with(
9911093
content: %r{^\s+GssapiLocalName\sOn$},
9921094
)
9931095
}
1096+
it {
1097+
is_expected.to contain_concat__fragment('rspec.example.com-directories').with(
1098+
content: %r{^\s+GssapiNameAttributes\sjson$},
1099+
)
1100+
}
1101+
it {
1102+
is_expected.to contain_concat__fragment('rspec.example.com-directories').with(
1103+
content: %r{^\s+GssapiNegotiateOnce\sOn$},
1104+
)
1105+
}
1106+
it {
1107+
is_expected.to contain_concat__fragment('rspec.example.com-directories').with(
1108+
content: %r{^\s+GssapiPublishErrors\sOn$},
1109+
)
1110+
}
1111+
it {
1112+
is_expected.to contain_concat__fragment('rspec.example.com-directories').with(
1113+
content: %r{^\s+GssapiPublishMech\sOn$},
1114+
)
1115+
}
1116+
it {
1117+
is_expected.to contain_concat__fragment('rspec.example.com-directories').with(
1118+
content: %r{^\s+GssapiRequiredNameAttributes\s"auth-indicators=high"$},
1119+
)
1120+
}
1121+
it {
1122+
is_expected.to contain_concat__fragment('rspec.example.com-directories').with(
1123+
content: %r{^\s+GssapiSessionKey\sfile:/path/to/example\.key$},
1124+
)
1125+
}
1126+
it {
1127+
is_expected.to contain_concat__fragment('rspec.example.com-directories').with(
1128+
content: %r{^\s+GssapiSignalPersistentAuth\sOn$},
1129+
)
1130+
}
1131+
it {
1132+
is_expected.to contain_concat__fragment('rspec.example.com-directories').with(
1133+
content: %r{^\s+GssapiSSLonly\sOn$},
1134+
)
1135+
}
1136+
it {
1137+
is_expected.to contain_concat__fragment('rspec.example.com-directories').with(
1138+
content: %r{^\s+GssapiUseS4U2Proxy\sOn$},
1139+
)
1140+
}
1141+
it {
1142+
is_expected.to contain_concat__fragment('rspec.example.com-directories').with(
1143+
content: %r{^\s+GssapiUseSessions\sOn$},
1144+
)
1145+
}
9941146
it {
9951147
is_expected.to contain_concat__fragment('rspec.example.com-directories').with(
9961148
content: %r{^\s+SSLVerifyClient\soptional$},

‎templates/vhost/_gssapi.epp

Lines changed: 121 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -1,20 +1,123 @@
1-
<%|
1+
<%- |
22
# https://github.com/gssapi/mod_auth_gssapi
3-
Optional[Enum['On','Off']] $basicauth = undef,
4-
Optional[String[1]] $credstore = undef,
5-
Optional[Enum['On','Off']] $sslonly = undef,
6-
Optional[Enum['On','Off']] $localname = undef,
7-
|%>
3+
Optional[Variant[String[1], Enum['{HOSTNAME}']]] $acceptor_name = undef,
4+
Optional[Array[Enum['krb5','iakerb','ntlmssp']]] $allowed_mech = undef,
5+
Optional[Boolean] $basic_auth = undef,
6+
Optional[Array[Enum['krb5','iakerb','ntlmssp']]] $basic_auth_mech = undef,
7+
Optional[[Integer[1]]] $basic_ticket_timeout = undef,
8+
Optional[Boolean] $connection_bound = undef,
9+
Optional[Struct[{
10+
Optional['ccache'] => Array[Stdlib::Unixpath],
11+
Optional['client_keytab'] => Array[Stdlib::Unixpath],
12+
Optional['keytab'] => Array[Stdlib::Unixpath],
13+
}]] $cred_store = undef,
14+
Optional[Stdlib::Unixpath] $deleg_ccache_dir = undef,
15+
Optional[[String[1]]] $deleg_ccache_env_var = undef,
16+
Optional[Struct[{
17+
'mode' => Stdlib::Filemode,
18+
'uid' => Variant[Integer[1], String[1]],
19+
'gid' => Variant[Integer[1], String[1]],
20+
}]] $deleg_ccache_perms = undef,
21+
Optional[Boolean] $deleg_ccache_unique = undef,
22+
Optional[Boolean] $impersonate = undef,
23+
Optional[Boolean] $local_name = undef,
24+
Optional[Variant[String[1], Enum['json']]] $name_attributes = undef,
25+
Optional[Boolean] $negotiate_once = undef,
26+
Optional[Boolean] $publish_errors = undef,
27+
Optional[Boolean] $publish_mech = undef,
28+
Optional[[String[1]]] $required_name_attributes = undef,
29+
Optional[[String[1]]] $session_key = undef,
30+
Optional[Boolean] $signal_persistent_auth = undef,
31+
Optional[Boolean] $ssl_only = undef,
32+
Optional[Boolean] $use_s4u2_proxy = undef,
33+
Optional[Boolean] $use_sessions = undef,
34+
| -%>
35+
836
# mod_auth_gssapi configuration
9-
<% if $basicauth { -%>
10-
GssapiBasicAuth <%= $basicauth %>
11-
<% } -%>
12-
<% if $sslonly { -%>
13-
GssapiSSLonly <%= $sslonly %>
14-
<% } -%>
15-
<% if $localname { -%>
16-
GssapiLocalName <%= $localname %>
17-
<% } -%>
18-
<% if $credstore { -%>
19-
GssapiCredStore <%= $credstore %>
20-
<% } -%>
37+
<%- if $acceptor_name { -%>
38+
GssapiAcceptorName <%= $acceptor_name %>
39+
<%- } -%>
40+
<%- if $allowed_mech { -%>
41+
<%- $allowed_mech.each |$mech| { -%>
42+
GssapiAllowedMech <%= $mech %>
43+
<%- } -%>
44+
<%- } -%>
45+
<%- if $basic_auth { -%>
46+
GssapiBasicAuth On
47+
<%- } -%>
48+
<%- if $basic_auth_mech { -%>
49+
<%- $basic_auth_mech.each |$mech| { -%>
50+
GssapiBasicAuthMech <%= $mech %>
51+
<%- } -%>
52+
<%- } -%>
53+
<%- if $basic_ticket_timeout { -%>
54+
GssapiBasicTicketTimeout <%= $basic_ticket_timeout %>
55+
<%- } -%>
56+
<%- if $connection_bound { -%>
57+
GssapiConnectionBound On
58+
<%- } -%>
59+
<%- if $cred_store { -%>
60+
<%- if $cred_store[ccache] { -%>
61+
<%- $cred_store[ccache].each |$path| { -%>
62+
GssapiCredStore ccache:FILE:<%= $path %>
63+
<%- } -%>
64+
<%- } -%>
65+
<%- if $cred_store[client_keytab] { -%>
66+
<%- $cred_store[client_keytab].each |$path| { -%>
67+
GssapiCredStore client_keytab:<%= $path %>
68+
<%- } -%>
69+
<%- } -%>
70+
<%- if $cred_store[keytab] { -%>
71+
<%- $cred_store[keytab].each |$path| { -%>
72+
GssapiCredStore keytab:<%= $path %>
73+
<%- } -%>
74+
<%- } -%>
75+
<%- } -%>
76+
<%- if $deleg_ccache_dir { -%>
77+
GssapiDelegCcacheDir <%= $deleg_ccache_dir %>
78+
<%- } -%>
79+
<%- if $deleg_ccache_env_var { -%>
80+
GssapiDelegCcacheEnvVar <%= $deleg_ccache_env_var %>
81+
<%- } -%>
82+
<%- if $deleg_ccache_perms { -%>
83+
GssapiDelegCcachePerms mode:<%= $deleg_ccache_perms[mode] %> uid:<%= $deleg_ccache_perms[uid] %> gid:<%= $deleg_ccache_perms[gid] %>
84+
<%- } -%>
85+
<%- if $deleg_ccache_unique { -%>
86+
GssapiDelegCcacheUnique On
87+
<%- } -%>
88+
<%- if $impersonate { -%>
89+
GssapiImpersonate On
90+
<%- } -%>
91+
<%- if $local_name { -%>
92+
GssapiLocalName On
93+
<%- } -%>
94+
<%- if $name_attributes { -%>
95+
GssapiNameAttributes <%= $name_attributes %>
96+
<%- } -%>
97+
<%- if $negotiate_once { -%>
98+
GssapiNegotiateOnce On
99+
<%- } -%>
100+
<%- if $publish_errors { -%>
101+
GssapiPublishErrors On
102+
<%- } -%>
103+
<%- if $publish_mech { -%>
104+
GssapiPublishMech On
105+
<%- } -%>
106+
<%- if $required_name_attributes { -%>
107+
GssapiRequiredNameAttributes "<%= $required_name_attributes %>"
108+
<%- } -%>
109+
<%- if $session_key { -%>
110+
GssapiSessionKey <%= $session_key %>
111+
<%- } -%>
112+
<%- if $signal_persistent_auth { -%>
113+
GssapiSignalPersistentAuth On
114+
<%- } -%>
115+
<%- if $ssl_only { -%>
116+
GssapiSSLonly On
117+
<%- } -%>
118+
<%- if $use_s4u2_proxy and $deleg_ccache_dir { -%>
119+
GssapiUseS4U2Proxy On
120+
<%- } -%>
121+
<%- if $use_sessions { -%>
122+
GssapiUseSessions On
123+
<%- } -%>

0 commit comments

Comments
 (0)