Skip to content

Commit 58217d9

Browse files
canth1canth1
committed
mod_auth_gssapi: Add support for every configuration directive
1 parent ea09e3f commit 58217d9

File tree

3 files changed

+316
-23
lines changed

3 files changed

+316
-23
lines changed

‎manifests/vhost.pp

Lines changed: 31 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1509,9 +1509,37 @@
15091509
# directories => [
15101510
# { path => '/path/to/different/dir',
15111511
# gssapi => {
1512-
# credstore => 'keytab:/foo/bar.keytab',
1513-
# localname => 'Off',
1514-
# sslonly => 'On',
1512+
# acceptor_name => '{HOSTNAME}',
1513+
# allowed_mech => ['krb5', 'iakerb', 'ntlmssp'],
1514+
# basic_auth => true,
1515+
# basic_auth_mech => ['krb5', 'iakerb', 'ntlmssp'],
1516+
# basic_ticket_timeout => 300,
1517+
# connection_bound => true,
1518+
# cred_store => {
1519+
# ccache => ['/path/to/directory'],
1520+
# client_keytab => ['/path/to/example.keytab'],
1521+
# keytab => ['/path/to/example.keytab'],
1522+
# },
1523+
# deleg_ccache_dir => '/path/to/directory',
1524+
# deleg_ccache_env_var => 'KRB5CCNAME',
1525+
# deleg_ccache_perms => {
1526+
# mode => '0600',
1527+
# uid => 'example-user',
1528+
# gid => 'example-group',
1529+
# },
1530+
# deleg_ccache_unique => true,
1531+
# impersonate => true,
1532+
# local_name => true,
1533+
# name_attributes => 'json',
1534+
# negotiate_once => true,
1535+
# publish_errors => true,
1536+
# publish_mech => true,
1537+
# required_name_attributes => 'auth-indicators=high',
1538+
# session_key => 'file:/path/to/example.key',
1539+
# signal_persistent_auth => true,
1540+
# ssl_only => true,
1541+
# use_s4u2_proxy => true,
1542+
# use_sessions => true,
15151543
# }
15161544
# },
15171545
# ],

‎spec/defines/vhost_spec.rb

Lines changed: 163 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -252,9 +252,37 @@
252252
'passenger_app_log_file' => '/tmp/app.log',
253253
'passenger_debugger' => false,
254254
'gssapi' => {
255-
'credstore' => 'keytab:/foo/bar.keytab',
256-
'localname' => 'On',
257-
'sslonly' => 'Off',
255+
acceptor_name => '{HOSTNAME}',
256+
allowed_mech => ['krb5', 'iakerb', 'ntlmssp'],
257+
basic_auth => true,
258+
basic_auth_mech => ['krb5', 'iakerb', 'ntlmssp'],
259+
basic_ticket_timeout => 300,
260+
connection_bound => true,
261+
cred_store => {
262+
ccache => ['/path/to/directory'],
263+
client_keytab => ['/path/to/example.keytab'],
264+
keytab => ['/path/to/example.keytab'],
265+
},
266+
deleg_ccache_dir => '/path/to/directory',
267+
deleg_ccache_env_var => 'KRB5CCNAME',
268+
deleg_ccache_perms => {
269+
mode => '0600',
270+
uid => 'example-user',
271+
gid => 'example-group',
272+
},
273+
deleg_ccache_unique => true,
274+
impersonate => true,
275+
local_name => true,
276+
name_attributes => 'json',
277+
negotiate_once => true,
278+
publish_errors => true,
279+
publish_mech => true,
280+
required_name_attributes => 'auth-indicators=high',
281+
session_key => 'file:/path/to/example.key',
282+
signal_persistent_auth => true,
283+
ssl_only => true,
284+
use_s4u2_proxy => true,
285+
use_sessions => true,
258286
},
259287
},
260288
{
@@ -945,19 +973,149 @@
945973
}
946974
it {
947975
is_expected.to contain_concat__fragment('rspec.example.com-directories').with(
948-
content: %r{^\s+GssapiCredStore\skeytab:/foo/bar.keytab$},
976+
content: %r{^\s+GssapiAcceptorName\s{HOSTNAME}$},
977+
)
978+
}
979+
it {
980+
is_expected.to contain_concat__fragment('rspec.example.com-directories').with(
981+
content: %r{^\s+GssapiAllowedMech\skrb5$},
982+
)
983+
}
984+
it {
985+
is_expected.to contain_concat__fragment('rspec.example.com-directories').with(
986+
content: %r{^\s+GssapiAllowedMech\siakerb$},
987+
)
988+
}
989+
it {
990+
is_expected.to contain_concat__fragment('rspec.example.com-directories').with(
991+
content: %r{^\s+GssapiAllowedMech\sntlmssp$},
992+
)
993+
}
994+
it {
995+
is_expected.to contain_concat__fragment('rspec.example.com-directories').with(
996+
content: %r{^\s+GssapiBasicAuth\sOn$},
997+
)
998+
}
999+
it {
1000+
is_expected.to contain_concat__fragment('rspec.example.com-directories').with(
1001+
content: %r{^\s+GssapiBasicAuthMech\skrb5$},
1002+
)
1003+
}
1004+
it {
1005+
is_expected.to contain_concat__fragment('rspec.example.com-directories').with(
1006+
content: %r{^\s+GssapiBasicAuthMech\siakerb$},
1007+
)
1008+
}
1009+
it {
1010+
is_expected.to contain_concat__fragment('rspec.example.com-directories').with(
1011+
content: %r{^\s+GssapiBasicAuthMech\sntlmssp$},
1012+
)
1013+
}
1014+
it {
1015+
is_expected.to contain_concat__fragment('rspec.example.com-directories').with(
1016+
content: %r{^\s+GssapiBasicTicketTimeout\s300$},
1017+
)
1018+
}
1019+
it {
1020+
is_expected.to contain_concat__fragment('rspec.example.com-directories').with(
1021+
content: %r{^\s+GssapiConnectionBound\sOn$},
1022+
)
1023+
}
1024+
it {
1025+
is_expected.to contain_concat__fragment('rspec.example.com-directories').with(
1026+
content: %r{^\s+GssapiCredStore\sccache:FILE:/path/to/directory$},
1027+
)
1028+
}
1029+
it {
1030+
is_expected.to contain_concat__fragment('rspec.example.com-directories').with(
1031+
content: %r{^\s+GssapiCredStore\sclient_keytab:/path/to/example\.keytab$},
1032+
)
1033+
}
1034+
it {
1035+
is_expected.to contain_concat__fragment('rspec.example.com-directories').with(
1036+
content: %r{^\s+GssapiCredStore\skeytab:/path/to/example\.keytab$},
1037+
)
1038+
}
1039+
it {
1040+
is_expected.to contain_concat__fragment('rspec.example.com-directories').with(
1041+
content: %r{^\s+GssapiDelegCcacheDir\s/path/to/directory$},
1042+
)
1043+
}
1044+
it {
1045+
is_expected.to contain_concat__fragment('rspec.example.com-directories').with(
1046+
content: %r{^\s+GssapiDelegCcacheEnvVar\sKRB5CCNAME$},
1047+
)
1048+
}
1049+
it {
1050+
is_expected.to contain_concat__fragment('rspec.example.com-directories').with(
1051+
content: %r{^\s+GssapiDelegCcachePerms\smode:0600\suid:example-user\sgid:example-group$},
9491052
)
9501053
}
9511054
it {
9521055
is_expected.to contain_concat__fragment('rspec.example.com-directories').with(
953-
content: %r{^\s+GssapiSSLonly\sOff$},
1056+
content: %r{^\s+GssapiDelegCcacheUnique\sOn$},
1057+
)
1058+
}
1059+
it {
1060+
is_expected.to contain_concat__fragment('rspec.example.com-directories').with(
1061+
content: %r{^\s+GssapiImpersonate\sOn$},
9541062
)
9551063
}
9561064
it {
9571065
is_expected.to contain_concat__fragment('rspec.example.com-directories').with(
9581066
content: %r{^\s+GssapiLocalName\sOn$},
9591067
)
9601068
}
1069+
it {
1070+
is_expected.to contain_concat__fragment('rspec.example.com-directories').with(
1071+
content: %r{^\s+GssapiNameAttributes\sjson$},
1072+
)
1073+
}
1074+
it {
1075+
is_expected.to contain_concat__fragment('rspec.example.com-directories').with(
1076+
content: %r{^\s+GssapiNegotiateOnce\sOn$},
1077+
)
1078+
}
1079+
it {
1080+
is_expected.to contain_concat__fragment('rspec.example.com-directories').with(
1081+
content: %r{^\s+GssapiPublishErrors\sOn$},
1082+
)
1083+
}
1084+
it {
1085+
is_expected.to contain_concat__fragment('rspec.example.com-directories').with(
1086+
content: %r{^\s+GssapiPublishMech\sOn$},
1087+
)
1088+
}
1089+
it {
1090+
is_expected.to contain_concat__fragment('rspec.example.com-directories').with(
1091+
content: %r{^\s+GssapiRequiredNameAttributes\s"auth-indicators=high"$},
1092+
)
1093+
}
1094+
it {
1095+
is_expected.to contain_concat__fragment('rspec.example.com-directories').with(
1096+
content: %r{^\s+GssapiSessionKey\sfile:/path/to/example\.key$},
1097+
)
1098+
}
1099+
it {
1100+
is_expected.to contain_concat__fragment('rspec.example.com-directories').with(
1101+
content: %r{^\s+GssapiSignalPersistentAuth\sOn$},
1102+
)
1103+
}
1104+
it {
1105+
is_expected.to contain_concat__fragment('rspec.example.com-directories').with(
1106+
content: %r{^\s+GssapiSSLonly\sOn$},
1107+
)
1108+
}
1109+
it {
1110+
is_expected.to contain_concat__fragment('rspec.example.com-directories').with(
1111+
content: %r{^\s+GssapiUseS4U2Proxy\sOn$},
1112+
)
1113+
}
1114+
it {
1115+
is_expected.to contain_concat__fragment('rspec.example.com-directories').with(
1116+
content: %r{^\s+GssapiUseSessions\sOn$},
1117+
)
1118+
}
9611119
it {
9621120
is_expected.to contain_concat__fragment('rspec.example.com-directories').with(
9631121
content: %r{^\s+SSLVerifyClient\soptional$},

‎templates/vhost/_gssapi.epp

Lines changed: 122 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,123 @@
1-
<%|
1+
<%- |
22
# https://github.com/gssapi/mod_auth_gssapi
3-
Optional[String[1]] $credstore = undef,
4-
Optional[Enum['On','Off']] $sslonly = undef,
5-
Optional[Enum['On','Off']] $localname = undef,
6-
|%>
7-
# mod_auth_gssapi configuration
8-
<% if $sslonly { -%>
9-
GssapiSSLonly <%= $sslonly %>
10-
<% } -%>
11-
<% if $localname { -%>
12-
GssapiLocalName <%= $localname %>
13-
<% } -%>
14-
<% if $credstore { -%>
15-
GssapiCredStore <%= $credstore %>
16-
<% } -%>
3+
Optional[Variant[String[1], Enum['{HOSTNAME}']]] $acceptor_name = undef,
4+
Optional[Array[Enum['krb5','iakerb','ntlmssp']]] $allowed_mech = undef,
5+
Optional[Boolean] $basic_auth = undef,
6+
Optional[Array[Enum['krb5','iakerb','ntlmssp']]] $basic_auth_mech = undef,
7+
Optional[[Integer[1]]] $basic_ticket_timeout = undef,
8+
Optional[Boolean] $connection_bound = undef,
9+
Optional[Struct[{
10+
Optional['ccache'] => Array[Stdlib::Unixpath],
11+
Optional['client_keytab'] => Array[Stdlib::Unixpath],
12+
Optional['keytab'] => Array[Stdlib::Unixpath],
13+
}]] $cred_store = undef,
14+
Optional[Stdlib::Unixpath] $deleg_ccache_dir = undef,
15+
Optional[[String[1]]] $deleg_ccache_env_var = undef,
16+
Optional[Struct[{
17+
'mode' => Stdlib::Filemode,
18+
'uid' => Variant[Integer[1], String[1]],
19+
'gid' => Variant[Integer[1], String[1]],
20+
}]] $deleg_ccache_perms = undef,
21+
Optional[Boolean] $deleg_ccache_unique = undef,
22+
Optional[Boolean] $impersonate = undef,
23+
Optional[Boolean] $local_name = undef,
24+
Optional[Variant[String[1], Enum['json']]] $name_attributes = undef,
25+
Optional[Boolean] $negotiate_once = undef,
26+
Optional[Boolean] $publish_errors = undef,
27+
Optional[Boolean] $publish_mech = undef,
28+
Optional[[String[1]]] $required_name_attributes = undef,
29+
Optional[[String[1]]] $session_key = undef,
30+
Optional[Boolean] $signal_persistent_auth = undef,
31+
Optional[Boolean] $ssl_only = undef,
32+
Optional[Boolean] $use_s4u2_proxy = undef,
33+
Optional[Boolean] $use_sessions = undef,
34+
| -%>
35+
36+
# mod_auth_gssapi configuration
37+
<%- if $acceptor_name { -%>
38+
GssapiAcceptorName <%= $acceptor_name %>
39+
<%- } -%>
40+
<%- if $allowed_mech { -%>
41+
<%- $allowed_mech.each |$mech| { -%>
42+
GssapiAllowedMech <%= $mech %>
43+
<%- } -%>
44+
<%- } -%>
45+
<%- if $basic_auth { -%>
46+
GssapiBasicAuth On
47+
<%- } -%>
48+
<%- if $basic_auth_mech { -%>
49+
<%- $basic_auth_mech.each |$mech| { -%>
50+
GssapiBasicAuthMech <%= $mech %>
51+
<%- } -%>
52+
<%- } -%>
53+
<%- if $basic_ticket_timeout { -%>
54+
GssapiBasicTicketTimeout <%= $basic_ticket_timeout %>
55+
<%- } -%>
56+
<%- if $connection_bound { -%>
57+
GssapiConnectionBound On
58+
<%- } -%>
59+
<%- if $cred_store { -%>
60+
<%- if $cred_store[ccache] { -%>
61+
<%- $cred_store[ccache].each |$path| { -%>
62+
GssapiCredStore ccache:FILE:<%= $path %>
63+
<%- } -%>
64+
<%- } -%>
65+
<%- if $cred_store[client_keytab] { -%>
66+
<%- $cred_store[client_keytab].each |$path| { -%>
67+
GssapiCredStore client_keytab:<%= $path %>
68+
<%- } -%>
69+
<%- } -%>
70+
<%- if $cred_store[keytab] { -%>
71+
<%- $cred_store[keytab].each |$path| { -%>
72+
GssapiCredStore keytab:<%= $path %>
73+
<%- } -%>
74+
<%- } -%>
75+
<%- } -%>
76+
<%- if $deleg_ccache_dir { -%>
77+
GssapiDelegCcacheDir <%= $deleg_ccache_dir %>
78+
<%- } -%>
79+
<%- if $deleg_ccache_env_var { -%>
80+
GssapiDelegCcacheEnvVar <%= $deleg_ccache_env_var %>
81+
<%- } -%>
82+
<%- if $deleg_ccache_perms { -%>
83+
GssapiDelegCcachePerms mode:<%= $deleg_ccache_perms[mode] %> uid:<%= $deleg_ccache_perms[uid] %> gid:<%= $deleg_ccache_perms[gid] %>
84+
<%- } -%>
85+
<%- if $deleg_ccache_unique { -%>
86+
GssapiDelegCcacheUnique On
87+
<%- } -%>
88+
<%- if $impersonate { -%>
89+
GssapiImpersonate On
90+
<%- } -%>
91+
<%- if $local_name { -%>
92+
GssapiLocalName On
93+
<%- } -%>
94+
<%- if $name_attributes { -%>
95+
GssapiNameAttributes <%= $name_attributes %>
96+
<%- } -%>
97+
<%- if $negotiate_once { -%>
98+
GssapiNegotiateOnce On
99+
<%- } -%>
100+
<%- if $publish_errors { -%>
101+
GssapiPublishErrors On
102+
<%- } -%>
103+
<%- if $publish_mech { -%>
104+
GssapiPublishMech On
105+
<%- } -%>
106+
<%- if $required_name_attributes { -%>
107+
GssapiRequiredNameAttributes "<%= $required_name_attributes %>"
108+
<%- } -%>
109+
<%- if $session_key { -%>
110+
GssapiSessionKey <%= $session_key %>
111+
<%- } -%>
112+
<%- if $signal_persistent_auth { -%>
113+
GssapiSignalPersistentAuth On
114+
<%- } -%>
115+
<%- if $ssl_only { -%>
116+
GssapiSSLonly On
117+
<%- } -%>
118+
<%- if $use_s4u2_proxy and $deleg_ccache_dir { -%>
119+
GssapiUseS4U2Proxy On
120+
<%- } -%>
121+
<%- if $use_sessions { -%>
122+
GssapiUseSessions On
123+
<%- } -%>

0 commit comments

Comments
 (0)