freeipa

#5959 The framework needs to run in a spearate process
Closed: fixed Opened by simo.

Closed: fixed
Reopen Issue

The IPA framework should sto prunning as the Apache user and instead be run as a separate use via mod_wsgi configuration.

This is need to implement privilege separation so that the framework will not be able to impersonate random users, only the apache authentication modules should be able to.

This is related to both efforts to introduce External Authentication[1] and efforts to add GSSAPI authentication proxying to dogtag[2].

[1] http://www.freeipa.org/page/V4/External_Authentication
[2] https://fedorahosted.org/freeipa/ticket/5011

master:

  • d5af11f65cc2a2d6860579a63a173b67cb12bcf3 renew agent: handle non-replicated certificates
  • ad49bda907b3c2ec5b98946a2c4000bb6edaf835 dogtaginstance: track server certificate with our renew agent
  • 926fe2049a1839fd7e68c9fa55f64154ee83c841 cainstance: do not configure renewal guard

master:

  • c894ebefc5c4c4c7ea340d6ddc4cd3c081917e4a Change session handling
  • 38c66896de1769077cd5b057133606ec5eeaf62b Generate tmpfiles config at install time
  • b109f5d850ce13585d4392ca48896dc069a746e5 Drop use of kinit_as_http from trust code
  • b6741d81e187fc84177c12ef8ad900d3b5cda6a4 Use Anonymous user to obtain FAST armor ccache
  • d2f5fc304f1938d23171ae330fa20b213ceed54e Configure HTTPD to work via Gss-Proxy
  • d124e307f3b7d88bca53784f030ed6043b224432 Separate RA cert store from the HTTP cert store
  • f648c5631afa5e7954eee9a84fb1222d3bce3bf1 Simplify NSSDatabase password file handling
  • c2b1b2a36200b50babfda1eca37fb4b51fefa9c6 Always use /etc/ipa/ca.crt as CA cert file
  • 4fd89833ee5421b05c10329d627d0e0fc8496046 Add a new user to run the framework code
  • 4bd2d6ad46c9151e11f9223dd5383555fdedb249 Rationalize creation of RA and HTTPD NSS databases
  • 00a9d2f94dee17e28e39cdae0c32acc3d1fe51ed Fix uninstall stopping ipa.service
  • 41c1efc44a6b809445facd4772574595029553b1 Allow rpc callers to pass ccache and service names
  • 09c92e2bc1ca9db5b73d5ab8483b42dbd6b9a0e9 Explicitly pass down ccache names for connections
  • e4d462ad53597fd5410aa4e94a57bb15b92a3f13 Insure removal of session on identity change

master:

  • b4fa354f500bcf3ac23ee3805f2c166c6a635b92 client install: create /etc/ipa/nssdb with correct mode
  • ba8a10fbdb39cab672038e1a6dc9c7507070cdf9 server upgrade: fix upgrade in CA-less
  • 97e838e10da3b42e3605d230e0b8e01b9148876f server upgrade: fix upgrade from pre-4.0
  • 6d34c2169fcd520cc726e58e01d008ae3637aad4 server upgrade: uninstall ipa_memcached properly

master:

  • 32076df10231b381a80c9ef850c2c31d7a25feb8 Fix ipa-server-upgrade

Metadata Update from @simo:
- Issue assigned to someone
- Issue set to the milestone: FreeIPA 4.5

master:

  • d5e7a57e5b25b9cecb7a65096487a65374ad860d Limit sessions to 30 minutes by default

master:

  • 8fb61a55fe32438752567bde8af73d6b8230a386 backup: backup anonymous keytab

Metadata Update from @mbasti:
- Issue set to the milestone: FreeIPA 4.5.1 (was: FreeIPA 4.5)

Was implemented in 4.5. Regressions are filed separately.

Metadata Update from @pvoborni:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
Low
task
IPA
5011
0
http://www.freeipa.org/page/V4/External_Authentication
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.