Make it easier to set up Apache httpd as a proxied service and a proxied NFS client #40
Conversation
The 80-httpd and 99-network-fs-clients examples might be used together such as an Apache httpd web server that authenticates web clients but is also authenticated itself as an NFS client to access remote content it must serve to web clients. This prevents ticket collisions in the credential caches by making them distinct for these two independent use cases so that they might be used together. Signed-off-by: John Florian <jflorian@doubledog.org>
GSS-Proxy might be used to authenticate web clients to httpd AND also authenticate the apache user running httpd to access networked file systems with Kerberos. Signed-off-by: John Florian <jflorian@doubledog.org>
There was a problem hiding this comment.
I am not sure I want to change the config snippets by default.
I think we should describe that an admin may want to change the ccache if he intends to use disjoint principals for the http and nfs service configurations (if the same principal is used and just mapped on the nfs server side, this change would not be necessary)
| make sure the HTTP stanza preceeds any ```allow_any_uid=yes``` sections.) | ||
| make sure the HTTP stanza precedes any ```allow_any_uid=yes``` sections.) | ||
|
|
||
| For the second goal, the proxy will require a keytab for the user principal (apache@REALM). Again, the uid used here is 48, but it must match whatever httpd is running as. |
There was a problem hiding this comment.
So while this is a valid choice, it is not required. It is as well possible to simply map the HTTP/fqdn principal to an "apache" user on the server for example.
So I think we should rephrase this bit something like "a principal that maps to the correct user on the server", then you can make an example using apache@REALM...
|
I think I follow and see why that would be less involved. Also seems more resilient to the order in which resources become available (booting a micro home data center or even installing rpms that want to conditionally add system users like Once again, thank you for taking the time to educate me. |
Per discussion#39.