Skip to content

Commit 25262ba

Browse files
ekohlekohl
committed
Convert Apache IPA authentication template to EPP
This moves the IPA authentication from 4 separate ERB files to a single EPP file. This gives better guarantees because of data types. It's also easier to maintain a single file that gives the complete overview of the feature. It's moved to foreman::config::apache together with the inclusion of required modules. This does make the http_keytab variable a bit uglier.
1 parent 5f38479 commit 25262ba

File tree

7 files changed

+84
-83
lines changed

7 files changed

+84
-83
lines changed

‎manifests/config.pp‎

Lines changed: 1 addition & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -207,7 +207,7 @@
207207
content => template('foreman/pam_service.erb'),
208208
}
209209

210-
$http_keytab = pick($foreman::http_keytab, "${apache::conf_dir}/http.keytab")
210+
$http_keytab = $foreman::config::apache::http_keytab
211211

212212
exec { 'ipa-getkeytab':
213213
command => "/bin/echo Get keytab \
@@ -222,24 +222,6 @@
222222
mode => '0600',
223223
}
224224

225-
$gssapi_local_name = bool2str($foreman::gssapi_local_name, 'On', 'Off')
226-
227-
foreman::config::apache::fragment { 'intercept_form_submit':
228-
ssl_content => template('foreman/intercept_form_submit.conf.erb'),
229-
}
230-
231-
foreman::config::apache::fragment { 'lookup_identity':
232-
ssl_content => template('foreman/lookup_identity.conf.erb'),
233-
}
234-
235-
foreman::config::apache::fragment { 'auth_gssapi':
236-
ssl_content => template('foreman/auth_gssapi.conf.erb'),
237-
}
238-
239-
foreman::config::apache::fragment { 'external_auth_api':
240-
ssl_content => template('foreman/external_auth_api.conf.erb'),
241-
}
242-
243225
if $foreman::ipa_manage_sssd {
244226
$sssd = pick(fact('foreman_sssd'), {})
245227
$sssd_services = join(unique(pick($sssd['services'], []) + ['ifp']), ', ')

‎manifests/config/apache.pp‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -238,6 +238,20 @@
238238
include apache::mod::intercept_form_submit
239239
include apache::mod::lookup_identity
240240
include apache::mod::auth_gssapi
241+
242+
# This is also used in manifests::config
243+
$http_keytab = pick($foreman::http_keytab, "${apache::conf_dir}/http.keytab")
244+
245+
$external_auth_context = {
246+
'pam_service' => $foreman::pam_service,
247+
'keytab' => $foreman::http_keytab,
248+
'gssapi_local_name' => $foreman::gssapi_local_name,
249+
'ipa_authentication_api' => $foreman::ipa_authentication_api,
250+
}
251+
252+
foreman::config::apache::fragment { 'intercept_form_submit':
253+
ssl_content => epp('foreman/apache_ipa_authentication.epp', $external_auth_context),
254+
}
241255
} elsif $keycloak {
242256
include apache::mod::auth_openidc
243257

‎templates/apache_ipa_authentication.epp‎

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
<%|
2+
String[1] $pam_service,
3+
Stdlib::Absolutepath $keytab,
4+
Boolean $gssapi_local_name,
5+
Boolean $ipa_authentication_api,
6+
-%>
7+
8+
<Location /users/login>
9+
InterceptFormPAMService <%= $pam_service %>
10+
InterceptFormLogin login[login]
11+
InterceptFormPassword login[password]
12+
</Location>
13+
14+
<LocationMatch ^(/api(/v2)?)?/users/(ext)?login/?$>
15+
LookupUserAttr email REMOTE_USER_EMAIL
16+
LookupUserAttr firstname REMOTE_USER_FIRSTNAME
17+
LookupUserAttr lastname REMOTE_USER_LASTNAME
18+
LookupUserGroups REMOTE_USER_GROUPS :
19+
LookupUserGroupsIter REMOTE_USER_GROUP
20+
21+
# Set headers for proxy requests
22+
RequestHeader set REMOTE_USER %{REMOTE_USER}e
23+
RequestHeader set REMOTE_USER_EMAIL %{REMOTE_USER_EMAIL}e
24+
RequestHeader set REMOTE_USER_FIRSTNAME %{REMOTE_USER_FIRSTNAME}e
25+
RequestHeader set REMOTE_USER_LASTNAME %{REMOTE_USER_LASTNAME}e
26+
RequestHeader set REMOTE_USER_GROUPS %{REMOTE_USER_GROUPS}e
27+
</LocationMatch>
28+
29+
<LocationMatch ^/users/extlogin/?$>
30+
SSLRequireSSL
31+
AuthType GSSAPI
32+
AuthName "GSSAPI Single Sign On Login"
33+
GssapiCredStore keytab:<%= $keytab %>
34+
GssapiSSLonly On
35+
GssapiLocalName <%= $gssapi_local_name %>
36+
# require valid-user
37+
require pam-account <%= $pam_service %>
38+
ErrorDocument 401 '<html><meta http-equiv="refresh" content="0; URL=/users/login"><body>Kerberos authentication did not pass.</body></html>'
39+
# The following is needed as a workaround for https://bugzilla.redhat.com/show_bug.cgi?id=1020087
40+
ErrorDocument 500 '<html><meta http-equiv="refresh" content="0; URL=/users/login"><body>Kerberos authentication did not pass.</body></html>'
41+
</LocationMatch>
42+
43+
<LocationMatch ^/api(/v2)?/users/extlogin/?$>
44+
SSLRequireSSL
45+
<% if $ipa_authentication_api -%>
46+
<If "%{HTTP:Authorization} =~ /^Basic/">
47+
AuthType Basic
48+
AuthName "PAM Authentication"
49+
AuthBasicProvider PAM
50+
AuthPAMService <%= $pam_service %>
51+
</If>
52+
<Else>
53+
AuthType GSSAPI
54+
AuthName "GSSAPI Single Sign On Login"
55+
GssapiCredStore keytab:<%= $keytab %>
56+
GssapiSSLonly On
57+
GssapiLocalName <%= apache::bool2httpd($gssapi_local_name) %>
58+
</Else>
59+
<% else -%>
60+
AuthType Basic
61+
AuthName "PAM Authentication"
62+
AuthBasicProvider PAM
63+
AuthPAMService <%= $pam_service %>
64+
<% end -%>
65+
require pam-account <%= $pam_service %>
66+
ErrorDocument 401 '{ "error": "External authentication did not pass." }'
67+
# The following is needed as a workaround for https://bugzilla.redhat.com/show_bug.cgi?id=1020087
68+
ErrorDocument 500 '{ "error": "External authentication did not pass." }'
69+
</LocationMatch>

‎templates/auth_gssapi.conf.erb‎

Lines changed: 0 additions & 14 deletions
This file was deleted.

‎templates/external_auth_api.conf.erb‎

Lines changed: 0 additions & 28 deletions
This file was deleted.

‎templates/intercept_form_submit.conf.erb‎

Lines changed: 0 additions & 7 deletions
This file was deleted.

‎templates/lookup_identity.conf.erb‎

Lines changed: 0 additions & 15 deletions
This file was deleted.

0 commit comments

Comments
 (0)