freeipa

#5699 switch to mod_auth_gssapi sessions
Closed: fixed Opened by pvoborni.

Closed: fixed
Reopen Issue

FreeIPA API uses its own implementation of sessions, cookies and manipulation of Kerberos ccaches.

Switching to mod_auth_gssapi sessions could simplify this part of IPA and will reduce the amount of code to maintain. It will also allow to drop memcache usage.

Related: #5653

https://github.com/modauthgssapi/mod_auth_gssapi

It most-likely won't fit in 4.4 even though it would great to do it there.

simo's idea for forms-based auth: the auth code would get a tgt but then just loop back to mod_auth_gssapi and just delegate a HTTP ticket and then discard the TGT, ie never keep it around like we do now (better security that way and no special cases depending on which auth method you choose)

Metadata Update from @pvoborni:
- Issue assigned to someone
- Issue set to the milestone: Future Releases

This was implemented in FreeIPA 4.5. http://www.freeipa.org/page/V4/External_Authentication

Metadata Update from @pvoborni:
- Issue close_status updated to: fixed
- Issue set to the milestone: FreeIPA 4.5 (was: Future Releases)
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
Normal
refactoring
IPA
0
0
wanted
mkubik
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.