Natxo Asenjo wrote:
hi,
enable a kerberized site with the fqdn is very easy with freeipa but we
would like to use virtual hosting and kerberized sites.
I have joined a host webserver01.ipa.domain.tld to a ipa realm. I then
created a spn HTTP/webserver01.ipa.domain.tld, generated the keytab,
configured the apache webserver and it works.
Then I created a cname record (vhost) pointing to
webserver01.ipa.domain.tld. I enabled virtual hosting in the apache
webserver, configured the vhosts without kerberizing anything. Virtual
hosts work as expected.
But when I enable a kerberized directory in the vhost, then I see this
in the log file:
[Wed Mar 28 22:02:14 2012] [error] [client 192.168.0.21]
gss_acquire_cred() failed: Unspecified GSS failure. Minor code may
provide more information (, Permission denied)
[Wed Mar 28 22:02:14 2012] [debug] src/mod_auth_kerb.c(1578): [client
192.168.0.21] kerb_authenticate_user entered with user (NULL) and
auth_type Kerberos
[Wed Mar 28 22:02:14 2012] [debug] src/mod_auth_kerb.c(1578): [client
192.168.0.21] kerb_authenticate_user entered with user (NULL) and
auth_type Kerberos
[Wed Mar 28 22:02:14 2012] [debug] src/mod_auth_kerb.c(1213): [client
192.168.0.21] Acquiring creds for h...@vhost.ipa.domain.tld.
When not using vhosts, it works although I see similar debugging info
(but instead of h...@vhost.ipa.domain.tld,
h...@webserver01.ipa.domain.tld). So I was wondering if it is possible
to do this vhost thing. With the ipa tools I can only add service
principals to joined hosts, not to cnames.
It would be nice to have. Otherwise we need to have one server per
kerberized site, a bit of an overkill really.
You should be able to add a host entry for the vhost, perhaps with the
--force flag to let it add w/o a DNS A record. Then you should be able
to create the service.
rob
_______________________________________________
Freeipa-users mailing list
Freeipa-users@redhat.com
https://www.redhat.com/mailman/listinfo/freeipa-users
