Imported Upstream version 4.0.5

2021-07-25 07:50:50 +02:00
parent 8ff3be4216
commit 3bfaa6e020
2049 changed files with 317193 additions and 1632423 deletions
--- a/install/conf/Makefile.am
+++ b/install/conf/Makefile.am
@@ -3,7 +3,6 @@ NULL =
 appdir = $(IPA_DATA_DIR)
 app_DATA =                              \
 	ipa.conf			\
-	ipa-kdc-proxy.conf.template	\
 	ipa-pki-proxy.conf		\
 	ipa-rewrite.conf		\
 	$(NULL)
@@ -11,3 +10,7 @@ app_DATA =                              \
 EXTRA_DIST =                            \
        $(app_DATA)                     \
        $(NULL)
+
+MAINTAINERCLEANFILES =                  \
+        *~                              \
+        Makefile.in
--- a/install/conf/Makefile.in
+++ b/install/conf/Makefile.in
@@ -1,7 +1,7 @@
-# Makefile.in generated by automake 1.15.1 from Makefile.am.
+# Makefile.in generated by automake 1.14.1 from Makefile.am.
 # @configure_input@

-# Copyright (C) 1994-2017 Free Software Foundation, Inc.
+# Copyright (C) 1994-2013 Free Software Foundation, Inc.

 # This Makefile.in is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
@@ -15,17 +15,7 @@
@SET_MAKE@

 VPATH = @srcdir@
-am__is_gnu_make = { \
-  if test -z '$(MAKELEVEL)'; then \
-    false; \
-  elif test -n '$(MAKE_HOST)'; then \
-    true; \
-  elif test -n '$(MAKE_VERSION)' && test -n '$(CURDIR)'; then \
-    true; \
-  else \
-    false; \
-  fi; \
-}
+am__is_gnu_make = test -n '$(MAKEFILE_LIST)' && test -n '$(MAKELEVEL)'
 am__make_running_with_option = \
  case $${target_option-} in \
      ?) ;; \
@@ -86,22 +76,13 @@ POST_INSTALL = :
 NORMAL_UNINSTALL = :
 PRE_UNINSTALL = :
 POST_UNINSTALL = :
-build_triplet = @build@
-host_triplet = @host@
-subdir = install/conf
+subdir = conf
+DIST_COMMON = $(srcdir)/Makefile.in $(srcdir)/Makefile.am
 ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
-am__aclocal_m4_deps = $(top_srcdir)/m4/gettext.m4 \
-	$(top_srcdir)/m4/iconv.m4 $(top_srcdir)/m4/intlmacosx.m4 \
-	$(top_srcdir)/m4/lib-ld.m4 $(top_srcdir)/m4/lib-link.m4 \
-	$(top_srcdir)/m4/lib-prefix.m4 $(top_srcdir)/m4/libtool.m4 \
-	$(top_srcdir)/m4/ltoptions.m4 $(top_srcdir)/m4/ltsugar.m4 \
-	$(top_srcdir)/m4/ltversion.m4 $(top_srcdir)/m4/lt~obsolete.m4 \
-	$(top_srcdir)/m4/nls.m4 $(top_srcdir)/m4/po.m4 \
-	$(top_srcdir)/m4/progtest.m4 $(top_srcdir)/VERSION.m4 \
-	$(top_srcdir)/server.m4 $(top_srcdir)/configure.ac
+am__aclocal_m4_deps = $(top_srcdir)/../version.m4 \
+	$(top_srcdir)/configure.ac
 am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \
 	$(ACLOCAL_M4)
-DIST_COMMON = $(srcdir)/Makefile.am $(am__DIST_COMMON)
 mkinstalldirs = $(install_sh) -d
 CONFIG_HEADER = $(top_builddir)/config.h
 CONFIG_CLEAN_FILES =
@@ -155,115 +136,38 @@ am__uninstall_files_from_dir = { \
 am__installdirs = "$(DESTDIR)$(appdir)"
 DATA = $(app_DATA)
 am__tagged_files = $(HEADERS) $(SOURCES) $(TAGS_FILES) $(LISP)
-am__DIST_COMMON = $(srcdir)/Makefile.in
 DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST)
 ACLOCAL = @ACLOCAL@
 AMTAR = @AMTAR@
 AM_DEFAULT_VERBOSITY = @AM_DEFAULT_VERBOSITY@
-API_VERSION = @API_VERSION@
-AR = @AR@
 AUTOCONF = @AUTOCONF@
 AUTOHEADER = @AUTOHEADER@
 AUTOMAKE = @AUTOMAKE@
 AWK = @AWK@
-CC = @CC@
-CCDEPMODE = @CCDEPMODE@
-CFLAGS = @CFLAGS@
-CMOCKA_CFLAGS = @CMOCKA_CFLAGS@
-CMOCKA_LIBS = @CMOCKA_LIBS@
-CONFIG_STATUS = @CONFIG_STATUS@
-CPP = @CPP@
-CPPFLAGS = @CPPFLAGS@
-CRYPTO_CFLAGS = @CRYPTO_CFLAGS@
-CRYPTO_LIBS = @CRYPTO_LIBS@
 CYGPATH_W = @CYGPATH_W@
-DATA_VERSION = @DATA_VERSION@
 DEFS = @DEFS@
-DEPDIR = @DEPDIR@
-DIRSRV_CFLAGS = @DIRSRV_CFLAGS@
-DIRSRV_LIBS = @DIRSRV_LIBS@
-DLLTOOL = @DLLTOOL@
-DSYMUTIL = @DSYMUTIL@
-DUMPBIN = @DUMPBIN@
 ECHO_C = @ECHO_C@
 ECHO_N = @ECHO_N@
 ECHO_T = @ECHO_T@
-EGREP = @EGREP@
-EXEEXT = @EXEEXT@
-FGREP = @FGREP@
 GETTEXT_DOMAIN = @GETTEXT_DOMAIN@
-GETTEXT_MACRO_VERSION = @GETTEXT_MACRO_VERSION@
-GIT_BRANCH = @GIT_BRANCH@
-GIT_VERSION = @GIT_VERSION@
-GMSGFMT = @GMSGFMT@
-GMSGFMT_015 = @GMSGFMT_015@
-GREP = @GREP@
-INI_CFLAGS = @INI_CFLAGS@
-INI_LIBS = @INI_LIBS@
 INSTALL = @INSTALL@
 INSTALL_DATA = @INSTALL_DATA@
 INSTALL_PROGRAM = @INSTALL_PROGRAM@
 INSTALL_SCRIPT = @INSTALL_SCRIPT@
 INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@
-INTLLIBS = @INTLLIBS@
-INTL_MACOSX_LIBS = @INTL_MACOSX_LIBS@
-IPAPLATFORM = @IPAPLATFORM@
 IPA_DATA_DIR = @IPA_DATA_DIR@
 IPA_SYSCONF_DIR = @IPA_SYSCONF_DIR@
-JSLINT = @JSLINT@
-KRAD_LIBS = @KRAD_LIBS@
-KRB5KDC_SERVICE = @KRB5KDC_SERVICE@
-KRB5_CFLAGS = @KRB5_CFLAGS@
-KRB5_LIBS = @KRB5_LIBS@
-LD = @LD@
-LDAP_CFLAGS = @LDAP_CFLAGS@
-LDAP_LIBS = @LDAP_LIBS@
-LDFLAGS = @LDFLAGS@
-LIBICONV = @LIBICONV@
-LIBINTL = @LIBINTL@
-LIBINTL_LIBS = @LIBINTL_LIBS@
 LIBOBJS = @LIBOBJS@
-LIBPDB_NAME = @LIBPDB_NAME@
 LIBS = @LIBS@
-LIBTOOL = @LIBTOOL@
-LIBVERTO_CFLAGS = @LIBVERTO_CFLAGS@
-LIBVERTO_LIBS = @LIBVERTO_LIBS@
-LIPO = @LIPO@
-LN_S = @LN_S@
-LTLIBICONV = @LTLIBICONV@
-LTLIBINTL = @LTLIBINTL@
 LTLIBOBJS = @LTLIBOBJS@
-LT_SYS_LIBRARY_PATH = @LT_SYS_LIBRARY_PATH@
+MAINT = @MAINT@
 MAKEINFO = @MAKEINFO@
-MANIFEST_TOOL = @MANIFEST_TOOL@
 MKDIR_P = @MKDIR_P@
-MK_ASSIGN = @MK_ASSIGN@
-MK_ELSE = @MK_ELSE@
-MK_ENDIF = @MK_ENDIF@
-MK_IFEQ = @MK_IFEQ@
 MSGATTRIB = @MSGATTRIB@
+MSGCMP = @MSGCMP@
 MSGFMT = @MSGFMT@
-MSGFMT_015 = @MSGFMT_015@
+MSGINIT = @MSGINIT@
 MSGMERGE = @MSGMERGE@
-NAMED_GROUP = @NAMED_GROUP@
-NDRNBT_CFLAGS = @NDRNBT_CFLAGS@
-NDRNBT_LIBS = @NDRNBT_LIBS@
-NDRPAC_CFLAGS = @NDRPAC_CFLAGS@
-NDRPAC_LIBS = @NDRPAC_LIBS@
-NDR_CFLAGS = @NDR_CFLAGS@
-NDR_LIBS = @NDR_LIBS@
-NM = @NM@
-NMEDIT = @NMEDIT@
-NSPR_CFLAGS = @NSPR_CFLAGS@
-NSPR_LIBS = @NSPR_LIBS@
-NSS_CFLAGS = @NSS_CFLAGS@
-NSS_LIBS = @NSS_LIBS@
-NUM_VERSION = @NUM_VERSION@
-OBJDUMP = @OBJDUMP@
-OBJEXT = @OBJEXT@
-ODS_USER = @ODS_USER@
-OTOOL = @OTOOL@
-OTOOL64 = @OTOOL64@
 PACKAGE = @PACKAGE@
 PACKAGE_BUGREPORT = @PACKAGE_BUGREPORT@
 PACKAGE_NAME = @PACKAGE_NAME@
@@ -272,88 +176,33 @@ PACKAGE_TARNAME = @PACKAGE_TARNAME@
 PACKAGE_URL = @PACKAGE_URL@
 PACKAGE_VERSION = @PACKAGE_VERSION@
 PATH_SEPARATOR = @PATH_SEPARATOR@
-PKG_CONFIG = @PKG_CONFIG@
-PKG_CONFIG_LIBDIR = @PKG_CONFIG_LIBDIR@
-PKG_CONFIG_PATH = @PKG_CONFIG_PATH@
-POPT_CFLAGS = @POPT_CFLAGS@
-POPT_LIBS = @POPT_LIBS@
-POSUB = @POSUB@
-PYLINT = @PYLINT@
-PYTHON = @PYTHON@
-PYTHON2 = @PYTHON2@
-PYTHON3 = @PYTHON3@
-PYTHON_EXEC_PREFIX = @PYTHON_EXEC_PREFIX@
-PYTHON_INSTALL_EXTRA_OPTIONS = @PYTHON_INSTALL_EXTRA_OPTIONS@
-PYTHON_PLATFORM = @PYTHON_PLATFORM@
-PYTHON_PREFIX = @PYTHON_PREFIX@
-PYTHON_VERSION = @PYTHON_VERSION@
-RANLIB = @RANLIB@
-SAMBA40EXTRA_LIBPATH = @SAMBA40EXTRA_LIBPATH@
-SAMBAUTIL_CFLAGS = @SAMBAUTIL_CFLAGS@
-SAMBAUTIL_LIBS = @SAMBAUTIL_LIBS@
-SASL_CFLAGS = @SASL_CFLAGS@
-SASL_LIBS = @SASL_LIBS@
 SED = @SED@
 SET_MAKE = @SET_MAKE@
 SHELL = @SHELL@
-SSSCERTMAP_CFLAGS = @SSSCERTMAP_CFLAGS@
-SSSCERTMAP_LIBS = @SSSCERTMAP_LIBS@
-SSSIDMAP_CFLAGS = @SSSIDMAP_CFLAGS@
-SSSIDMAP_LIBS = @SSSIDMAP_LIBS@
-SSSNSSIDMAP_CFLAGS = @SSSNSSIDMAP_CFLAGS@
-SSSNSSIDMAP_LIBS = @SSSNSSIDMAP_LIBS@
 STRIP = @STRIP@
-TALLOC_CFLAGS = @TALLOC_CFLAGS@
-TALLOC_LIBS = @TALLOC_LIBS@
-TEVENT_CFLAGS = @TEVENT_CFLAGS@
-TEVENT_LIBS = @TEVENT_LIBS@
-UNISTRING_LIBS = @UNISTRING_LIBS@
-UNLINK = @UNLINK@
-USE_NLS = @USE_NLS@
-UUID_CFLAGS = @UUID_CFLAGS@
-UUID_LIBS = @UUID_LIBS@
-VENDOR_SUFFIX = @VENDOR_SUFFIX@
+TX = @TX@
 VERSION = @VERSION@
 XGETTEXT = @XGETTEXT@
-XGETTEXT_015 = @XGETTEXT_015@
-XGETTEXT_EXTRA_OPTIONS = @XGETTEXT_EXTRA_OPTIONS@
-XMLRPC_CFLAGS = @XMLRPC_CFLAGS@
-XMLRPC_LIBS = @XMLRPC_LIBS@
 abs_builddir = @abs_builddir@
 abs_srcdir = @abs_srcdir@
 abs_top_builddir = @abs_top_builddir@
 abs_top_srcdir = @abs_top_srcdir@
-ac_ct_AR = @ac_ct_AR@
-ac_ct_CC = @ac_ct_CC@
-ac_ct_DUMPBIN = @ac_ct_DUMPBIN@
-am__include = @am__include@
 am__leading_dot = @am__leading_dot@
-am__quote = @am__quote@
 am__tar = @am__tar@
 am__untar = @am__untar@
 bindir = @bindir@
-build = @build@
 build_alias = @build_alias@
-build_cpu = @build_cpu@
-build_os = @build_os@
-build_vendor = @build_vendor@
 builddir = @builddir@
 datadir = @datadir@
 datarootdir = @datarootdir@
 docdir = @docdir@
 dvidir = @dvidir@
 exec_prefix = @exec_prefix@
-host = @host@
 host_alias = @host_alias@
-host_cpu = @host_cpu@
-host_os = @host_os@
-host_vendor = @host_vendor@
 htmldir = @htmldir@
-i18ntests = @i18ntests@
 includedir = @includedir@
 infodir = @infodir@
 install_sh = @install_sh@
-krb5rundir = @krb5rundir@
 libdir = @libdir@
 libexecdir = @libexecdir@
 localedir = @localedir@
@@ -362,20 +211,13 @@ mandir = @mandir@
 mkdir_p = @mkdir_p@
 oldincludedir = @oldincludedir@
 pdfdir = @pdfdir@
-pkgpyexecdir = @pkgpyexecdir@
-pkgpythondir = @pkgpythondir@
 prefix = @prefix@
 program_transform_name = @program_transform_name@
 psdir = @psdir@
-pyexecdir = @pyexecdir@
-pythondir = @pythondir@
 sbindir = @sbindir@
 sharedstatedir = @sharedstatedir@
 srcdir = @srcdir@
 sysconfdir = @sysconfdir@
-sysconfenvdir = @sysconfenvdir@
-systemdsystemunitdir = @systemdsystemunitdir@
-systemdtmpfilesdir = @systemdtmpfilesdir@
 target_alias = @target_alias@
 top_build_prefix = @top_build_prefix@
 top_builddir = @top_builddir@
@@ -384,7 +226,6 @@ NULL =
 appdir = $(IPA_DATA_DIR)
 app_DATA = \
 	ipa.conf			\
-	ipa-kdc-proxy.conf.template	\
 	ipa-pki-proxy.conf		\
 	ipa-rewrite.conf		\
 	$(NULL)
@@ -393,10 +234,14 @@ EXTRA_DIST = \
        $(app_DATA)                     \
        $(NULL)

+MAINTAINERCLEANFILES = \
+        *~                              \
+        Makefile.in
+
 all: all-am

 .SUFFIXES:
-$(srcdir)/Makefile.in:  $(srcdir)/Makefile.am  $(am__configure_deps)
+$(srcdir)/Makefile.in: @MAINTAINER_MODE_TRUE@ $(srcdir)/Makefile.am  $(am__configure_deps)
 	@for dep in $?; do \
 	  case '$(am__configure_deps)' in \
 	    *$$dep*) \
@@ -405,9 +250,10 @@ $(srcdir)/Makefile.in:  $(srcdir)/Makefile.am  $(am__configure_deps)
 	      exit 1;; \
 	  esac; \
 	done; \
-	echo ' cd $(top_srcdir) && $(AUTOMAKE) --foreign install/conf/Makefile'; \
+	echo ' cd $(top_srcdir) && $(AUTOMAKE) --foreign conf/Makefile'; \
 	$(am__cd) $(top_srcdir) && \
-	  $(AUTOMAKE) --foreign install/conf/Makefile
+	  $(AUTOMAKE) --foreign conf/Makefile
+.PRECIOUS: Makefile
 Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status
 	@case '$?' in \
 	  *config.status*) \
@@ -420,17 +266,11 @@ Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status
 $(top_builddir)/config.status: $(top_srcdir)/configure $(CONFIG_STATUS_DEPENDENCIES)
 	cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh

-$(top_srcdir)/configure:  $(am__configure_deps)
+$(top_srcdir)/configure: @MAINTAINER_MODE_TRUE@ $(am__configure_deps)
 	cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
-$(ACLOCAL_M4):  $(am__aclocal_m4_deps)
+$(ACLOCAL_M4): @MAINTAINER_MODE_TRUE@ $(am__aclocal_m4_deps)
 	cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
 $(am__aclocal_m4_deps):
-
-mostlyclean-libtool:
-	-rm -f *.lo
-
-clean-libtool:
-	-rm -rf .libs _libs
 install-appDATA: $(app_DATA)
 	@$(NORMAL_INSTALL)
 	@list='$(app_DATA)'; test -n "$(appdir)" || list=; \
@@ -526,9 +366,10 @@ distclean-generic:
 maintainer-clean-generic:
 	@echo "This command is intended for maintainers to use"
 	@echo "it deletes files that may require special tools to rebuild."
+	-test -z "$(MAINTAINERCLEANFILES)" || rm -f $(MAINTAINERCLEANFILES)
 clean: clean-am

-clean-am: clean-generic clean-libtool mostlyclean-am
+clean-am: clean-generic mostlyclean-am

 distclean: distclean-am
 	-rm -f Makefile
@@ -580,7 +421,7 @@ maintainer-clean-am: distclean-am maintainer-clean-generic

 mostlyclean: mostlyclean-am

-mostlyclean-am: mostlyclean-generic mostlyclean-libtool
+mostlyclean-am: mostlyclean-generic

 pdf: pdf-am

@@ -594,20 +435,17 @@ uninstall-am: uninstall-appDATA

 .MAKE: install-am install-strip

-.PHONY: all all-am check check-am clean clean-generic clean-libtool \
-	cscopelist-am ctags-am distclean distclean-generic \
-	distclean-libtool distdir dvi dvi-am html html-am info info-am \
-	install install-am install-appDATA install-data \
-	install-data-am install-dvi install-dvi-am install-exec \
-	install-exec-am install-html install-html-am install-info \
-	install-info-am install-man install-pdf install-pdf-am \
-	install-ps install-ps-am install-strip installcheck \
-	installcheck-am installdirs maintainer-clean \
-	maintainer-clean-generic mostlyclean mostlyclean-generic \
-	mostlyclean-libtool pdf pdf-am ps ps-am tags-am uninstall \
-	uninstall-am uninstall-appDATA
-
-.PRECIOUS: Makefile
+.PHONY: all all-am check check-am clean clean-generic cscopelist-am \
+	ctags-am distclean distclean-generic distdir dvi dvi-am html \
+	html-am info info-am install install-am install-appDATA \
+	install-data install-data-am install-dvi install-dvi-am \
+	install-exec install-exec-am install-html install-html-am \
+	install-info install-info-am install-man install-pdf \
+	install-pdf-am install-ps install-ps-am install-strip \
+	installcheck installcheck-am installdirs maintainer-clean \
+	maintainer-clean-generic mostlyclean mostlyclean-generic pdf \
+	pdf-am ps ps-am tags-am uninstall uninstall-am \
+	uninstall-appDATA


 # Tell versions [3.59,3.63) of GNU make to not export all variables.
--- a/install/conf/ipa-kdc-proxy.conf.template
+++ b/install/conf/ipa-kdc-proxy.conf.template
@@ -1,30 +0,0 @@
-# Kerberos over HTTP / MS-KKDCP support (Kerberos KDC Proxy)
-#
-# The symlink from /etc/ipa/kdcproxy/ to /etc/httpd/conf.d/ is maintained
-# by the ExecStartPre script /usr/libexec/ipa/ipa-httpd-kdcproxy in
-# httpd.service. The service also sets the environment variable
-# KDCPROXY_CONFIG to $KDCPROXY_CONFIG.
-#
-# Disable KDC Proxy on the current host:
-#   # ipa-ldap-updater /usr/share/ipa/kdcproxy-disable.uldif
-#   # systemctl restart httpd.service
-#
-# Enable KDC Proxy on the current host:
-#   # ipa-ldap-updater /usr/share/ipa/kdcproxy-enable.uldif
-#   # systemctl restart httpd.service
-#
-
-WSGIDaemonProcess kdcproxy processes=2 threads=15 maximum-requests=5000 \
-  user=kdcproxy group=kdcproxy display-name=%{GROUP}
-WSGIImportScript /usr/share/ipa/kdcproxy.wsgi \
-  process-group=kdcproxy application-group=kdcproxy
-WSGIScriptAlias /KdcProxy /usr/share/ipa/kdcproxy.wsgi
-WSGIScriptReloading Off
-
-<Location "/KdcProxy">
-  Satisfy Any
-  Order Deny,Allow
-  Allow from all
-  WSGIProcessGroup kdcproxy
-  WSGIApplicationGroup kdcproxy
-</Location>
--- a/install/conf/ipa-pki-proxy.conf
+++ b/install/conf/ipa-pki-proxy.conf
@@ -1,4 +1,4 @@
-# VERSION 11 - DO NOT REMOVE THIS LINE
+# VERSION 4 - DO NOT REMOVE THIS LINE

 ProxyRequests Off

@@ -11,7 +11,7 @@ ProxyRequests Off
 </LocationMatch>

 # matches for admin port and installer
-<LocationMatch "^/ca/admin/ca/getCertChain|^/ca/admin/ca/getConfigEntries|^/ca/admin/ca/getCookie|^/ca/admin/ca/getStatus|^/ca/admin/ca/securityDomainLogin|^/ca/admin/ca/getDomainXML|^/ca/admin/ca/updateNumberRange|^/ca/admin/ca/tokenAuthenticate|^/ca/admin/ca/updateNumberRange|^/ca/admin/ca/updateDomainXML|^/ca/admin/ca/updateConnector|^/ca/admin/ca/getSubsystemCert|^/kra/admin/kra/updateNumberRange|^/kra/admin/kra/getConfigEntries">
+<LocationMatch "^/ca/admin/ca/getCertChain|^/ca/admin/ca/getConfigEntries|^/ca/admin/ca/getCookie|^/ca/admin/ca/getStatus|^/ca/admin/ca/securityDomainLogin|^/ca/admin/ca/getDomainXML|^/ca/rest/installer/installToken|^/ca/admin/ca/updateNumberRange|^/ca/rest/securityDomain/domainInfo|^/ca/rest/account/login|^/ca/admin/ca/tokenAuthenticate|^/ca/admin/ca/updateNumberRange|^/ca/admin/ca/updateDomainXML|^/ca/rest/account/logout|^/ca/rest/securityDomain/installToken">
    NSSOptions +StdEnvVars +ExportCertData +StrictRequire +OptRenegotiate
    NSSVerifyClient none
    ProxyPassMatch ajp://localhost:$DOGTAG_PORT
@@ -19,28 +19,12 @@ ProxyRequests Off
 </LocationMatch>

 # matches for agent port and eeca port
-<LocationMatch "^/ca/agent/ca/displayBySerial|^/ca/agent/ca/doRevoke|^/ca/agent/ca/doUnrevoke|^/ca/agent/ca/updateDomainXML|^/ca/eeca/ca/profileSubmitSSLClient|^/kra/agent/kra/connector">
+<LocationMatch "^/ca/agent/ca/displayBySerial|^/ca/agent/ca/doRevoke|^/ca/agent/ca/doUnrevoke|^/ca/agent/ca/updateDomainXML|^/ca/eeca/ca/profileSubmitSSLClient">
    NSSOptions +StdEnvVars +ExportCertData +StrictRequire +OptRenegotiate
    NSSVerifyClient require
    ProxyPassMatch ajp://localhost:$DOGTAG_PORT
    ProxyPassReverse ajp://localhost:$DOGTAG_PORT
 </LocationMatch>

-# matches for CA REST API
-<LocationMatch "^/ca/rest/account/login|^/ca/rest/account/logout|^/ca/rest/installer/installToken|^/ca/rest/securityDomain/domainInfo|^/ca/rest/securityDomain/installToken|^/ca/rest/profiles|^/ca/rest/authorities|^/ca/rest/certrequests|^/ca/rest/admin/kraconnector/remove|^/ca/rest/certs/search">
-    NSSOptions +StdEnvVars +ExportCertData +StrictRequire +OptRenegotiate
-    NSSVerifyClient optional
-    ProxyPassMatch ajp://localhost:$DOGTAG_PORT
-    ProxyPassReverse ajp://localhost:$DOGTAG_PORT
-</LocationMatch>
-
-# matches for KRA REST API
-<LocationMatch "^/kra/rest/config/cert/transport|^/kra/rest/account|^/kra/rest/agent/keyrequests|^/kra/rest/agent/keys">
-    NSSOptions +StdEnvVars +ExportCertData +StrictRequire +OptRenegotiate
-    NSSVerifyClient optional
-    ProxyPassMatch ajp://localhost:$DOGTAG_PORT
-    ProxyPassReverse ajp://localhost:$DOGTAG_PORT
-</LocationMatch>
-
 # Only enable this on servers that are not generating a CRL
 ${CLONE}RewriteRule ^/ipa/crl/MasterCRL.bin https://$FQDN/ca/ee/ca/getCRL?op=getCRL&crlIssuingPoint=MasterCRL [L,R=301,NC]
--- a/install/conf/ipa.conf
+++ b/install/conf/ipa.conf
@@ -1,17 +1,13 @@
 #
-# VERSION 27 - DO NOT REMOVE THIS LINE
+# VERSION 16 - DO NOT REMOVE THIS LINE
 #
 # This file may be overwritten on upgrades.
 #
-
-# Load lookup_identity module in case it has not been loaded yet
-# The module is used to search users according the certificate.
-<IfModule !lookup_identity_module>
-    LoadModule lookup_identity_module modules/mod_lookup_identity.so
-</IfModule>
+# LoadModule auth_kerb_module modules/mod_auth_kerb.so

 ProxyRequests Off

+
 #We use xhtml, a file format that the browser validates
 DirectoryIndex index.html

@@ -20,13 +16,12 @@ DirectoryIndex index.html
 # requests, ticket #2767. This should easily support a 64KiB PAC.
 LimitRequestFieldSize 100000

-# Increase connection keep alive time. Default value is 5 seconds, which is too
-# short for interactive ipa commands. 30 seconds is a good compromise.
-KeepAlive On
-KeepAliveTimeout 30
-
 # ipa-rewrite.conf is loaded separately

+# This is required so the auto-configuration works with Firefox 2+
+AddType application/java-archive        jar
+AddType application/x-xpinstall         xpi
+
 # Proper header for .tff fonts
 AddType application/x-font-ttf          ttf

@@ -47,9 +42,9 @@ WSGISocketPrefix /run/httpd/wsgi


 # Configure mod_wsgi handler for /ipa
-WSGIDaemonProcess ipa processes=2 threads=1 maximum-requests=500 \
-  user=ipaapi group=ipaapi display-name=%{GROUP} socket-timeout=2147483647 \
-  lang=C.UTF-8 locale=C.UTF-8
+WSGIDaemonProcess ipa processes=2 threads=1 maximum-requests=500
+WSGIProcessGroup ipa
+WSGIApplicationGroup ipa
 WSGIImportScript /usr/share/ipa/wsgi.py process-group=ipa application-group=ipa
 WSGIScriptAlias /ipa /usr/share/ipa/wsgi.py
 WSGIScriptReloading Off
@@ -66,69 +61,40 @@ WSGIScriptReloading Off
  SetHandler None
 </Location>

+KrbConstrainedDelegationLock ipa
+
 # Protect /ipa and everything below it in webspace with Apache Kerberos auth
 <Location "/ipa">
-  AuthType GSSAPI
+  AuthType Kerberos
  AuthName "Kerberos Login"
-  GssapiUseSessions On
-  Session On
-  SessionCookieName ipa_session path=/ipa;httponly;secure;
-  SessionHeader IPASESSION
-  # Uncomment the following to have shorter sessions, but beware this may break
-  # old IPA client tols that incorrectly parse cookies.
-  # SessionMaxAge 1800
-  GssapiSessionKey file:/etc/httpd/alias/ipasession.key
-
-  GssapiImpersonate On
-  GssapiDelegCcacheDir /var/run/ipa/ccaches
-  GssapiDelegCcachePerms mode:0660 gid:ipaapi
-  GssapiUseS4U2Proxy on
-  GssapiAllowedMech krb5
+  KrbMethodNegotiate on
+  KrbMethodK5Passwd off
+  KrbServiceName HTTP
+  KrbAuthRealms $REALM
+  Krb5KeyTab /etc/httpd/conf/ipa.keytab
+  KrbSaveCredentials on
+  KrbConstrainedDelegation on
  Require valid-user
  ErrorDocument 401 /ipa/errors/unauthorized.html
-  WSGIProcessGroup ipa
-  WSGIApplicationGroup ipa
-  Header always append X-Frame-Options DENY
-  Header always append Content-Security-Policy "frame-ancestors 'none'"
-
-  # mod_session always sets two copies of the cookie, and this confuses our
-  # legacy clients, the unset here works because it ends up unsetting only one
-  # of the 2 header tables set by mod_session, leaving the other intact
-  Header unset Set-Cookie
 </Location>

-# Target for login with internal connections
-Alias /ipa/session/cookie "/usr/share/ipa/gssapi.login"
-
-# Turn off Apache authentication for password/token based login pages
-<Location "/ipa/session/login_password">
+# Turn off Apache authentication for sessions
+<Location "/ipa/session/json">
  Satisfy Any
  Order Deny,Allow
  Allow from all
 </Location>

-# Login with user certificate/smartcard configuration
-# This configuration needs to be loaded after <Location "/ipa">
-<Location "/ipa/session/login_x509">
-  AuthType none
-  GssapiDelegCcacheDir /var/run/ipa/ccaches
-  GssapiDelegCcachePerms mode:0660 gid:ipaapi
-  NSSVerifyClient require
-  NSSUserName SSL_CLIENT_CERT
-  LookupUserByCertificate On
-  LookupUserByCertificateParamName "username"
-  WSGIProcessGroup ipa
-  WSGIApplicationGroup ipa
-  GssapiImpersonate On
+<Location "/ipa/session/xml">
+  Satisfy Any
+  Order Deny,Allow
+  Allow from all
+</Location>

-  GssapiUseSessions On
-  Session On
-  SessionCookieName ipa_session path=/ipa;httponly;secure;
-  SessionHeader IPASESSION
-  SessionMaxAge 1800
-  GssapiSessionKey file:/etc/httpd/alias/ipasession.key
-
-  Header unset Set-Cookie
+<Location "/ipa/session/login_password">
+  Satisfy Any
+  Order Deny,Allow
+  Allow from all
 </Location>

 <Location "/ipa/session/change_password">
@@ -143,14 +109,6 @@ Alias /ipa/session/cookie "/usr/share/ipa/gssapi.login"
  Allow from all
 </Location>

-# Custodia stuff is redirected to the custodia daemon
-# after authentication
-<Location "/ipa/keys/">
-    ProxyPass "unix:/run/httpd/ipa-custodia.sock|http://localhost/keys/"
-    RequestHeader set GSS_NAME %{GSS_NAME}s
-    RequestHeader set REMOTE_USER %{REMOTE_USER}s
-</Location>
-
 # This is where we redirect on failed auth
 Alias /ipa/errors "/usr/share/ipa/html"

@@ -216,6 +174,21 @@ Alias /ipa/wsgi "/usr/share/ipa/wsgi"
    AddHandler wsgi-script .py
 </Directory>

+# Protect our CGIs
+<Directory /var/www/cgi-bin>
+  AuthType Kerberos
+  AuthName "Kerberos Login"
+  KrbMethodNegotiate on
+  KrbMethodK5Passwd off
+  KrbServiceName HTTP
+  KrbAuthRealms $REALM
+  Krb5KeyTab /etc/httpd/conf/ipa.keytab
+  KrbSaveCredentials on
+  Require valid-user
+  ErrorDocument 401 /ipa/errors/unauthorized.html
+</Directory>
+
+
 # migration related pages
 Alias /ipa/migration "/usr/share/ipa/migration"
 <Directory "/usr/share/ipa/migration">