Attachment 298751 Details for Bug 438021 – re-root to /ipa

[patch] re-root to /ipa

freeipa-727-webroot.patch (text/plain), 6.83 KB, created by Rob Crittenden on 2008-03-20 21:49:27 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Rob Crittenden

Created: 2008-03-20 21:49:27 UTC

Size: 6.83 KB

patch

obsolete

># HG changeset patch
># User Rob Crittenden <rcritten@redhat.com>
># Date 1206049727 14400
># Node ID 95b22b7a2c508eaddb2f8faea7bdffc2186d5cef
># Parent  ea8a9ad2441691bb5292194d4bd3ceea5e3b6718
>Re-root the IPA web UI to /ipa
>
>438021
>
>diff -r ea8a9ad24416 -r 95b22b7a2c50 ipa-python/rpcclient.py
>--- a/ipa-python/rpcclient.py	Mon Mar 17 18:04:49 2008 -0400
>+++ b/ipa-python/rpcclient.py	Thu Mar 20 17:48:47 2008 -0400
>@@ -37,7 +37,7 @@ class RPCClient:
>     
>     def server_url(self, server):
>         """Build the XML-RPC server URL from our configuration"""
>-        return "https://" + server + "/ipa"
>+        return "https://" + server + "/ipaxml"
>     
>     def setup_server(self):
>         """Create our XML-RPC server connection using kerberos
>diff -r ea8a9ad24416 -r 95b22b7a2c50 ipa-server/ipa-gui/ipa_webgui.cfg
>--- a/ipa-server/ipa-gui/ipa_webgui.cfg	Mon Mar 17 18:04:49 2008 -0400
>+++ b/ipa-server/ipa-gui/ipa_webgui.cfg	Thu Mar 20 17:48:47 2008 -0400
>@@ -29,7 +29,7 @@ server.thread_pool = 10
> 
> # if this is part of a larger site, you can set the path
> # to the TurboGears instance here
>-# server.webpath=""
>+server.webpath="/ipa"
> 
> # Set to True if you are deploying your App behind a proxy
> # e.g. Apache using mod_proxy
>@@ -58,7 +58,7 @@ session_filter.storage_path='/var/cache/
> 
> # Listen only on the local interface so all requests go through
> # Apache/mod_auth_kerb/mod_proxy.
>-server.server_port = 8080
>+server.socket_port = 8080
> server.socket_host="127.0.0.1"
> 
> # LOGGING
>diff -r ea8a9ad24416 -r 95b22b7a2c50 ipa-server/ipa-gui/ipagui/proxyprovider.py
>--- a/ipa-server/ipa-gui/ipagui/proxyprovider.py	Mon Mar 17 18:04:49 2008 -0400
>+++ b/ipa-server/ipa-gui/ipagui/proxyprovider.py	Thu Mar 20 17:48:47 2008 -0400
>@@ -25,6 +25,7 @@ import ipa.group
> import ipa.group
> import ipa.user
> import ldap
>+import krbV
> 
> log = logging.getLogger("turbogears.identity")
> 
>@@ -132,7 +133,7 @@ class ProxyIdentityProvider(SqlObjectIde
>             user = IPA_User(user_name)
>             log.debug( "validate_identity %s" % user_name)
>             return ProxyIdentity(visit_key, user)
>-        except:
>+        except Exception, e:
>             # Something went wrong in fetching the user. Set to
>             # anonymous which will deny access.
>             return ProxyIdentity( None )
>@@ -143,12 +144,18 @@ class ProxyIdentityProvider(SqlObjectIde
> 
>     def load_identity(self, visit_key):
>         try:
>-            user_name= cherrypy.request.headers['X-FORWARDED-USER']
>             os.environ["KRB5CCNAME"] = cherrypy.request.headers['X-FORWARDED-KEYTAB']
>-#             user_name = "test@FREEIPA.ORG"
>-#             os.environ["KRB5CCNAME"] = "FILE:/tmp/krb5cc_500"
>+            ccache = krbV.CCache(cherrypy.request.headers['X-FORWARDED-KEYTAB'])
>+            user_name = ccache.principal().name
>+#            user_name = "test@FREEIPA.ORG"
>+#            os.environ["KRB5CCNAME"] = "FILE:/tmp/krb5cc_500"
>         except KeyError:
>             return None
>+        except AttributeError:
>+            return None
>+        except krbV.Krb5Error:
>+            return None
>+
>         set_login_attempted( True )
>         return self.validate_identity( user_name, None, visit_key )
> 
>diff -r ea8a9ad24416 -r 95b22b7a2c50 ipa-server/ipa-gui/ipagui/templates/master.kid
>--- a/ipa-server/ipa-gui/ipagui/templates/master.kid	Mon Mar 17 18:04:49 2008 -0400
>+++ b/ipa-server/ipa-gui/ipagui/templates/master.kid	Thu Mar 20 17:48:47 2008 -0400
>@@ -24,13 +24,13 @@
>     <title py:replace="''">Your title goes here</title>
>     <meta py:replace="item[:]"/>
>     <style type="text/css" media="all">
>-    @import "${tg.url('/static/css/style_platform.css')}";
>-    @import "${tg.url('/static/css/style_platform-objects.css')}";
>-    @import "${tg.url('/static/css/style_freeipa.css')}";
>+    @import "/static/css/style_platform.css";
>+    @import "/static/css/style_platform-objects.css";
>+    @import "/static/css/style_freeipa.css";
>     </style>
>-    <script type="text/javascript" charset="utf-8" src="${tg.url('/static/javascript/prototype.js')}"></script>
>-    <script type="text/javascript" charset="utf-8" src="${tg.url('/static/javascript/scriptaculous.js?load=effects')}"></script>
>-    <script type="text/javascript" charset="utf-8" src="${tg.url('/static/javascript/ipautil.js')}"></script>
>+    <script type="text/javascript" charset="utf-8" src="/static/javascript/prototype.js"></script>
>+    <script type="text/javascript" charset="utf-8" src="/static/javascript/scriptaculous.js?load=effects"></script>
>+    <script type="text/javascript" charset="utf-8" src="/static/javascript/ipautil.js"></script>
> </head>
> 
> <body py:match="item.tag=='{http://www.w3.org/1999/xhtml}body'" py:attrs="item.items()">
>diff -r ea8a9ad24416 -r 95b22b7a2c50 ipa-server/xmlrpc-server/ipa-rewrite.conf
>--- a/ipa-server/xmlrpc-server/ipa-rewrite.conf	Mon Mar 17 18:04:49 2008 -0400
>+++ b/ipa-server/xmlrpc-server/ipa-rewrite.conf	Thu Mar 20 17:48:47 2008 -0400
>@@ -1,4 +1,9 @@ RewriteEngine on
> RewriteEngine on
>+
>+# By default forward all requests to /ipa. If you don't want IPA
>+# to be the default on your web server comment this line out. You will
>+# need to modify ipa_webgui.cfg as well.
>+RewriteRule ^/$$ https://$FQDN/ipa [L,NC]
> 
> # Redirect to the fully-qualified hostname. Not redirecting to secure
> # port so configuration files can be retrieved without requiring SSL.
>diff -r ea8a9ad24416 -r 95b22b7a2c50 ipa-server/xmlrpc-server/ipa.conf
>--- a/ipa-server/xmlrpc-server/ipa.conf	Mon Mar 17 18:04:49 2008 -0400
>+++ b/ipa-server/xmlrpc-server/ipa.conf	Thu Mar 20 17:48:47 2008 -0400
>@@ -22,35 +22,26 @@ AddType application/java-archive        
>   Order deny,allow
>   Allow from all
> 
>-  # We create a subrequest to find REMOTE_USER. Don't do this for every
>-  # subrequest too (slow and huge logs result)
>-  RewriteCond %{IS_SUBREQ}% false
>-  RewriteRule .* - [E=RU:%{LA-U:REMOTE_USER}]
>-  RequestHeader set X-Forwarded-User %{RU}e
>   RequestHeader set X-Forwarded-Keytab %{KRB5CCNAME}e
> 
>   # RequestHeader unset Authorization
> </Proxy>
> 
> # The URI's with a trailing ! are those that aren't handled by the proxy
>-ProxyPass /cgi-bin !
>-ProxyPass /errors !
>-ProxyPass /config !
>-ProxyPass /ipa !
>-#ProxyPass /ipatest !
>-ProxyPass / http://localhost:8080/
>-ProxyPassReverse /cgi-bin !
>-ProxyPassReverse /errors !
>-ProxyPassReverse /config !
>-ProxyPassReverse /ipa !
>-#ProxyPassReverse /ipatest !
>-ProxyPassReverse / http://localhost:8080/
>+ProxyPass /ipa http://localhost:8080/ipa
>+ProxyPassReverse /ipa http://localhost:8080/ipa
> 
> # Configure the XML-RPC service
>+Alias /ipaxml "/usr/share/ipa/ipaserver/XMLRPC"
> 
>-Alias /ipa "/usr/share/ipa/ipaserver/XMLRPC"
>+# This is where we redirect on failed auth
> Alias /errors "/usr/share/ipa/html"
>+
>+# For the MIT Windows config files
> Alias /config "/usr/share/ipa/html"
>+
>+# So we don't have to hardcode a path into the CSS
>+Alias /static "/usr/share/ipa/ipagui/static"
> 
> <Directory "/usr/share/ipa/ipaserver">
>   AuthType Kerberos

Actions: View | Diff

Attachments on bug 438021: 298546 | 298751