Bug 786206

Summary: Document how to modify browser config to remove ticket delegation
Product: Red Hat Enterprise Linux 6 Reporter: Dmitri Pal <dpal>
Component: doc-Identity_Management_GuideAssignee: Deon Ballard <dlackey>
Status: CLOSED CURRENTRELEASE QA Contact: ecs-bugs
Severity: medium Docs Contact:
Priority: medium    
Version: 6.3CC: jskeoch, mkosek
Target Milestone: rcKeywords: Documentation
Target Release: 6.3   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2012-06-29 15:13:51 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:

Description Dmitri Pal 2012-01-31 17:39:11 UTC 
This bug is created as a clone of upstream ticket:
https://fedorahosted.org/freeipa/ticket/2310

With IPA 2.2 we will be using a feature of the KDC called S4U2Proxy (services for user to proxy). We won't need users to delegated their TGT to IPA anymore.

This means that people who have already configured their web browser to delegate their TGT can unset this. It won't cause problems if it is set but it is essentially sharing your full identity with a remote server so not doing so is safer.

To do this the user will need to go to the URL about:config

Search for delegation

Select the value network.negotiate-auth.delegation-uris and clear out the IPA domain (.example.com or example.com) and click Ok.

That's it. No need to restart the browser.

This will only work against 2.2+.
Comment 2 Deon Ballard 2012-04-18 17:55:21 UTC 
Added upgrade info here:
http://documentation-stage.bne.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/6/html/Identity_Management_Guide/upgrading.html#ticket-delegation

Removed delegation.uris part here:
http://documentation-stage.bne.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/6/html/Identity_Management_Guide/using-the-ui.html#config-browser
Comment 4 Deon Ballard 2012-06-22 20:09:33 UTC 
Fixed:

* http://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/6/html/Identity_Management_Guide/upgrading.html#ticket-delegation

* http://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/6/html/Identity_Management_Guide/using-the-ui.html#config-browser

Just an FYI, spellchecking is the last thing I do before GA.