Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

Description of problem:

Partially related to bug 1255105:

The Apache configuration created by ipsilon-server-install is stored in /etc/ipsilon/idp/idp.conf, symlinked from /etc/httpd/conf.d/ipsilon-idp.conf. The net effect is that the SELinux type of that file is

# ls -laZ /etc/ipsilon/idp/idp.conf
-rw-------. ipsilon ipsilon unconfined_u:object_r:etc_t:s0   /etc/ipsilon/idp/idp.conf

and it is owned by ipsilon:ipsilon. All other Apache configuration files, stored in /etc/httpd/conf.d, have type httpd_config_t.

That etc_t does not cause any issues (now) but wouldn't it be more correct to either have the Apache config file stored directly in /etc/httpd/conf.d, or stored in a location like /etc/ipsilon/idp/httpd which would have fcontext set to use httpd_config_t?

Version-Release number of selected component (if applicable):

ipsilon-1.0.0-7.el7.noarch

How reproducible:

Deterministic.

Steps to Reproduce:
1. yum install ipsilon ; ipsilon-server-install [ some useful options ]
2. Check the SELinux type of /etc/httpd/conf.d/ipsilon-idp.conf, and its target /etc/ipsilon/idp/idp.conf

Actual results:

etc_t

Expected results:

httpd_config_t

Additional info:

Red Hat Enterprise Linux 7.2 introduced the Ipsilon identity provider service for federated single sign-on (SSO). Subsequently, Red Hat has released Red Hat Single Sign-On as a web SSO solution based on the Keycloak community project. Red Hat Single Sign-On provides greater capabilities than Ipsilon and is designated as the standard web SSO solution across the Red Hat product portfolio.

Therefore, as mentioned in the RHEL-7.3 Release Notes:
https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/7.3_Release_Notes/chap-Red_Hat_Enterprise_Linux-7.3_Release_Notes-Deprecated_Functionality.html
Ipsilon is now obsolete in RHEL and all existing Ipsilon users are recommended to migrate to Red Hat SSO product:
https://access.redhat.com/products/red-hat-single-sign-on
Please approach the Customer Service for advice.

Given above, this Bugzilla is now closed as WONTFIX.