{"action":"created","issue":{"url":"https://api.github.com/repos/cockpit-project/cockpit/issues/3434","labels_url":"https://api.github.com/repos/cockpit-project/cockpit/issues/3434/labels{/name}","comments_url":"https://api.github.com/repos/cockpit-project/cockpit/issues/3434/comments","events_url":"https://api.github.com/repos/cockpit-project/cockpit/issues/3434/events","html_url":"https://github.com/cockpit-project/cockpit/pull/3434","id":125454299,"number":3434,"title":"cockpit-ws: allow to define Kerberos keytab for cockpit-session","user":{"login":"abbra","id":2066,"avatar_url":"https://avatars.githubusercontent.com/u/2066?v=3","gravatar_id":"","url":"https://api.github.com/users/abbra","html_url":"https://github.com/abbra","followers_url":"https://api.github.com/users/abbra/followers","following_url":"https://api.github.com/users/abbra/following{/other_user}","gists_url":"https://api.github.com/users/abbra/gists{/gist_id}","starred_url":"https://api.github.com/users/abbra/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/abbra/subscriptions","organizations_url":"https://api.github.com/users/abbra/orgs","repos_url":"https://api.github.com/users/abbra/repos","events_url":"https://api.github.com/users/abbra/events{/privacy}","received_events_url":"https://api.github.com/users/abbra/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/cockpit-project/cockpit/labels/needswork","name":"needswork","color":"eb6420"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":7,"created_at":"2016-01-07T18:13:49Z","updated_at":"2016-01-08T11:02:29Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/cockpit-project/cockpit/pulls/3434","html_url":"https://github.com/cockpit-project/cockpit/pull/3434","diff_url":"https://github.com/cockpit-project/cockpit/pull/3434.diff","patch_url":"https://github.com/cockpit-project/cockpit/pull/3434.patch"},"body":"Cockpit allows to authenticate with GSSAPI. As it is running as\r\na web server, browsers will use HTTP/cockpit.server@REALM as\r\na Kerberos service principal. Cockpit code uses default keytab\r\nto search for HTTP/cockpit.server@REALM keys.\r\n\r\nAllow cockpit-ws to redefine Kerberos keytab location with cockpit.conf:\r\n\r\n[Negotiate]\r\n  keytab = /path/to/keytab.file\r\n\r\nWhen Cockpit runs on the same server as FreeIPA master, FreeIPA already\r\nmanages keys to HTTP/cockpit.server@REALM principal. Given that\r\ncockpit-session runs as a privileged process, it would be able to retrieve\r\nkeys from the FreeIPA's /etc/httpd/conf/ipa.keytab with the following\r\nconfiguration:\r\n\r\n[Negotiate]\r\n  keytab = /etc/httpd/conf/ipa.keytab\r\n\r\nSigned-off-by: Alexander Bokovoy <abokovoy@redhat.com>"},"comment":{"url":"https://api.github.com/repos/cockpit-project/cockpit/issues/comments/169964622","html_url":"https://github.com/cockpit-project/cockpit/pull/3434#issuecomment-169964622","issue_url":"https://api.github.com/repos/cockpit-project/cockpit/issues/3434","id":169964622,"user":{"login":"stefwalter","id":795070,"avatar_url":"https://avatars.githubusercontent.com/u/795070?v=3","gravatar_id":"","url":"https://api.github.com/users/stefwalter","html_url":"https://github.com/stefwalter","followers_url":"https://api.github.com/users/stefwalter/followers","following_url":"https://api.github.com/users/stefwalter/following{/other_user}","gists_url":"https://api.github.com/users/stefwalter/gists{/gist_id}","starred_url":"https://api.github.com/users/stefwalter/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/stefwalter/subscriptions","organizations_url":"https://api.github.com/users/stefwalter/orgs","repos_url":"https://api.github.com/users/stefwalter/repos","events_url":"https://api.github.com/users/stefwalter/events{/privacy}","received_events_url":"https://api.github.com/users/stefwalter/received_events","type":"User","site_admin":false},"created_at":"2016-01-08T11:02:29Z","updated_at":"2016-01-08T11:02:29Z","body":"@abbra So with the above in mind, what do you think about the idea of having a well known location for the cockpit keytab and symlinking other keytabs in that place, as a means of configuration?\r\n\r\nThat's sorta how we do it with our certificates. Configuration by placing a file in the expected location: http://cockpit-project.org/guide/latest/https.html\r\n"}}