@@ -67,9 +67,55 @@ extensions you can also simply set the KRB5_KTNAME environment variable in the
6767Apache init script and skip the GssapiCredStore option completely.
6868
6969
70+ Environment Variables
71+ ---------------------
72+
73+ (Note: these are not process environment variables, but rather Apache
74+ environment variables, as described
75+ [in the apache docs](https://httpd.apache.org/docs/2.4/env.html).)
76+
77+ ### gssapi-no-negotiate
78+
79+ This environment variable is used to suppress setting Negotiate headers. Not
80+ sending these headers is useful to work around browsers that do not handle
81+ them properly (and incorrectly show authentication popups to users).
82+
83+ #### Example
84+
85+ For instance, to suppress negotiation on Windows browsers, one could set:
86+
87+ BrowserMatch Windows gssapi-no-negotiate
88+
89+
90+
7091Configuration Directives
7192------------------------
7293
94+ ### Alphabetic List of Directives
95+
96+ [GssapiAcceptorName](#gssapiacceptorname)<br>
97+ [GssapiAllowedMech](#gssapiallowedmech)<br>
98+ [GssapiBasicAuth](#gssapibasicauth)<br>
99+ [GssapiBasicAuthMech](#gssapibasicauthmech)<br>
100+ [GssapiConnectionBound](#gssapiconnectionbound)<br>
101+ [GssapiCredStore](#gssapicredstore)<br>
102+ [GssapiDelegCcacheDir](#gssapidelegccachedir)<br>
103+ [GssapiDelegCcacheEnvVar](#gssapidelegccacheenvvar)<br>
104+ [GssapiDelegCcachePerms](#gssapidelegccacheperms)<br>
105+ [GssapiDelegCcacheUnique](#gssapidelegccacheunique)<br>
106+ [GssapiImpersonate](#gssapiimpersonate)<br>
107+ [GssapiLocalName](#gssapilocalname)<br>
108+ [GssapiNameAttributes](#gssapinameattributes)<br>
109+ [GssapiNegotiateOnce](#gssapinegotiateonce)<br>
110+ [GssapiPublishErrors](#gssapipublisherrors)<br>
111+ [GssapiRequiredNameAttributes](#gssapirequirednameattributes)<br>
112+ [GssapiSessionKey](#gssapisessionkey)<br>
113+ [GssapiSignalPersistentAuth](#gssapisignalpersistentauth)<br>
114+ [GssapiSSLonly](#gssapisslonly)<br>
115+ [GssapiUseS4U2Proxy](#gssapiuses4u2proxy)<br>
116+ [GssapiUseSessions](#gssapiusesessions)<br>
117+
118+
73119### GssapiSSLonly
74120
75121Forces the authentication attempt to fail if the connection is not being
@@ -108,6 +154,7 @@ request for continuation.
108154
109155
110156### GssapiSignalPersistentAuth
157+
111158For clients that make use of Persistent-Auth header, send the header according
112159to GssapiConnectionBound setting.
113160
@@ -237,6 +284,7 @@ keytab and store a ccache in the configured ccache file.
237284
238285
239286### GssapiBasicAuth
287+
240288Allows the use of Basic Auth in conjunction with Negotiate.
241289If the browser fails to use Negotiate it will instead fallback to Basic and
242290the username and password will be used to try to acquire credentials in the
@@ -307,6 +355,7 @@ underscores for environment variable names.
307355 GssapiNameAttributes json
308356 GssapiNameAttributes RADIUS_NAME urn:ietf:params:gss:radius-attribute_1
309357
358+
310359### GssapiRequiredNameAttributes
311360
312361This option allows specifying one or more Name Attributes that the client must
@@ -336,6 +385,7 @@ expression, or no Name Attributes are present, a 403 response is returned.
336385 GssapiRequiredNameAttributes "auth-indicators=high or other-attr=foo"
337386 GssapiRequiredNameAttributes "((auth-indicators=low and auth-indicators=med) or auth-indicators=high)"
338387
388+
339389### GssapiNegotiateOnce
340390
341391When this option is enabled the Negotiate header will not be resent if
@@ -360,6 +410,7 @@ Auth mechanism. Enable GssapiNegotiateOnce to avoid this situation.
360410- **Enable with:** GssapiNegotiateOnce On
361411- **Default:** GssapiNegotiateOnce Off
362412
413+
363414### GssapiImpersonate
364415
365416This option can be used even if AuthType GSSAPI is not used for given
@@ -451,21 +502,4 @@ Note: The GSS_C_NT_HOSTBASED_SERVICE format is used for names (see example).
451502#### Example
452503 GssapiAcceptorName HTTP@www.example.com
453504
454- Environment Variables
455- ---------------------
456-
457- (Note: these are not process environment variables, but rather Apache
458- environment variables, as described
459- [in the apache docs](https://httpd.apache.org/docs/2.4/env.html).)
460-
461- ### gssapi-no-negotiate
462-
463- This environment variable is used to suppress setting Negotiate headers. Not
464- sending these headers is useful to work around browsers that do not handle
465- them properly (and incorrectly show authentication popups to users).
466505
467- #### Example
468-
469- For instance, to suppress negotiation on Windows browsers, one could set:
470-
471- BrowserMatch Windows gssapi-no-negotiate
0 commit comments