Skip to content

Commit 7bfe7ff

Browse files
simo5frozencemetery
authored andcommitted
Add list of directives
This allows to consult the whole list in one place and then jump to the desired section as needed. Also fix some minor formatting discrepancies. Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-by: Robbie Harwood <rharwood@redhat.com> Merges: #160
1 parent 94c96fe commit 7bfe7ff

File tree

1 file changed

+51
-17
lines changed

1 file changed

+51
-17
lines changed

README

Lines changed: 51 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -67,9 +67,55 @@ extensions you can also simply set the KRB5_KTNAME environment variable in the
6767
Apache init script and skip the GssapiCredStore option completely.
6868

6969

70+
Environment Variables
71+
---------------------
72+
73+
(Note: these are not process environment variables, but rather Apache
74+
environment variables, as described
75+
[in the apache docs](https://httpd.apache.org/docs/2.4/env.html).)
76+
77+
### gssapi-no-negotiate
78+
79+
This environment variable is used to suppress setting Negotiate headers. Not
80+
sending these headers is useful to work around browsers that do not handle
81+
them properly (and incorrectly show authentication popups to users).
82+
83+
#### Example
84+
85+
For instance, to suppress negotiation on Windows browsers, one could set:
86+
87+
BrowserMatch Windows gssapi-no-negotiate
88+
89+
90+
7091
Configuration Directives
7192
------------------------
7293

94+
### Alphabetic List of Directives
95+
96+
[GssapiAcceptorName](#gssapiacceptorname)<br>
97+
[GssapiAllowedMech](#gssapiallowedmech)<br>
98+
[GssapiBasicAuth](#gssapibasicauth)<br>
99+
[GssapiBasicAuthMech](#gssapibasicauthmech)<br>
100+
[GssapiConnectionBound](#gssapiconnectionbound)<br>
101+
[GssapiCredStore](#gssapicredstore)<br>
102+
[GssapiDelegCcacheDir](#gssapidelegccachedir)<br>
103+
[GssapiDelegCcacheEnvVar](#gssapidelegccacheenvvar)<br>
104+
[GssapiDelegCcachePerms](#gssapidelegccacheperms)<br>
105+
[GssapiDelegCcacheUnique](#gssapidelegccacheunique)<br>
106+
[GssapiImpersonate](#gssapiimpersonate)<br>
107+
[GssapiLocalName](#gssapilocalname)<br>
108+
[GssapiNameAttributes](#gssapinameattributes)<br>
109+
[GssapiNegotiateOnce](#gssapinegotiateonce)<br>
110+
[GssapiPublishErrors](#gssapipublisherrors)<br>
111+
[GssapiRequiredNameAttributes](#gssapirequirednameattributes)<br>
112+
[GssapiSessionKey](#gssapisessionkey)<br>
113+
[GssapiSignalPersistentAuth](#gssapisignalpersistentauth)<br>
114+
[GssapiSSLonly](#gssapisslonly)<br>
115+
[GssapiUseS4U2Proxy](#gssapiuses4u2proxy)<br>
116+
[GssapiUseSessions](#gssapiusesessions)<br>
117+
118+
73119
### GssapiSSLonly
74120

75121
Forces the authentication attempt to fail if the connection is not being
@@ -108,6 +154,7 @@ request for continuation.
108154

109155

110156
### GssapiSignalPersistentAuth
157+
111158
For clients that make use of Persistent-Auth header, send the header according
112159
to GssapiConnectionBound setting.
113160

@@ -237,6 +284,7 @@ keytab and store a ccache in the configured ccache file.
237284

238285

239286
### GssapiBasicAuth
287+
240288
Allows the use of Basic Auth in conjunction with Negotiate.
241289
If the browser fails to use Negotiate it will instead fallback to Basic and
242290
the username and password will be used to try to acquire credentials in the
@@ -307,6 +355,7 @@ underscores for environment variable names.
307355
GssapiNameAttributes json
308356
GssapiNameAttributes RADIUS_NAME urn:ietf:params:gss:radius-attribute_1
309357

358+
310359
### GssapiRequiredNameAttributes
311360

312361
This option allows specifying one or more Name Attributes that the client must
@@ -336,6 +385,7 @@ expression, or no Name Attributes are present, a 403 response is returned.
336385
GssapiRequiredNameAttributes "auth-indicators=high or other-attr=foo"
337386
GssapiRequiredNameAttributes "((auth-indicators=low and auth-indicators=med) or auth-indicators=high)"
338387

388+
339389
### GssapiNegotiateOnce
340390

341391
When this option is enabled the Negotiate header will not be resent if
@@ -360,6 +410,7 @@ Auth mechanism. Enable GssapiNegotiateOnce to avoid this situation.
360410
- **Enable with:** GssapiNegotiateOnce On
361411
- **Default:** GssapiNegotiateOnce Off
362412

413+
363414
### GssapiImpersonate
364415

365416
This option can be used even if AuthType GSSAPI is not used for given
@@ -451,21 +502,4 @@ Note: The GSS_C_NT_HOSTBASED_SERVICE format is used for names (see example).
451502
#### Example
452503
GssapiAcceptorName HTTP@www.example.com
453504

454-
Environment Variables
455-
---------------------
456-
457-
(Note: these are not process environment variables, but rather Apache
458-
environment variables, as described
459-
[in the apache docs](https://httpd.apache.org/docs/2.4/env.html).)
460-
461-
### gssapi-no-negotiate
462-
463-
This environment variable is used to suppress setting Negotiate headers. Not
464-
sending these headers is useful to work around browsers that do not handle
465-
them properly (and incorrectly show authentication popups to users).
466505

467-
#### Example
468-
469-
For instance, to suppress negotiation on Windows browsers, one could set:
470-
471-
BrowserMatch Windows gssapi-no-negotiate

0 commit comments

Comments
 (0)