pgreco / rpms / ipa

Forked from forks/areguera/rpms/ipa 4 years ago
Clone

Blame SOURCES/0188-Revert-setting-sessionMaxAge-for-old-clients.patch

ac7d03
From f231d5ceb283723c42f6c15210c76f28324c2e15 Mon Sep 17 00:00:00 2001
ac7d03
From: Simo Sorce <simo@redhat.com>
ac7d03
Date: Tue, 6 Jun 2017 09:04:58 -0400
ac7d03
Subject: [PATCH] Revert setting sessionMaxAge for old clients
ac7d03
ac7d03
Older clients have issues properly parsing cookies and the sessionMaxAge
ac7d03
setting is one of those that breaks them.
ac7d03
Comment out the setting and add a comment that explains why it is not
ac7d03
set by default.
ac7d03
ac7d03
https://pagure.io/freeipa/issue/7001
ac7d03
ac7d03
Signed-off-by: Simo Sorce <simo@redhat.com>
ac7d03
Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
ac7d03
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
ac7d03
---
ac7d03
 install/conf/ipa.conf | 6 ++++--
ac7d03
 1 file changed, 4 insertions(+), 2 deletions(-)
ac7d03
ac7d03
diff --git a/install/conf/ipa.conf b/install/conf/ipa.conf
ac7d03
index a7ca5ce715e55960b8edd307cdbe41dcbd6b29ca..01bf9a4f97fc0cf197c0ad12743affa597b54911 100644
ac7d03
--- a/install/conf/ipa.conf
ac7d03
+++ b/install/conf/ipa.conf
ac7d03
@@ -1,5 +1,5 @@
ac7d03
 #
ac7d03
-# VERSION 26 - DO NOT REMOVE THIS LINE
ac7d03
+# VERSION 27 - DO NOT REMOVE THIS LINE
ac7d03
 #
ac7d03
 # This file may be overwritten on upgrades.
ac7d03
 #
ac7d03
@@ -77,7 +77,9 @@ WSGIScriptReloading Off
ac7d03
   Session On
ac7d03
   SessionCookieName ipa_session path=/ipa;httponly;secure;
ac7d03
   SessionHeader IPASESSION
ac7d03
-  SessionMaxAge 1800
ac7d03
+  # Uncomment the following to have shorter sessions, but beware this may break
ac7d03
+  # old IPA client tols that incorrectly parse cookies.
ac7d03
+  # SessionMaxAge 1800
ac7d03
   GssapiSessionKey file:/etc/httpd/alias/ipasession.key
ac7d03
 
ac7d03
   GssapiImpersonate On
ac7d03
-- 
ac7d03
2.9.4
ac7d03