aboutsummaryrefslogtreecommitdiff
path: root/doc/html/admin/https.html
diff options
context:
space:
mode:
authorCy Schubert <cy@FreeBSD.org>2025-03-19 22:12:25 +0000
committerCy Schubert <cy@FreeBSD.org>2025-03-19 22:12:25 +0000
commit8f7d3ef26dec89a92ec0665de84a5936310a5574 (patch)
tree9a465418bd4056bf0d369751320a414eaed29fa4 /doc/html/admin/https.html
parent1a79b20663ca26acc2998b90ea2ff2aefd8af5b1 (diff)
Diffstat (limited to 'doc/html/admin/https.html')
-rw-r--r--doc/html/admin/https.html56
1 files changed, 25 insertions, 31 deletions
diff --git a/doc/html/admin/https.html b/doc/html/admin/https.html
index cb0d0e49ff3a..7047915be95b 100644
--- a/doc/html/admin/https.html
+++ b/doc/html/admin/https.html
@@ -1,35 +1,26 @@
-<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
- "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+<!DOCTYPE html>
-<html xmlns="http://www.w3.org/1999/xhtml">
+<html>
<head>
- <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
+ <meta charset="utf-8" />
+ <meta name="viewport" content="width=device-width, initial-scale=1.0" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
+
<title>HTTPS proxy configuration &#8212; MIT Kerberos Documentation</title>
- <link rel="stylesheet" href="../_static/agogo.css" type="text/css" />
- <link rel="stylesheet" href="../_static/pygments.css" type="text/css" />
- <link rel="stylesheet" href="../_static/kerb.css" type="text/css" />
- <script type="text/javascript">
- var DOCUMENTATION_OPTIONS = {
- URL_ROOT: '../',
- VERSION: '1.21.2',
- COLLAPSE_INDEX: false,
- FILE_SUFFIX: '.html',
- HAS_SOURCE: true,
- SOURCELINK_SUFFIX: '.txt'
- };
- </script>
- <script type="text/javascript" src="../_static/jquery.js"></script>
- <script type="text/javascript" src="../_static/underscore.js"></script>
- <script type="text/javascript" src="../_static/doctools.js"></script>
+ <link rel="stylesheet" type="text/css" href="../_static/pygments.css" />
+ <link rel="stylesheet" type="text/css" href="../_static/agogo.css" />
+ <link rel="stylesheet" type="text/css" href="../_static/kerb.css" />
+ <script data-url_root="../" id="documentation_options" src="../_static/documentation_options.js"></script>
+ <script src="../_static/jquery.js"></script>
+ <script src="../_static/underscore.js"></script>
+ <script src="../_static/doctools.js"></script>
<link rel="author" title="About these documents" href="../about.html" />
<link rel="index" title="Index" href="../genindex.html" />
<link rel="search" title="Search" href="../search.html" />
<link rel="copyright" title="Copyright" href="../copyright.html" />
<link rel="next" title="Authentication indicators" href="auth_indicator.html" />
<link rel="prev" title="Encryption types" href="enctypes.html" />
- </head>
- <body>
+ </head><body>
<div class="header-wrapper">
<div class="header">
@@ -61,7 +52,7 @@
<div class="bodywrapper">
<div class="body" role="main">
- <div class="section" id="https-proxy-configuration">
+ <section id="https-proxy-configuration">
<span id="https"></span><h1>HTTPS proxy configuration<a class="headerlink" href="#https-proxy-configuration" title="Permalink to this headline">¶</a></h1>
<p>In addition to being able to use UDP or TCP to communicate directly
with a KDC as is outlined in RFC4120, and with kpasswd services in a
@@ -78,14 +69,14 @@ and servers.</p>
<p>An HTTPS proxy server is provided as a feature in some versions of
Microsoft Windows Server, and a WSGI implementation named <cite>kdcproxy</cite>
is available in the python package index.</p>
-<div class="section" id="configuring-the-clients">
+<section id="configuring-the-clients">
<h2>Configuring the clients<a class="headerlink" href="#configuring-the-clients" title="Permalink to this headline">¶</a></h2>
<p>To use an HTTPS proxy, a client host must trust the CA which issued
that proxy’s SSL certificate. If that CA’s certificate is not in the
system-wide default set of trusted certificates, configure the
following relation in the client host’s <a class="reference internal" href="conf_files/krb5_conf.html#krb5-conf-5"><span class="std std-ref">krb5.conf</span></a> file in
the appropriate <a class="reference internal" href="conf_files/krb5_conf.html#realms"><span class="std std-ref">[realms]</span></a> subsection:</p>
-<div class="highlight-default"><div class="highlight"><pre><span></span><span class="n">http_anchors</span> <span class="o">=</span> <span class="n">FILE</span><span class="p">:</span><span class="o">/</span><span class="n">etc</span><span class="o">/</span><span class="n">krb5</span><span class="o">/</span><span class="n">cacert</span><span class="o">.</span><span class="n">pem</span>
+<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="n">http_anchors</span> <span class="o">=</span> <span class="n">FILE</span><span class="p">:</span><span class="o">/</span><span class="n">etc</span><span class="o">/</span><span class="n">krb5</span><span class="o">/</span><span class="n">cacert</span><span class="o">.</span><span class="n">pem</span>
</pre></div>
</div>
<p>Adjust the pathname to match the path of the file which contains a
@@ -94,21 +85,23 @@ more fully in <a class="reference internal" href="conf_files/krb5_conf.html#krb5
<p>Configure the client to access the KDC and kpasswd service by
specifying their locations in its <a class="reference internal" href="conf_files/krb5_conf.html#krb5-conf-5"><span class="std std-ref">krb5.conf</span></a> file in the form
of HTTPS URLs for the proxy server:</p>
-<div class="highlight-default"><div class="highlight"><pre><span></span><span class="n">kdc</span> <span class="o">=</span> <span class="n">https</span><span class="p">:</span><span class="o">//</span><span class="n">server</span><span class="o">.</span><span class="n">fqdn</span><span class="o">/</span><span class="n">KdcProxy</span>
+<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="n">kdc</span> <span class="o">=</span> <span class="n">https</span><span class="p">:</span><span class="o">//</span><span class="n">server</span><span class="o">.</span><span class="n">fqdn</span><span class="o">/</span><span class="n">KdcProxy</span>
<span class="n">kpasswd_server</span> <span class="o">=</span> <span class="n">https</span><span class="p">:</span><span class="o">//</span><span class="n">server</span><span class="o">.</span><span class="n">fqdn</span><span class="o">/</span><span class="n">KdcProxy</span>
</pre></div>
</div>
<p>If the proxy and client are properly configured, client commands such
-as <code class="docutils literal"><span class="pre">kinit</span></code>, <code class="docutils literal"><span class="pre">kvno</span></code>, and <code class="docutils literal"><span class="pre">kpasswd</span></code> should all function normally.</p>
-</div>
-</div>
+as <code class="docutils literal notranslate"><span class="pre">kinit</span></code>, <code class="docutils literal notranslate"><span class="pre">kvno</span></code>, and <code class="docutils literal notranslate"><span class="pre">kpasswd</span></code> should all function normally.</p>
+</section>
+</section>
+ <div class="clearer"></div>
</div>
</div>
</div>
</div>
<div class="sidebar">
+
<h2>On this page</h2>
<ul>
<li><a class="reference internal" href="#">HTTPS proxy configuration</a><ul>
@@ -168,6 +161,7 @@ as <code class="docutils literal"><span class="pre">kinit</span></code>, <code c
<input type="hidden" name="check_keywords" value="yes" />
<input type="hidden" name="area" value="default" />
</form>
+
</div>
<div class="clearer"></div>
</div>
@@ -175,8 +169,8 @@ as <code class="docutils literal"><span class="pre">kinit</span></code>, <code c
<div class="footer-wrapper">
<div class="footer" >
- <div class="right" ><i>Release: 1.21.2</i><br />
- &copy; <a href="../copyright.html">Copyright</a> 1985-2023, MIT.
+ <div class="right" ><i>Release: 1.21.3</i><br />
+ &copy; <a href="../copyright.html">Copyright</a> 1985-2024, MIT.
</div>
<div class="left">
generated by cgit v1.3 (git 2.53.0) at 2026-04-07 18:21:46 +0000