Simo Sorce

Provide alternative to mod_session

7

mod_session is turning out to cause more issues than it resolves, from adding arbitrary data to a cookie, to double cookies being sent to clients, and other issues worked around...

Explore use of mod_watchdog to clean up ccache store

1

GssapiDelegCcacheUnique has a nasty not that users need to come up with a way to monitor and clear of old caches the ccache directory. We also provide a sweeper.py utility...

libkrb5 does it on its own normally and is influenced by locator plugins. kdcproxy should just follow suite.

Make the code compatible with Jwcrypto 1.4

7

This version of jwcrypto had to break API due to a security fix. This patch makes the code compatible with both newer and older jwcrypto versions. Note: the way FreeIPa...

CA operations with external provider fail CA certificate=private key check due to improper export

5

This comes out of this issue: https://github.com/latchset/pkcs11-provider/issues/94 The gist of it is that EVP_PKEY_eq() is called to check if the private key provided correspond to the CA cert available and...

Add a document with all the options gss-proxy accept and their meaning

1

Docs !

Implements anonymous auth for initiators only, ie only the initiator can be anonymous, not the server. Both client and server support this. Resolves #9

Add Python type annotation

13

type annotations autodocument the function parameters and allow for static analysis and other nice things. See https://github.com/pythongssapi/python-gssapi/pull/284 for an example.

For algorithms like A256CBC-HS512 the output keysize is 256 bits, but the input keysize is expected to be 512 bits. When a JWK(generate='oct', alg='A256CBC-HS512') command is invoked the code tries...

Allow global white-lists for encryption/signing algorithms

1

This way a user can set the allowed algorithms globally and not risk unvalidated input to cause the use of algorithms not deemed acceptable for an application.