git: 300de978dd1a - main - www/freeipa-auth-gssapi: Add new Port

The branch main has been updated by joneum:

URL: https://cgit.FreeBSD.org/ports/commit/?id=300de978dd1a6537463e39bfb153e53f83828322

commit 300de978dd1a6537463e39bfb153e53f83828322
Author:     Jochen Neumeister <[email protected]>
AuthorDate: 2026-08-13 05:45:40 +0000
Commit:     Jochen Neumeister <[email protected]>
CommitDate: 2026-08-13 08:58:46 +0000

    www/freeipa-auth-gssapi: Add new Port
    
    mod_auth_gssapi is the Apache module FreeIPA uses for SPNEGO/GSSAPI
    authentication of the Web UI and API. www/mod_auth_gssapi defaults to
    the base-system GSSAPI on FreeBSD, which mixes base and ports MIT krb5
    in one httpd process and breaks gssproxy interposition. This port is an
    independent build hard-wired to the ports MIT krb5 (security/krb5) so it
    matches the rest of the FreeIPA stack (net/freeipa-server,
    security/gssproxy). It conflicts with ap24-mod_auth_gssapi.
    
    Sponsored by: Netzkommune GmbH
---
 www/Makefile                                       |  1 +
 www/freeipa-auth-gssapi/Makefile                   | 45 ++++++++++++++++++++++
 www/freeipa-auth-gssapi/distinfo                   |  3 ++
 .../files/240_mod_auth_gssapi.conf.sample.in       |  8 ++++
 www/freeipa-auth-gssapi/pkg-descr                  |  7 ++++
 5 files changed, 64 insertions(+)

diff --git a/www/Makefile b/www/Makefile
index 3eb7c9822fd6..ba573462e444 100644
--- a/www/Makefile
+++ b/www/Makefile
@@ -215,6 +215,7 @@
     SUBDIR += formication
     SUBDIR += foswiki
     SUBDIR += free-sa-devel
+    SUBDIR += freeipa-auth-gssapi
     SUBDIR += freenginx
     SUBDIR += freenginx-acme
     SUBDIR += freenginx-acme-module
diff --git a/www/freeipa-auth-gssapi/Makefile b/www/freeipa-auth-gssapi/Makefile
new file mode 100644
index 000000000000..fe0f2cc74057
--- /dev/null
+++ b/www/freeipa-auth-gssapi/Makefile
@@ -0,0 +1,45 @@
+PORTNAME=	freeipa-auth-gssapi
+DISTVERSIONPREFIX=	v
+DISTVERSION=	1.6.5
+CATEGORIES=	www
+PKGNAMEPREFIX=	${APACHE_PKGNAMEPREFIX}
+
+MAINTAINER=	[email protected]
+COMMENT=	Apache mod_auth_gssapi built against MIT krb5 for FreeIPA
+WWW=		https://github.com/gssapi/mod_auth_gssapi
+
+LICENSE=	MIT
+LICENSE_FILE=	${WRKSRC}/COPYING
+
+USES=		autoreconf apache bison gssapi:mit,flags libtool pkgconfig ssl
+USE_GITHUB=	yes
+GH_ACCOUNT=	gssapi
+GH_PROJECT=	mod_auth_gssapi
+MODULENAME=	mod_auth_gssapi
+GNU_CONFIGURE=	yes
+CONFIGURE_ARGS=	KRB5_CONFIG=${KRB5CONFIG} \
+		OPENSSL_CFLAGS=-I${OPENSSLINC} \
+		OPENSSL_LIBS=-lcrypto
+
+# Independent build of mod_auth_gssapi, hard-wired to the MIT (security/krb5)
+# GSSAPI so it matches the rest of the FreeIPA stack (freeipa-server, gssproxy).
+# www/mod_auth_gssapi defaults to GSSAPI_BASE on FreeBSD 15/16, which mixes base
+# and port MIT krb5 in one httpd process and breaks gssproxy interposition
+# (gss_acquire_cred fails), so FreeIPA needs the MIT-linked build.
+CONFLICTS_INSTALL=	ap24-mod_auth_gssapi
+
+APMOD_FILE=	240_${MODULENAME}.conf.sample
+SUB_FILES=	${APMOD_FILE}
+PLIST_FILES=	@sample\ ${APACHEETCDIR}/modules.d/${APMOD_FILE} \
+		${APACHEMODDIR}/${MODULENAME}.so
+PLIST_SUB=	APMOD_FILE=${APMOD_FILE}
+
+do-install:
+	@${MKDIR} ${STAGEDIR}${PREFIX}/${APACHEMODDIR} \
+		  ${STAGEDIR}${PREFIX}/${APACHEETCDIR}/modules.d
+	${APXS} -S LIBEXECDIR=${STAGEDIR}${PREFIX}/${APACHEMODDIR} \
+		-i -n ${MODULENAME} ${WRKSRC}/src/${MODULENAME}.la
+	${INSTALL_DATA} ${WRKDIR}/${APMOD_FILE} ${STAGEDIR}${PREFIX}/${APACHEETCDIR}/modules.d
+	${STRIP_CMD} ${STAGEDIR}${PREFIX}/${APACHEMODDIR}/${MODULENAME}.so
+
+.include <bsd.port.mk>
diff --git a/www/freeipa-auth-gssapi/distinfo b/www/freeipa-auth-gssapi/distinfo
new file mode 100644
index 000000000000..37edee86c32d
--- /dev/null
+++ b/www/freeipa-auth-gssapi/distinfo
@@ -0,0 +1,3 @@
+TIMESTAMP = 1661791300
+SHA256 (gssapi-mod_auth_gssapi-v1.6.5_GH0.tar.gz) = 8c61c04062d3fffadfad8e71e65783d8e5dffe806be76e8c9a097500a59a76eb
+SIZE (gssapi-mod_auth_gssapi-v1.6.5_GH0.tar.gz) = 123448
diff --git a/www/freeipa-auth-gssapi/files/240_mod_auth_gssapi.conf.sample.in b/www/freeipa-auth-gssapi/files/240_mod_auth_gssapi.conf.sample.in
new file mode 100644
index 000000000000..698e021db390
--- /dev/null
+++ b/www/freeipa-auth-gssapi/files/240_mod_auth_gssapi.conf.sample.in
@@ -0,0 +1,8 @@
+## vim: set filetype=apache:
+##
+## module file for mod_auth_gssapi
+##
+## PROVIDE: mod_auth_gssapi
+## REQUIRE:
+
+#LoadModule auth_gssapi_module        %%APACHEMODDIR%%/mod_auth_gssapi.so
diff --git a/www/freeipa-auth-gssapi/pkg-descr b/www/freeipa-auth-gssapi/pkg-descr
new file mode 100644
index 000000000000..3b9e6c9b8104
--- /dev/null
+++ b/www/freeipa-auth-gssapi/pkg-descr
@@ -0,0 +1,7 @@
+mod_auth_gssapi is an Apache HTTP Server module that authenticates users
+with GSSAPI/Kerberos (SPNEGO) and related mechanisms.
+
+This is an independent build of mod_auth_gssapi wired to the MIT Kerberos
+from security/krb5, so it matches the FreeIPA server stack (net/freeipa-server,
+security/gssproxy).  It installs the same module and therefore conflicts with
+www/mod_auth_gssapi.