xx-ipa-experimental-x509-auth.conf

# Login with user certificate/smartcard configuration
# This configuration needs to be loaded after <Location "/ipa">
<Location "/ipa/session/login_x509">
  AuthType none
  GssapiCredStore keytab:/etc/httpd/conf/ipa.keytab
  GssapiCredStore client_keytab:/etc/httpd/conf/ipa.keytab
  GssapiDelegCcacheDir /var/run/httpd/ipa/clientcaches
  GssapiImpersonate On
  NSSVerifyClient require
  NSSUserName SSL_CLIENT_CERT
  LookupUserByCertificate On
  WSGIProcessGroup ipa
  WSGIApplicationGroup ipa
</Location>