On Feb 9, 9:50 am, Eric Sorenson <ahp...@gmail.com> wrote: > On Feb 8, 2010, at 4:20 PM, Christophe Bonnaud wrote: > > > > > > >> I've seen the same thing with my setup...the solution for me was to > >> put the "RequestHeader" lines found on the Puppet Passenger wiki page > >> (http://www.reductivelabs.com/trac/puppet/wiki/UsingPassenger) into my > >> Apache virtual host config: > > >> RequestHeader set X-SSL-Subject %{SSL_CLIENT_S_DN}e > >> RequestHeader set X-Client-DN %{SSL_CLIENT_S_DN}e > >> RequestHeader set X-Client-Verify %{SSL_CLIENT_VERIFY}e > > >> ...not sure why that section isn't included in the provided template > >> (./ext/rack/files/apache2.conf) from the puppet sources (I'm using > >> v0.25.4), but adding them fixed things up for me. Note that I also > >> don't have an auth.conf file, and even if I add one and take these > >> lines out, I'm back to getting the "err: Could not retrieve catalog > >> from remote server: Error 403 on SERVER:" message. Hope that helps! > > > Indeed this was the solution... thanks so much for your help!! > > I'm agree it's strange that those lines are not in the provided > > template... > > Anyone know why? > > The documented suggestion -- though I agree it's not on the wiki page; once > we resolve this question here I'd be happy to update UsingPassenger this as > I've just gone through it myself -- is to go at it from the other direction. > Instead of changing apache to match puppet's defaults, you tell puppet the > names of the apache variables: > > (from ext/rack/README) > Required puppet.conf settings: > [puppetmasterd] > ssl_client_header = SSL_CLIENT_S_DN > ssl_client_verify_header = SSL_CLIENT_VERIFY > > Then the required httpd.conf line is just > SSLOptions +StdEnvVars > > which *is* in the config file in the distribution. > > I'm not enough of an expert to know whether one is preferable to the other, > though. > > -=Eric
hum yes indeed it works fine in that way too. I though I already tried that because I saw that in the documentation but I may have done something else wrong at this moment... Thanks Eric! -- You received this message because you are subscribed to the Google Groups "Puppet Users" group. To post to this group, send email to puppet-us...@googlegroups.com. To unsubscribe from this group, send email to puppet-users+unsubscr...@googlegroups.com. For more options, visit this group at http://groups.google.com/group/puppet-users?hl=en.
