Alias /idp/ui /usr/share/ipsilon/ui
WSGIScriptAlias /idp /usr/libexec/ipsilon.py
WSGIDaemonProcess idp maximum-requests=2 user=ipsilon group=ipsilon
WSGIProcessGroup idp

<Location /idp/login/gssapi/negotiate>
  AuthType GSSAPI
  AuthName "GSSAPI Single Sign On Login"
  GssapiCredStore /etc/httpd/conf/http.keytab
  GssapiSSLonly On
  GssapiLocalName on
  Require valid-user

  ErrorDocument 401 /idp/login/gssapi/unauthorized
  ErrorDocument 500 /idp/login/gssapi/failed
</Location>

<Directory /usr/libexec>
    Order allow,deny
    Allow from all
    Require all granted
</Directory>