Skip to content

Commit d11c2c9

Browse files
committed
Documentation fixes
Fix GssapiDelegCcacheDir examples and add all the required options to make GssapiUseS4U2Proxy really work. Thanks to David Kupka for testing that highlighted these issues.
1 parent e6d9a30 commit d11c2c9

File tree

1 file changed

+9
-2
lines changed

1 file changed

+9
-2
lines changed

README

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -152,7 +152,7 @@ principal and the subprocess environment variable KRB5CCNAME will be set
152152
to point to that file.
153153

154154
Example:
155-
GssapiDelegCcacheDir = /var/run/httpd/clientcaches
155+
GssapiDelegCcacheDir /var/run/httpd/clientcaches
156156

157157

158158
A user foo@EXAMPLE.COM delegating its credentials would cause the server to
@@ -171,7 +171,14 @@ ticket by the application.
171171

172172
Example:
173173
GssapiUseS4U2Proxy On
174-
GssapiDelegCcacheDir = /var/run/httpd/clientcaches
174+
GssapiCredStore keytab:/etc/httpd.keytab
175+
GssapiCredStore client_keytab:/etc/httpd.keytab
176+
GssapiCredStore ccache:FILE:/var/run/httpd/krb5ccache
177+
GssapiDelegCcacheDir /var/run/httpd/clientcaches
178+
179+
NOTE: The client keytab is necessary to allow GSSAPI to initate via keytab
180+
on its own. If not present an external mechanism needs to kinit with the
181+
keytab and store a ccache in the configured ccache file.
175182

176183

177184
### GssapiBasicAuth

0 commit comments

Comments
 (0)