Properly check return error when filtering mechs

[mod_auth_gssapi.git] / README

diff --git a/README b/README
index e8d3031..93a90b8 100644 (file)
--- a/README
+++ b/README
@@ -204,3 +204,28 @@ Example:
   GssapiCredStore keytab:/etc/httpd/http.keytab
   Require valid-user
 </Location>
+
+
+### GssapiAllowedMech
+
+List of allowed mechanisms. This is useful to restrict the mechanism that
+can be used when credentials for multiple mechanisms are available.
+By default no mechanism is set, this means all locally available mechanisms
+are allowed.  The recognized mechanism names are: krb5, iakerb, ntlmssp
+
+Example:
+    GssapiAllowedMech krb5
+    GssapiAllowedMech ntlmssp
+
+
+### GssapiBasicAuthMech
+
+List of mechanisms against which Basic Auth is attempted. This is useful to
+restrict the mechanisms that can be used to attaempt password auth.
+By default no mechanism is set, this means all locally available mechanisms
+are allowed, unless GssapiAllowedMech is set, in which case those are used.
+GssapiBasicAuthMech always takes precendence over GssapiAllowedMech.
+The recognized mechanism names are: krb5, iakerb, ntlmssp
+
+Example:
+    GssapiBasicAuthMech krb5