From: Simo Sorce <simo@redhat.com>
Date: Mon, 9 Mar 2015 14:46:55 +0000 (-0400)
Subject: Documentation fixes
X-Git-Tag: v1.1.0~6
X-Git-Url: http://www.project-moonshot.org/gitweb/?p=mod_auth_gssapi.git;a=commitdiff_plain;h=d11c2c952df6b232b17a26f8433d4919589649ad

Documentation fixes

Fix GssapiDelegCcacheDir examples and add all the required options to
make GssapiUseS4U2Proxy really work.

Thanks to David Kupka for testing that highlighted these issues.
---

diff --git a/README b/README
index 6c37412..e23f745 100644
--- a/README
+++ b/README
@@ -152,7 +152,7 @@ principal and the subprocess environment variable KRB5CCNAME will be set
 to point to that file.
 
 Example:
-    GssapiDelegCcacheDir = /var/run/httpd/clientcaches
+    GssapiDelegCcacheDir /var/run/httpd/clientcaches
 
 
 A user foo@EXAMPLE.COM delegating its credentials would cause the server to
@@ -171,7 +171,14 @@ ticket by the application.
 
 Example:
     GssapiUseS4U2Proxy On
-    GssapiDelegCcacheDir = /var/run/httpd/clientcaches
+    GssapiCredStore keytab:/etc/httpd.keytab
+    GssapiCredStore client_keytab:/etc/httpd.keytab
+    GssapiCredStore ccache:FILE:/var/run/httpd/krb5ccache
+    GssapiDelegCcacheDir /var/run/httpd/clientcaches
+
+NOTE: The client keytab is necessary to allow GSSAPI to initate via keytab
+on its own. If not present an external mechanism needs to kinit with the
+keytab and store a ccache in the configured ccache file.
 
 
 ### GssapiBasicAuth