#3472 doc: gssapi debug update
Merged by tkopecek. Opened by tkopecek.
tkopecek/koji issue3471  into  master

Download 3472.patch

Related: https://pagure.io/koji/issue/3471

Metadata Update from @tkopecek:
- Pull-request tagged with: doc, no_qe

I dare suggest rewording completely as this is essentially a long-winded way of saying "Make sure your dns_canonicalize_hostname is true but actually try fallback and false too or ask around". Plus, there's a couple of typos and the grammar is odd overall.

Something like:

  • Wrong service ticket E.g. because your instance is hidden behind a proxy.
    In such a case, you'll see a wrong principal in the output, such as e.g.
    HTTP/proxy10.fedoraproject.org@FEDORAPROJECT.ORG. Kerberos
    authentication will fail because krbV will try to fetch a service ticket for
    PTR instead of a DNS record, effectively asking for a wrong service.
    The correct form is HTTP/koji.fedoraproject.org@FEDORAPROJECT.ORG
    (also listed as "Ticket Server" in klist output). This problem is usually
    caused by a wrong value of dns_canonicalize_hostname in /etc/krb5.conf.
    Please try setting it to true, fallback and false in turn,
    as different values may be required depending on your situation.

rebased onto 49ff0164959b8e4ce429df7748e29d51e446bbc9

Commit a5a2ac38 fixes this pull-request

Pull-Request has been merged by tkopecek

Metadata