Bug 1257042

Summary:	RequestHeaderIdentityProvider promotes Kerberos/mod_auth_kerb, GSSAPI/mod_auth_gssapi is preferred
Product:	OpenShift Container Platform	Reporter:	Jan Pazdziora <jpazdziora>
Component:	Documentation	Assignee:	Vikram Goyal <vigoyal>
Status:	CLOSED CURRENTRELEASE	QA Contact:	Vikram Goyal <vigoyal>
Severity:	medium	Docs Contact:	Vikram Goyal <vigoyal>
Priority:	medium
Version:	3.0.0	CC:	aos-bugs, bleanhar, jokerman, jpazdziora, mmccomas
Target Milestone:	---
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2017-10-18 19:08:54 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Jan Pazdziora 2015-08-26 07:17:26 UTC

Document URL: 

https://docs.openshift.com/enterprise/3.0/admin_guide/configuring_authentication.html#RequestHeaderIdentityProvider

Section Number and Name: 

Apache Configuration, the example of the configuration

Describe the issue: 

    # For Kerberos remove "AuthType basic" and insert the following:
    # AuthType Kerberos
    # KrbMethodNegotiate on
    # KrbMethodK5Passwd off
    # KrbServiceName Any
    # KrbAuthRealms EXAMPLE.COM
    # Krb5Keytab /path/to/keytab
    # KrbSaveCredentials off

Suggestions for improvement: 

The use of AuthType Kerberos implies the use of mod_auth_kerb. In Fedoras and RHEL 7, mod_auth_gssapi is now available which is a replacement of no-longer-actively-maintained mod_auth_kerb. The AuthType Kerberos should be replaced by AuthType GSSAPI and the Krb* directives with some equivalent directives of mod_auth_gssapi.

Additional information:

Comment 2 Brenton Leanhardt 2015-09-15 19:46:43 UTC

This PR references mod_auth_gssapi: https://github.com/openshift/openshift-docs/pull/903

It will merge sometime before 3.0.2 is released.

Comment 4 Jan Pazdziora 2017-10-18 08:34:32 UTC

I confirm that https://docs.openshift.com/enterprise/3.0/admin_guide/configuring_authentication.html#RequestHeaderIdentityProvider today says

    # For Kerberos
    # yum install mod_auth_gssapi
    # AuthType GSSAPI
    # GssapiCredStore keytab:/etc/httpd.keytab

Why is this bugzilla tracked with ose-2.2.z ? flag and not just marked resolved in CURRENTRELEASE?

Comment 5 Brenton Leanhardt 2017-10-18 19:08:54 UTC

Hi Jan,

The docs team doesn't really use flags for tracking bugs as far as I know.  I'm going to close this bug if you say it's fixed.  Thanks.