<div class="gmail_quote">On Wed, Mar 28, 2012 at 11:36 PM, Simo Sorce <span dir="ltr"><<a href="mailto:simo@redhat.com">simo@redhat.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div class="HOEnZb"><div class="h5"><br>
</div></div>CNAMEs should work just fine with the host's HTTP/A-name@REALM key.<br>
In fact I just tested a virtual host on my ipa server using a cname and<br>
it worked.<br></blockquote><div><br>great! <br> <br></div><blockquote class="gmail_quote" style="margin:0pt 0pt 0pt 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
Can you post your (sanitized) mod_auth_kerb configuration ?<br>
Also what browser are you testing with ?<br></blockquote><div><br>sure:<br><br> <VirtualHost *:80><br> ServerName vhost.ipa.domain.tld<br> ServerAdmin webmaster@domain.tld<br> DocumentRoot /var/www/html/vhost1<br>
LogLevel debug<br> CustomLog /var/log/httpd/vhost1.access.log combined<br> ErrorLog /var/log/httpd/vhost1.error.log<br><br><Location "/kerb"><br> AuthType Kerberos<br> AuthName "Kerberos Login"<br>
KrbMethodNegotiate on<br> KrbMethodK5Passwd off<br> KrbServiceName HTTP<br> KrbAuthRealms IPA.DOMAIN.TLD<br> Krb5KeyTab /etc/httpd/conf/webserver01_http.keytab<br> KrbSaveCredentials on<br> Require valid-user<br></Location><br>
<br></VirtualHost><br></div><blockquote class="gmail_quote" style="margin:0pt 0pt 0pt 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
If you kdestroy and then kinit clean, and then try to access the server<br>
*only* using the CNAME you should see the browser has acquired a ticket<br>
for HTTP/A-name, You can use klist to verify. If this works you know it<br>
is a server side issue only. If you do not have the ticket, there may be<br>
a DNS/browser issue.<br></blockquote><div><br>yes, I get a HTTP/A-name ticket and a 500 internal server error on the browser. So you are right, we have an apache issue only. If you can shed some light on the the mod_kerb config that will be great.<br>
</div></div><br>TIA.<br><br>-- <br>Groeten,<br>Natxo<br>