templates/auth_gssapi.conf.erb


<LocationMatch ^/users/extlogin/?$>
  SSLRequireSSL
  AuthType GSSAPI
  AuthName "GSSAPI Single Sign On Login"
  GssapiCredStore keytab:<%= @http_keytab %>
  GssapiSSLonly On
  GssapiLocalName <%= @gssapi_local_name %>
  # require valid-user
  require pam-account <%= scope.lookupvar('foreman::pam_service') %>
  ErrorDocument 401 '<html><meta http-equiv="refresh" content="0; URL=/users/login"><body>Kerberos authentication did not pass.</body></html>'
  # The following is needed as a workaround for https://bugzilla.redhat.com/show_bug.cgi?id=1020087
  ErrorDocument 500 '<html><meta http-equiv="refresh" content="0; URL=/users/login"><body>Kerberos authentication did not pass.</body></html>'
</LocationMatch>