Description of problem:

Current man page provides the following information:

ldap_sasl_authid (string)
           Specify the SASL authorization id to use. When GSSAPI is used, this
represents the Kerberos
           principal used for authentication to the directory. This option can
either contain the full
           principal (for example host/myhost@EXAMPLE.COM) or just the
principal name (for example
           host/myhost).

           Default: host/hostname@REALM

This is not complete.
It would be helpful information on what priority or order is used.

Version-Release number of selected component (if applicable):
NA

How reproducible:
NA

Steps to Reproduce:
1.
2.
3.

Actual results:

ldap_sasl_authid (string)
           Specify the SASL authorization id to use. When GSSAPI is used, this
represents the Kerberos
           principal used for authentication to the directory. This option can
either contain the full
           principal (for example host/myhost@EXAMPLE.COM) or just the
principal name (for example
           host/myhost).

           Default: host/hostname@REALM

Expected results:


The priority of the lookup is noted in a comment of the function
select_principal_from_keytab() in the code:

     * Priority of lookup:
     * - our.hostname@REALM or host/our.hostname@REALM depending on the input
     * - SHORT.HOSTNAME$@REALM (AD domain)
     * - host/our.hostname@REALM
     * - foobar$@REALM (AD domain)
     * - host/foobar@REALM
     * - host/foo@BAR
     * - pick the first principal in the keytab
     */

It would be helpful if similar information is presented in the man page.

Additional info: