Swithing to use GSS-Proxy/mod_auth_gssapi (#4189 #4190) will require the server installer to be changed to place the HTTP keytab in a place accessible to GSS-Proxy but not apache.
A design page on how to handle updates (or not) to change from the old to the new configuration is also needed.
This is rather documentation ticket, FreeIPA upgrader should handle everything automatically.
Given that mod_auth_gssapi is transparent and we have all the documentation in the upstream mod_auth_gssapi project, we can close this ticket. Please reopen if you disagree.
Metadata Update from @simo: - Issue assigned to someone - Issue set to the milestone: FreeIPA 4.2
Login to comment on this ticket.