SSLRequireSSL
AuthType Kerberos
AuthName "Kerberos Login"
KrbMethodNegotiate On
KrbMethodK5Passwd Off
KrbAuthRealms <%= @default_ipa_realm %>
Krb5KeyTab <%= @http_keytab %>
KrbLocalUserMapping On
# require valid-user
require pam-account <%= @pam_service %>
ErrorDocument 401 'Kerberos authentication did not pass.'
# The following is needed as a workaround for https://bugzilla.redhat.com/show_bug.cgi?id=1020087
ErrorDocument 500 'Kerberos authentication did not pass.'