using mod_auth_kerb with openbsd's apache

to get mod_auth_kerb working on openbsd using the chroot'd apache, you need to follow 3 easy steps. i assume you've already setup a kerberos realm according to `info heimdal`

install package
extract keytab
configure apache

1. install package

# pkg_add mod_auth_kerb

2. extract keytab

# kadmin -l
kadmin> ext_keytab -k /tmp/apache.keytab HTTP/server.realm
kadmin> quit
# install -m 600 /tmp/apache.keytab /var/www/conf/apache.keytab
# chown www:www /var/www/conf/apache.keytab
# rm /tmp/apache.keytab

if you hadn't already extracted the keytab for the system, you need to do that too

kadmin> ext_keytab -k /tmp/system.keytab host/server.realm
kadmin> quit
# install -m 600 /tmp/system.keytab /etc/kerberosV/krb5.keytab
# rm /tmp/system.keytab

3. configure apache


        AuthType Kerberos
        AuthName "Kerberos Protected Directory"
        Krb5Keytab /conf/apache.keytab
        require valid-user

enjoy