[Freeipa-users] Re: Apache HTTPD Service Account Override
Further investigation suggests this might have something to do with gssproxy. I was
expecting to find the HTTP keytab at /etc/httpd/conf/ipa.keytab, but now see it is in
/var/lib/ipa/gssproxy. This problem only occurs if the PHP script is executed by the
apache user in the context of the HTTPD web server. Executing the PHP script directly
such as "sudo -u apache php test.php" works as expected (the myservice principal
is used). Anyone know why apache user in HTTPD context goes with HTTP service principal
despite the script executing kinit with a different principal and setting environment
variables to try to use the alternative principal?