document additional Kerberos aliases and services

_toc.yml

@@ -68,6 +68,7 @@ chapters:
               - file: admin-guide/configuration/basic/verbose_boot
               - file: admin-guide/configuration/basic/sysctl
               - file: admin-guide/configuration/basic/gssproxy_with_keytab
+              - file: admin-guide/configuration/basic/kerberos
           - file: admin-guide/configuration/access
             sections:
               - file: admin-guide/configuration/access/system_access

admin-guide/configuration/basic/kerberos.md

@@ -0,0 +1,26 @@
+# Additional Kerberos Aliases and Services
+
+It is possible to extend the system keytab `/etc/krb5.keytab` with additional aliases and services.
+
+## Additional Kerberos Aliases
+
+By default only the real hostname is known to the AD and the system keytab.
+If a host is known in DNS with additional hostnames, then Kerberos does not work if these are used.
+
+Below configuration will add the respective aliases to the AD and the system keytab:
+```
+kerberos::aliases:
+  - 'login.psi.ch'
+  - 'llc.psi.ch'
+```
+Note that the short name without the domain part is automatically added.
+
+
+## Additional Kerberos Services
+
+Also additional Kerberos Services might be introduced with the Hiera key `kerberos::additional_services`:
+
+```
+kerberos::additional_services:
+  - 'http'
+```