documentation/admin-guide/configuration/basic/kerberos.md

Additional Kerberos Aliases and Services

It is possible to extend the system keytab /etc/krb5.keytab with additional aliases and services.

Additional Kerberos Aliases

By default only the real hostname is known to the AD and the system keytab. If a host is known in DNS with additional hostnames, then Kerberos does not work if these are used.

Below configuration will add the respective aliases to the AD and the system keytab:

kerberos::aliases:
  - 'login.psi.ch'
  - 'llc.psi.ch'

Note that the short name without the domain part is automatically added.

Additional Kerberos Services

Also additional Kerberos Services might be introduced with the Hiera key kerberos::additional_services:

kerberos::additional_services:
  - 'http'