From b6b3dbbca3c65e250304bb4d80e11f999205a988 Mon Sep 17 00:00:00 2001
From: Timo Makinen <tmakinen@foo.sh>
Date: Thu, 6 Jun 2019 02:30:56 +0300
Subject: [PATCH] more authz regexp base dn's for gssapi authentication

---
 roles/ldap/server/templates/slapd.conf.j2 | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/roles/ldap/server/templates/slapd.conf.j2 b/roles/ldap/server/templates/slapd.conf.j2
index a01f699..e733c23 100644
--- a/roles/ldap/server/templates/slapd.conf.j2
+++ b/roles/ldap/server/templates/slapd.conf.j2
@@ -98,11 +98,15 @@ authz-regexp
 authz-regexp
     "uid=([^,]\+),cn=gssapi,cn=auth"
     "ldap:///{{ ldap_basedn }}??sub?(&(uid=$1)(objectClass=posixAccount))"
+authz-regexp
+    "uid=([^,]\+),cn=gss-spnego,cn=auth"
+    "ldap:///{{ ldap_basedn }}??sub?(&(uid=$1)(objectClass=posixAccount))"
 
 # require authentication for authenticated users that don't match above
 access to *
     by dn.children="cn=peercred,cn=external,cn=auth" auth
     by dn.children="cn=gssapi,cn=auth" auth
+    by dn.children="cn=gss-spnego,cn=auth" auth
     by anonymous auth
     by * break