[#2247] gss-tsig example configs updated

diff --git a/doc/examples/ddns/gss-tsig.json b/doc/examples/ddns/gss-tsig.json
index 0cc324df74f216356c8f906ae4daccce9fa553b2..e98a2ef667d9791876161ae8241ba6a392aa2054 100644 (file)
--- a/doc/examples/ddns/gss-tsig.json
+++ b/doc/examples/ddns/gss-tsig.json
@@ -56,7 +56,7 @@
         ]
     },
 
-    // Need to add gss-tsig hook here
+    // The GSS-TSIG hook is loaded and its configuration is specified here.
     "hooks-libraries": [
     {
         "library": "/opt/lib/libddns_gss_tsig.so",
@@ -69,8 +69,15 @@
 
             "server-principal": "DNS/server.example.org@EXAMPLE.ORG",
             "client-principal": "DHCP/admin.example.org@EXAMPLE.ORG",
-            "client-keytab": "FILE:/etc/dhcp.keytab", // toplevel only
-            "credentials-cache": "FILE:/etc/ccache", // toplevel only
+
+            // client-keytab and credentials-cache can both be used to
+            // store client keys. As credentials cache is more flexible,
+            // it is recommended to use it. Typically, using both at the
+            // same time may cause problems.
+            //
+            // "client-keytab": "FILE:/etc/dhcp.keytab", // toplevel only
+            "credentials-cache": "FILE:/etc/ccache",     // toplevel only
+
             "tkey-lifetime": 3600, // 1 hour
             "rekey-interval": 2700, // 45 minutes
             "retry-interval": 120, // 2 minutes

diff --git a/doc/sphinx/arm/ext-gss-tsig.rst b/doc/sphinx/arm/ext-gss-tsig.rst
index f415b64a0de125696a7ff1e1b0da99727906c731..b0012c2193fc4704f66d56ad32e53a652e60e856 100644 (file)
--- a/doc/sphinx/arm/ext-gss-tsig.rst
+++ b/doc/sphinx/arm/ext-gss-tsig.rst
@@ -466,7 +466,7 @@ An excerpt from a D2 server configuration is provided below; more examples are a
 
 .. code-block:: javascript
    :linenos:
-   :emphasize-lines: 57-107
+   :emphasize-lines: 57-113
 
 
     {
@@ -525,7 +525,7 @@ An excerpt from a D2 server configuration is provided below; more examples are a
             ]
         },
 
-        // Need to add gss-tsig hook here
+        // The GSS-TSIG hook is loaded and its configuration is specified here.
         "hooks-libraries": [
         {
             "library": "/opt/lib/libddns_gss_tsig.so",
@@ -538,7 +538,13 @@ An excerpt from a D2 server configuration is provided below; more examples are a
 
                 "server-principal": "DNS/server.example.org@EXAMPLE.ORG",
                 "client-principal": "DHCP/admin.example.org@EXAMPLE.ORG",
-                "client-keytab": "FILE:/etc/dhcp.keytab", // toplevel only
+
+                // client-keytab and credentials-cache can both be used to
+                // store client keys. As credentials cache is more flexible,
+                // it is recommended to use it. Typically, using both at the
+                // same time may cause problems.
+                //
+                // "client-keytab": "FILE:/etc/dhcp.keytab", // toplevel only
                 "credentials-cache": "FILE:/etc/ccache", // toplevel only
                 "tkey-lifetime": 3600, // 1 hour
                 "rekey-interval": 2700, // 45 minutes