chrisfu c1d2a91991 fix(spnego): Subject.callAs, AES keytab, and krb5.conf sync for JDK 21 ... - KerberosSpnegoService: replace Subject.doAs with Subject.callAs (JDK 18+) so Subject.current() is set correctly for JGSS credential lookup in JDK 21. Pass null GSSCredential to createContext so the mechanism auto-selects rather than failing with "No credential found for 1.3.6.1.5.5.2". - knoe-auth-deployment: fix PROLE_KERBEROS_KEYTAB_PATH to /etc/knoe-auth/http.keytab (matches the knoe-auth-http-keytab secret volume mount). - knoe-kdc-configmap: full rewrite from stale KNOE.DEV to KNOE.LOCAL; add PROLE.ORG realm (Samba AD at 10.0.0.3) and [capaths] for future cross-realm trust. Drop arcfour-hmac/des3 from permitted_enctypes — RC4 hard-removed in JDK 21 and service account now AES-only (msDS-SupportedEncryptionTypes=24). Fix hardcoded secret values in entrypoint.sh to use ${PROLE_KDC_MASTER_PASSWORD} variable references. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>		2026-05-27 20:06:36 -07:00
..
gcp	feat(auth): add Google Workspace OAuth (prole.org) for Grafana + Supabase Studio	2026-05-06 16:22:49 -04:00
opentofu	fix(spnego): Subject.callAs, AES keytab, and krb5.conf sync for JDK 21	2026-05-27 20:06:36 -07:00