Fix koji service accounts with gssapi

Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com>

roles/base/templates/krb5.conf.j2

@@ -19,6 +19,11 @@
   kdc = ipa01{{ env_suffix }}.phx2.fedoraproject.org
 {% else %}
   kdc = https://id{{ env_suffix }}.fedoraproject.org/KdcProxy
+{% endif %}
+{% if ansible_hostname.startswith('koji') %}
+  # This maps "A/B@FP.O" to "A/B@FP.O", and is used for gss localname in koji gssapi
+  auth_to_local = RULE:[2:$1/$2@$0](.*)
+  auth_to_local = DEFAULT
 {% endif %}
  }