CentOS - Jul 2011 - nfsv4 and kerberos - fails to mount

I have been trying all sorts of things to get this working.
nfsv4 works fine if I just use the nfs-v3 form of export
i.e.
/nfs4exports 
192.168.230.237/24(ro,fsid=0,sync,insecure,no_root_squash,no_subtree_check,squash_uids=0-99)
/nfs4exports/NDG 
192.168.230.237/24(rw,insecure,no_subtree_check,nohide,sync,no_root_squash,squash_uids=0-99)
but this is inherently open to all on this machine.

so then using this recipe
http://www.techrepublic.com/blog/opensource/kerberos-authentication-with-nfsv4/1965
and many others that hours of google foo shows

change exports to
/nfs4exports 
gss/krb5(ro,fsid=0,sync,insecure,no_root_squash,no_subtree_check,squash_uids=0-99)
/nfs4exports/NDG 
gss/krb5(rw,insecure,no_subtree_check,nohide,sync,no_root_squash,squash_uids=0-99)

now from the client I can see
[rkampen at timsws ~]$ showmount -e example.com
Export list for example.com:
/nfs4exports     gss/krb5
/nfs4exports/NDG gss/krb5

but
[rkampen at timsws /]$ sudo mount -t nfs4 -o sec=krb5 ndgonline.net:/ /NDG/
mount.nfs4: access denied by server while mounting ndgonline.net:/

and
[rkampen at timsws /]$ sudo mount -t nfs4 -o sec=krb5 ndgonline.net:/NDG /NDG/
mount.nfs4: access denied by server while mounting ndgonline.net:/NDG

And I cannot find any log entries relating to the kerberos KDC or on the 
nfs server - two different machines.
I have set up all the principals in the KDC and used kadmin/ktadd to 
load into the client and the server /etc/krb5.keytab as per the above url.
How and where do I get logging to occur so I can find out the missing 
piece in my kerberos setup?
Any help or directions appreciated.
TIA



-------------- next part --------------
A non-text attachment was scrubbed...
Name: rkampen.vcf
Type: text/x-vcard
Size: 280 bytes
Desc: not available
URL:
<http://lists.centos.org/pipermail/centos/attachments/20110719/28d80004/attachment-0001.vcf>

Rob Kampen wrote:

Hello,

nfs4 with kerberos works fine here on CentOS 5.6.
> change exports to
>[...]gss/krb([...]
>[...]gss/krb([...]
My /etc/exports says '... gss/krb5(...'.
And 'SECURE_NFS="yes"' is set in /etc/sysconfig/nfs.

All needed services are running?
- rpcsvcgssd (server)
- rpcidmapd (server)
- rpcgssd (client)

A very good instruction, in my opinion, to get it running is
http://sadiquepp.blogspot.com/2009/02/how-to-configure-nfsv4-with-kerberos-in.html.


regards
Olaf