When attempting to use fedpkg, I was running into the authentication issue described at the fourth bullet point under General problems at https://docs.pagure.org/koji/kerberos_gssapi_debug/. As instructed, I checked my /etc/krb5.conf to see whether it contained the line dns_canonicalize_hostname = true. It did. After checking the rest of the config file as well as /etc/krb5.conf.d/fedoraproject_org and not seeing anything suspicious, I tried setting dns_canonicalize_hostname to fallback, which solved the issue. After further experimentation, I found out that dns_canonicalize_hostname needs to be set to fallback or false. The authentication fails if it's set to true, or if the line is missing altogether. I'm not sure whether the documentation is factually wrong, clumsily worded, outdated, or whether I was perhaps running into a different problem which happened to manifest itself this same way.

I can reliably reproduce the problem by either setting dns_canonicalize_hostname to true or deleting the line from the config file.