diff --git a/manifests/vhost.pp b/manifests/vhost.pp
index 1ad825fa11..49c0a83eb4 100644
--- a/manifests/vhost.pp
+++ b/manifests/vhost.pp
@@ -1509,6 +1509,7 @@
 #     directories => [
 #       { path   => '/path/to/different/dir',
 #         gssapi => {
+#           basicauth => 'On',
 #           credstore => 'keytab:/foo/bar.keytab',
 #           localname => 'Off',
 #           sslonly   => 'On',
diff --git a/spec/defines/vhost_spec.rb b/spec/defines/vhost_spec.rb
index 730e9e0bfa..c92d96b2ef 100644
--- a/spec/defines/vhost_spec.rb
+++ b/spec/defines/vhost_spec.rb
@@ -252,6 +252,7 @@
                   'passenger_app_log_file'                              => '/tmp/app.log',
                   'passenger_debugger'                                  => false,
                   'gssapi'                                              => {
+                    'basicauth' => 'On',
                     'credstore' => 'keytab:/foo/bar.keytab',
                     'localname' => 'On',
                     'sslonly'   => 'Off',
@@ -943,6 +944,11 @@
               content: %r{^\s+PassengerDebugger\sOff$},
             )
           }
+          it {
+            is_expected.to contain_concat__fragment('rspec.example.com-directories').with(
+              content: %r{^\s+GssapiBasicAuth\sOn$},
+            )
+          }
           it {
             is_expected.to contain_concat__fragment('rspec.example.com-directories').with(
               content: %r{^\s+GssapiCredStore\skeytab:/foo/bar.keytab$},
diff --git a/templates/vhost/_gssapi.epp b/templates/vhost/_gssapi.epp
index 4f2d9f9114..789e90595b 100644
--- a/templates/vhost/_gssapi.epp
+++ b/templates/vhost/_gssapi.epp
@@ -1,10 +1,14 @@
 <%|
   # https://github.com/gssapi/mod_auth_gssapi
+  Optional[Enum['On','Off']] $basicauth = undef,
   Optional[String[1]]        $credstore = undef,
   Optional[Enum['On','Off']] $sslonly   = undef,
   Optional[Enum['On','Off']] $localname = undef,
 |%>
-# mod_auth_gssapi configuration
+    # mod_auth_gssapi configuration
+<% if $basicauth { -%>
+    GssapiBasicAuth <%= $basicauth %>
+<% } -%>
 <% if $sslonly { -%>
     GssapiSSLonly <%= $sslonly %>
 <% } -%>