<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html;charset=ISO-8859-1">
<title></title>
</head>
<body text="#000000" bgcolor="#ffffff">
Sam Hartman wrote:<br>
<blockquote type="cite" cite="midtsl65notl9g.fsf@konishi-polis.mit.edu">
<pre wrap="">Sorry. I meant krb.conf for Windows and krb5.conf for Unix/Mac.</pre>
</blockquote>
<br>
Sam:<br>
<br>
I am sorry, I do not understand what this clarification is supposed to
mean.<br>
We already check krb.con.<br>
<br>
The logic is<br>
<br>
<ul>
<li>if there is no krb.con file assume we use DNS</li>
<li>if there is a krb.con file, and the krb.con file does explicitly
say "use DNS" we do not.</li>
<li>if we are no using DNS and there is no realm info we try
"kerberos.REALM"</li>
</ul>
At present there is no option in krb.con that indicates "do not try
Kerberos for this realm". We could certainly add such an option, but
it would only be for this release and we would need to support it in
all releases going forward after the krb4 library merger. I think at
this point it is better to ignore the issue until after the krb4 merger
and the new credential cache library is ready.<br>
<br>
- Jeff<br>
<br>
<br>
</body>
</html>