Mail.app with multiple accounts using Kerberos

[John Rudd]

Jeffrey Altman wrote:


> The reality is that in the current day you either need to use
> cross-realm or your applications have to maintain knowledge of which
> principal should be used to access the given resource.
> 
> This is a non-trivial problem.


That seems almost like an "over-engineered" type response.

What is wrong with making the application maintain that knowledge? 
Afterall, that's exactly the purpose of preferences databases and rc-files.

Using your email example:

1) Have the application record:

    a) A default principle for the application,

    b) A default principle for each mail personality (which may itself 
default to "email-userid at defalt-realm" and let the user change that 
manually), and

    c) A specific principle for each folder/resource.

2) If none of those preferences exist, ask the user which of the 
principles in their cache is the right one to use for that resource (and 
offer a "none of these" option; if they choose that, then invoke your 
kinit type program, and update your list of choices to offer when it 
returns).  And give them a checkbox for "remember this principle for 
this resource".


If they end up with a lesser degree of access to a folder because they 
didn't specify 1c, then they need to specify 1c.

For AFS, access to the local cell is presumably going to happen at a 
point where you only have 1 principle to choose from (assuming you're 
doing a kerberos PAM and then an afs PAM that leverages your kerberos 
ticket;  otherwise, it should default to username@(an explicit realm 
setting for that AFS cell) ).  Once you've got a home directory that you 
can read from, have a .afsrc file in your home directory which tells AFS 
which principle goes with which cell (or even which principle goes with 
directory within a volume within a cell).  Same thing as for email, 
really, just a slightly different implementation.


As for multiple principles in one cache: if the limitation is that 
there's only one KDC time-offset entry in the cache, then extend the 
cache format so that it can have a different time-offset for each KDC 
that it needs to deal with.  (the idea that you would need to have a 
different cache file for each principle is rather repugnant)